Media stream encryption transmission method and media stream transmission system

Abstract

According to the media stream encryption transmission method and the media stream transmission system provided by the invention, encryption identification information can be encrypted by adopting a quantum key, and a ciphertext token is obtained. The playing device can send the ciphertext token to the streaming media server, so that the streaming media server can obtain the encryption identification information based on the ciphertext token, encrypt the to-be-transmitted media stream data according to the encryption identification information to obtain the encrypted media stream data, and transmit the encrypted media stream data to the playing device. The playing device can obtain the to-be-transmitted media stream data based on the encrypted media stream data, and performs video playing according to the to-be-transmitted media stream data. Therefore, the leakage risk of the encrypted identification information and the media stream data in IP network transmission can be reduced, and the data security of media stream transmission can be enhanced.

Description

Technical Field

[0001] The present application relates to the technical field of streaming media transmission, and in particular to a media stream encryption transmission method and a media stream transmission system. Background Art

[0002] With the development and popularization of video surveillance technology, streaming media services on the cloud have become a trend to store video stream data through cloud servers. When streaming media services are on the cloud, when a user needs to play a video, the video stream data is forwarded to the client APP (application) of the playback device through the streaming media service. During the forwarding process, the video stream data is exposed to the public network environment and is easily stolen, resulting in the leakage of video stream data. It can be seen that the existing technology has the problem of low data security. Summary of the invention

[0003] The purpose of this application is to solve at least one of the above-mentioned technical deficiencies, especially the technical defect of low data security in the prior art.

[0004] In a first aspect, an embodiment of the present application provides a method for encrypting and transmitting a media stream, which is applied to a media stream transmission system, wherein the media stream transmission system includes a playback device and a streaming media server; the method includes:

[0005] The playback device obtains media stream address information, a quantum key and a ciphertext token respectively, and generates a media stream acquisition request; wherein the ciphertext token is obtained by encrypting a plaintext token according to the quantum key, and the plaintext token includes encryption identification information; the media stream acquisition request carries the media stream address information and the ciphertext token;

[0006] The playback device sends the media stream acquisition request to the streaming media server;

[0007] The streaming media server extracts the media stream address information and the ciphertext token respectively from the media stream acquisition request;

[0008] The streaming media server reads the media stream data to be transmitted according to the media stream address information;

[0009] The streaming media server obtains the quantum key, and decrypts the ciphertext token according to the quantum key to obtain the encrypted identification information;

[0010] The streaming media server encrypts the media stream data to be transmitted according to the encryption identification information to obtain encrypted media stream data;

[0011] The streaming media server returns the encrypted media stream data to the playback device;

[0012] The playback device decrypts the encrypted media stream data according to the quantum key to obtain the media stream data to be transmitted.

[0013] In one embodiment, the media streaming system further includes a service platform and a quantum security shield server;

[0014] The playback device obtains media stream address information, quantum key and ciphertext token respectively, including:

[0015] The playback device sends an address acquisition request to the service platform;

[0016] The service platform determines the media stream address information and the plaintext token respectively in response to the address acquisition request, and generates a request identifier;

[0017] The service platform sends the first key acquisition request to the quantum security shield server through the quantum channel; wherein the first key acquisition request carries the request identifier;

[0018] The quantum security shield server generates the quantum key corresponding to the request identifier in response to the first key acquisition request;

[0019] The quantum security shield server returns the quantum key to the service platform through the quantum channel;

[0020] The service platform encrypts the plaintext token according to the quantum key to obtain the ciphertext token, and concatenates the ciphertext token, the media stream address information and the request identifier to obtain address response information;

[0021] The service platform returns the address response information to the playback device;

[0022] The playback device extracts the ciphertext token, the media stream address information and the request identifier respectively from the address response information;

[0023] The playback device sends a first key query request to the quantum security shield server through a quantum channel; wherein the first key query request carries the request identifier;

[0024] The quantum security shield server returns the quantum key to the playback device through the quantum channel in response to the first key query request;

[0025] The playback device decrypts the ciphertext token according to the quantum key to obtain the plaintext token.

[0026] In one embodiment, before the playback device sends the address acquisition request to the service platform, the process includes:

[0027] The playback device sends a network access authentication request to the quantum security shield server through a quantum channel;

[0028] The quantum security shield server performs network access verification on the playback device in response to the network access authentication request and generates a verification result;

[0029] The quantum security shield server returns the verification result to the playback device through the quantum channel.

[0030] In one embodiment, the media stream acquisition request also carries the request identifier;

[0031] The streaming media server obtains the quantum key, including:

[0032] The streaming media server extracts the request identifier from the media stream acquisition request;

[0033] The streaming media server sends a second key query request to the quantum security shield server through the quantum channel; wherein the second key query request carries the request identifier;

[0034] The quantum security shield server returns the quantum key to the streaming media server through the quantum channel in response to the second key query request.

[0035] In one embodiment, the encryption identification information includes an encryption algorithm identification, a video encryption type identification, and a video encryption length.

[0036] In one embodiment, the media stream data to be transmitted includes video data to be transmitted, and the encrypted media stream data includes encrypted video data;

[0037] The streaming media server encrypts the media stream data to be transmitted according to the encryption identification information to obtain encrypted media stream data, including:

[0038] The streaming media server determines the media stream encryption algorithm according to the encryption algorithm identifier;

[0039] When the video encryption type identifier is a key frame encryption identifier, the streaming media server encrypts the first N bytes of each key frame in the video data to be transmitted according to the media stream encryption algorithm to obtain key frame encrypted data, and generates the encrypted video data based on the key frame encrypted data; wherein N is the video encryption length;

[0040] When the video encryption type identifier is a partial encryption identifier, the streaming media server encrypts the first N bytes of each frame of the video data to be transmitted according to the media stream encryption algorithm to obtain the encrypted video data;

[0041] When the video encryption type identifier is a full encryption identifier, the streaming media server encrypts all bytes of each frame in the video data to be transmitted according to the media stream encryption algorithm to obtain the encrypted video data.

[0042] In one embodiment, the encryption identification information also includes an audio encryption identification.

[0043] In one embodiment, the media stream data to be transmitted includes audio data to be transmitted, and the encrypted media stream data includes encrypted audio data;

[0044] The streaming media server encrypts the media stream data to be transmitted according to the encryption identification information to obtain encrypted media stream data, including:

[0045] The streaming media server determines the media stream encryption algorithm according to the encryption algorithm identifier;

[0046] The streaming media server encrypts all bytes of the audio data to be transmitted according to the media stream encryption algorithm to obtain the encrypted audio data.

[0047] In one embodiment, the playback device decrypts the encrypted media stream data according to the quantum key to obtain the media stream data to be transmitted, including:

[0048] The playback device decrypts the ciphertext token according to the quantum key to obtain the plaintext token;

[0049] The playback device determines the encrypted identification information according to the plaintext token, and performs decryption processing according to the encrypted media stream data to obtain the media stream data to be transmitted.

[0050] In a second aspect, an embodiment of the present application provides a media stream transmission system based on the media stream encryption transmission method described in any of the above embodiments, including: a playback device and a streaming media server; wherein:

[0051] The playback device is used to obtain media stream address information, a quantum key and a ciphertext token respectively, and generate a media stream acquisition request; wherein the ciphertext token is obtained by encrypting a plaintext token according to the quantum key, and the plaintext token includes encryption identification information; the media stream acquisition request carries the media stream address information and the ciphertext token;

[0052] The playback device is used to send the media stream acquisition request to the streaming media server;

[0053] The streaming media server is used to extract the media stream address information and the ciphertext token from the media stream acquisition request respectively;

[0054] The streaming media server is used to read the media stream data to be transmitted according to the media stream address information;

[0055] The streaming media server is used to obtain a quantum key, and decrypt the ciphertext token according to the quantum key to obtain the encrypted identification information;

[0056] The streaming media server is used to encrypt the media stream data to be transmitted according to the encryption identification information to obtain encrypted media stream data;

[0057] The streaming media server is used to return the encrypted media stream data to the playback device;

[0058] The playback device is used to decrypt the encrypted media stream data according to the quantum key to obtain the media stream data to be transmitted.

[0059] In the media stream encryption transmission method and media stream transmission system provided in some embodiments of the present application, a quantum key can be used to encrypt the encryption identification information and obtain a ciphertext token. The playback device can send a ciphertext token to the streaming media server, so that the streaming media server can obtain the encryption identification information based on the ciphertext token, and encrypt the media stream data to be transmitted according to the encryption identification information to obtain the encrypted media stream data, and transmit the encrypted media stream data to the playback device. The playback device can obtain the media stream data to be transmitted based on the encrypted media stream data, and play the video accordingly. In this way, the risk of leakage of the encryption identification information and the media stream data in the IP (Internet Protocol) network transmission can be reduced, thereby enhancing the data security of the media stream transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0061] Figure 1 One of the flowcharts of the method for encrypting and transmitting media streams in one embodiment;

[0062] Figure 2 The second flowchart of the method for encrypting and transmitting media streams in one embodiment is shown;

[0063] Figure 3A schematic diagram of a data structure of key frame encrypted data in one embodiment;

[0064] Figure 4 One of the data structure diagrams of encrypted video data in one embodiment;

[0065] Figure 5 The second data structure diagram of encrypted video data in one embodiment;

[0066] Figure 6 The figure is a schematic diagram of the data structure of encrypted audio data in one embodiment. DETAILED DESCRIPTION

[0067] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0068] The terms involved in this application are explained below.

[0069] AES (Advanced Encryption Standard) algorithm: A symmetric encryption algorithm that uses the same key for encryption and decryption.

[0070] SM4 algorithm: The city uses the national secret SM4 block cipher algorithm, which is a symmetric encryption algorithm.

[0071] CBC (Cipher-block chaining): An encryption mode in which each plaintext block is XORed with the previous ciphertext block before being encrypted, thus ensuring the uniqueness of each message.

[0072] NAL: video data encoded by H.264.

[0073] In one embodiment, the present application provides a method for encrypting and transmitting a media stream. The method can be applied to a media stream transmission system, which may include a playback device and a streaming media server. The streaming media server refers to a server for providing streaming media services, which can be used to store media stream data. The playback device refers to an electronic device for playing videos, which may be, but is not limited to, a smartphone, a tablet computer, a desktop computer, a laptop computer, a wearable device, an Internet of Things device, a home appliance, etc. In one example, the playback device may be installed with a player.

[0074] like Figure 1As shown, the media stream encryption transmission method of the present application may include the following steps:

[0075] S102: The playback device obtains media stream address information, quantum key and ciphertext token respectively, and generates a media stream acquisition request.

[0076] The media stream acquisition request carries media stream address information and a ciphertext token. The media stream address information is address information used to obtain the media stream to be played. The ciphertext token is token data obtained by encrypting the plaintext token according to the quantum key, and the plaintext token includes encryption identification information. The encryption identification information is used to reflect the encryption information for encrypting the media stream data to be transmitted, for example, it may include any one or any combination of information such as an encryption method identifier, an encryption algorithm identifier, and a media stream encryption and decryption key.

[0077] In one example, the plaintext token may further include an expiration timestamp for verifying the validity of the plaintext token.

[0078] In this step, the playback device can obtain the media stream address information, the quantum key and the ciphertext token respectively, and generate a media stream acquisition request according to the media stream address information and the ciphertext token, so that the media stream acquisition request carries the media stream address information and the ciphertext token.

[0079] S104: The playback device sends a media stream acquisition request to the streaming media server.

[0080] In this step, the playback device establishes a communication connection with the streaming media server and may send a media stream acquisition request to the streaming media server to attempt to call the streaming media service provided by the streaming media server and obtain the media stream data to be played.

[0081] S106: The streaming media server extracts the media stream address information and the ciphertext token from the media stream acquisition request respectively.

[0082] In this step, since the media stream acquisition request carries the media stream address information and the ciphertext token, the streaming media server can extract the media stream address information and the ciphertext token from the media stream acquisition request after receiving the media stream acquisition request sent by the playback device. Exemplarily, the streaming media server can parse the media stream acquisition request according to a pre-set parsing rule and obtain the media stream address information and the ciphertext token.

[0083] S108: The streaming media server reads the media stream data to be transmitted according to the media stream address information.

[0084] In this step, after obtaining the media stream address information, the streaming media server can read the media stream data to be played by the playback device based on the media stream address information, and obtain the media stream data to be transmitted. It can be understood that the media stream data to be transmitted described in this application refers to the media stream data that needs to be transmitted to the playback device, that is, the above-mentioned media stream data to be played.

[0085] S110: The streaming media server obtains the quantum key, and decrypts the ciphertext token according to the quantum key to obtain the encrypted identification information.

[0086] In this step, after obtaining the ciphertext token, the streaming media server needs to decrypt the ciphertext token to obtain the encryption identification information, so as to encrypt the media stream data to be transmitted according to the encryption identification information and realize the encrypted transmission of the media stream. Therefore, the streaming media server can obtain the quantum key, and decrypt the ciphertext token based on the quantum key to obtain the plaintext token, and obtain the encryption identification information according to the plaintext token.

[0087] S112: The streaming media server encrypts the media stream data to be transmitted according to the encryption identification information to obtain encrypted media stream data.

[0088] In this step, the streaming media server may encrypt the media stream data to be transmitted according to the encryption identification information. For example, when the encryption identification information includes an encryption algorithm identification and a media stream encryption and decryption key, the streaming media server may use the media stream encryption and decryption key as an encryption key and use a target encryption algorithm corresponding to the encryption identification algorithm to encrypt the media stream data to be transmitted to generate encrypted media stream data.

[0089] S114: The streaming media server returns the encrypted media stream data to the playback device.

[0090] In this step, after obtaining the encrypted media stream data, the streaming media server may return the encrypted media stream data to the playback device, so as to realize encrypted transmission of the media stream through the encrypted media stream data.

[0091] S116: The playback device decrypts the encrypted media stream data according to the quantum key to obtain the media stream data to be transmitted.

[0092] In this step, after receiving the encrypted media stream data, the playback device can decrypt the encrypted media stream data according to the quantum key to obtain the media stream data to be transmitted, and perform media playback based on the media stream data to be transmitted.

[0093] In one example, S116 may include the following steps:

[0094] Step A1: The playback device decrypts the ciphertext token according to the quantum key to obtain a plaintext token;

[0095] Step A2: The playback device determines the encryption identification information according to the plaintext token, and performs decryption processing according to the encrypted media stream data to obtain the media stream data to be transmitted.

[0096] Specifically, during the decryption process, the playback device can first use the quantum key to decrypt the ciphertext token to obtain the plaintext token. Since the streaming media server encrypts the media stream data based on the encrypted identification information in the plaintext token, the playback device can decrypt the encrypted media stream data based on the encrypted identification information in the plaintext token to obtain the plaintext data corresponding to the encrypted media stream data, that is, the media stream data to be transmitted.

[0097] In this embodiment, the quantum key can be used to encrypt the encryption identification information and obtain a ciphertext token. The playback device can send the ciphertext token to the streaming media server, so that the streaming media server can obtain the encryption identification information based on the ciphertext token, and encrypt the media stream data to be transmitted according to the encryption identification information to obtain the encrypted media stream data, and transmit the encrypted media stream data to the playback device. The playback device can obtain the media stream data to be transmitted based on the encrypted media stream data, and play the video accordingly. In this way, the risk of leakage of the encryption identification information and the media stream data in the IP network transmission can be reduced, thereby enhancing the data security of the media stream transmission.

[0098] In one embodiment, the media streaming system further includes a service platform and a quantum security shield server, wherein the service platform refers to a service platform for managing streaming media servers (i.e., video source information), and the quantum security shield server refers to a platform for generating, publishing, and managing quantum keys.

[0099] like Figure 2 As shown, the playback device obtains the media stream address information, the quantum key and the ciphertext token respectively, including the following steps:

[0100] S208: The playback device sends an address acquisition request to the service platform;

[0101] S210: The service platform determines the media stream address information and the plaintext token respectively in response to the address acquisition request, and generates a request identifier;

[0102] S212: The service platform sends a first key acquisition request to the quantum security shield server through a quantum channel; wherein the first key acquisition request carries a request identifier;

[0103] S214: The quantum security shield server generates a quantum key corresponding to the request identifier in response to the first key acquisition request;

[0104] S216: The quantum security shield server returns the quantum key to the business platform through the quantum channel;

[0105] S218: The service platform encrypts the plaintext token according to the quantum key to obtain the ciphertext token, and concatenates the ciphertext token, the media stream address information and the request identifier to obtain the address response information;

[0106] S220: The service platform returns address response information to the playback device;

[0107] S222: The playback device extracts the ciphertext token, the media stream address information, and the request identifier from the address response information respectively;

[0108] S224: The playback device sends a first key query request to the quantum security shield server through the quantum channel; wherein the first key query request carries a request identifier;

[0109] S226: The quantum security shield server returns the quantum key to the playback device through the quantum channel in response to the first key query request;

[0110] S228: The playback device decrypts the ciphertext token according to the quantum key to obtain a plaintext token.

[0111] In actual applications, different media stream data may correspond to different streaming media servers. When playing media data such as audio and video, the playback device needs to initiate a media stream acquisition request from the specified streaming media server to obtain the media stream data to be played from the specified streaming media server. Therefore, the playback device can obtain the media stream address information from the service platform.

[0112] At the same time, different media stream data can be encrypted using different encryption algorithms, different encryption methods and / or different media stream encryption and decryption keys, and the encryption identification information can be centrally managed by the service platform. In this case, the playback device can interact with the service platform to obtain the encryption identification information from the service platform.

[0113] Specifically, in this embodiment, the playback device can send an address acquisition request to the service platform through the IP channel to try to obtain the media stream address information corresponding to the media stream to be played from the service platform. When the service platform receives the address acquisition request, it can respectively determine the media stream address information corresponding to the media stream to be played and the plaintext token corresponding to the media stream to be played, and generate a request identifier sid. Among them, the plaintext token includes the encrypted identification information corresponding to the media stream to be played. The request identifier sid can identify the acquisition process of this media stream data and can be used to manage quantum keys.

[0114] The business platform may generate a first key acquisition request according to the request identifier sid, and send the first key acquisition request to the quantum security shield server through the quantum channel. Upon receiving the first key acquisition request, the quantum security shield server may generate a quantum key corresponding to the request identifier sid, and return the quantum key to the business platform through the quantum channel.

[0115] In one example, the business platform can obtain the quantum key through the QMS server SDK (Software Development Kit). In this example, the business platform can send a second key acquisition request carrying a request identifier sid to the QMS server SDK. In response to the second key acquisition request, the QMS server SDK sends the request identifier sid to the quantum security shield server through the quantum channel. The quantum security shield server returns the quantum key to the QMS server SDK based on the request identifier sid. The QMS server SDK forwards the quantum key to the business platform, so that the business platform obtains the quantum key corresponding to the request identifier sid.

[0116] The business platform can encrypt the plaintext token according to the quantum key and obtain the ciphertext token. For example, the AES256 algorithm can be used for encryption. After obtaining the ciphertext token, the business platform can splice the ciphertext token, the media stream address information and the request identifier sid to obtain the address response information, and return the address response information to the playback device. In an example, the address response information may be wss: / / videoaddress.cn / live.flv?token=aaa&sid=123. wss: / / videoaddress.cn / live.flv is the media stream address information based on the WSS (WebSocket Secure) protocol, aaa is the ciphertext token, and 123 is the request identifier.

[0117] After receiving the address response information returned by the service platform, the playback device can extract the ciphertext token, media stream address information and request identifier sid from the address response information. For example, the playback device can parse the address response information according to a preset parsing rule and obtain the ciphertext token, media stream address information and request identifier sid respectively.

[0118] The playback device may generate a first key query request according to the request identifier sid, and send the first key query request to the quantum security shield server through the quantum channel. When the quantum security shield server receives the first key query request, it may return the quantum key corresponding to the request identifier sid to the playback device through the quantum channel, so that the playback device can decrypt the ciphertext token according to the received quantum key and obtain the plaintext token.

[0119] In one example, the playback device may be installed with a player and a quantum security shield SDK, and the player may obtain a quantum key through the quantum security shield SDK. In this example, the playback device may send a third key acquisition request carrying a request identifier sid to the quantum security shield SDK. In response to the third key acquisition request, the quantum security shield SDK sends a request identifier sid to the quantum security shield server through a quantum channel. The quantum security shield server returns the quantum key to the quantum security shield SDK based on the request identifier sid. The quantum security shield SDK forwards the quantum key to the player.

[0120] In this embodiment, the quantum security shield server can exchange data with other platform devices through the quantum channel, and transmit key acquisition requests, key query requests and quantum keys through the quantum channel to reduce the risk of leakage of request identifiers and quantum keys, thereby further improving data security.

[0121] In one embodiment, Figure 2 As shown, before the playback device sends an address acquisition request to the service platform, it includes:

[0122] S202: The playback device sends a network access authentication request to the Quantum Security Shield server through the quantum channel;

[0123] S204: The quantum security shield server responds to the network access authentication request, performs network access authentication on the playback device, and generates a verification result;

[0124] S206: The quantum security shield server returns the verification result to the playback device through the quantum channel.

[0125] In this embodiment, before initiating an address acquisition request, the playback device may first perform network access authentication to further improve data security.

[0126] In one example, when a player and a quantum security shield SDK are installed on a playback device, the player can first perform local shield settings and monitoring, and call the quantum security shield SDK to initialize and perform network access verification. The quantum security shield SDK can send a network access authentication request to the quantum security shield server through a quantum channel. The quantum security shield server performs network access verification in response to the network access authentication request, generates a verification result, and returns the verification result to the quantum security shield SDK. The quantum security shield SDK returns the initialization result to the player based on the verification result.

[0127] In one embodiment, the media stream acquisition request also carries a request identifier. For the relevant description of the request identifier, please refer to the above text, which will not be repeated here.

[0128] The streaming media server obtains the quantum key, including:

[0129] The streaming media server extracts a request identifier from the media stream acquisition request;

[0130] The streaming media server sends a second key query request to the quantum security shield server through the quantum channel; wherein the second key query request carries a request identifier;

[0131] The quantum security shield server responds to the second key query request and returns the quantum key to the streaming media server through the quantum channel.

[0132] In this embodiment, the streaming media server can exchange data with the quantum security shield server through the quantum channel to obtain the quantum key, which can reduce the risk of quantum key leakage and further improve data security.

[0133] Specifically, the streaming media server can extract the request identifier sid from the media stream acquisition request, generate a second key query request according to the request identifier sid, and send the second key query request to the quantum security shield server through the quantum channel. In response to the second key query request, the quantum security shield server returns the quantum key to the streaming media server through the quantum channel, so that the streaming media server can obtain the quantum key corresponding to the request identifier sid.

[0134] In one embodiment, the encryption identification information includes an encryption algorithm identifier, a video encryption type identifier, and a video encryption length. Among them, the encryption algorithm identifier can be used to reflect the encryption algorithm used in the encryption process of the media stream data. The media stream data may include video data, and the video encryption type identifier can be used to reflect the data that needs to be encrypted in the video data. For example, the video data may include key frames (I frames), predicted frames (P frames), and bidirectional predicted frames (B frames). The present application may choose to encrypt key frames, predicted frames, or bidirectional predicted frames, or may choose to encrypt key frames and predicted frames, or may choose to encrypt all frames. In addition, after determining the frame type that needs to be encrypted, for each video frame that needs to be encrypted, the present application may choose to encrypt part of the bytes of the video frame, or may choose to encrypt all the bytes of the video frame. If encryption of part of the bytes of the video frame is required, the length of the bytes that need to be encrypted can be determined by the video encryption length.

[0135] In one embodiment, the media stream data may include audio data, and the encryption identification information may also include an audio encryption identification. The audio encryption identification may be used to reflect whether the audio data is encrypted. In one example, the parameters and related descriptions of the encryption identification information may be shown in Table 1.

[0136] Table 1

[0137]

[0138] For example, a plaintext token could be:

[0139] ts=1714978040&venc=1&algori=1&vtype=0&vencl=16&aenc=1&atype=1

[0140] Among them, the expiration timestamp is 1714978040; when transmitting media stream data, it is necessary to use the AES256 encryption algorithm to encrypt the key frames of the video data and fully encrypt the audio data.

[0141] In one embodiment, the media stream data to be transmitted includes video data to be transmitted, and the encrypted media stream data includes encrypted video data, wherein the encrypted video data is data obtained by encrypting the video data to be transmitted according to the encryption identification information.

[0142] The streaming media server encrypts the media stream data to be transmitted according to the encryption identification information to obtain encrypted media stream data, including:

[0143] Step B1: The streaming media server determines the media stream encryption algorithm according to the encryption algorithm identifier;

[0144] Step B2: When the video encryption type identifier is a key frame encryption identifier, the streaming media server encrypts the first N bytes of each key frame in the video data to be transmitted according to the media stream encryption algorithm to obtain key frame encrypted data, and generates encrypted video data based on the key frame encrypted data; wherein N is the video encryption length;

[0145] Step B3: When the video encryption type identifier is a partial encryption identifier, the streaming media server encrypts the first N bytes of each frame of the video data to be transmitted according to the media stream encryption algorithm to obtain encrypted video data;

[0146] Step B4: When the video encryption type identifier is a full encryption identifier, the streaming media server encrypts all bytes of each frame of the video data to be transmitted according to the media stream encryption algorithm to obtain encrypted video data.

[0147] It is understood that the streaming media server can use any format to realize the encapsulation of encrypted media stream data, and the video encryption length can be determined according to the actual length. For ease of explanation, the following embodiment is described by taking the flv format and the video encryption length of 32 bytes as an example. When the flv format is used to encapsulate the media stream data, the streaming media server can encrypt the video data in the flv format data. The encryption method of the video data can include a key frame encryption method, a partial encryption method and a full encryption method.

[0148] If the video encryption identifier is a key frame encryption identifier, the streaming media server can use the key frame encryption method to encrypt the video data. The key frame encryption method refers to encrypting the first 32 bytes of each key frame (I frame). In this way, the encryption efficiency can be improved on the basis of ensuring data security, thereby improving the real-time performance of video playback.

[0149] In one example, if Figure 3 As shown, the key frame encrypted data may include flv header, previous tag length (previous tag len), video tag header (video tag header) and video body (video body). The video body may include the length of NAL Unit (nal_unit_len) and NAL data (nal), and the NAL data includes the encrypted data obtained by AES256 / SM4 encryption of the first 32 bytes of the key frame and the remaining bytes of the key frame that are not encrypted.

[0150] If the video encryption type is marked as partial encryption, the streaming media server can use partial encryption to encrypt the video data. Partial encryption means encrypting the first 32 bytes of each video frame (including I frame, P frame and B frame) in the video data. In this way, both real-time playback and data security can be taken into account. In an example, the data structure of the encrypted video data can be as follows: Figure 4 shown.

[0151] If the video encryption type is marked as full encryption, the streaming media server can use full encryption to encrypt the video data. Full encryption means encrypting all bytes of each video frame (including I frame, P frame and B frame) in the video data, and obtaining encrypted video data accordingly. In this way, data security can be further improved. In an example, the data structure of the encrypted video data can be as follows: Figure 5 shown.

[0152] In one embodiment, the media stream data to be transmitted includes audio data to be transmitted, and the encrypted media stream data includes encrypted audio data, wherein the encrypted audio data refers to data obtained by encrypting the audio data to be transmitted according to the encryption identification information.

[0153] The streaming media server encrypts the media stream data to be transmitted according to the encryption identification information to obtain encrypted media stream data, including:

[0154] The streaming media server determines the media stream encryption algorithm according to the encryption algorithm identifier;

[0155] The streaming media server encrypts all bytes of the audio data to be transmitted according to the media stream encryption algorithm to obtain encrypted audio data.

[0156] In this embodiment, the streaming media server can encrypt the audio data in the media stream data in a full encryption manner and obtain the encrypted audio data. In this way, the risk of audio leakage can be reduced to further improve data security. For example, the data format of the encrypted audio data can be as follows: Figure 6 As shown, the encrypted audio data includes flv header, previous tag length (previous tag len), audio tag header (audio tag header) and audio body (audio body). The audio body may include data obtained by AES256 encryption of the audio data to be transmitted.

[0157] In another example, the encrypted audio data and the encrypted video data may be padded using the pcks7 padding algorithm so that the length of the padded data is a multiple of 16.

[0158] In one embodiment, the present application provides a media stream transmission system based on any of the above embodiments of the media stream encryption transmission method, the system comprising: a playback device and a streaming media server. Among them:

[0159] The playback device is used to obtain the media stream address information, the quantum key and the ciphertext token respectively, and generate a media stream acquisition request; wherein the ciphertext token is obtained by encrypting the plaintext token according to the quantum key, and the plaintext token includes the encryption identification information; the media stream acquisition request carries the media stream address information and the ciphertext token;

[0160] The playback device is used to send a media stream acquisition request to the streaming media server;

[0161] The streaming media server is used to extract the media stream address information and the ciphertext token from the media stream acquisition request respectively;

[0162] The streaming media server is used to read the media stream data to be transmitted according to the media stream address information;

[0163] The streaming media server is used to obtain the quantum key and decrypt the ciphertext token according to the quantum key to obtain the encrypted identification information;

[0164] The streaming media server is used to encrypt the media stream data to be transmitted according to the encryption identification information to obtain the encrypted media stream data;

[0165] The streaming media server is used to return encrypted media stream data to the playback device;

[0166] The playback device is used to decrypt the encrypted media stream data according to the quantum key to obtain the media stream data to be transmitted.

[0167] In one embodiment, the media streaming system may further include a service platform and a quantum shield security server.

[0168] The playback device is used to send an address acquisition request to the service platform;

[0169] The service platform is used to respond to the address acquisition request, determine the media stream address information and the plaintext token respectively, and generate a request identifier;

[0170] The service platform is used to send a first key acquisition request to the quantum security shield server through a quantum channel; wherein the first key acquisition request carries a request identifier;

[0171] The quantum security shield server is used to generate a quantum key corresponding to the request identifier in response to the first key acquisition request;

[0172] The quantum security shield server is used to return the quantum key to the business platform through the quantum channel;

[0173] The business platform is used to encrypt the plaintext token according to the quantum key to obtain the ciphertext token, and to splice the ciphertext token, the media stream address information and the request identifier to obtain the address response information;

[0174] The service platform is used to return address response information to the playback device;

[0175] The playback device is used to extract the ciphertext token, the media stream address information and the request identifier from the address response information respectively;

[0176] The playback device is used to send a first key query request to the quantum security shield server through a quantum channel; wherein the first key query request carries a request identifier;

[0177] The quantum security shield server is used to respond to the first key query request and return the quantum key to the playback device through the quantum channel;

[0178] The playback device is used to decrypt the ciphertext token according to the quantum key to obtain the plaintext token.

[0179] For the interaction process between the playback device, streaming media server, quantum security shield server and business platform, please refer to the relevant description of the above-mentioned media stream encryption transmission method, which will not be repeated in this article.

[0180] In one example, the playback device can be installed with a player and a quantum security shield SDK, and the business platform can achieve data interaction with the quantum security shield server through the QMS server SDK. For related descriptions, please refer to the relevant descriptions of the above-mentioned media stream encryption transmission method, which will not be repeated here.

[0181] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the term "include", "comprise" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements not only includes those elements, but also includes other elements not clearly listed, or also includes elements inherent to such process, method, article or equipment. In the absence of more restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or equipment including the elements. Herein, "one", "one", "said", "the" and "it" may also include plural forms, unless the context clearly indicates another way. A plurality refers to at least two cases, such as 2, 3, 5 or 8, etc. "And / or" includes any and all combinations of the relevant listed items.

[0182] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can refer to each other.

[0183] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for encrypting and transmitting a media stream, characterized in that: Applied to a media streaming transmission system, the media streaming transmission system includes a playback device and a streaming media server; the method includes: The playback device obtains media stream address information, a quantum key and a ciphertext token respectively, and generates a media stream acquisition request; wherein the ciphertext token is obtained by encrypting a plaintext token according to the quantum key, and the plaintext token includes encryption identification information; the media stream acquisition request carries the media stream address information and the ciphertext token; The playback device sends the media stream acquisition request to the streaming media server; The streaming media server extracts the media stream address information and the ciphertext token respectively from the media stream acquisition request; The streaming media server reads the media stream data to be transmitted according to the media stream address information; The streaming media server obtains the quantum key, and decrypts the ciphertext token according to the quantum key to obtain the encrypted identification information; The streaming media server encrypts the media stream data to be transmitted according to the encryption identification information to obtain encrypted media stream data; The streaming media server returns the encrypted media stream data to the playback device; The playback device decrypts the encrypted media stream data according to the quantum key to obtain the media stream data to be transmitted.

2. The method according to claim 1, characterized in that The media streaming system also includes a service platform and a quantum security shield server; The playback device obtains media stream address information, quantum key and ciphertext token respectively, including: The playback device sends an address acquisition request to the service platform; The service platform determines the media stream address information and the plaintext token respectively in response to the address acquisition request, and generates a request identifier; The service platform sends the first key acquisition request to the quantum security shield server through the quantum channel; wherein the first key acquisition request carries the request identifier; The quantum security shield server generates the quantum key corresponding to the request identifier in response to the first key acquisition request; The quantum security shield server returns the quantum key to the service platform through the quantum channel; The service platform encrypts the plaintext token according to the quantum key to obtain the ciphertext token, and concatenates the ciphertext token, the media stream address information and the request identifier to obtain address response information; The service platform returns the address response information to the playback device; The playback device extracts the ciphertext token, the media stream address information and the request identifier respectively from the address response information; The playback device sends a first key query request to the quantum security shield server through a quantum channel; wherein the first key query request carries the request identifier; The quantum security shield server returns the quantum key to the playback device through the quantum channel in response to the first key query request; The playback device decrypts the ciphertext token according to the quantum key to obtain the plaintext token.

3. The method according to claim 2, characterized in that Before the playback device sends an address acquisition request to the service platform, the method includes: The playback device sends a network access authentication request to the quantum security shield server through a quantum channel; The quantum security shield server performs network access verification on the playback device in response to the network access authentication request and generates a verification result; The quantum security shield server returns the verification result to the playback device through the quantum channel.

4. The method according to claim 2, characterized in that: The media stream acquisition request also carries the request identifier; The streaming media server obtains the quantum key, including: The streaming media server extracts the request identifier from the media stream acquisition request; The streaming media server sends a second key query request to the quantum security shield server through the quantum channel; wherein the second key query request carries the request identifier; The quantum security shield server returns the quantum key to the streaming media server through the quantum channel in response to the second key query request.

5. The method according to any one of claims 1 to 4, characterized in that: The encryption identification information includes an encryption algorithm identification, a video encryption type identification and a video encryption length.

6. The method according to claim 5, characterized in that The media stream data to be transmitted includes video data to be transmitted, and the encrypted media stream data includes encrypted video data; The streaming media server encrypts the media stream data to be transmitted according to the encryption identification information to obtain encrypted media stream data, including: The streaming media server determines the media stream encryption algorithm according to the encryption algorithm identifier; When the video encryption type identifier is a key frame encryption identifier, the streaming media server encrypts the first N bytes of each key frame in the video data to be transmitted according to the media stream encryption algorithm to obtain key frame encrypted data, and generates the encrypted video data based on the key frame encrypted data; wherein N is the video encryption length; When the video encryption type identifier is a partial encryption identifier, the streaming media server encrypts the first N bytes of each frame of the video data to be transmitted according to the media stream encryption algorithm to obtain the encrypted video data; When the video encryption type identifier is a full encryption identifier, the streaming media server encrypts all bytes of each frame in the video data to be transmitted according to the media stream encryption algorithm to obtain the encrypted video data.

7. The method according to claim 5, characterized in that The encryption identification information also includes an audio encryption identification.

8. The method according to claim 7, characterized in that The media stream data to be transmitted includes audio data to be transmitted, and the encrypted media stream data includes encrypted audio data; The streaming media server encrypts the media stream data to be transmitted according to the encryption identification information to obtain encrypted media stream data, including: The streaming media server determines the media stream encryption algorithm according to the encryption algorithm identifier; The streaming media server encrypts all bytes of the audio data to be transmitted according to the media stream encryption algorithm to obtain the encrypted audio data.

9. The method according to claim 5, characterized in that The playback device decrypts the encrypted media stream data according to the quantum key to obtain the media stream data to be transmitted, including: The playback device decrypts the ciphertext token according to the quantum key to obtain the plaintext token; The playback device determines the encrypted identification information according to the plaintext token, and performs decryption processing according to the encrypted media stream data to obtain the media stream data to be transmitted.

10. A media stream transmission system based on the media stream encryption transmission method according to any one of claims 1 to 9, characterized in that: include: Playback device and streaming media server; wherein: The playback device is used to obtain media stream address information, a quantum key and a ciphertext token respectively, and generate a media stream acquisition request; wherein the ciphertext token is obtained by encrypting a plaintext token according to the quantum key, and the plaintext token includes encryption identification information; the media stream acquisition request carries the media stream address information and the ciphertext token; The playback device is used to send the media stream acquisition request to the streaming media server; The streaming media server is used to extract the media stream address information and the ciphertext token from the media stream acquisition request respectively; The streaming media server is used to read the media stream data to be transmitted according to the media stream address information; The streaming media server is used to obtain a quantum key, and decrypt the ciphertext token according to the quantum key to obtain the encrypted identification information; The streaming media server is used to encrypt the media stream data to be transmitted according to the encryption identification information to obtain encrypted media stream data; The streaming media server is used to return the encrypted media stream data to the playback device; The playback device is used to decrypt the encrypted media stream data according to the quantum key to obtain the media stream data to be transmitted.

Images