System based on railway comprehensive video monitoring security application

Abstract

The invention relates to a system based on railway comprehensive video monitoring security application, and the system comprises a railway video monitoring system which comprises a video management platform, front-end equipment and a terminal user; the video management platform is internally provided with an identity security authentication management and control module which is used for realizing identity authentication, verification and authorization of the video management platform when a terminal user registers; the security level control management and control module is used for realizing control signaling authentication when the front-end equipment, the terminal user and the video management platform perform signaling interaction; the video safety calling management and control module is used for realizing a video calling management and control function of the video management platform on a terminal user; and the security application system comprises a high-security-level authentication module and a video security key service system, and the high-security-level authentication module and the video security key service system are matched to provide bidirectional identity security authentication, control signaling authentication and video data encryption and decryption functions under the high-security-level application condition. The method can be widely applied to the field of railway video monitoring systems.

Description

Technical Field

[0001] The present invention relates to a system based on the security application of a railway integrated video monitoring system, and in particular to a system combining the information security of a video monitoring device, system and platform based on the GB35114 technical standard with the characteristics of railway video control and management, belonging to the field of railway video monitoring systems. Background Art

[0002] Railway video surveillance system is an important equipment system for railways, providing important support for realizing modern and efficient operation and management of railways. By deploying railway video surveillance system in major areas such as station halls, platforms, entrances and exits, power and low-voltage electrical machine rooms, train entry and exit, and passenger boarding and alighting places, it provides strong guarantee for railway traffic command, production organization, passenger and freight transportation services, operation monitoring, emergency rescue, and public security prevention.

[0003] At present, the railway video surveillance system is constantly developing and its application is gradually expanding in the fields of transportation command, production operation, operation management, public security maintenance, etc. It has become a key scientific and technological guarantee for high-speed railway production safety, efficiency improvement, and management strengthening. With the rapid development of video surveillance applications and network technology, the ensuing data security issues are becoming increasingly prominent. People are paying more attention to security issues such as illegal user access, user unauthorized operation control, and illegal theft of video data. For example: 1. The existing video surveillance system, front-end equipment and terminal users use username and password and device password-based authentication to perform identity authentication, which poses security risks such as illegal user access, weak password accounts, password leakage and cracking; 2. The lack of integrity authentication and permission access control in video control signaling leads to information destruction, unauthorized manipulation by users, and illegal simulation of control signaling for malicious operations. 3. Video image data is encoded in international standard formats such as H.264 and H.265 and transmitted in plain text. Video data is more easily illegally stolen, forged, and tampered with by unauthorized personnel in the network, causing the data to lose its original authenticity and integrity, endangering the safe and smooth operation of the video surveillance system.

[0004] Therefore, how to better, more comprehensively and more systematically ensure the security of system video data has become an important issue that needs to be solved urgently. Summary of the invention

[0005] In view of the above problems, the purpose of the present invention is to provide a system based on railway integrated video surveillance security application, which aims to improve the network and information security protection level of existing video surveillance equipment, systems and platforms, reduce the information security risks of video surveillance systems, increase user identity attributes and role authority management capabilities, further enhance the security protection capabilities of video surveillance systems, and enable existing systems and equipment to meet the growing information security requirements.

[0006] To achieve the above object, the present invention adopts the following technical solutions: A system based on railway integrated video surveillance security application, comprising: a railway video surveillance system, the railway video surveillance system comprising a video management platform, front-end equipment and terminal users; The video management platform is provided with an identity security authentication control module, a security level control control module and a video security call control module; The identity security authentication control module is used to implement identity authentication, verification and authorization of the video management platform when the terminal user registers; The security level control management module is used to implement control signaling authentication when the front-end device, the terminal user and the video management platform perform signaling interaction; The video security call control module is used to implement the video management platform's control function for terminal user video calls; It also includes a security application system, in which a high-security level authentication module and a video security key service system are set up. The two are used together to provide two-way identity security authentication, control signaling authentication and video data encryption and decryption functions in high-security level applications.

[0007] Further, the high security level authentication module includes a certificate management module, a security storage module, a key management module, an encryption and decryption module, and an identity authentication module; The certificate management module is used to implement the application, update, and deletion functions of the signature and encryption certificates of the front-end device and the terminal user, and applies for the signature and encryption certificate related information by calling the service interface of the video security key service system, records the device ID, cipher machine ID, signature information, public key information digital certificate information, and binds the applied digital certificate to the front-end device and the terminal user; The secure storage module is used to implement the secure storage, query and protection functions of the video management platform to store information related to front-end devices and terminal users; The identity authentication module is used to implement the data signature and data verification functions of the video management platform when the front-end device and the terminal user register; The key management module is used to provide application services for video key encryption key VKEK when the video management platform receives registration requests from front-end devices and terminal users, and also provides key storage and query management functions; The encryption and decryption module is used to implement the video management platform's asymmetric encryption and decryption functions for video data based on the front-end device and the digital certificate of the terminal user.

[0008] Furthermore, the identity security authentication control module includes a user verification module, a user authorization module and a two-way identity authentication module; The user verification module is used to perform multi-faceted verification when the terminal user registers, and construct a corresponding registration return result to the terminal user if the verification fails; The user authorization module is used to authorize the permissions and roles of the terminal users who have passed the verification, and construct the corresponding registration return results to the terminal users; The two-way identity authentication module is used to perform two-way identity authentication based on digital certificates on terminal users in high-security level applications, and construct corresponding registration return results to the terminal users.

[0009] Furthermore, the user verification module verifies the terminal user including first login and complex password verification, username and password verification, IP binding verification, user blacklist verification, time-limited user verification, frequent login failure lock verification, maximum login user number verification and high-authority user login preemption; when the maximum number of login users in the system is reached, if there is no user with lower authority than the user in the user login list, a failure response indicating that the low authority does not allow login is returned; if there is a user with lower priority than the user, the low-priority user is notified that the login authority is preempted and is kicked out by the high-priority user, allowing a higher-authority user to log in; The authorization content of the user authorization module includes user role, user security level, user group and user authority, whether to restrict the flow and the configuration of the maximum flow restriction number.

[0010] Furthermore, when the two-way identity authentication module performs two-way identity authentication, it includes authentication of digital certificates and data signatures; When authenticating the data signature, it includes applying for a video key encryption key VKEK for the terminal user from the key management module at the time of the first registration or querying the stored key from the secure storage module when the update cycle has not expired, using the key as a component of the signature data, and returning the signature information to the terminal user in the constructed registration return result; When authenticating a digital certificate, it includes searching for the digital certificate from the certificate management module according to the terminal user ID, determining whether the digital certificate is valid, and returning the determination result to the terminal user.

[0011] Further, the security level control management and control module includes a task plan configuration module, a task plan list maintenance module, a control signaling issuance module and a control signaling authentication module; The task plan configuration module is used to pre-configure different levels of activation / deactivation task plans for the front-end device; The task plan list maintenance module is used to automatically detect the addition of a new task plan or the deletion of an old task plan, and maintain the task plan list; The control signaling sending module is used to send the control signaling of the front-end device security level switching in a single or batch manner when the task plan starts to be executed, and perform security level switching control on the front-end device; The control signaling authentication module is used to authenticate the control signaling based on a hash algorithm with a key in a high security level application.

[0012] Furthermore, the parameters of the task plan include: plan level, device ID list, whether the plan is enabled, and information related to the plan start time.

[0013] Further, the video security call control module includes a basic authentication module, a shielding authentication module and a video encryption call control module; The basic authentication module is used to perform basic authority authentication on the terminal user when the terminal user issues a video call request; The shielding authentication module is used to perform user shielding authentication on the terminal user who has passed the basic authentication check, and after the user shielding authentication is passed, play the real-time video, play back / download the historical video, and return a response message to the terminal user; The video encryption call control module is used to provide video data encryption and decryption functions in high-security applications, as well as real-time encrypted video playback, historical encrypted video playback and encrypted video download functions within the user's authority range.

[0014] Further, the basic authentication content of the basic authentication module includes basic authority judgment on user real-time / real-time encrypted video browsing, historical / historical encrypted video playback and historical / historical encrypted video downloading, whether the stream is restricted, whether the maximum number of video call paths of the system is exceeded, and the maximum number of video call paths of the user is limited; The user shielding authentication includes the authentication of shielding at this level and shielding at the upper level, wherein the shielding authentication at this level is implemented in accordance with the blacklist mode. By configuring the shielding plan at this level, the video surveillance platform automatically detects the plan list for execution, so that shielded users are not allowed to call shielded video resources within the set time period; the shielding authentication at the upper level is implemented in accordance with the whitelist mode. Through the shielding plan issued by the upper level, only shielded users are allowed to call shielded video resources within the set time period.

[0015] Further, the video encryption call control module includes encryption / decryption of real-time video or historical video; When encrypting real-time video or historical video, query the terminal user's key VKEK from the secure storage module and the key management module, and use the encryption and decryption module to encrypt VKEK based on the user's public key, encrypt the historical video, and securely transmit the VKEK ciphertext and VKEKVersion as a response message to the terminal user; When decrypting real-time or historical videos, use the user's private key with corresponding decryption permissions to decrypt VKEK and decrypt the video for playback.

[0016] The present invention adopts the above technical solution, which has the following advantages: (1) The present invention adds identity security authentication control module, security level control control module, video security call control module and GB35114 implementation related modules to the original system architecture. Figure 1 The subsystem shown and the functional modules jointly implement identity security authentication, control signaling integrity authentication and secure access control, and video data security calling functions, solving the problems of identity authentication security, control signaling and access control security, and video data security in the existing system.

[0017] (2) The identity security authentication control module ensures that the front-end devices and terminal users have unique identities, confirms the real identities of users, and verifies and authorizes users in multiple aspects in order to perform access control and management, and prevent illegal users from accessing system data or performing illegal and malicious operations.

[0018] (3) The signaling authentication and security access control module ensures the integrity of the control signaling between the video management platform and the front-end devices and terminal users. The security access control implements batch switching of security levels for the front-end security devices to prevent users from illegally simulating the control command sending platform and maliciously forging signaling.

[0019] (4) The video security call control module implements user basic authority authentication, user blocking authentication, and video encryption transmission and call for user video requests, ensuring that terminal users can implement encrypted video security calls and prevent video stream data from being stolen or tampered with, making communication data information more secure, trustworthy, and reliable.

[0020] Therefore, the present invention can be widely applied to the field of railway video monitoring systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Throughout the accompanying drawings, the same reference numerals are used to represent the same components. In the accompanying drawings: Figure 1 It is a flow chart of the identity security authentication control module provided in an embodiment of the present invention; Figure 2 It is a flow chart of the control signaling authentication and security level control management module provided in an embodiment of the present invention; Figure 3 is a video security call flow chart provided in an embodiment of the present invention; Figure 4 It is a system structure diagram based on the railway integrated video monitoring system security application provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the embodiment of the present invention clearer, the technical solution of the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings of the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all of the embodiments. Based on the described embodiment of the present invention, all other embodiments obtained by ordinary technicians in this field belong to the scope of protection of the present invention.

[0023] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0024] The technical standard "GB 35114-2017 Technical Requirements for Information Security of Public Security Video Surveillance Networks" (hereinafter referred to as GB35114) is a national mandatory standard and is the first technical standard in my country for the implementation of information security of video surveillance networks. It stipulates the technical requirements for the security protection of video information and control signaling in the public security field of video surveillance networks. The GB35114 technical standard is a digital certificate and key management system based on the national secret algorithm. It provides integrity regulations for video front-end equipment, video networking platforms, and two-way identity authentication between platforms, control signaling integrity verification, video data verification, encryption and decryption, etc. It can reduce the information security risks of video surveillance systems and improve the security protection capabilities of video surveillance systems. The GB35114 technical standard provides an overall solution for the information security of video surveillance systems at the system level. It superimposes an information security assurance mechanism on the basis of the GB / T28181 protocol, which is more conducive to the current GB / T 28181 interconnected platform upgrade to support security functions. It is an important technical basis for strengthening information security in the video surveillance field and upgrading and transforming existing systems.

[0025] Based on this, in some embodiments of the present invention, a method based on railway integrated video surveillance security application is provided. The system conducts application research on identity authentication security, control signaling and access control security, and video data security in accordance with the requirements of GB35114-2017 technical standard and combined with the actual needs of railway video surveillance systems. A design scheme that meets the actual needs and GB35114 technical standards in terms of identity security authentication, control signaling authentication and secure access control, and video data security in existing railway video surveillance systems is proposed, aiming to improve the network and information security protection level of existing video surveillance equipment, systems and platforms, strengthen user identity authority management, and enable existing systems and equipment to meet the growing security requirements.

[0026] Specifically, the present invention improves the security of the system in three aspects: (1) Security of identity authentication In order to improve the security of identity authentication in video surveillance systems, the present invention is based on the existing video surveillance system's digital summary authentication method based on passwords. In particular, when a terminal user logs in, the legitimacy of the user's identity is verified and authorized from multiple aspects, such as user blacklist, temporary user, frequent login failure verification, and maximum number of user login verification, to enhance the reliability and security of the identity authentication process. In high-security applications, a two-way identity authentication method based on digital certificates that complies with the GB35114 technical standard is provided to make up for the shortcomings of the password-based authentication method, aiming to improve the authenticity, accuracy, and security of identity authentication.

[0027] (2) Security of control signaling and access control In order to enhance the security of control signaling interaction and access control of video surveillance systems, attribute- and role-based access control granularity is used to control user rights and access, especially for front-end security equipment access control, providing the function of enabling / disabling task planning configuration for batch control of video security levels (A / B / C) of front-end security equipment. In high-security applications, a control signaling authentication function based on a hash algorithm with a key that complies with the GB35114 technical standard is provided to achieve the goals of control signaling integrity verification, user security access, and authority control.

[0028] (3) Security of video data In order to ensure the security of video data transmission and call, especially when the terminal user calls the video, the basic user authority authentication, user shielding authentication, video stream number call limit and other aspects are verified. In high-security applications, the video data encryption and decryption function that complies with the GB35114 technical standard is provided, and users are supported to play real-time encrypted videos, play back historical encrypted videos, and download encrypted videos within the scope of authority, so as to achieve the goals of video data encryption protection, secure transmission and call.

[0029] Example 1 like Figure 1 As shown, this embodiment provides a system based on railway integrated video surveillance security application, which includes: There are existing railway video surveillance systems and security application systems. Among them, the existing railway video surveillance system includes a video management platform, front-end equipment and terminal users; the video management platform is equipped with an identity security authentication control module, a security level control control module and a video security call control module; among them, the identity security authentication control module is used to realize the identity authentication, verification and authorization of the video management platform when the terminal user registers; the security level control control module is used to realize the control signaling authentication when the front-end equipment, the terminal user and the video management platform interact with each other; the video security call control module is used to realize the video management platform's video call control function for the terminal user; the security application system is equipped with a GB35114 module and a video security key service system, which are used to provide two-way identity security authentication, control signaling authentication and video data encryption and decryption functions that comply with the GB35114 technical standard in high-security applications.

[0030] Furthermore, the GB35114 module includes a certificate management module, a secure storage module, a key management module, an encryption and decryption module, and an identity authentication module. Among them, the certificate management module is used to implement the application, update, and deletion of signature and encryption certificates of front-end devices and terminal users, and to apply for signature, encryption certificates and other related information by calling the service interface of the video security key service system, record digital certificate information such as device ID, cipher machine ID, signature information, public key information, and bind the applied digital certificate to the front-end device and terminal user.

[0031] The secure storage module is used to implement the video management platform to save important information related to front-end devices and terminal users, such as certificate information, registration information, registration password and current key VKEK and other information secure storage, query and protection functions.

[0032] The identity authentication module is used to implement the data signature and data verification functions of the video management platform when registering front-end devices and terminal users, and to achieve two-way identity authentication based on digital certificates.

[0033] The key management module is used to provide application services for video key encryption keys VKEK when the video management platform receives registration requests from front-end devices and terminal users, and also provides management functions such as key storage and query.

[0034] The encryption and decryption module is used to implement the video management platform's asymmetric encryption and decryption of video data based on the front-end device, the terminal user's digital certificate and the SM2 algorithm.

[0035] Further, such as Figure 2 As shown, the identity security authentication control module includes a user verification module, a user authorization module and a two-way identity authentication module. Among them, the user verification module is used to perform multi-faceted verification when the terminal user registers. If the verification fails, the corresponding registration return result is constructed to the terminal user; the user authorization module is used to authorize the terminal user who has passed the verification with permissions and roles, and construct the corresponding registration return result to the terminal user; the two-way identity authentication module is used to perform two-way identity authentication based on digital certificates for the terminal user through the GB35114 module when the video management platform enables the 35114 mode, that is, the high-security level application, and construct the corresponding registration return result to the terminal user, so as to make up for the shortcomings of the password-based authentication method to the identity authentication method, aiming to improve the authenticity, accuracy and security of the identity authentication.

[0036] Furthermore, the user verification module verifies the terminal user, including the first login and complex password verification (the first login prompts to modify the complex password), username and password verification, IP binding verification, user blacklist verification, time-limited user verification (whether it exceeds the set active time period), frequent login failure lock verification, maximum login user number verification and high-privilege user login preemption. When the system reaches the maximum number of login users, if there is no user with lower authority than the user in the user login list, a failure response indicating that the low authority does not allow login is returned; if there is a user with a lower priority than the user, the low-priority user is notified that the login authority is preempted and kicked out by the high-priority user, allowing higher-privilege users to log in.

[0037] Furthermore, the authorization content of the user authorization module includes user roles, user security levels, user groups and user permissions (real-time browsing, historical stream playback and download permissions, cloud mirror control permissions), whether to restrict the flow, and the maximum flow limit configuration.

[0038] Furthermore, when the two-way identity authentication module performs two-way identity authentication, it includes the authentication of digital certificates and data signatures. Specifically, when verifying the data signature, the video key encryption key VKEK is applied for the terminal user from the key management module of the GB35114 module during the first registration, or the stored key is queried from the security storage module when the update cycle has not exceeded, and the key is used as a component of the signature data, and the signature information is returned to the terminal user in the constructed registration return result. When verifying the digital certificate, the digital certificate is searched from the certificate management module according to the terminal user ID, and it is determined whether the digital certificate is valid, and the determination result is returned to the terminal user.

[0039] Further, such as Figure 3 As shown, the security level control management and control module includes a task plan configuration module, a task plan list maintenance module, a control signaling sending module and a control signaling authentication module. Among them, the task plan configuration module is used to pre-configure different levels (level A / level B / level C) of enabling / disabling task plans for front-end devices; the task plan list maintenance module is used to automatically detect the addition of new task plans or the deletion of old task plans, and maintain the task plan list; the control signaling sending module is used to send the control signaling of the front-end device security level switching in a single or batch manner when the task plan starts to execute, and control the security level switching of the front-end device; the control signaling authentication module is used to provide a control signaling authentication function based on a keyed hash algorithm that complies with the GB35114 technical standard under high security levels, so as to achieve the control signaling integrity verification, user security access and authority control goals.

[0040] In this embodiment, the relevant parameters in the task plan include the plan level, the device ID list, whether the plan is enabled, and the information related to the plan start time. Manually switching the security level of a single front-end security device is cumbersome and time-consuming. Especially when the number of line access front-end security devices increases, the automatic switching of security levels in batches is more prominent.

[0041] Further, such as Figure 4 As shown, the video security call control module includes a basic authentication module, a shielding authentication module and a video encryption call control module. Among them, the basic authentication module is used to perform basic authority authentication on the terminal user when the terminal user issues a video call request; the shielding authentication module is used to perform user shielding authentication on the terminal user who has passed the basic authentication check, and after the user shielding authentication is passed, the real-time video is played, the historical video is played back / downloaded, and the response message is returned to the terminal user; the video encryption call control module is used to provide video data encryption and decryption functions that comply with the GB35114 technical standard in high-security applications, and supports users to play real-time encrypted videos, play back historical encrypted videos, and download encrypted videos within the scope of authority, so as to achieve video data encryption protection, secure transmission and call goals.

[0042] Furthermore, when the basic authentication module performs basic authority authentication, the basic authentication content mainly includes basic authority judgment on the user's real-time / real-time encrypted video browsing, historical / historical encrypted video playback and historical / historical encrypted video downloading, whether the stream is restricted, whether the system's maximum video call path is exceeded, and the user's maximum video call path limit.

[0043] In particular, when the maximum number of system video call paths exceeds the limit but the maximum number of user video call paths exceeds the limit, if there is a user with lower authority than this user, the low-authority user will be notified to close one video stream, and a prompt will be given that the permission to call the video stream has been preempted by a high-authority user, allowing the high-authority user to make video calls; if there is no user with lower authority than this user, a failure message is directly returned indicating that the user authority is low and the video call path limit has been reached.

[0044] Furthermore, user shielding authentication includes shielding authentication at this level and shielding authentication at the upper level. Shielding authentication at this level is implemented in accordance with the blacklist mode. By configuring the shielding plan at this level (including the start and end time of the plan, shielded users, and shielded resources), the platform automatically detects the plan list and executes it, so that shielded users are not allowed to call shielded video resources during the set time period. Shielding authentication at the upper level is implemented in accordance with the whitelist mode. Through the shielding plan issued by the upper level, only shielded users are allowed to call shielded video resources during the set time period.

[0045] Furthermore, the video encryption call control module includes encryption / decryption of real-time video and encryption / decryption of historical video. When encrypting / decrypting historical video, the terminal user's key VKEK is queried from the secure storage module and key management module in the GB35114 module, and the encryption / decryption module is used to encrypt VKEK based on the user's public key, encrypt the historical video, and securely transmit the VKEK ciphertext and VKEKVersion to the terminal user as a response message, and use the user's private key with corresponding decryption authority to decrypt VKEK for video decryption and playback.

[0046] During the real-time encrypted video on demand process, if the video channel key changes, the platform will immediately send a key change notification message to ensure the continuity of the terminal user's secure video call.

[0047] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A system based on railway integrated video surveillance security application, comprising: A railway video monitoring system, comprising a video management platform, front-end equipment and terminal users; characterized in that: The video management platform is provided with an identity security authentication control module, a security level control control module and a video security call control module; The identity security authentication control module is used to implement identity authentication, verification and authorization of the video management platform when the terminal user registers; The security level control management module is used to implement control signaling authentication when the front-end device, the terminal user and the video management platform perform signaling interaction; The video security call control module is used to implement the video call control function of the video management platform for terminal users; It also includes a security application system, in which a high-security level authentication module and a video security key service system are provided. The high-security level authentication module and the video security key service system cooperate to provide two-way identity security authentication, control signaling authentication and video data encryption and decryption functions in high-security level applications.

2. A system based on railway integrated video surveillance safety application as claimed in claim 1, characterized in that: The high security level authentication module includes a certificate management module, a security storage module, a key management module, an encryption and decryption module and an identity authentication module; The certificate management module is used to implement the application, update, and deletion functions of the signature and encryption certificates of the front-end device and the terminal user, and applies for the signature and encryption certificate related information by calling the service interface of the video security key service system, records the device ID, cipher machine ID, signature information, public key information digital certificate information, and binds the applied digital certificate to the front-end device and the terminal user; The secure storage module is used to implement the secure storage, query and protection functions of the video management platform to store the front-end equipment and terminal user related information; The identity authentication module is used to implement the data signature and data verification functions of the video management platform when the front-end device and the terminal user register; The key management module is used to provide application services for video key encryption key VKEK when the video management platform receives registration requests from front-end devices and terminal users, and also provides key storage and query management functions; The encryption and decryption module is used to implement the video management platform's asymmetric encryption and decryption functions for video data based on the front-end device and the digital certificates of the terminal users.

3. A system based on railway integrated video surveillance safety application as claimed in claim 2, characterized in that: The identity security authentication control module includes a user verification module, a user authorization module and a two-way identity authentication module; The user verification module is used to perform multi-faceted verification when the terminal user registers, and construct a corresponding registration return result to the terminal user if the verification fails; The user authorization module is used to authorize the permissions and roles of the terminal users who have passed the verification, and construct the corresponding registration return results to the terminal users; The two-way identity authentication module is used to perform two-way identity authentication based on digital certificates on terminal users in high-security level applications, and construct corresponding registration return results to the terminal users.

4. A system based on railway integrated video surveillance safety application as claimed in claim 3, characterized in that: The user verification module verifies the terminal user, including first login and complex password verification, username and password verification, IP binding verification, user blacklist verification, time-limited user verification, frequent login failure lock verification, maximum login user number verification and high-authority user login preemption; when the maximum number of login users in the system is reached, if there is no user with lower authority than the user in the user login list, a failure response indicating that the low authority does not allow login is returned; if there is a user with a lower priority than the user, the low-priority user is notified that the login authority is preempted and is kicked out by the high-priority user, allowing a higher-authority user to log in; The authorization content of the user authorization module includes user role, user security level, user group and user authority, whether to restrict the flow and the configuration of the maximum flow restriction number.

5. A system based on railway integrated video surveillance safety application as claimed in claim 3, characterized in that: When the two-way identity authentication module performs two-way identity authentication, it includes authentication of digital certificates and data signatures; When authenticating the data signature, it includes applying for a video key encryption key VKEK for the terminal user from the key management module at the time of the first registration or querying the stored key from the secure storage module when the update cycle has not expired, using the key as a component of the signature data, and returning the signature information to the terminal user in the constructed registration return result; When authenticating a digital certificate, it includes searching for the digital certificate from the certificate management module according to the terminal user ID, determining whether the digital certificate is valid, and returning the determination result to the terminal user.

6. A system based on railway integrated video surveillance safety application as claimed in claim 2, characterized in that: The security level control management and control module includes a task plan configuration module, a task plan list maintenance module, a control signaling issuance module and a control signaling authentication module; The task plan configuration module is used to pre-configure different levels of activation / deactivation task plans for the front-end device; The task plan list maintenance module is used to automatically detect the addition of a new task plan or the deletion of an old task plan, and maintain the task plan list; The control signaling sending module is used to send the control signaling of the front-end device security level switching in a single or batch manner when the task plan starts to be executed, and perform security level switching control on the front-end device; The control signaling authentication module is used to authenticate the control signaling based on a hash algorithm with a key in a high security level application.

7. A system based on railway integrated video surveillance safety application as claimed in claim 6, characterized in that: The parameters of the task plan include: plan level, device ID list, whether the plan is enabled, and information related to the plan start time.

8. A system based on railway integrated video surveillance safety application as claimed in claim 2, characterized in that: The video security call control module includes a basic authentication module, a shielding authentication module and a video encryption call control module; The basic authentication module is used to perform basic authority authentication on the terminal user when the terminal user issues a video call request; The shielding authentication module is used to perform user shielding authentication on the terminal user who has passed the basic authentication check, and after the user shielding authentication is passed, play the real-time video, play back / download the historical video, and return a response message to the terminal user; The video encryption call control module is used to provide video data encryption and decryption functions in high-security applications, as well as real-time encrypted video playback, historical encrypted video playback and encrypted video download functions within the user's authority range.

9. A system based on railway integrated video surveillance safety application as claimed in claim 8, characterized in that: The basic authentication content of the basic authentication module includes basic authority judgment on user real-time / real-time encrypted video browsing, historical / historical encrypted video playback and historical / historical encrypted video downloading, whether the stream is restricted, whether the maximum number of video call paths of the system is exceeded, and the maximum number of video call paths of the user; The user shielding authentication includes the authentication of shielding at this level and shielding at the upper level, wherein the shielding authentication at this level is implemented in accordance with the blacklist mode. By configuring the shielding plan at this level, the video surveillance platform automatically detects the plan list for execution, so that shielded users are not allowed to call shielded video resources within the set time period; the shielding authentication at the upper level is implemented in accordance with the whitelist mode. Through the shielding plan issued by the upper level, only shielded users are allowed to call shielded video resources within the set time period.

10. A system based on railway integrated video surveillance safety application as claimed in claim 8, characterized in that: The video encryption call control module includes encryption / decryption of real-time video or historical video; When encrypting real-time video or historical video, query the terminal user's key VKEK from the secure storage module and the key management module, and use the encryption and decryption module to encrypt VKEK based on the user's public key, encrypt the historical video, and securely transmit the VKEK ciphertext and VKEKVersion as a response message to the terminal user; When decrypting real-time or historical videos, use the user's private key with corresponding decryption permissions to decrypt VKEK and decrypt the video for playback.

Images