Video data encryption method and video data storage sharing system based on block chain

Abstract

The invention relates to a video data encryption method and a video data storage sharing system based on a block chain, and the video data encryption method comprises the steps: carrying out the encryption processing of video data through a SECMPEG algorithm model, and carrying out the encryption of the encrypted video data through combining a homomorphic encryption model and an attribute-based searchable encryption model. Calculation and analysis of the data in an encryption state and security of private data are guaranteed, and authenticity and reliability of the data in a storage sharing process are guaranteed. According to the video data storage and sharing system based on the block chain, the block chain is used as a core layer, the video data is encrypted according to a video encryption method, in the storage and sharing process, the data security is ensured, and the data authenticity and reliability are ensured in the query and downloading process of a user.

Description

Technical Field

[0001] The present application relates to the field of video data processing technology, and in particular to a video data encryption method and a blockchain-based video data storage and sharing system. Background Art

[0002] With the development and progress of society, various monitoring equipment including video surveillance are all over the streets and alleys. The significance of the existence of monitoring equipment is to better protect the lives and property of citizens and provide evidence for possible disputes or disagreements. Monitoring as a means of protection is becoming more and more common in people's lives. The use of monitoring data can better restore the real situation and prevent fraud and accidents. The video monitoring system has a strong prevention ability, so it is an indispensable part of the entire security system. In specific applications, video monitoring has distinct characteristics, which are specifically manifested in convenience, dynamism and intuitiveness. With the continuous improvement of my country's scientific and technological level in recent years, monitoring technology has achieved significant development, and has been widely used in many fields, such as large shopping malls, offices, banks, enterprises and other institutions, anti-theft and anti-theft, case evidence collection, protection of public safety, and avoidance of potential security risks.

[0003] As a new application model, cloud computing has been widely used in all walks of life, replacing the traditional storage solutions using SAN or NAS architecture to become the mainstream storage solution. Cloud storage refers to connecting various common storage devices through the network to fully realize data sharing, reduce resource waste, and enable data to be updated in a timely manner to ensure data consistency. In addition, cloud storage supports PB-level storage capacity, which is particularly suitable for data with a large amount of information. When storage space is insufficient, the system capacity can be expanded by adding storage nodes online. In short, cloud storage can flexibly expand storage capacity and become the best choice for storing massive video data.

[0004] Blockchain is a decentralized, shared ledger of transaction information. All kinds of nodes can track transactions without relying on central nodes. Blockchain is composed of connected blocks. The latter block contains the hashed identifier of the previous block. Each block stores all transaction data and execution details, and can be traced and verified. Blockchain technology can use data encryption, timestamps, distributed consensus and other means to achieve decentralized peer-to-peer coordination and collaboration in a distributed system where nodes do not need to trust each other, thus providing a solution to the high cost, low efficiency and low security problems commonly found in centralized institutions. Blockchain technology is also anonymous, decentralized and highly secure. Using blockchain technology to access and query monitoring data can effectively prevent stakeholders from tampering with or destroying monitoring data on the basis of protecting data privacy, thereby solving the problem of distrust of stakeholders' data providers.

[0005] In the era of big data, faced with massive storage, cloud centers or local storage directly store real-time sensor data. The storage center is vulnerable to hacker attacks, and private data is easily leaked or tampered with. Moreover, the cloud is a semi-trusted entity, and data information will be leaked intentionally or unintentionally, which greatly affects the authenticity and reliability of the data and hinders the analysis of big data. Summary of the invention

[0006] The technical problem to be solved by this application is that in the face of massive storage, the cloud center or local storage directly stores the real-time data of sensors. The storage center is vulnerable to hacker attacks, and private data is easily leaked or tampered with. Moreover, the cloud is a semi-trusted entity, and data information will be leaked intentionally or unintentionally, which greatly affects the authenticity and reliability of the data and hinders the analysis of big data.

[0007] In order to solve the above problems, in order to solve the above technical problems or at least partially solve the above technical problems, the present application provides a video data encryption method and a blockchain-based video data storage and sharing system.

[0008] In a first aspect, the present invention discloses a video data encryption method, which comprises the following steps:

[0009] Construct the SECMPEG algorithm model, perform segmented encryption on the original video data, and obtain the first-level encrypted video ciphertext data;

[0010] Construct a homomorphic encryption model, input the first-level encrypted video ciphertext data for processing, use an asymmetric public key to perform a second-level encryption on the first-level encrypted video ciphertext data, and use a predefined ciphertext storage format to obtain the second-level encrypted video ciphertext data;

[0011] Construct an attribute-based searchable encryption model, input the second-level encrypted video ciphertext data, generate video ciphertext data with access control, encrypt the information related to the original video, and obtain the metadata ciphertext index according to the predefined searchable index structure;

[0012] A mapping relationship between video ciphertext data with access control and metadata ciphertext index is established, which is stored through the set ciphertext storage protocol. The relevant video metadata plaintext information is obtained by decrypting the metadata ciphertext index using a searchable query language.

[0013] Preferably, constructing an attribute-based searchable encryption model, inputting the second-level encrypted video ciphertext data, generating video ciphertext data with access control, and encrypting the information related to the original video, and obtaining the metadata ciphertext index according to the predefined searchable index structure, specifically includes the following steps:

[0014] Receive the second-level encrypted video ciphertext data, obtain the corresponding attribute set from the preset access control policy as the input parameter of the attribute encryption algorithm, perform attribute-based encryption processing on the video ciphertext data, and obtain the video ciphertext data with access control;

[0015] A searchable encryption algorithm is used to encrypt the video-related metadata information, and a metadata ciphertext index is constructed based on a predefined index structure.

[0016] Preferably, a mapping relationship between video ciphertext data with access control and metadata ciphertext index is established, stored through a set ciphertext storage protocol, and the relevant video metadata plaintext information is obtained by decrypting the metadata ciphertext index using a searchable query language, specifically including the following steps:

[0017] A mapping relationship between video ciphertext data with access control and the corresponding metadata ciphertext index is established through the set mapping rules;

[0018] The video ciphertext data and metadata ciphertext index with access control are stored in different storage nodes of the distributed storage system according to a predetermined storage protocol;

[0019] The user makes a video retrieval request and provides his / her attribute certificate. The system verifies whether the user attributes meet the access control policy requirements.

[0020] When the user attributes meet the requirements, the matching results are searched in the metadata ciphertext index according to the user's search keywords, and the storage location information of the corresponding video ciphertext data is obtained. When the user data does not meet the requirements, the video retrieval request is stopped;

[0021] The user attribute certificate and the required video ciphertext data location information are submitted to the distributed storage system. The storage node holding the corresponding decryption key in the storage system verifies the attribute certificate and returns the video ciphertext data to the user if it passes.

[0022] Preferably, before constructing the SECMPEG algorithm model, the following steps are specifically included: acquiring original video data, and extracting metadata information of the video data.

[0023] Preferably, after obtaining the relevant video metadata plaintext information by decrypting the metadata ciphertext index, the following steps are specifically included:

[0024] According to the preset ciphertext access protocol, the access rights to the video ciphertext data are granted to the authorized user, and the private key generated in the asymmetric encryption is sent to the authorized user with access rights.

[0025] In the second aspect, the present invention discloses a video data storage and sharing system based on blockchain, which adopts the above-mentioned video data encryption method to encrypt video data, and includes a storage module for storing video data and encrypted video data, an edge server module for encrypting video data and generating related data, an agent authorization center module for deploying smart contracts, a blockchain network module for storing related data, and a sharing module that provides query and verification functions to users.

[0026] Preferably, the storage module comprises:

[0027] A specific data storage unit stores the encrypted specific data and sends a hash value of the encrypted specific data to the sharing module;

[0028] The cloud storage data unit is used to store encrypted video data.

[0029] Preferably, the edge server module comprises:

[0030] A raw data uploading unit, used for collecting and processing raw video data;

[0031] Specific data generation unit: collects 30 seconds of original video data, compresses it, and generates specific data;

[0032] A video encryption unit encrypts specific data and original video data;

[0033] The data uploading unit uploads the encrypted video data to the cloud storage data unit, uploads the encrypted specific data to the specific data storage unit, and generates a hash value of the encrypted specific data, which is passed to the blockchain network module.

[0034] Preferably, the blockchain network module includes:

[0035] The chain-up unit obtains the chain-up request for video data and generates a new storage block in the blockchain;

[0036] The offline data storage unit stores the video data, video data information and related specific data sent to the blockchain network module.

[0037] Preferably, the sharing module includes:

[0038] User information unit, used for user identity information registration and verification, and storing user information;

[0039] A data query unit, which obtains video data and specific data information in the blockchain network module according to the query information input by the user;

[0040] The data downloading unit pairs the video data and specific data information in the blockchain network module with the storage module, and downloads the original video data accordingly.

[0041] The above technical solution provided by this application has the following advantages compared with the prior art:

[0042] The application provides a video data encryption method and a video data storage and sharing system based on blockchain, wherein the video data encryption method, the SECMPEG algorithm model encrypts the video data, and the encrypted video data can be encrypted in combination with the homomorphic encryption model and the attribute-based searchable encryption model, thereby ensuring the calculation and analysis of the data in an encrypted state and the security of the privacy data, and ensuring the authenticity and reliability of the data in the storage and sharing process.

[0043] The blockchain-based video data storage and sharing system uses blockchain as the core layer and encrypts video data according to the video encryption method. It ensures data security during storage and sharing, and users can ensure data authenticity and reliability during query and download. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0046] Figure 1 A schematic diagram of a video data encryption method provided in this application Figure 1 ;

[0047] Figure 2 A schematic diagram of a video data encryption method provided in this application Figure 2 ;

[0048] Figure 3 A module diagram of a blockchain-based video data storage and sharing system provided in this application;

[0049] Figure 4 A network deployment diagram of a blockchain-based video data storage and sharing system provided for this application.

[0050] Description of reference numerals:

[0051] 1. Video data storage and sharing system based on blockchain;

[0052] 11. Storage module for video data;

[0053] 12. Edge server module;

[0054] 13. Agent authorization center module;

[0055] 14. Blockchain network module;

[0056] 15. Shared module. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0058] First, see Figure 1-2 The present invention discloses a video data encryption method, which comprises the following steps:

[0059] S1: Obtain original video data and extract metadata information of the video data;

[0060] S2: Construct the SECMPEG algorithm model, perform segmented encryption on the original video data, and obtain the first-level encrypted video ciphertext data;

[0061] S3: construct a homomorphic encryption model, input the first-level encrypted video ciphertext data for processing, use an asymmetric public key to perform a second-level encryption on the first-level encrypted video ciphertext data, and use a predefined ciphertext storage format to obtain the second-level encrypted video ciphertext data;

[0062] S4: construct an attribute-based searchable encryption model, input the second-level encrypted video ciphertext data, generate video ciphertext data with access control, and encrypt the information related to the original video, and obtain the metadata ciphertext index according to the predefined searchable index structure;

[0063] S5: Establish a mapping relationship between video ciphertext data with access control and metadata ciphertext index, store it through a set ciphertext storage protocol, and use a searchable query language to obtain relevant video metadata plaintext information by decrypting the metadata ciphertext index;

[0064] S6: According to the preset ciphertext access protocol, the access right to the video ciphertext data is granted to the authorized user, and the private key generated in the asymmetric encryption is sent to the authorized user with the access right.

[0065] Specifically, in step S1, the original video data is obtained, and metadata information such as shooting time and location is extracted to facilitate subsequent encryption processing.

[0066] It can be understood that in the intelligent video system, the original video data is first obtained by the high-definition camera, and metadata information such as the shooting time and location of the video is automatically extracted through the built-in software.

[0067] Specifically, in step S2, the SECMPEG algorithm uses a combination of symmetric encryption algorithms and asymmetric encryption algorithms to use DES3 to encrypt the video data in segments, and then uses RSA to encrypt the DES3 key to generate a key ciphertext. According to the required security level, the encrypted data can be encrypted in a hierarchical manner to ensure that data of different levels have different security levels.

[0068] It can be understood that the SECMPEG algorithm is used to encrypt video data in segments. This algorithm is particularly suitable for processing large video files and can effectively divide the video into multiple small segments, each of which is 10 seconds long, to ensure the efficiency and security of encryption processing. The encrypted video data, that is, the first-level encrypted video ciphertext data, will be input into the homomorphic encryption algorithm module.

[0069] Specifically, in step S3, the encrypted video data is re-encrypted using homomorphic encryption. In this embodiment, the Paillier homomorphic encryption algorithm is used. The Paillier homomorphic encryption algorithm is a public key encryption algorithm that can achieve additive homomorphism. The result of the addition operation on the homomorphic ciphertext is the same as the result of the addition operation on the plaintext, thereby realizing data search and addition operations. The encrypted video data is re-encrypted using the algorithm to generate homomorphic ciphertext, that is, the second-level encrypted video ciphertext data, to ensure that the data can still be calculated in the encrypted state, thereby realizing search and analysis.

[0070] Specifically, in step S4, a searchable encryption algorithm is used to encrypt the homomorphic ciphertext, which can realize the search and query of data in an encrypted state without decrypting the data, thereby protecting the privacy of the data. The attribute-based encryption (ABE) algorithm is used to encrypt the homomorphic ciphertext to generate a searchable ciphertext. The ABE algorithm controls access rights according to the attributes possessed by the visitor, and only visitors with corresponding attributes can decrypt the data.

[0071] Specifically, in step S5, when it is necessary to retrieve the target video clip, the metadata retrieval conditions such as the shooting time and location of the target video clip are obtained, and the relevant video metadata plaintext information is obtained by decrypting the metadata ciphertext index using a searchable query language; based on the obtained video metadata plaintext information, the searchable query optimization technology is used to determine the storage location of the corresponding video ciphertext data with access control in the mapping relationship table.

[0072] Specifically, in step S6, the authorized user obtains the right to access the abnormal video clip through identity authentication and sends a video access request; after receiving the video access request from the authorized user, the system uses the private key in the asymmetric encryption to decrypt the video ciphertext data with access control step by step, first using the second-level ciphertext decryption algorithm to decrypt the second-level encryption to obtain the first-level encrypted video ciphertext data, and then using the first-level ciphertext decryption algorithm to decrypt the first-level encryption to obtain the original video data, and finally presents a visual video picture, and uses privacy protection mechanisms such as data desensitization to protect sensitive information in the video.

[0073] It can be understood that in the video data encryption method, the SECMPEG algorithm model encrypts the video data. Combined with the homomorphic encryption model and the attribute-based searchable encryption model, the encrypted video data can be encrypted to ensure the calculation and analysis of the data in an encrypted state and the security of privacy data, thereby ensuring the authenticity and reliability of the data during the storage and sharing process.

[0074] The blockchain-based video data storage and sharing system uses blockchain as the core layer and encrypts video data according to the video encryption method. It ensures data security during storage and sharing, and users can ensure data authenticity and reliability during query and download.

[0075] Step S3 specifically includes the following steps:

[0076] Step S31: inputting the first-level encrypted video ciphertext data into the homomorphic encryption algorithm module;

[0077] Step S32: Performing a second-level encryption on the first-level encrypted video ciphertext data using an asymmetric public key;

[0078] Step S33: using a predefined ciphertext storage format to obtain the second-level encrypted video ciphertext data;

[0079] Step S34: Classify and store the second-level encrypted video ciphertext data according to the shooting time and location in the metadata information;

[0080] Step S35: If it is necessary to retrieve the video surveillance data of a certain time period or location, the corresponding second-level encrypted video ciphertext data is retrieved according to the corresponding metadata information, and decrypted using an asymmetric private key to obtain the original video surveillance data.

[0081] It can be understood that the homomorphic encryption algorithm adopts asymmetric encryption technology based on elliptic curves, and uses the public key to perform the second-level encryption on the first-level encrypted video ciphertext data, ensuring that even if the data is intercepted during transmission, it cannot be decrypted by unauthorized persons. The second-level encrypted video ciphertext data is stored in a predefined XML format, which includes metadata information of the encrypted video, such as encryption time, video length, and encryption algorithm version, etc., to facilitate subsequent management and retrieval. When it is necessary to retrieve video data for a specific time period or location, the system uses the database query function to retrieve the corresponding second-level encrypted video ciphertext data based on the shooting time and location information of the video. After finding the required ciphertext data, use the corresponding private key for decryption. The private key is managed by the security module to ensure that only authorized users can access the original video data.

[0082] In addition, during the decryption process, the system first uses the private key to decrypt the second-level encrypted video ciphertext data to obtain the first-level encrypted video ciphertext data, and then uses the decryption key of the SECMPEG algorithm to decrypt it, and finally restores the original video data for further analysis and use.

[0083] Step S4 specifically includes the following steps:

[0084] Step S41: receiving the second-level encrypted video ciphertext data, obtaining a corresponding attribute set from a preset access control policy as an input parameter of an attribute encryption algorithm, performing attribute-based encryption processing on the video ciphertext data, and obtaining the video ciphertext data with access control;

[0085] Step S42: Encrypt the metadata information related to the video using a searchable encryption algorithm, and construct a metadata ciphertext index based on a predefined index structure.

[0086] Specifically, when the system receives the video ciphertext data that has undergone the second-level encryption processing, it first extracts a set of attributes related to the video from the preset access control policy library, such as video type, confidentiality level, department to which it belongs, etc., and uses it as the input parameter of the attribute encryption algorithm. In some embodiments, the CP-ABE algorithm can be used to encrypt the video ciphertext data, set the encryption parameter to 256 bits, and the number of iterations to 10 rounds to obtain the video ciphertext data with access control. At the same time, the metadata information of the video, such as video name, shooting time, keywords, etc., is encrypted using a searchable encryption algorithm, and a metadata ciphertext index is constructed based on a tree index structure. In some embodiments, the PEKS searchable encryption algorithm is used for encryption, and a metadata ciphertext index is constructed based on a predefined B+ tree index structure.

[0087] Step S5 specifically includes the following steps:

[0088] Step S51: establishing a mapping relationship between the video ciphertext data with access control and the corresponding metadata ciphertext index through the set mapping rule;

[0089] Step S52: storing the video ciphertext data and metadata ciphertext index with access control in different storage nodes of the distributed storage system according to a predetermined storage protocol;

[0090] Step S53: The user makes a video retrieval request and provides his / her own attribute certificate, and the system verifies whether the user attributes meet the access control policy requirements;

[0091] Step S54: when the user attributes meet the requirements, the matching results are searched in the metadata ciphertext index according to the user's search keywords, and the storage location information of the corresponding video ciphertext data is obtained. When the user data does not meet the requirements, the video retrieval request is stopped;

[0092] Step S55: Submit the user attribute certificate and the required video ciphertext data location information to the distributed storage system. The storage node holding the corresponding decryption key in the storage system verifies the attribute certificate and returns the video ciphertext data to the user if it passes.

[0093] It can be understood that through the set hash mapping rules, a one-to-one correspondence between the video ciphertext data and the metadata ciphertext index is established, which is convenient for subsequent retrieval and positioning. Finally, the encrypted video ciphertext data and metadata ciphertext index are distributed and stored in multiple storage nodes of the distributed system according to the predetermined storage protocol, such as block storage, copy backup, etc., to achieve data dispersion and redundancy. When the user needs to retrieve and access the video, he needs to carry his own attribute certificate in the retrieval request. The system first verifies whether the user attributes meet the preset access control policy requirements. Here, the attribute matching algorithm is used to calculate the matching degree between the user attributes and the policy requirements. The matching degree threshold is set to 8. If it exceeds this value, the user attributes are considered to meet the requirements. After verification, according to the search keywords provided by the user, the search operation is performed in the metadata ciphertext index, and the KMP algorithm is used for string matching. The top 10 results with the highest matching degree are returned to obtain the storage location information of the corresponding video ciphertext data. After that, the user attribute certificate and the location information of the target video are submitted to the distributed storage system for further verification and processing. After receiving the request, the storage node uses the preset 256-bit decryption key to decrypt and verify the user attribute certificate. After passing, it retrieves the required video ciphertext data based on the location information and returns it to the user. During the return process, the SSL secure communication protocol is used to encrypt and protect the transmission channel to prevent data leakage.

[0094] Furthermore, according to the metadata retrieval conditions such as the shooting time and shooting location of the target video clip input by the user, a searchable query language is used to construct a query request for the encrypted metadata index. The constructed query request is sent to the metadata management module, and the metadata management module uses a symmetric encryption algorithm to decrypt the encrypted metadata index according to the query request to obtain video metadata information in plain text format. The decrypted video metadata information is parsed and extracted to obtain the target video metadata plain text information that matches the user's retrieval conditions. According to the extracted target video metadata plain text information, an inverted index technology is used to query in a pre-constructed mapping relationship table of video metadata plain text and encrypted video data storage location to determine the storage location information of the encrypted video data corresponding to the target video metadata plain text. The determined encrypted video data storage location information is returned to the access control module, and the access control module determines whether the user has the right to access the encrypted video data according to the user's identity and authority information. If the user has access rights, the access control module reads the corresponding encrypted video data from the video data storage module according to the storage location information, and decrypts it using the video data encryption key to obtain the target video clip data in plain text format. The decrypted target video clip data is returned to the user terminal and played and displayed by the video player of the terminal device, completing the entire business process of video retrieval and access control.

[0095] S6 specifically includes the following steps:

[0096] Step S61: Using the characteristics of homomorphic encryption, the acquired video ciphertext data with access control is subjected to computational analysis such as target detection and behavior recognition in an encrypted state to determine whether the content of the video ciphertext data contains abnormal behavior or suspicious targets. If there is an abnormality or suspicious situation, an early warning mechanism is triggered, and the access rights to the video ciphertext data are granted to a designated authorized user through a preset ciphertext access protocol.

[0097] Step S62: The authorized user obtains the permission to access the abnormal video clip through identity authentication and sends a video access request. After receiving the video access request from the authorized user, the system uses the private key in the asymmetric encryption to decrypt the video ciphertext data with access control step by step. First, the second-level ciphertext decryption algorithm is used to decrypt the second-level encryption to obtain the first-level encrypted video ciphertext data, and then the first-level ciphertext decryption algorithm is used to decrypt the first-level encryption to obtain the original video surveillance data. Finally, a visual video surveillance screen is presented, and privacy protection mechanisms such as data desensitization are used to protect sensitive information in the video.

[0098] Specifically, in step S61, the video data is kept in an encrypted state through homomorphic encryption technology to ensure data security. Machine learning algorithms are used to perform target detection and behavior recognition on the encrypted video data, so that the content can be analyzed without decryption. The results of target detection and behavior recognition are obtained. If abnormal behavior or suspicious targets are detected, the access rights are dynamically adjusted through the preset ciphertext access protocol, and only specific users are authorized to access these video ciphertext data. Authorized users access the system through a secure access protocol to ensure the security of the data transmission process. When authorized users access video ciphertext data, homomorphic encryption technology is continued to be used to encrypt user operations to ensure the security of the operation process. Based on the data analysis results, the parameter settings of the early warning mechanism are adjusted to optimize the response speed and accuracy of the system. Finally, the system records all operations and access logs for subsequent security audits and performance evaluations.

[0099] It can be understood that in the process of implementing homomorphic encryption technology to protect video data, a lattice-based homomorphic encryption algorithm (such as the Ring-LWE algorithm) is first used to ensure the security of video data in an encrypted state. The algorithm can support complex operations on encrypted data, such as addition and multiplication, and is therefore suitable for subsequent machine learning processing. Next, the convolutional neural network (CNN) model in deep learning is used to perform target detection and behavior recognition on the encrypted video data. In this process, the CNN model is adjusted to operate directly on the encrypted domain, and by introducing activation functions and pooling operations compatible with homomorphic encryption, it is ensured that the model can effectively learn and predict without decrypting the data. When the system detects abnormal behavior or suspicious targets through the encrypted machine learning model, such as a sudden increase in pedestrian density of more than 10 people per square meter, or a similarity of more than 85% of a specific behavior pattern is detected, the system will automatically trigger the ciphertext access protocol. The protocol is based on attribute-based encryption (ABE) technology, dynamically adjusts data access rights, and ensures that only users with corresponding attributes (such as security level, department, etc.) can access the relevant video ciphertext data. Authorized users need to pass two-factor authentication when accessing this data, adding a layer of identity authentication security. When users operate encrypted video data, all operation instructions are also processed with homomorphic encryption to ensure the privacy and security of the operation. In addition, the system will monitor the frequency and type of operations in real time, such as querying video data no more than 5 times per minute, so as to adjust the parameters of the early warning mechanism and optimize the response speed and accuracy of the system. Finally, all logs of user operations and system responses will be recorded and encrypted for subsequent security audits and performance evaluations to ensure continuous optimization and security upgrades of the entire system.

[0100] Specifically, in step S62, the user authority is verified by the identity authentication module to ensure that only authorized users can send video access requests. After receiving the request, the system obtains the corresponding private key from the key management system for decryption processing of the video data. A hierarchical decryption strategy is adopted. The encrypted video data is first decrypted using the second-level private key to obtain the first-level encrypted video ciphertext. Then, the first-level private key is used to decrypt the first-level encrypted video ciphertext to restore the original video surveillance data. Before displaying the video surveillance screen, the video data is processed by a data desensitization algorithm to blur sensitive information in the video, such as faces and license plate numbers, to protect personal privacy. Finally, the system displays the video surveillance screen that has been desensitized, ensuring that the user's personal privacy is effectively protected while viewing the video.

[0101] It can be understood that in the system for implementing secure access and privacy protection of video surveillance data, the identity authentication module is first used, such as using the OAuth0 protocol, to ensure that only authorized users can initiate video access requests. After receiving the request, the system retrieves the corresponding 2048-bit RSA private key from the key management system. This key provides higher security due to its longer key length. Using this private key, the system first performs a second-level decryption on the video data. After this decryption step, the video data is still in an encrypted state, but has been converted into ciphertext that can only be decrypted by the first-level private key. Subsequently, the system uses the first-level 1024-bit RSA private key to decrypt this part of the ciphertext and restore the original video surveillance data. Before displaying the video data, the system uses a data desensitization algorithm based on deep learning, such as using a convolutional neural network (CNN) to automatically identify and blur sensitive information in the video, such as faces and license plates. This processing not only ensures the protection of personal privacy, but also ensures the efficiency of data processing. Generally speaking, the time complexity of this desensitization process is O(n), where n is the number of video frames. Ultimately, what users see is the video surveillance footage that has been desensitized, ensuring that users can safely view the video content without leaking their personal privacy.

[0102] Second, see Figure 3-4 The present invention discloses a video data storage and sharing system 1 based on blockchain, which adopts the above-mentioned video data encryption method to encrypt video data, and includes a storage module 11 for storing video data and encrypted video data, an edge server module 12 for encrypting video data and generating related data, an agent authorization center module 13 for deploying smart contracts, a blockchain network module 14 for storing related data, and a sharing module 15 for providing query and inspection functions to users.

[0103] The system also includes an access control module, which provides the user with a function of querying stored video information and provides a verification function for users who have obtained original data.

[0104] It can be understood that the video data storage and sharing system 1 based on blockchain takes blockchain as the core layer, deploys smart contracts through agency nodes, and supports the system to perform subsequent access control operations. The user node registers as a data user node on the front-end page, and determines whether it has the download right, that is, the attribute user, through the smart contract based on the information entered in the registration, otherwise it is an ordinary user. The user query is a classified query from the local database, and the download is downloaded through the corresponding hash value through the reserved link to the storage platform API interface on the web page. The edge server is responsible for the original data encryption task and encrypts it according to the key authorized by the agency authority center. The edge server uploads the encrypted data to the storage platform and uploads the corresponding hash value to the blockchain for storage.

[0105] In addition, the video storage sharing system includes four parts: data owner, data storage, proxy authority center and data user, which involves three types of account nodes: data owner node, proxy authority node and data user node. The network deployment is as follows: Figure 4 As shown. The data owner node will have its own unique identity address in the system. Each edge computing server is a data owner node, which collects and processes raw data and uploads the raw data to the data storage module. The proxy authority node is served by the proxy authority center, which mainly completes the generation of access control keys and the deployment of smart contracts. At the same time, IPFS cooperates with blockchain and smart contracts to store massive videos in the cloud through a hybrid searchable encryption technology based on security. Specific video data is encrypted and stored on IPFS. Both storage are combined with blockchain. Data users access the system through the WEB front-end web page, and constrain access control and perform corresponding operations through smart contracts deployed on the blockchain.

[0106] The storage module comprises:

[0107] A specific data storage unit stores the encrypted specific data and sends a hash value of the encrypted specific data to the sharing module 15;

[0108] The cloud storage data unit is used to store encrypted video data.

[0109] Specifically, the edge server module 12 encrypts the specific data, uploads it to IPFS after encryption and returns the hash value of the data, calls the contract interface and writes the information type into the blockchain in the form of a hash value. After the specific data is encrypted, it is stored in a specific data storage unit. When it needs to be called, it is directly searched and obtained in the specific data storage unit. At the same time, the edge server module 12 encrypts the video and then uploads different video files to the cloud storage data unit in sequence. When requesting to call the contract interface, the request parameters of the blockchain are the video index information and the information type, which are then uploaded to the blockchain network module 14 through the smart contract.

[0110] The edge server module 12 includes:

[0111] A raw data uploading unit, used for collecting and processing raw video data;

[0112] Specific data generation unit: collects 30 seconds of original video data, compresses it, and generates specific data;

[0113] A video encryption unit encrypts specific data and original video data;

[0114] The data uploading unit uploads the encrypted video data to the cloud storage data unit, uploads the encrypted specific data to the specific data storage unit, and generates a hash value of the encrypted specific data, which is transmitted to the blockchain network module 14.

[0115] Specifically, the original data uploading unit segments the original video data and performs upload processing. When the video encryption unit performs video encryption, the specific data generating unit generates specific data for the original video data to facilitate subsequent search.

[0116] The video encryption unit uses the video encryption method disclosed in the first aspect to encrypt the video data, compress the 30-second video data, encrypt the original video and send it to the cloud storage center, and encrypt and package the specific data within this 30 seconds for transmission. The edge computing server will use a secure hybrid searchable encryption algorithm to encrypt the original data and specific data to upload to the storage module, and upload the video index value, cloud storage address, and IPFS hash value information to the blockchain.

[0117] The blockchain network module 14 includes:

[0118] The chain-up unit obtains the chain-up request for video data and generates a new storage block in the blockchain;

[0119] The offline data storage unit stores the video data, video data information and related specific data sent to the blockchain network module 14.

[0120] Specifically, during the upload process, the system backend API obtains the chain request, generates a new block through the Ethereum consensus algorithm, and stores the corresponding data. The smart contract is deployed by the proxy authorization node, and some trigger conditions or states for uploading data and judging queries are preset internally. When the conditions are met, the contract automatically runs.

[0121] Specifically, the offline data storage unit is a MongoDB database, which stores the data in the blockchain network module 14. The system backend monitors the chain module through NodJS, and once a chain action is generated, the block information and transaction details will be obtained. In this way, the encrypted data is encrypted, and the encrypted data is stored in the local database MongoDB together with its transaction number TxID, timestamp Timestamp, block number BlockNum, data hash DataHash and other trust data for fast data retrieval.

[0122] Among them, the video data and specific data information on the blockchain network module 14 include seven fields: video identification code, video time period, video location, Hash value of specific data in specific data generation unit, and Hash value of stage video cloud storage: ① Video camera (VoidID): The sensor identification code generated by this video is the primary key of the data information table and the only authentication code for the data user node in the data information. ② Video name (VoidName): Description of the video in this time period. ③ Blockchain transaction number (TXID): The block where the video data is located can be quickly viewed through TXid. ④ Video time (StartTime, EndTime): The start time and end time of this video data time period. ⑤ Video location (Location): The location where the video segment cloud video is stored, and the video storage location can be obtained. ⑥ Hash value of specific data in IPFS (IPFSHash): The Hash value of specific data stored in the IPFS system. It is convenient for later search and download of video content. ⑦ Complete video index value (VideoHash): The index value of this time period provides an index for subsequent access control.

[0123] The sharing module 15 includes:

[0124] User information unit, used for user identity information registration and verification, and storing user information;

[0125] A data query unit, which obtains video data and specific data information in the blockchain network module 14 according to the query information input by the user;

[0126] The data downloading unit pairs the video data and specific data information in the blockchain network module 14 with the storage module, and downloads the original video data accordingly.

[0127] Specifically, the user information unit is the portal of this system. This part is mainly divided into three main functional modules: user registration, account generation and user login, which mainly register and verify user identity information. ① User registration: When a user enters the homepage system for the first time, he can add his own user information through the registration function to obtain identity access. The registered account can be divided into ordinary users and attribute users. The system determines whether the registered person is an ordinary user or an attribute user based on the user's personal attribute ID. After the attribute user registers, the account generation module is called. This module generates a dedicated private key based on the user's attributes. If the attribute strategy is not met, the generation fails and it is still an ordinary user. The access control channel on the chain stores the user attribute information generated by the policy management contract deployed by the blockchain node. ② Account generation: The front-end registration page will enter the relevant information. According to the access strategy based on the attribute access control strategy, this module generates the user private key based on the attribute. ③ User login: After registration, the login module is optional. On the login page, when the user views the video information, the viewing and operation permissions of the data resources will depend on the different user roles.

[0128] The user information unit includes a MySQL database, which is used to store user information. The user information includes user name, password, user type, personal ID and mobile phone number, etc. The password, real name and mobile phone number are encrypted. The encryption here is processed by a hash algorithm plus a salt value. The salt value here is generally the user's ID. When a user registers for the first time, the registration bar obtains all the user data in the above table, encrypts it and stores it in MySQL. Ordinary users obtain accounts through registration, and UserType is automatically set to 0. For users who pass attribute verification, UserType is set to 1. When a user logs in to the system through the login page, he enters the UserID and Password to log in. The system first matches the UserID, and then matches the encrypted Password after it is correct.

[0129] The data query unit queries the module based on time and camera ID. The specific operation process is as follows: ordinary users and attribute users log in to the page, enter the records they want to query, and the front end generates a corresponding HTML table; the Web end queries the local database on MongoDB through the API according to the request and returns the required content based on the data.

[0130] In the data download unit, attribute users can perform downloading behaviors, and the downloading behaviors are accompanied by the data query module. The Web end first performs data query and returns the corresponding data. The Web end calls the smart contract, and the smart contract verifies the user attributes. When the event of downloading the cloud and IPFS is triggered by the access control contract, the stored content is downloaded from the cloud or IPFS.

[0131] In addition, the sharing module 15 also includes a data verification module. When the attribute user uploads his own decrypted original video data and the corresponding hash value returned at that time on the front-end page, the data verification module will verify it through the same encryption method.

[0132] It can be understood that in order to reduce the storage burden in the blockchain and improve the accuracy of information acquisition during downloading, the system encrypts the original file of the extracted specific data and uploads it to the specific data storage unit for storage. In the subsequent program flow, the file content can be obtained by calling the Hash value of the file. The relatively heavy video data volume stored in the specific data storage unit and the blockchain network module 14 does not conform to the actual application scenario, so it is still stored in the cloud storage data unit, but no protection measures are taken. The data in the cloud storage data unit is easy to be tampered with, so encryption technology is used to ensure the security of the data, and the encrypted data is stored in the cloud. The data encryption adopts the video encryption method mentioned in the first aspect.

[0133] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0134] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the present invention.

[0135] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0136] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be connected, detachably connected, or integrated; it can be mechanically connected or electrically connected; it can be directly connected or indirectly connected through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0137] In the present invention, unless otherwise clearly specified and limited, a first feature being "above" or "below" a second feature may include that the first and second features are in direct contact, or may include that the first and second features are not in direct contact but are in contact through another feature between them. Moreover, a first feature being "above", "above" and "above" a second feature includes that the first feature is directly above and obliquely above the second feature, or simply indicates that the first feature is higher in level than the second feature. A first feature being "below", "below" and "below" a second feature includes that the first feature is directly below and obliquely below the second feature, or simply indicates that the first feature is lower in level than the second feature.

[0138] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms should not be understood as necessarily referring to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification.

[0139] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

[0140] The above is a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A video data encryption method, characterized in that: The following steps are involved: Construct the SECMPEG algorithm model, perform segmented encryption on the original video data, and obtain the first-level encrypted video ciphertext data; Construct a homomorphic encryption model, input the first-level encrypted video ciphertext data for processing, use an asymmetric public key to perform a second-level encryption on the first-level encrypted video ciphertext data, and use a predefined ciphertext storage format to obtain the second-level encrypted video ciphertext data; Construct an attribute-based searchable encryption model, input the second-level encrypted video ciphertext data, generate video ciphertext data with access control, encrypt the information related to the original video, and obtain the metadata ciphertext index according to the predefined searchable index structure; A mapping relationship between video ciphertext data with access control and metadata ciphertext index is established, which is stored through the set ciphertext storage protocol. The relevant video metadata plaintext information is obtained by decrypting the metadata ciphertext index using a searchable query language.

2. The video data encryption method according to claim 1, characterized in that: Construct an attribute-based searchable encryption model, input the second-level encrypted video ciphertext data, generate video ciphertext data with access control, and encrypt the information related to the original video. According to the predefined searchable index structure, obtain the metadata ciphertext index, which specifically includes the following steps: Receiving the second-level encrypted video ciphertext data, obtaining a corresponding attribute set from a preset access control policy as an input parameter of an attribute encryption algorithm, performing attribute-based encryption processing on the video ciphertext data, and obtaining the video ciphertext data with access control; A searchable encryption algorithm is used to encrypt the video-related metadata information, and a metadata ciphertext index is constructed based on a predefined index structure.

3. The video data encryption method according to claim 1, characterized in that: A mapping relationship between video ciphertext data with access control and metadata ciphertext index is established, stored through a set ciphertext storage protocol, and the relevant video metadata plaintext information is obtained by decrypting the metadata ciphertext index using a searchable query language, specifically including the following steps: A mapping relationship between video ciphertext data with access control and the corresponding metadata ciphertext index is established through the set mapping rules; The video ciphertext data and metadata ciphertext index with access control are stored in different storage nodes of the distributed storage system according to a predetermined storage protocol; The user makes a video retrieval request and provides his / her attribute certificate. The system verifies whether the user attributes meet the access control policy requirements. When the user attributes meet the requirements, the matching results are searched in the metadata ciphertext index according to the user's search keywords, and the storage location information of the corresponding video ciphertext data is obtained. When the user data does not meet the requirements, the video retrieval request is stopped; The user attribute certificate and the required video ciphertext data location information are submitted to the distributed storage system. The storage node holding the corresponding decryption key in the storage system verifies the attribute certificate and returns the video ciphertext data to the user if it passes.

4. The video data encryption method according to claim 1, characterized in that: Before constructing the SECMPEG algorithm model, the following steps are specifically included: obtaining original video data, and extracting metadata information of the video data.

5. The video data encryption method according to claim 1, characterized in that: After obtaining the relevant video metadata plaintext information by decrypting the metadata ciphertext index, the following steps are specifically included: According to the preset ciphertext access protocol, the access rights to the video ciphertext data are granted to the authorized user, and the private key generated in the asymmetric encryption is sent to the authorized user with access rights.

6. A video data storage and sharing system based on blockchain, using the video data encryption method described in any one of claims 1 to 5 above, characterized in that: It includes a storage module for storing video data and encrypted video data, an edge server module for encrypting video data and generating related data, an agent authorization center module for deploying smart contracts, a blockchain network module for storing related data, and a sharing module that provides query and inspection functions to users.

7. The video data storage and sharing system based on blockchain according to claim 6 is characterized in that: The storage module comprises: A specific data storage unit stores the encrypted specific data and sends a hash value of the encrypted specific data to the sharing module; The cloud storage data unit is used to store encrypted video data.

8. The video data storage and sharing system based on blockchain according to claim 6 is characterized in that: The edge server module comprises: A raw data uploading unit, used for collecting and processing raw video data; Specific data generation unit: collects 30 seconds of original video data, compresses it, and generates specific data; A video encryption unit encrypts specific data and original video data; The data uploading unit uploads the encrypted video data to the cloud storage data unit, uploads the encrypted specific data to the specific data storage unit, and generates a hash value of the encrypted specific data, which is passed to the blockchain network module.

9. The video data storage and sharing system based on blockchain according to claim 6 is characterized in that: The blockchain network module includes: The chain-up unit obtains the chain-up request for video data and generates a new storage block in the blockchain; The offline data storage unit stores the video data, video data information and related specific data sent to the blockchain network module.

10. The video data storage and sharing system based on blockchain according to claim 6 is characterized in that: The shared module includes: User information unit, used for user identity information registration and verification, and storing user information; A data query unit, which obtains video data and specific data information in the blockchain network module according to the query information input by the user; The data downloading unit pairs the video data and specific data information in the blockchain network module with the storage module, and downloads the original video data accordingly.

Images