Software and hardware encryption and decryption method for video surveillance platform based on dynamic strategy

Abstract

The present invention belongs to the field of video surveillance technology, and specifically relates to a method for software and hardware encryption and decryption of a video surveillance platform based on dynamic strategies. The platform contains multiple modules such as device access, AS superior, and streaming media. After the front-end device initiates a connection, the platform dynamically selects hardware or software encryption and decryption based on the access volume, server performance, etc. Hardware encryption and decryption rely on a cryptographic machine to verify signatures and process data and manage keys; software encryption and decryption calls library function operations. After the device is registered and put online, each module collaborates, and the platform continuously monitors the device status, and can re-evaluate the system and encryption and decryption methods in case of abnormalities. The present invention solves many traditional problems, has the advantages of flexible configuration, excellent performance, good certificate management, fast calculation, strong security, etc., and is of great significance to the field of video surveillance security.

Description

Technical Field

[0001] The invention belongs to the technical field of video monitoring, and in particular relates to a software and hardware encryption and decryption method for a video monitoring platform based on a dynamic strategy. Background Art

[0002] As video surveillance technology becomes increasingly popular, it plays a vital role in maintaining social order, ensuring public safety, and improving the management efficiency of various industries. As the core hub of the entire system, the video surveillance platform needs to be seamlessly connected with many front-end cameras or other video platforms with security functions to achieve efficient transmission, storage and management of video data. The introduction of the national standard 35114 protocol provides a unified specification framework for this secure connection, aiming to ensure secure and reliable communication between different devices and platforms. However, during the signaling interaction process of the connection, the protocol does not provide clear guidance on the specific implementation of digital certificate signatures and encryption. This makes the industry face multiple choices when actually implementing secure connection, mainly including soft and hard solutions.

[0003] Existing technical solutions and their advantages and disadvantages:

[0004] Single openssl soft solution: The soft solution developed based on openssl_1_1b version has been applied in some scenarios due to its unique advantages. Its deployment process is extremely lightweight and can be easily adapted to various platforms to achieve lightweight deployment, effectively reducing system resource usage. In terms of implementation process, encryption and decryption operations can be completed by simply calling the openssl library interface, which makes it highly flexible in version iteration and can quickly adapt to the platform's functional upgrade requirements. At the same time, it has a high degree of customization and can be personalized according to the needs of specific platforms.

[0005] Performance bottleneck problem: The core flaw of the soft solution is its high dependence on server CPU resources. In the video surveillance system, as the number of docking devices continues to increase, the amount of encryption and decryption tasks increases exponentially, occupying a large amount of CPU computing resources. This causes the thread of the single national standard access service to take too long to process encryption and decryption operations, gradually forming a docking bottleneck. As the system load increases, the overall performance decreases significantly, which not only affects the real-time transmission and processing efficiency of video data, but may also cause system instability such as freezes, delays, and even crashes, seriously threatening the continuity and reliability of the service.

[0006] Certificate management dilemma: All certificates are tightly bound to the platform database and all need to be configured uniformly from the platform web. In actual applications, video surveillance systems often involve many devices and users, with a large number of certificates and complex sources. This centralized management method makes the certificate management process cumbersome, complex to operate, and prone to human errors and management chaos. At the same time, the centralized storage and processing of a large number of certificates also causes a waste of resources and reduces the operating efficiency of the system.

[0007] Computing rate limitations: Software-implemented encryption and decryption operations have obvious performance shortcomings when facing large-scale data processing or high-frequency encryption and decryption needs. Compared with specialized hardware acceleration methods, the CPU's computing power is relatively limited and cannot efficiently process complex encryption and decryption algorithms. When processing the encrypted transmission of massive video data or high-frequency data interaction in real-time monitoring, the computing rate of software decomposition is far from meeting the real-time requirements of the system, resulting in data transmission delays, affecting user experience and the actual application effect of the system.

[0008] Security risks: Software runs on the operating system and is inevitably affected by vulnerabilities in the operating system and other software. As the core of the entire computer system, the security of the operating system is of vital importance. Once there are security vulnerabilities in the operating system, such as buffer overflow vulnerabilities and privilege escalation vulnerabilities that are not repaired in time, attackers may obtain system permissions by exploiting these vulnerabilities, and then access and tamper with sensitive information in the software decoding process, such as digital certificates and encryption keys. In addition, vulnerabilities in other software may also be exploited by attackers to disrupt the normal operation of the software decoding function through malware injection, code execution, etc., and even steal video data, posing a serious security threat to the entire video surveillance system.

[0009] Although the prior art is constantly developing and improving, there are still some problems and deficiencies, which provide a broad space for innovation and optimization of the present invention. Therefore, it is necessary for those skilled in the art to provide a more efficient, secure and flexible video surveillance platform software and hardware encryption and decryption solution for the defects of the prior art. Summary of the invention

[0010] In view of the fact that the encryption and decryption technology of the current video surveillance platform in the process of secure docking with the front-end equipment has many deficiencies, such as the performance bottleneck, inconvenient certificate management, low computing speed and high security risk of the single OpenSSL soft solution. The present invention provides a video surveillance platform software and hardware encryption and decryption method based on dynamic strategy, aiming to solve the following key problems: first, by dynamically selecting hardware or software encryption and decryption methods, the CPU resource consumption problem that may exist in the original national standard access service is effectively solved in combination with hardware encryption and decryption, thereby improving system performance; second, the certificate management is handed over to the cipher machine to solve the problem of cumbersome certificate management, realize module separation, and improve management efficiency; third, the advantage of hardware encryption and decryption is used to improve the computing speed, meet the high-intensity and high-frequency encryption and decryption requirements, and enhance the overall performance of the system; fourth, with the characteristics of the hardware encryption and decryption independent host, the risk of being attacked by the network and physical is reduced, and the system security is improved; fifth, flexible encryption and decryption strategy selection is provided, so that the platform can be flexibly configured according to the actual situation, adapt to different on-site environments and business needs, and promote the development of video surveillance platform security access technology.

[0011] To achieve the above object, the technical solution adopted by the present invention is: a video surveillance platform software and hardware encryption and decryption method based on dynamic strategy, characterized in that it includes the following steps:

[0012] Step S1: The front-end security device initiates a connection request with the video surveillance platform. The video surveillance platform includes a device access service module, an AS upper module, a streaming media module, a web service module, a client module and a cryptographic machine module. The modules cooperate with each other to achieve the platform function. The device access service module serves as the information interaction hub between the front-end security device and the platform, receives the access request of the front-end security device and processes the related device operation signaling; the AS upper module is responsible for cascading communication with the national standard downstream platform to realize cross-platform data interaction; the streaming media module focuses on processing audio and video data streams, including format conversion, encoding and decoding operations on the data transmitted by the front-end device to ensure smooth transmission and accurate playback of data within the platform and the client; the web service module, as the B / S end of the platform, provides the interface of the basic platform function operation and the basic device operation for the web page login user; the client module, as the C / S end of the platform, provides the user with the function of obtaining the stream for the access device; the cryptographic machine module, as a hardware device, undertakes the encryption and decryption operations in the national secret authentication process to ensure the security of sensitive information;

[0013] Step S2: After the platform receives the connection request from the front-end security device, the device access service module transmits the request information to the platform database to query the configuration information, and determines whether to use hardware encryption or software encryption according to the dynamic policy in the configuration information. If it is hardware encryption, execute step S3, if it is software encryption, execute step S4, the dynamic policy is based on system status information, such as the number of access devices and server performance parameters;

[0014] Step S3: If hardware encryption and decryption is adopted, the device access service module calls the signature verification interface and encryption and decryption interface corresponding to the cryptographic machine module. The cryptographic machine module uses its dedicated encryption module to verify the device certificate information, including parsing the certificate format, verifying the certificate signature and validity period. After the signature verification is successful, the data transmitted between the device and the platform is encrypted and decrypted. During the processing, the key management security mechanism is followed to ensure the secure exchange of keys between the software and hardware modules;

[0015] Step S4: If software encryption and decryption is used, the device access service module calls the relevant interface of the libgb35114 software library and uses the software to verify the device certificate information, including checking the integrity of the certificate chain and the certificate revocation status. After the verification is successful, the data transmitted between the device and the platform is encrypted and decrypted;

[0016] Step S5: When the platform verifies the signature, it obtains the device's certificate information from the platform database and performs the signature verification process in conjunction with the interface selected in step S3 or S4. If the signature verification is successful, the platform server returns a successful response to the device, the device completes the registration and enters the online process. If the signature verification fails, the platform returns an error code to the device, and the device needs to re-initiate an access request and register;

[0017] Step S6: After the device is successfully registered and goes online, the device access service module interacts with the AS upper module and the streaming media module to implement the device information reporting and authentication process. The web service module and the client module obtain device information and audio and video data through data interaction with the device access service module and the streaming media module, and provide users with an operation interface and display content. The cipher module performs encryption and decryption operations as needed in the subsequent data interaction between the device and the platform to ensure data security, thereby realizing safe and efficient docking and data processing between the video surveillance device and the platform. The device can perform subsequent data interaction and operations, such as device status update and audio and video data transmission.

[0018] Furthermore, in step S1, when the device access service module receives the front-end security device access request, the specific steps are as follows:

[0019] Step S11: Parse the access request of the front-end security device and extract the key information of the device identification and request type;

[0020] Step S12: Match the extracted key information with the device information pre-stored in the platform to determine whether the device is a legally authorized device;

[0021] Step S13: If the device is legal, a communication link with the front-end security device is established, and information related to the access request is transmitted to other related modules. If it is illegal, access is denied and corresponding error information is returned to the device.

[0022] Furthermore, in step S2, the dynamic strategy is determined as follows:

[0023] Step S21: The platform monitors the number of access devices, server CPU usage, memory usage, data transmission frequency and data sensitivity system status information of the system in real time;

[0024] Step S22: When the number of connected devices exceeds the preset number threshold, or the CPU usage is higher than the preset CPU threshold, or the memory usage is higher than the preset memory threshold, or the data transmission frequency is higher than the preset frequency threshold and the data sensitivity is high, the hardware encryption and decryption method is preferentially selected; when the system is in a low load state, that is, the number of connected devices is small, the CPU usage and memory usage are low, and the data transmission frequency and sensitivity are low, the software encryption and decryption method is selected; at the same time, the platform provides a manual intervention interface, and the administrator can manually adjust the selection of encryption and decryption methods according to actual conditions.

[0025] Furthermore, in step S3, when the cryptographic machine module performs digital certificate signature verification, the specific steps are as follows:

[0026] Step S31: The cryptographic machine module receives the device certificate information transmitted by the device access service module, uses the built-in certificate parsing program to parse the certificate format, verifies the validity of the certificate signature, checks whether the validity period of the certificate is within the legal range, and checks the certificate issuing authority and certificate chain integrity related information;

[0027] Step S32: If the certificate format is correct, the signature is valid, it is within the validity period, and the certificate chain is complete and all the signature verification conditions are met, the signature verification is successful, and the cryptographic machine module is ready to perform data encryption and decryption operations; if any condition is not met during the signature verification process, the operation is stopped, and the signature verification failure information is fed back to the device access service module, and the device access service module then returns an error code to the device.

[0028] Furthermore, in step S4, when the software is encrypted and decrypted, the specific steps are as follows:

[0029] Step S41: the device access service module calls the certificate verification function in the libgb35114 software library to comprehensively check the integrity of the certificate chain, confirm whether the certificate is in the revocation list, and check the version compatibility related information of the certificate;

[0030] Step S42: If the certificate chain is complete, not in the revocation list, and all version compatibility verification conditions are met, the signature verification is successful, and the software uses the encryption function in the library to encrypt the data transmitted between the device and the platform, and uses the decryption function to decrypt the received encrypted data; if the signature verification fails, the operation is stopped, and the signature verification failure information is fed back to the device access service module, and the device access service module returns an error code to the device.

[0031] Furthermore, after step S6, the platform continuously monitors the operation status of the device, and the specific steps are as follows:

[0032] Step S71: Regularly check the data transmission link status between the device and the platform, including checking one or more parameters of data transmission packet loss rate, delay time, and bandwidth utilization, and monitor the device response time and data transmission frequency device operation indicators;

[0033] Step S72: If the data transmission link is abnormal, such as the packet loss rate exceeds the preset packet loss threshold, the delay time exceeds the preset delay threshold, or the bandwidth utilization is abnormal, or the device operation index is abnormal, the platform re-evaluates the system status, and re-selects the hardware or software encryption and decryption method according to the number of access devices and server performance of the current system. If necessary, the device registration process is re-performed, including re-obtaining the device certificate information and re-verifying the signature;

[0034] Step S73: When the device has no data interaction within a certain period of time, the heartbeat detection mechanism is started, and the platform sends a heartbeat detection signal to the device. If no response signal from the device is received for multiple consecutive times, the device is determined to be offline, the device offline time is recorded, and the relevant management personnel are notified. At the same time, the device is monitored for reconnection. When the device is reconnected, the process of steps S1 to S6 is repeated.

[0035] Furthermore, it also includes a security mechanism for key management, including protection methods for the entire process of key generation, distribution, storage and destruction; the specific key secure encryption communication mechanism between software and hardware modules includes the following:

[0036] Key generation and issuance:

[0037] The key is generated by a CA or a certificate issuing agency and is issued using the producer's CA public key. After issuance, it is encoded in base64 and stored in certificates of different formats, including one or more of pem, crt, and pfx formats.

[0038] Key file classification and initial processing:

[0039] Key files are divided into public key files and private key files. Public key files are saved freely by users in PEM format. Users can import public key files into devices and register with the platform with public key information for encryption and decryption interaction with the platform's private key. Private key files are encrypted by administrators using AES in PEM format (encryption method is optional) and stored in the platform database or service cache.

[0040] Key transfer:

[0041] After the private key file is stored in the database, during the operation of the platform: the device access service module or the cascade access service module can query the database to obtain the private key file. In the software decryption scenario, after the service module obtains the private key file, it obtains the original file content through the decryption method matched with the storage encryption method, and delivers it to the software decryption service for password extraction operation; in the hardware decryption scenario, the service module passes the private key file pointer, including the cache address, to the cryptographic machine module, and the cryptographic machine module performs hardware decryption operations to ensure the secure exchange and use of keys during the operation of the platform, especially when data is interacted between software and hardware modules;

[0042] Key destruction:

[0043] When the private key file needs to be destroyed, the administrator exports the private key file from the database and performs the destruction operation to ensure that the private key file and all its copies and related storage records are completely cleared to prevent the private key from being illegally recovered and used.

[0044] The present invention adopts the above technical solution, which has at least the following beneficial effects:

[0045] 1. Significant performance improvement: By introducing dynamic strategies to select hardware or software encryption and decryption methods, the performance bottleneck problem caused by the traditional single OpenSSL soft solution due to excessive reliance on server CPU resources is effectively solved. When the system is under high load, such as when a large number of devices are connected, the hardware encryption and decryption method can quickly process encryption and decryption tasks, avoiding the situation where the single national standard access service thread takes too long, and ensuring the real-time transmission and processing efficiency of video data. Compared with pure software solutions, when dealing with multi-device access scenarios, hardware encryption and decryption can significantly reduce processing time, improve system response speed, ensure service stability and reliability, and effectively prevent system freezes, delays, and even crashes.

[0046] 2. Efficient certificate management: Certificate management is separated from the platform web side and handed over to the cryptographic machine, which greatly simplifies the certificate management process. Compared with the traditional solution in which the certificates of each party are bound to the platform database and need to be uniformly configured from the web side, the present invention reduces the probability of human error and avoids management chaos. In actual application scenarios, it can effectively reduce system failures and security risks caused by poor certificate management, improve certificate management efficiency, reduce resource waste, make certificate management more convenient and efficient, and improve the operating efficiency of the entire system.

[0047] 3. Enhanced computing speed: Taking advantage of hardware encryption and decryption, the computing speed is significantly improved when processing large-scale data or high-frequency encryption and decryption needs. Hardware encryption devices can efficiently process complex encryption and decryption algorithms with their specially optimized chips and architecture. When processing encrypted transmission of massive video data or high-frequency data interaction scenarios in real-time monitoring, its computing speed is significantly improved compared to software encryption and decryption, which can effectively meet the system's strict real-time requirements, improve user experience and the actual application effect of the system, for example, it can significantly reduce the encryption transmission delay of video data and ensure the smoothness of video playback.

[0048] 4. System security reinforcement: With the independent operation characteristics of the hardware cryptographic machine and the high-security encryption module, the risk of system attacks is effectively reduced. As an independent host, the hardware cryptographic machine is not easily threatened by operating system or other software vulnerabilities. Compared with the software implementation, its security is greatly improved. In the face of various network attacks such as malware injection and operating system vulnerability exploitation, it can effectively resist and protect sensitive information such as digital certificates and encryption keys from being accessed and tampered with, ensure the normal operation of the software decoding function, prevent video data from being stolen, and provide reliable security protection for the video surveillance system.

[0049] 5. Flexible and diverse configuration: The dynamic policy-based encryption and decryption method provided by the present invention can flexibly select hardware encryption and decryption or software encryption and decryption in a dynamic switch manner according to factors such as the number of project accesses, server performance, and on-site environmental security. This flexibility enables the video surveillance platform to better adapt to different application scenarios and user needs. For example, in small monitoring projects, when the server performance is sufficient and the data security requirements are relatively low, software encryption and decryption can be selected to reduce costs; in large-scale monitoring projects with extremely high security requirements, hardware encryption and decryption can be switched to ensure efficient and safe operation of the system. This flexible configuration feature improves the adaptability and scalability of the system, and helps to promote its application in video surveillance scenarios of various scales and requirements.

[0050] In summary, the present invention has made significant technological progress in the field of software and hardware encryption and decryption of video surveillance platforms, effectively solved many problems existing in the prior art, has good application prospects and market value, and can provide strong support for the safe and stable development of the video surveillance industry. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] Figure 1 It is a flow chart of the software and hardware encryption and decryption method of the video monitoring platform of the present invention.

[0053] Figure 2 It is a schematic diagram of the security mechanism of key management of the present invention.

[0054] Figure 3 It is a schematic diagram of the video monitoring platform architecture of the present invention.

[0055] Figure 4 It is a timing diagram of the video monitoring platform calling of the present invention. DETAILED DESCRIPTION

[0056] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0057] Embodiment 1

[0058] like Figure 1 The present embodiment provides a video surveillance platform software and hardware encryption and decryption method based on a dynamic strategy, characterized in that it includes the following steps:

[0059] Step S1: The front-end security device initiates a connection request with the video surveillance platform. The video surveillance platform includes a device access service module, an AS upper module, a streaming media module, a web service module, a client module and a cryptographic machine module. The modules cooperate with each other to achieve the platform function. The device access service module serves as the information interaction hub between the front-end security device and the platform, receives the access request of the front-end security device and processes the related device operation signaling; the AS upper module is responsible for cascading communication with the national standard downstream platform to realize cross-platform data interaction; the streaming media module focuses on processing audio and video data streams, including format conversion, encoding and decoding operations on the data transmitted by the front-end device to ensure smooth transmission and accurate playback of data within the platform and the client; the web service module, as the B / S end of the platform, provides the interface of the basic platform function operation and the basic device operation for the web page login user; the client module, as the C / S end of the platform, provides the user with the function of obtaining the stream for the access device; the cryptographic machine module, as a hardware device, undertakes the encryption and decryption operations in the national secret authentication process to ensure the security of sensitive information;

[0060] Step S2: After the platform receives the connection request from the front-end security device, the device access service module transmits the request information to the platform database to query the configuration information, and determines whether to use hardware encryption or software encryption according to the dynamic policy in the configuration information. If it is hardware encryption, execute step S3, if it is software encryption, execute step S4, the dynamic policy is based on system status information, such as the number of access devices and server performance parameters;

[0061] Step S3: If hardware encryption and decryption is adopted, the device access service module calls the signature verification interface and encryption and decryption interface corresponding to the cryptographic machine module. The cryptographic machine module uses its dedicated encryption module to verify the device certificate information, including parsing the certificate format, verifying the certificate signature and validity period. After the signature verification is successful, the data transmitted between the device and the platform is encrypted and decrypted. During the processing, the key management security mechanism is followed to ensure the secure exchange of keys between the software and hardware modules;

[0062] Step S4: If software encryption and decryption is used, the device access service module calls the relevant interface of the libgb35114 software library and uses the software to verify the device certificate information, including checking the integrity of the certificate chain and the certificate revocation status. After the verification is successful, the data transmitted between the device and the platform is encrypted and decrypted;

[0063] Step S5: When the platform verifies the signature, it obtains the device's certificate information from the platform database and performs the signature verification process in conjunction with the interface selected in step S3 or S4. If the signature verification is successful, the platform server returns a successful response to the device, the device completes the registration and enters the online process. If the signature verification fails, the platform returns an error code to the device, and the device needs to re-initiate an access request and register;

[0064] Step S6: After the device is successfully registered and goes online, the device access service module interacts with the AS upper module and the streaming media module to implement the device information reporting and authentication process. The web service module and the client module obtain device information and audio and video data through data interaction with the device access service module and the streaming media module, and provide users with an operation interface and display content. The cipher module performs encryption and decryption operations as needed in the subsequent data interaction between the device and the platform to ensure data security, thereby realizing safe and efficient docking and data processing between the video surveillance device and the platform. The device can perform subsequent data interaction and operations, such as device status update and audio and video data transmission.

[0065] As a preferred implementation, in step S1 of this embodiment, when the device access service module receives a front-end security device access request, the specific steps are as follows:

[0066] Step S11: Parse the access request of the front-end security device and extract the key information of the device identification and request type;

[0067] Step S12: Match the extracted key information with the device information pre-stored in the platform to determine whether the device is a legally authorized device;

[0068] Step S13: If the device is legal, a communication link with the front-end security device is established, and information related to the access request is transmitted to other related modules. If it is illegal, access is denied and corresponding error information is returned to the device.

[0069] As a preferred implementation, in step S2 of this embodiment, the steps of determining the dynamic strategy are as follows:

[0070] Step S21: The platform monitors the number of access devices, server CPU usage, memory usage, data transmission frequency and data sensitivity system status information of the system in real time;

[0071] Step S22: When the number of connected devices exceeds the preset number threshold, or the CPU usage is higher than the preset CPU threshold, or the memory usage is higher than the preset memory threshold, or the data transmission frequency is higher than the preset frequency threshold and the data sensitivity is high, the hardware encryption and decryption method is preferentially selected; when the system is in a low load state, that is, the number of connected devices is small, the CPU usage and memory usage are low, and the data transmission frequency and sensitivity are low, the software encryption and decryption method is selected; at the same time, the platform provides a manual intervention interface, and the administrator can manually adjust the selection of encryption and decryption methods according to actual conditions.

[0072] As a preferred implementation, in step S3 of this embodiment, when the cryptographic machine module performs digital certificate signature verification, the specific steps are as follows:

[0073] Step S31: The cryptographic machine module receives the device certificate information transmitted by the device access service module, uses the built-in certificate parsing program to parse the certificate format, verifies the validity of the certificate signature, checks whether the validity period of the certificate is within the legal range, and checks the certificate issuing authority and certificate chain integrity related information;

[0074] Step S32: If the certificate format is correct, the signature is valid, it is within the validity period, and the certificate chain is complete and all the signature verification conditions are met, the signature verification is successful, and the cryptographic machine module is ready to perform data encryption and decryption operations; if any condition is not met during the signature verification process, the operation is stopped, and the signature verification failure information is fed back to the device access service module, and the device access service module then returns an error code to the device.

[0075] As a preferred implementation, in step S4 of this embodiment, when performing software encryption and decryption operations, the specific steps are as follows:

[0076] Step S41: the device access service module calls the certificate verification function in the libgb35114 software library to comprehensively check the integrity of the certificate chain, confirm whether the certificate is in the revocation list, and check the version compatibility related information of the certificate;

[0077] Step S42: If the certificate chain is complete, not in the revocation list, and all version compatibility verification conditions are met, the signature verification is successful, and the software uses the encryption function in the library to encrypt the data transmitted between the device and the platform, and uses the decryption function to decrypt the received encrypted data; if the signature verification fails, the operation is stopped, and the signature verification failure information is fed back to the device access service module, and the device access service module returns an error code to the device.

[0078] Furthermore, after step S6, the platform continuously monitors the operation status of the device, and the specific steps are as follows:

[0079] Step S71: Regularly check the data transmission link status between the device and the platform, including checking one or more parameters of data transmission packet loss rate, delay time, and bandwidth utilization, and monitor the device response time and data transmission frequency device operation indicators;

[0080] Step S72: If the data transmission link is abnormal, such as the packet loss rate exceeds the preset packet loss threshold, the delay time exceeds the preset delay threshold, or the bandwidth utilization is abnormal, or the device operation index is abnormal, the platform re-evaluates the system status, and re-selects the hardware or software encryption and decryption method according to the number of access devices and server performance of the current system. If necessary, the device registration process is re-performed, including re-obtaining the device certificate information and re-verifying the signature;

[0081] Step S73: When the device has no data interaction within a certain period of time, the heartbeat detection mechanism is started, and the platform sends a heartbeat detection signal to the device. If no response signal from the device is received for multiple consecutive times, the device is determined to be offline, the device offline time is recorded, and the relevant management personnel are notified. At the same time, the device is monitored for reconnection. When the device is reconnected, the process of steps S1 to S6 is repeated.

[0082] like Figure 2 As shown, as a preferred implementation, this embodiment also includes a security mechanism for key management, including a protection method for the entire process of key generation, distribution, storage and destruction; the specific key secure encryption communication mechanism between software and hardware modules includes the following:

[0083] Key generation and issuance:

[0084] The key is generated by a CA or a certificate issuing agency and is issued using the producer's CA public key. After issuance, it is encoded in base64 and stored in certificates of different formats, including one or more of pem, crt, and pfx formats.

[0085] Key file classification and initial processing:

[0086] Key files are divided into public key files and private key files. Public key files are saved freely by users in PEM format. Users can import public key files into devices and register with the platform with public key information for encryption and decryption interaction with the platform's private key. Private key files are encrypted by administrators using AES in PEM format (encryption method is optional) and stored in the platform database or service cache.

[0087] Key transfer:

[0088] After the private key file is stored in the database, during the operation of the platform: the device access service module or the cascade access service module can query the database to obtain the private key file. In the software decryption scenario, after the service module obtains the private key file, it obtains the original file content through the decryption method matched with the storage encryption method, and delivers it to the software decryption service for password extraction operation; in the hardware decryption scenario, the service module passes the private key file pointer, including the cache address, to the cryptographic machine module, and the cryptographic machine module performs hardware decryption operations to ensure the secure exchange and use of keys during the operation of the platform, especially when data is interacted between software and hardware modules;

[0089] Key destruction:

[0090] When the private key file needs to be destroyed, the administrator exports the private key file from the database and performs the destruction operation to ensure that the private key file and all its copies and related storage records are completely cleared to prevent the private key from being illegally recovered and used.

[0091] Embodiment 2

[0092] like Figure 3 As shown, this embodiment provides a video surveillance platform architecture implementation scheme related to the present invention:

[0093] 1. The functions of each module are:

[0094] 35114 Management Platform: As the core management hub of the system, it is responsible for coordinating and managing the operation of the entire platform, including user authentication, authority management, and coordinating the workflow between modules to ensure the orderly operation of the platform.

[0095] AS Superior (libgb35114) Information Comprehensive Management Module: Focuses on processing information related to the superior platform. Collects, organizes, analyzes and stores information from different sources to provide data support for the decision-making and operation of the platform.

[0096] Streaming media service module: mainly responsible for processing audio and video data streams. After receiving video data from the front-end security device, a series of operations are performed, such as data format conversion, encoding and decoding processing, to ensure that the video data can be smoothly transmitted within the platform and accurately played on the client.

[0097] Device access service module: It is the key interface between the front-end security device and the platform. It is responsible for receiving access requests from front-end devices, performing legitimacy verification and access management on the devices, and transmitting operation instructions and data between the devices and the platform.

[0098] Front-end security device (FDWSF): As the source of data collection, it is responsible for acquiring video data at the monitoring site and transmitting the data to the platform. At the same time, it also needs to respond to the operation instructions sent by the platform through the device access service module.

[0099] User terminal: It is the starting point for users to interact with the platform. Users initiate login requests and operation instructions through the user terminal, such as viewing video surveillance, performing equipment control and other operations.

[0100] Client (C / S) module: provides users with more abundant operation functions. Through this module, users can fetch streams from devices connected to the platform, view real-time video data, and perform local storage, playback and other operations.

[0101] The Web (B / S) side provides an operation interface for users who log in through the web page. Users can perform basic platform functions (such as system settings, user management, etc.) and basic equipment operations (such as equipment query, control, etc.) here, making it convenient for users to remotely manage and monitor video equipment.

[0102] Database: As the core component of data storage, it stores various types of data such as user information, device information, platform business information, and video data. It provides data query and storage services for each module of the platform.

[0103] AC lower level: mainly used for the access and management of lower-level platforms. In the multi-level platform architecture, it is responsible for data interaction with the upper-level platform (such as the device access service module) to achieve device access, data transmission and management operations of the lower-level platform.

[0104] Lower level platform ( Figure 2 As the lower management platform in the system, it is managed and directed by the 35114 management platform. It is responsible for managing its subordinate devices and users, and interacting with the upper-level platform for data and business collaboration.

[0105] User information management entry module (not shown in the figure)

[0106] Responsible for processing the input and management of user information, including user account creation, authority allocation, information update and other operations, and feeding back the processed user information to the 35114 management platform.

[0107] Platform business information entry module (not shown in the figure)

[0108] Focus on the input and storage of platform business information. Organize and store business data during the platform operation into the database, and interact with the 35114 management platform to ensure the integrity and accuracy of the platform business data.

[0109] Cipher module

[0110] As a hardware security component, it is responsible for encryption and decryption operations in the national secret authentication process. By encrypting sensitive information such as digital certificates and communication data, it ensures the security of data during transmission and storage.

[0111] 2. Data Interaction Logic between Components

[0112] User terminal and 35114 management platform

[0113] Interaction logic: The user sends a login request and operation instructions to the 35114 management platform. The 35114 management platform authenticates the user and performs corresponding operations according to the user's operation instructions.

[0114] Data types: user login information, operation instructions (such as viewing videos, device control, etc.).

[0115] 35114 management platform and AS superior (libgb35114) information integrated management module

[0116] Interaction logic: The 35114 management platform sends information requests and management instructions to the AS upper module. The AS upper module processes the relevant information and feeds back the results to the 35114 management platform.

[0117] Data types: platform management information, data query requests, analysis results, etc.

[0118] 35114 Management Platform and Client (C / S) Module

[0119] Interaction logic: The 35114 management platform sends operation instructions and related data to the client module, and the client module executes the operation and returns information such as user operation feedback and video data request to the 35114 management platform.

[0120] Data types: operation instructions (such as device streaming operations), user operation feedback, and video data.

[0121] 35114 Management Platform and Database

[0122] Interaction logic: The 35114 management platform queries the database for user information, device information, platform business information, etc., and the database returns the query results; at the same time, the 35114 management platform also stores new user information, business information, etc. in the database.

[0123] Data types: user information, device information, platform business information.

[0124] Device access service module and front-end security device (FDWSF)

[0125] Interaction logic: The front-end security device sends an access request and video data to the device access service module. The device access service module verifies the legitimacy of the device (possibly through the cryptographic machine module and related 35114 level modules), and receives and processes the video data.

[0126] Data types: device access request, video data, device authentication result.

[0127] Device access service module and cryptographic machine module and 35114 related level modules (such as 35114 - B level, C level, A level module)

[0128] Interaction logic: The device access service module sends the device access request and data to the cryptographic machine module and 35114 related level modules for authentication and processing. These modules feed back the authentication results and processed data to the device access service module.

[0129] Data type: device access request, video data, authentication result.

[0130] Streaming service module with STDU and RTP262 (signature verification)

[0131] Interaction logic: The streaming service module sends a video stream processing request to STDU and RTP262. STDU and RTP262 process the video stream (such as signature verification and specific data processing) and then feed back the results to the streaming service module.

[0132] Data type: video stream processing request, processed video stream.

[0133] 35114 Management platform and user information management entry module

[0134] Interaction logic: The 35114 management platform sends management instructions such as user information query, creation, and update to the user information management entry module. After processing, the user information management entry module feeds back the results to the 35114 management platform.

[0135] Data types: user information query requests, management instructions, and processed user information.

[0136] 35114 Management platform and platform business information entry module

[0137] Interaction logic: The 35114 management platform sends platform business information query and storage instructions to the platform business information entry module. The platform business information entry module stores the processed business information in the database and feeds back the operation results to the 35114 management platform.

[0138] Data types: platform business information query requests, storage instructions, and processed business information.

[0139] Device access service module and AC lower level

[0140] Interaction logic: The device access service module conducts two-way data interaction with the AC subordinate. The AC subordinate sends subordinate platform related data (such as device access request, business data) and operation request to the device access service module, and the device access service module processes and feedbacks.

[0141] Data types: device access request, lower-level platform data, and management instructions.

[0142] 35114 Management Platform and Subordinate Platform Interaction Logic: 35114 Management Platform and Subordinate Platform interact with each other. 35114 Management Platform issues management instructions and queries data to subordinate platforms. Subordinate platforms execute operations and feed back data and operation results to 35114 Management Platform.

[0143] Data types: management instructions, data query requests, operation results.

[0144] Through the data interaction logic between these components, the entire video surveillance platform can realize the full process functions from front-end data collection, equipment access management, data processing and storage to user operation and monitoring, ensuring the security, stability and efficient operation of the system.

[0145] Embodiment 3

[0146] See also Figure 4 Combined with Figure 3 This embodiment provides a video surveillance platform software and hardware encryption and decryption method based on dynamic strategy.

[0147] 1. System Architecture Overview

[0148] The video monitoring platform architecture involved in the present invention includes upper platform, 28181 management platform, video monitoring platform, AS upper level (gb28181), streaming media (GB28181 streaming media), cryptographic machine and front-end security equipment (FDWS) and other modules. The video monitoring platform is at the core and interacts with other modules.

[0149] Device access service: As the connection hub between the platform and front-end security cameras, it is responsible for processing device operation signals, realizing information interaction and command transmission between the two, and ensuring that the device can normally access the platform and respond to operation commands.

[0150] AS upper level: It undertakes the function of national standard cascade access service, and is mainly used to connect to the national standard lower link platform to realize cascade communication between different platforms, and ensure the transmission and interaction of video surveillance data between platforms at different levels.

[0151] Streaming media: Focuses on stream forwarding and audio and video data stream processing, and efficiently processes the audio and video data transmitted from the front-end device, such as format conversion, encoding and decoding, to ensure that the data can be smoothly transmitted within the platform and accurately played on the client.

[0152] Web service: As the B / S end of the platform, it provides an operation interface for users who log in through the web page. Users can perform basic platform functions (such as system settings, user management, etc.) and basic equipment operations (such as equipment query, control, etc.) here, making it convenient for users to remotely manage and monitor video equipment.

[0153] Client: The C / S end of the platform, which provides users with richer functions, especially streaming operations for devices connected to the platform, so that users can obtain real-time audio and video data for viewing and analysis. It may also support local storage, playback and other functions.

[0154] Cipher machine: As a hardware device, it is responsible for the encryption and decryption operations in the national secret authentication process. It uses its dedicated encryption module to encrypt sensitive information (such as digital certificates, communication data, etc.) to ensure the security of data during transmission and storage.

[0155] Data interaction logic: The device access service receives access requests and data transmission from the front-end security camera, and exchanges signaling and data with AS superiors, streaming media and other modules to implement device registration, authentication and other processes. The web service and client obtain device information and audio and video data through data interaction with device access services, streaming media and other modules, and provide users with operation interfaces and display content. The cipher machine cooperates with modules such as the device access service to perform corresponding processing when encryption and decryption operations are required (such as digital certificate verification, data encryption transmission, etc.) to ensure data security. The overall architecture realizes safe and efficient docking and data processing between video surveillance equipment and the platform through data interaction between modules.

[0156] In this embodiment, there is a close data interaction and operation process relationship between the front-end security device, device access service, platform database, cryptographic machine and libgb35114 software library. The specific implementation process of the present invention will be described in detail below.

[0157] See also Figure 4 As shown, call the timing diagram process steps:

[0158] The device with national standard security access first initiates the 35114 registration process to the platform. This is the starting step to establish a connection between the device and the platform. The device actively initiates a request to seek access to the platform.

[0159] After receiving the registration request, the platform queries the platform configuration information in the database and determines whether to use hardware decryption or software decryption based on the configuration. If it is hardware decryption, the signature verification interface and encryption and decryption interface corresponding to the cipher machine are called; if it is software decryption, the relevant interface of OPENSSL is called to perform the software decryption process. This step reflects the platform's ability to flexibly select encryption and decryption methods based on preset configurations.

[0160] The platform checks the database to obtain the certificate information of the device, and performs the signature verification process in conjunction with the interface selected in the second step. After the signature verification is passed, the platform server returns a success response to the device, and the device is successfully registered; otherwise, it returns an error code of 400 or 401, and the device needs to be re-registered to ensure the legitimacy and security of the access device.

[0161] After successful registration, the platform will go online and the device will be officially connected to the platform. Subsequent data interaction and operations can be performed, such as device information reporting, audio and video data transmission, etc.

[0162] 2. Implementation steps

[0163] (I) The front-end security device initiates a connection request (step S1)

[0164] Module Function Introduction

[0165] The video surveillance platform contains multiple modules, among which the device access service module is the hub for information interaction between the front-end security equipment and the platform. The AS upper module is used for cascade communication with the national standard downstream platform. The streaming media module processes audio and video data streams, including format conversion, encoding and decoding operations. The web service module provides an operation interface for web page login users, the client module provides users with streaming function operations for access devices, and the cipher module is responsible for the encryption and decryption operations in the national secret authentication process.

[0166] Front-end security device access request processing (steps S11-S13)

[0167] When the front-end security device initiates a connection request with the video surveillance platform, the device access service module first parses the access request of the front-end security device and extracts key information such as the device identification and request type.

[0168] The extracted key information is then matched with the device information pre-stored on the platform to determine whether the device is a legally authorized device.

[0169] If the device is legal, the device access service module will establish a communication link with the front-end security device and pass the access request related information to other related modules; if the device is illegal, access will be denied and the corresponding error information will be returned to the device.

[0170] (II) Determine the encryption and decryption method (step S2)

[0171] Dynamic strategy monitoring (step S21)

[0172] The platform monitors system status information in real time, including the number of access devices, server CPU usage, memory usage, data transmission frequency, and data sensitivity.

[0173] Encryption and decryption method selection (step S22)

[0174] When the number of connected devices exceeds the preset number threshold, or the CPU usage is higher than the preset CPU threshold, or the memory usage is higher than the preset memory threshold, or the data transmission frequency is higher than the preset frequency threshold and the data sensitivity is high, hardware encryption and decryption is preferred.

[0175] When the system is in a low-load state, that is, when the number of connected devices is small, the CPU usage and memory usage are low, and the data transmission frequency and sensitivity are low, the software encryption and decryption method is selected. At the same time, the platform provides a manual intervention interface, and the administrator can manually adjust the encryption and decryption method according to the actual situation.

[0176] (III) Hardware encryption and decryption operation (step S3)

[0177] Interface call and signature verification (steps S31-S32)

[0178] If hardware encryption and decryption is used, the device access service module calls the signature verification interface and encryption and decryption interface corresponding to the cipher module.

[0179] After receiving the device certificate information, the cryptographic machine module uses the built-in certificate parsing program to parse the certificate format, verify the validity of the certificate signature, check whether the certificate validity period is within the legal range, and check the certificate issuing authority and certificate chain integrity related information.

[0180] If the certificate format is correct, the signature is valid, within the validity period, and the certificate chain is complete, all verification conditions are met, then the verification is successful and the cryptographic machine module is ready to perform data encryption and decryption operations; if any condition is not met during the verification process, the operation is stopped and the verification failure information is fed back to the device access service module, which then returns an error code to the device.

[0181] Data encryption and decryption and key management

[0182] After the signature verification is successful, the cryptographic module encrypts and decrypts the data transmitted between the device and the platform. During the processing, the key management security mechanism is followed to ensure the secure exchange of keys between the software and hardware modules.

[0183] (IV) Software encryption and decryption operation (step S4)

[0184] Software interface call and signature verification (steps S41-S42)

[0185] If software encryption and decryption is used, the device access service module calls the relevant interface of the libgb35114 software library.

[0186] Use software to verify the device certificate information, including checking the integrity of the certificate chain and the certificate revocation status, and checking the version compatibility related information of the certificate.

[0187] If the certificate chain is complete, not in the revocation list, and all version compatibility verification conditions are met, the signature verification is successful. The software uses the encryption function in the library to encrypt the data transmitted between the device and the platform, and uses the decryption function to decrypt the received encrypted data. If the signature verification fails, the operation is stopped and the signature verification failure information is fed back to the device access service module, and the device access service module returns an error code to the device.

[0188] (V) Platform signature verification and device registration (step S5)

[0189] When the platform performs the signature verification operation, it obtains the device's certificate information from the platform database and performs the signature verification process in conjunction with the interface selected in step S3 or S4.

[0190] If the signature verification succeeds, the platform server returns a successful response to the device, the device completes the registration and enters the online process; if the signature verification fails, the platform returns an error code to the device, and the device needs to re-initiate an access request and register.

[0191] (VI) Data interaction and operation after the device is online (step S6)

[0192] After the device is successfully registered and goes online, the device access service module interacts with the AS upper module and the streaming media module to implement the device information reporting and authentication process.

[0193] The web service module and the client module obtain device information and audio and video data through data interaction with the device access service module and the streaming media module, and provide users with an operation interface and display content.

[0194] In the subsequent data interaction between the device and the platform, the cipher module performs encryption and decryption operations as needed to ensure data security and realize safe and efficient connection and data processing between the video surveillance device and the platform. The device can perform subsequent data interaction and operations, such as device status update and audio and video data transmission.

[0195] (VII) Equipment operation status monitoring (step S7)

[0196] Link and indicator monitoring (step S71)

[0197] The platform regularly checks the data transmission link status between the device and the platform, including checking one or more parameters of data transmission packet loss rate, delay time, and bandwidth utilization, while monitoring device operation indicators such as device response time and data transmission frequency.

[0198] Exception handling and re-evaluation (step S72)

[0199] If an abnormality occurs in the data transmission link, such as the packet loss rate exceeds the preset packet loss threshold, the delay time exceeds the preset delay threshold, or the bandwidth utilization is abnormal, or the device operation indicators are abnormal, the platform re-evaluates the system status and re-selects the hardware or software encryption and decryption method based on the number of access devices and server performance of the current system. If necessary, the device registration process is re-performed, including re-obtaining the device certificate information and re-verifying the signature.

[0200] Heartbeat detection and offline processing (step S73)

[0201] When the device has no data interaction within a certain period of time, the heartbeat detection mechanism is started, and the platform sends a heartbeat detection signal to the device. If no response signal from the device is received for multiple consecutive times, the device is determined to be offline, the device offline time is recorded, and the relevant management personnel are notified. At the same time, the device is monitored for reconnection. When the device is reconnected, the process of steps S1 to S6 is repeated.

[0202] III. Advantages of this embodiment

[0203] 1. Performance Improvement

[0204] In actual scenarios, when a large number of front-end security devices are connected to the video surveillance platform, if the traditional single OpenSSL soft solution is used, the server CPU resources will be occupied in large quantities. However, the present invention selects hardware encryption and decryption through dynamic strategies. For example, in a multi-device access scenario, hardware encryption and decryption can quickly process encryption and decryption tasks, avoiding the problem of single national standard access service thread consuming too long due to soft solution, ensuring the real-time transmission and processing efficiency of video data, and improving the overall performance of the system.

[0205] 2. Efficient certificate management

[0206] In traditional solutions, certificate management is often bound to the platform web end and requires unified configuration, which is prone to human errors and management confusion. This embodiment separates certificate management from the platform web end and puts it in the charge of the cryptographic machine, simplifying the certificate management process. In practical applications, it reduces system failures and security risks caused by poor certificate management and improves certificate management efficiency.

[0207] (III) Increased computing speed

[0208] When dealing with large-scale video data encryption transmission or high-frequency data interaction scenarios, hardware encryption and decryption uses its specially optimized chips and architecture, and the computing speed is significantly improved compared to software encryption and decryption. For example, in large-scale video surveillance projects, hardware encryption devices can efficiently process complex encryption and decryption algorithms, meet the system's strict requirements for real-time performance, and ensure the smoothness of video playback.

[0209] 4. System security reinforcement

[0210] As an independent host, the hardware cryptographic machine is not vulnerable to threats from operating system or other software vulnerabilities. In actual operation, in the face of network attacks such as malware injection and operating system vulnerability exploitation, it can effectively protect sensitive information such as digital certificates and encryption keys from being accessed and tampered with, thus ensuring the security of the video surveillance system.

[0211] (V) Flexible and diverse configuration

[0212] In different video surveillance scenarios, the dynamic strategy of the present invention can flexibly select hardware or software encryption and decryption. For example, in a small surveillance project, when the server performance is sufficient and the data security requirements are relatively low, software encryption and decryption can be selected to reduce costs; while in a large surveillance project with extremely high security requirements, hardware encryption and decryption can be switched to ensure the efficient and safe operation of the system, improving the adaptability and scalability of the system.

[0213] The above description is only a preferred embodiment of the present invention and is not intended to limit the invention. Although the present invention is described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A video surveillance platform software and hardware encryption and decryption method based on dynamic strategy, characterized by: The following steps are involved: Step S1: The front-end security device initiates a connection request with the video surveillance platform. The video surveillance platform includes a device access service module, an AS upper module, a streaming media module, a web service module, a client module and a cryptographic machine module. The modules cooperate with each other to achieve the platform function. The device access service module serves as the information interaction hub between the front-end security device and the platform, receives the access request of the front-end security device and processes the related device operation signaling; the AS upper module is responsible for cascading communication with the national standard downstream platform to realize cross-platform data interaction; the streaming media module focuses on processing audio and video data streams, including format conversion, encoding and decoding operations on the data transmitted by the front-end device to ensure smooth transmission and accurate playback of data within the platform and the client; the web service module, as the B / S end of the platform, provides the interface of the basic platform function operation and the basic device operation for the web page login user; the client module, as the C / S end of the platform, provides the user with the function of obtaining the stream for the access device; the cryptographic machine module, as a hardware device, undertakes the encryption and decryption operations in the national secret authentication process to ensure the security of sensitive information; Step S2: After the platform receives the connection request from the front-end security device, the device access service module transmits the request information to the platform database to query the configuration information, and determines whether to use hardware encryption or software encryption according to the dynamic policy in the configuration information. If it is hardware encryption, then execute step S3; if it is software encryption, then execute step S4. The dynamic policy is based on the system status information, and the system status information includes the number of access devices and server performance parameters; Step S3: If hardware encryption and decryption is adopted, the device access service module calls the signature verification interface and encryption and decryption interface corresponding to the cryptographic machine module. The cryptographic machine module uses its encryption module to verify the device certificate information, including parsing the certificate format, verifying the certificate signature and validity period. After the signature verification is successful, the data transmitted between the device and the platform is encrypted and decrypted. During the processing, the key management security mechanism is followed to ensure the secure exchange of keys between the software and hardware modules. Step S4: If software encryption and decryption is used, the device access service module calls the relevant interface of the libgb35114 software library and uses the software to verify the device certificate information, including checking the integrity of the certificate chain and the certificate revocation status. After the verification is successful, the data transmitted between the device and the platform is encrypted and decrypted; Step S5: When the platform verifies the signature, it obtains the device's certificate information from the platform database and performs the signature verification process in conjunction with the interface selected in step S3 or S4. If the signature verification is successful, the platform server returns a successful response to the device, the device completes the registration and enters the online process. If the signature verification fails, the platform returns an error code to the device, and the device needs to re-initiate an access request and register; Step S6: After the device is successfully registered and goes online, the device access service module interacts with the AS upper module and the streaming media module to implement the device information reporting and authentication process. The web service module and the client module obtain device information and audio and video data through data interaction with the device access service module and the streaming media module, and provide users with an operation interface and display content. In the subsequent data interaction between the device and the platform, the cipher module performs encryption and decryption operations as needed to ensure data security, thereby realizing safe and efficient docking and data processing between the video surveillance device and the platform. The device can perform subsequent data interaction and operations, including device status update and audio and video data transmission.

2. The video surveillance platform software and hardware encryption and decryption method based on dynamic strategy according to claim 1 is characterized by: In step S1, when the device access service module receives a front-end security device access request, the specific steps are as follows: Step S11: Parse the access request of the front-end security device and extract the key information of the device identification and request type; Step S12: Match the extracted key information with the device information pre-stored in the platform to determine whether the device is a legally authorized device; Step S13: If the device is legal, a communication link with the front-end security device is established, and information related to the access request is transmitted to other related modules. If it is illegal, access is denied and corresponding error information is returned to the device.

3. The video surveillance platform software and hardware encryption and decryption method based on dynamic strategy according to claim 2 is characterized by: In step S2, the dynamic strategy is determined as follows: Step S21: The platform monitors the number of access devices, server CPU usage, memory usage, data transmission frequency and data sensitivity system status information of the system in real time; Step S22: When the number of connected devices exceeds the preset number threshold, or the CPU usage is higher than the preset CPU threshold, or the memory usage is higher than the preset memory threshold, or the data transmission frequency is higher than the preset frequency threshold and the data sensitivity is high, select the hardware encryption and decryption method; when the system is in a low load state, that is, the number of connected devices is small, the CPU usage and memory usage are low, and the data transmission frequency and sensitivity are low, select the software encryption and decryption method; at the same time, the platform provides a manual intervention interface, and the administrator can manually adjust the selection of encryption and decryption methods according to actual conditions.

4. The video surveillance platform software and hardware encryption and decryption method based on dynamic strategy according to claim 3 is characterized by: In step S3, when the cryptographic machine module performs digital certificate signature verification, the specific steps are as follows: Step S31: The cryptographic machine module receives the device certificate information transmitted by the device access service module, uses the built-in certificate parsing program to parse the certificate format, verifies the validity of the certificate signature, checks whether the validity period of the certificate is within the legal range, and checks the certificate issuing authority and certificate chain integrity related information; Step S32: If the certificate format is correct, the signature is valid, it is within the validity period, and the certificate chain is complete and all the signature verification conditions are met, the signature verification is successful, and the cryptographic machine module is ready to perform data encryption and decryption operations; if any condition is not met during the signature verification process, the operation is stopped, and the signature verification failure information is fed back to the device access service module, and the device access service module then returns an error code to the device.

5. The method for software and hardware encryption and decryption of a video surveillance platform based on dynamic strategy according to claim 4 is characterized in that: In step S4, when the software is encrypted and decrypted, the specific steps are as follows: Step S41: the device access service module calls the certificate verification function in the libgb35114 software library to comprehensively check the integrity of the certificate chain, confirm whether the certificate is in the revocation list, and check the version compatibility related information of the certificate; Step S42: If the certificate chain is complete, not in the revocation list, and all verification conditions for version compatibility are met, the signature verification is successful, and the software uses the encryption function in the library to encrypt the data transmitted between the device and the platform, and uses the decryption function to decrypt the received encrypted data; If the signature verification fails, the operation is stopped and the signature verification failure information is fed back to the device access service module, and the device access service module returns an error code to the device.

6. The method for software and hardware encryption and decryption of a video surveillance platform based on dynamic strategy according to claim 5 is characterized in that: After step S6, the platform continuously monitors the operating status of the device. The specific steps are as follows: Step S71: Regularly check the data transmission link status between the device and the platform, including checking one or more parameters of data transmission packet loss rate, delay time, and bandwidth utilization, and monitor the device response time and data transmission frequency device operation indicators; Step S72: If the data transmission link is abnormal, including the packet loss rate exceeding the preset packet loss threshold, the delay time exceeding the preset delay threshold, or the bandwidth utilization is abnormal, or the device operation index is abnormal, the platform re-evaluates the system status and re-selects the hardware or software encryption and decryption method according to the number of access devices and server performance of the current system; Step S73: When the device has no data interaction within a certain period of time, the heartbeat detection mechanism is started, and the platform sends a heartbeat detection signal to the device. If no response signal from the device is received for multiple consecutive times, the device is determined to be offline, the device offline time is recorded, and the relevant management personnel are notified. At the same time, the device is monitored for reconnection. When the device is reconnected, the process of steps S1 to S6 is repeated.

7. The video surveillance platform software and hardware encryption and decryption method based on dynamic strategy according to any one of claims 1 to 6, characterized in that: It also includes the security mechanism of key management, including the protection method of the whole process of key generation, distribution, storage and destruction; the specific key secure encryption communication mechanism between software and hardware modules includes the following: Key generation and issuance: The key is generated by a CA or a certificate issuing agency and is issued using the producer's CA public key. After issuance, it is encoded in base64 and stored in certificates of different formats, including one or more of pem, crt, and pfx formats. Key file classification and initial processing: Key files are divided into public key files and private key files; The public key file is saved freely by the user in PEM format. The user can import the public key file into the device and register with the platform with the public key information for encryption and decryption interaction with the platform's private key. The private key file is encrypted by the administrator using AES in PEM format and stored in the platform database or service cache. Key transfer: After the private key file is stored in the database, during the operation of the platform: the device access service module or the cascade access service module can query the database to obtain the private key file. In the software decryption scenario, after the service module obtains the private key file, it obtains the original file content through the decryption method matched with the storage encryption method, and delivers it to the software decryption service for password extraction operation; In the hardware decryption scenario, the service module passes the private key file pointer, including the cache address, to the cryptographic module, which performs hardware decryption operations to ensure the secure exchange and use of keys during data interaction between software and hardware modules during platform operation; Key destruction: When the private key file needs to be destroyed, the administrator exports the private key file from the database and performs the destruction operation to ensure that the private key file and all its copies and related storage records are completely cleared to prevent the private key from being illegally recovered and used.

Images