Encrypted video playing method and device, storage medium and computer equipment

Abstract

According to the encrypted video playing method and device, the storage medium and the computer equipment provided by the invention, in response to a playing request of target video data of a user in a client, an encrypted SM4 symmetric key is acquired from the playing request; determining a user certificate corresponding to the playing request, and decrypting the encrypted SM4 symmetric key by using a private key of the user certificate to obtain a temporary SM4 symmetric key; determining a VKEK plaintext of the target video data, and encrypting the VKEK plaintext by using the temporary SM4 symmetric key to obtain a target VKEK ciphertext; and returning the target VKEK ciphertext to the client, so that the client plays the target video data after decrypting the target VKEK ciphertext by using the temporary SM4 symmetric key, and destroys the temporary SM4 symmetric key. Therefore, the video data playing method and the video data playing device do not depend on USB-Key hardware equipment, so that various clients can play the video data conforming to the C level of the GB35114-2017 protocol specification.

Description

Technical Field

[0001] The present application relates to the field of video surveillance technology, and in particular to an encrypted video playback method, device, storage medium and computer equipment. Background Art

[0002] In the application of the national standard GB35117-2017 protocol, when users access the real-time or historical video of the video platform connected to the C-level front-end security device or the C-level front-end security device of the downstream cascade platform, the video data is securely encrypted. Video data is protected by symmetric encryption using VEK, which is protected by compound encryption using VKEK (Video Key Encryption Key). VKEK is generated by the video platform and protected and stored using asymmetric encryption. In the process of transmitting VKEK between the platform and the client, the VKEK needs to be encrypted with the user certificate before transmission. When users use VKEK, they need to use a USB-Key device to decrypt VKEK before use.

[0003] However, for client users using Android, iOS, MacOS, HarmonyOS, Kylin, etc., due to system or physical interface problems, or when the AI ​​algorithm calculates the encrypted video, it is impossible to complete the decryption of VKEK by connecting and calling USBKey, and therefore it is impossible to play video data that complies with the GB35114-2017 protocol specification Level C. Summary of the invention

[0004] The purpose of this application is to solve at least one of the above-mentioned technical defects, especially the technical defect in the prior art that the client cannot play video data that complies with Class C of the GB35114-2017 protocol specification.

[0005] In a first aspect, the present application provides an encrypted video playback method, which is applied to a video platform, and the method includes:

[0006] In response to a request for playing target video data from a user in the client, an encrypted SM4 symmetric key is obtained from the playback request, the target video data is video data of level C of the GB35114-2017 protocol specification, and the encrypted SM4 symmetric key is obtained by encrypting a temporary SM4 symmetric key using the user certificate returned by the video platform when the user logs in by the client;

[0007] Determine the user certificate corresponding to the play request, use the private key of the user certificate to decrypt the encrypted SM4 symmetric key, and obtain a temporary SM4 symmetric key;

[0008] Determine the VKEK plaintext of the target video data, and encrypt the VKEK plaintext using the temporary SM4 symmetric key to obtain the target VKEK ciphertext;

[0009] The target VKEK ciphertext is returned to the client, so that the client uses the temporary SM4 symmetric key to decrypt the target VKEK ciphertext, plays the target video data, and destroys the temporary SM4 symmetric key.

[0010] In one embodiment, the step of determining the user certificate corresponding to the play request includes:

[0011] Get the identity token from the play request;

[0012] The identity token is verified, and when the identity token passes the verification, the user certificate corresponding to the identity token is obtained.

[0013] In one embodiment, the process of returning the user credentials when the user logs in includes:

[0014] In response to a login request from a user in a client, obtaining a user name and a password in the login request;

[0015] Verify the username and password. If both the username and password are verified, generate an identity token for the username and query the user certificate generated when the username is registered.

[0016] Returns the identity token and user credentials to the client.

[0017] In one embodiment, the process of returning the user certificate further includes:

[0018] If the user name or the password of the user name fails to pass the verification, a login failure message is generated and returned to the client.

[0019] In one embodiment, when registering a user name, the process of generating a user certificate includes:

[0020] In response to a user's account creation request in the client, obtain the user name and password in the account creation request;

[0021] When there is no duplicate username, generate a public and private key pair for the username;

[0022] Use the user name as an identifier and the public key of the user name to generate a certificate request file;

[0023] Use the certificate request file to request a certificate issuing authority to issue a user certificate and obtain a user certificate for the user name.

[0024] In one embodiment, when registering a user name, the process of generating a user certificate also includes:

[0025] When there is a duplicate username, an error message is generated to indicate that the username already exists, and the error message is returned to the client.

[0026] In one embodiment, the step of determining the VKEK plaintext of the target video data includes:

[0027] Obtain the initial VKEK ciphertext of the target video data, where the initial VKEK ciphertext is encrypted using the platform encryption certificate;

[0028] Determine the key corresponding to the platform encryption certificate, and use the private key corresponding to the platform encryption certificate to decrypt the initial VKEK ciphertext to obtain the VKEK plaintext.

[0029] In a second aspect, the present application provides an encrypted video playback device, which is applied to a video platform, and the device includes:

[0030] The encrypted SM4 symmetric key acquisition module is used to respond to the user's request for playing the target video data in the client and obtain the encrypted SM4 symmetric key from the play request, the target video data is the video data of level C of the GB35114-2017 protocol specification, and the encrypted SM4 symmetric key is obtained by encrypting the temporary SM4 symmetric key using the user certificate returned by the video platform when the user logs in by the client;

[0031] The encrypted SM4 symmetric key decryption module is used to determine the user certificate corresponding to the play request, and use the private key of the user certificate to decrypt the encrypted SM4 symmetric key to obtain a temporary SM4 symmetric key;

[0032] A target VKEK ciphertext determination module is used to determine the VKEK plaintext of the target video data and encrypt the VKEK plaintext using a temporary SM4 symmetric key to obtain the target VKEK ciphertext;

[0033] The target video data playback module is used to return the target VKEK ciphertext to the client, so that the client uses the temporary SM4 symmetric key to decrypt the target VKEK ciphertext, plays the target video data, and destroys the temporary SM4 symmetric key.

[0034] In a third aspect, the present application provides a storage medium: the storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of any of the encrypted video playback methods in the above embodiments.

[0035] In a fourth aspect, the present application provides a computer device, comprising: one or more processors, and a memory;

[0036] The memory stores computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, the steps of the encrypted video playback method in any of the above embodiments are performed.

[0037] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0038] In the encrypted video playback method, device, storage medium and computer equipment provided by the present application, in the playback request stage, a temporary SM4 symmetric key is generated by encrypting the user certificate and securely transmitting it to the video platform, thereby realizing a more secure key transfer method; the encrypted SM4 symmetric key is decrypted using the private key of the user certificate, thereby making the key decryption process more flexible and efficient, and no longer relying on hardware devices such as USB-Key. For systems that do not support USB-Key, the private key decryption process of the user certificate solves the cross-platform compatibility problem, while also ensuring that only legitimate users can access the key, thereby enhancing the security of data access; by converting the VKEK plaintext into the target VKEK ciphertext, the risk of the VKEK plaintext being directly exposed in the transmission link is avoided, thereby ensuring the encrypted transfer of critical keys; the client decrypts the target VKEK ciphertext to play the video data, and destroys the temporary SM4 symmetric key after decryption, thereby helping to reduce the key exposure time and improve the security of key use. At the same time, the dynamic generation and post-use destruction of the temporary SM4 symmetric key improve the security and flexibility of key management. Based on this, this method eliminates the reliance on USB-Key hardware through the private key decryption mechanism of the user certificate, so that clients of systems such as Android, iOS, MacOS, HarmonyOS, and Kylin can decrypt and play Class C encrypted video data that complies with the GB35114-2017 protocol even when they cannot access the USB-Key, thus expanding the compatibility range of video access. At the same time, the temporary SM4 symmetric key generated when the user logs in is protected by the user certificate during transmission and decryption, without the need for an additional physical interface, which greatly improves security and user convenience. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0040] Figure 1 A flowchart of an encrypted video playback method provided in an embodiment of the present application;

[0041] Figure 2One of the example diagrams of the encrypted video playback method provided in the embodiment of the present application;

[0042] Figure 3 The second example diagram of the encrypted video playback method provided in the embodiment of the present application;

[0043] Figure 4 The third example diagram of the encrypted video playback method provided in the embodiment of the present application;

[0044] Figure 5 A schematic diagram of the structure of an encrypted video playback device provided in an embodiment of the present application;

[0045] Figure 6 A schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0047] The present application provides an encrypted video playback method. The following embodiments are described by taking the method applied to a video platform as an example. It can be understood that the video platform can be any device with data processing functions, including but not limited to a single server and a server cluster. Figure 1 As shown, the method may include the following steps:

[0048] S101: In response to a request for playing target video data from a user in a client, an encrypted SM4 symmetric key is obtained from the playing request.

[0049] Among them, the target video data is the video data of GB35114-2017 protocol specification level C, and the encrypted SM4 symmetric key is obtained by the client using the user certificate returned by the video platform when the user logs in to encrypt the temporary SM4 symmetric key.

[0050] Among them, the play request is a request issued by the client to access and play the target video data. The target video data is the video content requested by the user to be played, which follows the C-level encryption standard of the GB35114-2017 protocol. The GB35114-2017 protocol is a national standard for data protection of security video surveillance systems, which defines different encryption levels for video data to ensure the confidentiality and integrity of data during transmission and storage. The SM4 symmetric key is a symmetric encryption key based on the cryptographic algorithm SM4. SM4 is used to encrypt data in video content and key transmission to ensure the security of data during transmission. The encrypted SM4 symmetric key means that the SM4 key itself has been further encrypted and protected. The key is generated by the video platform when the user logs in and is encrypted by the user certificate to prevent it from being intercepted or tampered with during transmission. The user certificate is a digital certificate that contains the user's public and private key pairs for identity authentication and data encryption and decryption. The user certificate ensures that the video data can only be decrypted and played on a legitimate client device.

[0051] In this step, after receiving the playback request, the video platform confirms whether the user has the right to access the video data based on the user authentication information and permissions in the request. If the authorization is passed, the platform will query the SM4 symmetric key generated and encrypted when the user logs in. When the user initiates a playback request, the client generates a temporary SM4 symmetric key for the user, encrypts the key with the public key of the user certificate, and then sends the encrypted key to the video platform. The temporary SM4 symmetric key is a 124-bit one-time SM4 symmetric key temporarily generated when the user initiates a playback request.

[0052] It is understandable that in the process of securely transmitting video content, directly transmitting plaintext keys may lead to the risk of being maliciously intercepted or tampered with by a third party. Therefore, the client encrypts the SM4 key through the user certificate, so that only the video platform and client with the legitimate user certificate private key can decrypt and use the key, thus avoiding the risk of key leakage. This method ensures that users can only access video data when they have authorized devices, meeting the C-level data protection requirements in the GB35114-2017 protocol.

[0053] The dynamic generation and encryption management of temporary SM4 symmetric keys simplifies the key management process. The client can complete the temporary generation and encryption of keys when the user initiates a playback request, avoiding the security risks caused by the long-term residence of keys on the platform or client.

[0054] S102: Determine the user certificate corresponding to the play request, and use the private key of the user certificate to decrypt the encrypted SM4 symmetric key to obtain a temporary SM4 symmetric key.

[0055] Among them, the private key is a key securely stored in the platform's hardware cryptographic machine or cryptographic card, which corresponds one-to-one to the user certificate and is used to decrypt encrypted data related to the user's identity.

[0056] In this step, when the video platform receives a playback request, it will first check the user identity information contained in the request and search for the corresponding user certificate record in the video platform's database. The video platform will confirm the authorization certificate of the requesting user based on conditions such as the user's login status and certificate storage to ensure that the request comes from a valid and legitimate user. After the video platform retrieves the user certificate, it decrypts the encrypted SM4 symmetric key to generate a temporary SM4 key.

[0057] It is understandable that the user certificate corresponding to the playback request is determined to ensure that the playback request comes from a legitimate user with valid authorization. By verifying the user certificate, the video platform can effectively prevent unauthorized requests and ensure that only the correct user can access specific video data, thereby reducing the possibility of illegal access and meeting the requirements of the security protocol. The encryption key is ensured to be secure by decrypting the encrypted SM4 key with a private key, and it cannot be decrypted even if it is intercepted during transmission, thereby preventing key leakage.

[0058] S103: Determine the VKEK plaintext of the target video data, and use the temporary SM4 symmetric key to encrypt the VKEK plaintext to obtain the target VKEK ciphertext.

[0059] Among them, VKEK plaintext is the plaintext version of the main key used to encrypt the target video data. VKEK is the core key for encrypting video content and can symmetric encrypt and protect video data. The target VKEK ciphertext is the VKEK encrypted by the video platform using a temporary SM4 symmetric key. The ciphertext contains the key information required to decrypt the target video data and is protected by double-layer encryption to ensure its security during transmission.

[0060] In this step, the video platform first retrieves the corresponding VKEK plaintext according to the video data ID requested by the user. After obtaining the VKEK plaintext, it is encrypted using the temporary SM4 symmetric key.

[0061] It can be understood that the use of temporary SM4 symmetric keys to encrypt VKEK plaintext provides the basis for double-layer encryption. This process ensures that the VKEK plaintext remains encrypted during transmission and cannot be decrypted even if intercepted. Because the VKEK ciphertext can only be decrypted by the client holding the temporary SM4 key, this greatly enhances transmission security. In addition, VKEK's dynamic protection mechanism improves the confidentiality of the key and the security of transmission, reduces the risk of long-term storage and transmission, and thus more effectively protects video content and user privacy.

[0062] S104: Return the target VKEK ciphertext to the client, so that the client uses the temporary SM4 symmetric key to decrypt the target VKEK ciphertext, plays the target video data, and destroys the temporary SM4 symmetric key.

[0063] In this step, after encrypting the VKEK plaintext, the video platform sends the target VKEK ciphertext back to the client so that the client can continue the playback process. During the data transmission process, the video platform will authenticate and verify the integrity of the target VKEK ciphertext to ensure that the ciphertext has not been tampered with and is only transmitted to authorized clients. The client receives the encrypted VKEK ciphertext from the video platform, and then uses the temporary SM4 symmetric key obtained in the session to decrypt the VKEK ciphertext to obtain the VKEK plaintext. After obtaining the VKEK plaintext, the key is used to decrypt and play the target video data. After the playback is completed, the temporary SM4 symmetric key is deleted to prevent it from being improperly used or leaked, thereby enhancing the security of the video data.

[0064] It can be understood that the target VKEK ciphertext is securely transmitted to the client, ensuring that the VKEK will not be intercepted or tampered with during transmission, avoiding dependence on USB-Key hardware devices, and enabling multi-platform clients such as Android, iOS, MacOS, HarmonyOS, Kylin, etc. to successfully decrypt videos even when the USB-Key cannot be connected, significantly improving the compatibility and user experience of the video platform. The client destroys the temporary SM4 key after being able to play the target video, which helps reduce the risk of long-term storage of sensitive keys. This key lifecycle management mechanism enhances the security and confidentiality of data transmission, reduces the possibility of key leakage, and effectively protects user privacy and the security of video data.

[0065] In the above embodiment, during the playback request phase, a temporary SM4 symmetric key is generated by encrypting the user certificate and securely transmitting it to the video platform, thereby realizing a more secure key transfer method; the encrypted SM4 symmetric key is decrypted using the private key of the user certificate, thereby making the key decryption process more flexible and efficient, and no longer relying on hardware devices such as USB-Key. For systems that do not support USB-Key, the private key decryption process of the user certificate solves the cross-platform compatibility problem, while also ensuring that only legitimate users can access the key, thereby enhancing the security of data access; by converting the VKEK plaintext into the target VKEK ciphertext, the risk of the VKEK plaintext being directly exposed in the transmission link is avoided, thereby ensuring the encrypted transmission of critical keys; the client decrypts the target VKEK ciphertext to play the video data, and destroys the temporary SM4 symmetric key after decryption, thereby helping to reduce the key exposure time and improving the security of key use. At the same time, the dynamic generation and post-use destruction of the temporary SM4 symmetric key improves the security and flexibility of key management. Based on this, this method eliminates the reliance on USB-Key hardware through the private key decryption mechanism of the user certificate, so that clients of systems such as Android, iOS, MacOS, HarmonyOS, and Kylin can decrypt and play Class C encrypted video data that complies with the GB35114-2017 protocol even when they cannot access the USB-Key, thus expanding the compatibility range of video access. At the same time, the temporary SM4 symmetric key generated when the user logs in is protected by the user certificate during transmission and decryption, without the need for an additional physical interface, which greatly improves security and user convenience.

[0066] In one embodiment, the step of determining the user certificate corresponding to the play request includes:

[0067] Get the identity token from the play request;

[0068] The identity token is verified, and when the identity token passes the verification, the user certificate corresponding to the identity token is obtained.

[0069] Among them, the identity token is a security credential used for identity authentication, usually generated by the video platform after the user successfully logs in. The identity token contains the user's identity information and access rights, and is used to verify the legitimacy of the user in subsequent requests.

[0070] Specifically, after receiving a playback request, the video platform first parses the request content and extracts the identity token from it. The identity token is usually attached as part of the request in the request header or in the request body. The video platform verifies the extracted identity token and checks its validity and integrity. For example, the identity token can be decrypted to confirm its signature, check the token's expiration time, and compare it with the records on the server. Once the identity token is verified, the video platform retrieves the corresponding user certificate from the database or key management system based on the user information in the identity token, such as the user ID.

[0071] In this embodiment, extracting the identity token from the playback request is the first step to ensure the user's identity, ensuring that the video platform can track the request of a specific user and process it accordingly, thereby laying the foundation for secure access to video data. Verifying the identity token is the core step to ensure secure access. Through verification, it can effectively prevent forged or expired tokens from being used for improper access, thereby enhancing the security of the system. At the same time, this process can also prevent unauthorized users from accessing sensitive video content, in line with the platform's security policy.

[0072] Retrieving the user certificate based on a valid identity token ensures that subsequent operations can be performed safely. The user certificate is not only used in the subsequent decryption process, but also provides identity authentication for users, ensuring that only authorized users can access specific video content. This mechanism enhances the user experience and ensures the security of user data and video content, in compliance with relevant security protocols and standards.

[0073] In one embodiment, the process of returning the user credentials when the user logs in includes:

[0074] In response to a login request from a user in a client, obtaining a user name and a password in the login request;

[0075] Verify the username and password. If both the username and password are verified, generate an identity token for the username and query the user certificate generated when the username is registered.

[0076] Returns the identity token and user credentials to the client.

[0077] Specifically, after receiving the login request, the video platform first parses the request content and obtains the username and password from it. The video platform uses the user information in the database, such as the registered username and password hash, to verify the username and password in the login request. If the username exists and the password matches, the verification is successful. For example, a secure hashing algorithm can be used to hash the input password and compare it with the hash value stored in the database.

[0078] Once the verification is successful, the video platform will generate an identity token for the user, which usually contains the user's unique identifier, generation time, expiration time, etc. At the same time, the video platform will query the user certificate generated when the user registered based on the username. Finally, the video platform sends the generated identity token and the queried user certificate back to the client through a response message.

[0079] In this embodiment, verifying the username and password is a key step in verifying the user's identity. This process prevents unauthorized access and ensures that only the correct user can log in, protecting user data and platform security. The generation of an identity token provides security credentials for subsequent user operations, so that users do not need to re-enter their username and password in multiple requests, improving the user experience. In addition, the validity period setting of the identity token can enhance security and prevent potential risks caused by long-term use.

[0080] Querying and returning the user certificate immediately after the user logs in ensures that the user has the necessary permissions and authentication in subsequent encryption and decryption operations. This further improves the security of data transmission and user experience, ensuring that users can smoothly access their authorized content.

[0081] The identity token and user certificate are returned to the client together, ensuring the smooth progress of subsequent operations on the client. This design not only simplifies the user interaction process, but also enhances the security of the entire system and reduces the potential security risks caused by multiple inputs of sensitive information.

[0082] In one embodiment, the process of returning the user certificate further includes:

[0083] If the user name or the password of the user name fails to pass the verification, a login failure message is generated and returned to the client.

[0084] The login failure information is feedback information generated when the user enters an incorrect username or password during the login process. This information usually contains a description of the error type, such as "user name does not exist" or "password error", so that the user can understand the reason for the login failure.

[0085] Specifically, during the process of verifying the username and password, if it is found that the username does not exist, or the entered password does not match the stored hash value, the video platform will create a login failure message. After generating the login failure message, the video platform will send the information back to the client through HTTP response or other means.

[0086] In this embodiment, if the verification fails during the user login process, timely generation and provision of detailed failure information is crucial for user experience. The operation of returning the login failure information to the client ensures that the user can obtain timely feedback during the login process, avoids repeated attempts due to incorrect input by the user, and effectively prevents brute force attacks that may be caused by malicious login attempts.

[0087] In one embodiment, when registering a user name, the process of generating a user certificate includes:

[0088] In response to a user's account creation request in the client, obtain the user name and password in the account creation request;

[0089] When there is no duplicate username, generate a public and private key pair for the username;

[0090] Use the user name as an identifier and the public key of the user name to generate a certificate request file;

[0091] Use the certificate request file to request a certificate issuing authority to issue a user certificate and obtain a user certificate for the user name.

[0092] Among them, the account creation request is a request sent by the client to the video platform to create a new user account. The request contains necessary information such as the username and password that the user wants to register. The public-private key pair is a key pair generated by an asymmetric encryption algorithm, in which the public key is used to encrypt data and the private key is used to decrypt data. The certificate request file is a file containing user identity information and public key, usually used to apply for a digital certificate. This file is used when requesting a certificate from a certificate issuing authority. The certificate issuing authority is a trusted third-party entity that is responsible for verifying the user's identity and issuing digital certificates to ensure the legitimacy and security of the certificate.

[0093] Specifically, when the video platform receives an account creation request from a client, it first parses the request content and extracts the username and password in the request. It then queries the database to check whether the username has been registered. If the username does not have a duplicate, the video platform will use the cryptography library to generate a public-private key pair, and use the generated public key and username to create a certificate request file containing the user identity information and public key. The video platform sends the certificate request file to the certificate issuing authority to apply for the issuance of a user certificate. After authentication, the authority will return a user certificate containing the public key and user identity information.

[0094] In this embodiment, ensuring the uniqueness of the user name is the key to maintaining the integrity of system data and user experience. By preventing duplicate user names, the video platform can avoid user confusion and identity conflicts, ensuring that each user has a unique identifier. Generating a public-private key pair is the basis for providing users with secure communication and data protection. The public key can be used for encryption, while the private key is used for decryption. This asymmetric encryption mechanism enhances the security of data. Creating a certificate request file is a necessary step to apply for a user certificate from a certificate issuing authority to ensure the smooth progress of subsequent processes. The file provides users with a secure identity authentication credential to ensure the authenticity of the user's identity. By requesting a user certificate from a certificate issuing authority, the video platform can provide users with formal identity authentication. This not only improves the security of user accounts, but also provides users with the necessary trust basis in subsequent encryption and decryption operations, ensuring the confidentiality and integrity of data.

[0095] In one embodiment, when registering a user name, the process of generating a user certificate further includes:

[0096] When there is a duplicate username, an error message is generated to indicate that the username already exists, and the error message is returned to the client.

[0097] Specifically, upon receiving a user's registration request, the video platform will first query the database to verify whether the entered username already exists. If a record matching the entered username is found in the database, it means that the username has been registered. If a duplicate username is found, the video platform will generate an error message, usually including a clear prompt such as "The username has been registered, please select another username." After generating the error message, the video platform will send the information back to the client through HTTP response and other means to inform the user of the reason for the registration failure.

[0098] In this embodiment, specific error information is generated and provided in a timely manner, and the error information is fed back to the client, so that the platform can ensure that the user knows exactly where the problem lies. This not only helps the user to complete the registration process smoothly, but also reduces the system burden caused by unnecessary repeated attempts, and improves the stability and response speed of the system.

[0099] In one embodiment, the step of determining the VKEK plaintext of the target video data includes:

[0100] Obtain the initial VKEK ciphertext of the target video data, where the initial VKEK ciphertext is encrypted using the platform encryption certificate;

[0101] Determine the key corresponding to the platform encryption certificate, and use the private key corresponding to the platform encryption certificate to decrypt the initial VKEK ciphertext to obtain the VKEK plaintext.

[0102] Among them, in the video platform, the initial VKEK ciphertext is the VKEK key encrypted by the platform encryption certificate. The platform encryption certificate is a digital certificate used by the video platform, usually issued by a certificate authority, containing the platform's public key and identity information, and is used to encrypt and decrypt data to ensure the security of data transmission.

[0103] Specifically, when a user requests to play specific video data, the video platform will retrieve the initial VKEK ciphertext associated with the video data from the database. The ciphertext is generated and stored when the video data is processed, ensuring that the key associated with the specific video is stored securely. The video platform will find and confirm the private key associated with the currently used encryption certificate. The confirmed private key is used to decrypt the initial VKEK ciphertext to obtain the VKEK plaintext.

[0104] In this embodiment, obtaining the initial VKEK ciphertext of the target video data ensures that the video platform can accurately retrieve the encryption key corresponding to the specific video data. By confirming the correct key, the video platform can ensure the security and effectiveness of the data decryption process and ensure that only authorized operations can access the key to prevent potential security risks and data leakage. The decryption operation converts the ciphertext into usable plaintext, so that the encryption and decryption of the video data can proceed smoothly.

[0105] To facilitate understanding of the solution of the present application, specific examples are provided below for illustration.

[0106] like Figure 2 As shown below, the process of creating a user certificate is as follows:

[0107] In the first step, when the platform creates a user, you need to fill in the username and password login information;

[0108] In the second step, the platform determines whether the username is unique. If the username is the same as an existing username on the platform, an exception error is returned;

[0109] In the third step, if the username uniqueness is verified, the platform calls the hardware cryptographic machine to generate a pair of public and private keys for the user information;

[0110] In the fourth step, the platform uses the user name as an identifier and the public key to generate a user certificate request file;

[0111] Step 5: The platform uses the user certificate request file to apply to the CA certificate system for issuing a user certificate;

[0112] Step 6: Complete the creation of a new user.

[0113] like Figure 3 As shown in the figure, the client obtains the user certificate process

[0114] The first step is that when the user logs in, he enters his username and password through the client and requests the platform to log in;

[0115] In the second step, the platform verifies the username and password. If the verification fails, an error message indicating that the login failed.

[0116] In the third step, if the username and password verification passes, the platform will generate a token for interface access and query the certificate system for the user certificate corresponding to the username;

[0117] Step 4: The platform returns the token and user certificate in PEM format;

[0118] Step 5: The client saves the Token and the user certificate in PEM format for subsequent playback services.

[0119] like Figure 4 The following is the business process of client accessing encrypted video:

[0120] In the first step, when the client requests to play the video data of the GB35114 protocol C-level front-end device, a one-time 128-bit SM4 symmetric key is generated and the symmetric key is encrypted using the user certificate obtained during login;

[0121] In the second step, the client carries the encrypted SM4 symmetric key to request the platform interface to obtain the VKEK information of the encrypted video data;

[0122] In the third step, the platform uses the private key corresponding to the user certificate in the hardware cryptographic machine to decrypt the encrypted symmetric key and obtain the plaintext SM4 symmetric key;

[0123] In the fourth step, the platform queries and obtains the VKEK information stored in accordance with security specifications, decrypts it using the corresponding private key in the hardware cipher machine, and then encrypts it using the SM4 symmetric key to obtain the encrypted VKEK data;

[0124] Step 5: The platform returns the encrypted VKEK data to the client;

[0125] Step 6: The client uses the symmetric key to decrypt the encrypted VKEK data and obtains the plaintext VKEK data. The client can then use VKEK to play the encrypted video data pushed by the GB35114 protocol C-level front-end device.

[0126] In the seventh step, the client destroys the used symmetric key and regenerates the SM4 symmetric key the next time it needs to obtain VKEK.

[0127] The encrypted video playback device provided by the embodiment of the present application is described below. The encrypted video playback device described below and the encrypted video playback method described above can be referred to in correspondence with each other. Figure 5 As shown, the present application provides an encrypted video playback device, which is applied to a video platform, and the device includes:

[0128] The encrypted SM4 symmetric key acquisition module 201 is used to respond to a playback request of a target video data of a user in a client, and obtain an encrypted SM4 symmetric key from the playback request, wherein the target video data is video data of level C of the GB35114-2017 protocol specification, and the encrypted SM4 symmetric key is obtained by encrypting a temporary SM4 symmetric key using a user certificate returned by the video platform when the user logs in by the client;

[0129] The encrypted SM4 symmetric key decryption module 202 is used to determine the user certificate corresponding to the play request, and use the private key of the user certificate to decrypt the encrypted SM4 symmetric key to obtain a temporary SM4 symmetric key;

[0130] A target VKEK ciphertext determination module 203 is used to determine the VKEK plaintext of the target video data and encrypt the VKEK plaintext using a temporary SM4 symmetric key to obtain a target VKEK ciphertext;

[0131] The target video data playback module 204 is used to return the target VKEK ciphertext to the client, so that the client uses the temporary SM4 symmetric key to decrypt the target VKEK ciphertext, plays the target video data, and destroys the temporary SM4 symmetric key.

[0132] In one embodiment, the encrypted SM4 symmetric key decryption module 202 includes:

[0133] An identity token acquisition unit, used to acquire an identity token from a playback request;

[0134] The user certificate acquisition unit is used to verify the identity token and obtain the user certificate corresponding to the identity token when the identity token passes the verification.

[0135] In one embodiment, the encrypted SM4 symmetric key acquisition module 201 includes:

[0136] A user name acquisition unit, used to respond to a login request from a user in a client and acquire a user name and a password in the login request;

[0137] A user certificate query unit is used to verify the user name and password. When the user name and password are verified, an identity token of the user name is generated and the user certificate generated when the user name is registered is queried;

[0138] The user certificate returning unit is used to return the identity token and user certificate to the client.

[0139] In one embodiment, the encrypted SM4 symmetric key acquisition module 201 further includes:

[0140] The login failure information returning unit is used to generate login failure information if the user name or the password of the user name fails to pass the verification, and return the login failure information to the client.

[0141] In one embodiment, the user certificate query unit includes:

[0142] An account creation request response subunit, used to respond to an account creation request from a user in a client and obtain a user name and password in the account creation request;

[0143] A public-private key pair generation subunit, used to generate a public-private key pair for a user name when there is no duplicate user name;

[0144] The certificate request file generation subunit is used to use the user name as an identifier and use the public key of the user name to generate a certificate request file;

[0145] The user certificate acquisition subunit is used to use the certificate request file to request the certificate issuing authority to issue a user certificate and obtain the user certificate of the user name.

[0146] In one embodiment, the user certificate query unit further includes:

[0147] The error information returning subunit is used to generate an error message for prompting that the username already exists when there is a duplicate username, and return the error message to the client.

[0148] In one embodiment, the target VKEK ciphertext determination module 203 includes:

[0149] An initial VKEK ciphertext obtaining unit, used to obtain an initial VKEK ciphertext of target video data, where the initial VKEK ciphertext is encrypted using a platform encryption certificate;

[0150] The VKEK plaintext acquisition unit is used to determine the private key corresponding to the platform encryption certificate, and use the key corresponding to the platform encryption certificate to decrypt the initial VKEK ciphertext to obtain the VKEK plaintext.

[0151] In one embodiment, the present application also provides a storage medium, in which computer-readable instructions are stored. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the encrypted video playback method as described in any of the above embodiments.

[0152] In one embodiment, the present application also provides a computer device having computer-readable instructions stored therein. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the encrypted video playback method as described in any one of the above embodiments.

[0153] Indicatively, Figure 6 As shown, Figure 6 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. The computer device 300 may be provided as a server. Figure 6 The computer device 300 includes a processing component 302, which further includes one or more processors, and a memory resource represented by a memory 301 for storing instructions executable by the processing component 302, such as an application. The application stored in the memory 301 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 302 is configured to execute instructions to perform the encrypted video playback method of any of the above embodiments.

[0154] The computer device 300 may further include a power supply component 303 configured to perform power management of the computer device 300, a wired or wireless network interface 304 configured to connect the computer device 300 to a network, and an input / output (I / O) interface 305. The computer device 300 may operate based on an operating system stored in the memory 301, such as Windows Server TM, Mac OS X TM, Unix TM, Linux TM, Free BSD TM, or the like.

[0155] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0156] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the term "include", "comprise" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements not only includes those elements, but also includes other elements not clearly listed, or also includes elements inherent to such process, method, article or equipment. In the absence of more restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or equipment including the elements. Herein, "one", "one", "said", "the" and "it" may also include plural forms, unless the context clearly indicates another way. A plurality refers to at least two cases, such as 2, 3, 5 or 8, etc. "And / or" includes any and all combinations of the relevant listed items.

[0157] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can refer to each other.

[0158] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for playing encrypted video, characterized in that: Applied to a video platform, the method comprises: In response to a request for playing target video data of a user in a client, an encrypted SM4 symmetric key is obtained from the play request, wherein the target video data is video data of level C of the GB35114-2017 protocol specification, and the encrypted SM4 symmetric key is obtained by encrypting a temporary SM4 symmetric key using a user certificate returned by the video platform when the user logs in by the client; Determine the user certificate corresponding to the play request, and use the private key of the user certificate to decrypt the encrypted SM4 symmetric key to obtain the temporary SM4 symmetric key; Determine the VKEK plaintext of the target video data, and encrypt the VKEK plaintext using the temporary SM4 symmetric key to obtain the target VKEK ciphertext; The target VKEK ciphertext is returned to the client, so that the client uses the temporary SM4 symmetric key to decrypt the target VKEK ciphertext, plays the target video data, and destroys the temporary SM4 symmetric key.

2. The encrypted video playback method according to claim 1, characterized in that: The step of determining the user certificate corresponding to the playback request comprises: Obtaining an identity token from the play request; The identity token is verified, and when the identity token passes the verification, a user certificate corresponding to the identity token is obtained.

3. The encrypted video playback method according to claim 2, characterized in that: The process of returning the user certificate when the user logs in includes: In response to a login request from the user in the client, obtaining a user name and a password in the login request; Verify the user name and password. When both the user name and password are verified, generate an identity token for the user name and query the user certificate generated when the user name is registered; The identity token and the user credentials are returned to the client.

4. The encrypted video playback method according to claim 3, characterized in that: The process of returning the user certificate further includes: If the user name or the password of the user name fails to pass the verification, a login failure message is generated and the login failure message is returned to the client.

5. The encrypted video playback method according to claim 3, characterized in that: When the user name is registered, the process of generating the user certificate includes: In response to an account creation request from the user in the client, obtaining a user name and a password in the account creation request; When there is no duplicate username, generate a public-private key pair for the username; Using the user name as an identifier, and using the public key of the user name to generate a certificate request file; The certificate request file is used to request a certificate issuing authority to issue a user certificate, and a user certificate for the user name is obtained.

6. The encrypted video playback method according to claim 5, characterized in that: When the user name is registered, the process of generating the user certificate also includes: When there is a duplicate username, an error message is generated to prompt that the username already exists, and the error message is returned to the client.

7. The encrypted video playback method according to any one of claims 1 to 6, characterized in that: The step of determining the VKEK plaintext of the target video data comprises: Obtaining an initial VKEK ciphertext of the target video data, where the initial VKEK ciphertext is encrypted using a platform encryption certificate; Determine the key corresponding to the platform encryption certificate, and use the private key corresponding to the platform encryption certificate to decrypt the initial VKEK ciphertext to obtain the VKEK plaintext.

8. An encrypted video playback device, characterized in that: Applied to a video platform, the device comprises: An encrypted SM4 symmetric key acquisition module is used to respond to a playback request of a target video data of a user in a client, and to obtain an encrypted SM4 symmetric key from the playback request, wherein the target video data is video data of level C of the GB35114-2017 protocol specification, and the encrypted SM4 symmetric key is obtained by encrypting a temporary SM4 symmetric key using a user certificate returned by the video platform when the user logs in by the client; An encrypted SM4 symmetric key decryption module, used to determine the user certificate corresponding to the play request, and use the private key of the user certificate to decrypt the encrypted SM4 symmetric key to obtain the temporary SM4 symmetric key; A target VKEK ciphertext determination module, used to determine the VKEK plaintext of the target video data, and encrypt the VKEK plaintext using the temporary SM4 symmetric key to obtain a target VKEK ciphertext; The target video data playback module is used to return the target VKEK ciphertext to the client, so that the client uses the temporary SM4 symmetric key to decrypt the target VKEK ciphertext, plays the target video data, and destroys the temporary SM4 symmetric key.

9. A storage medium, characterized in that: The storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the encrypted video playback method as described in any one of claims 1 to 7.

10. A computer device, characterized in that: include: one or more processors, and memory; The memory stores computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the steps of the encrypted video playback method according to any one of claims 1 to 7 are performed.

Images