Method, device, storage medium and computer device for playing encrypted video

Abstract

In the encrypted video playback method, apparatus, storage medium, and computer device provided in this application, in response to a playback request of target video data from a user in a client, an encrypted SM4 symmetric key is obtained from the playback request; the user certificate corresponding to the playback request is determined, and the encrypted SM4 symmetric key is decrypted using the private key of the user certificate to obtain a temporary SM4 symmetric key; the VKEK plaintext of the target video data is determined, and the VKEK plaintext is encrypted using the temporary SM4 symmetric key to obtain the target VKEK ciphertext; the target VKEK ciphertext is returned to the client, so that the client uses the temporary SM4 symmetric key to decrypt the target VKEK ciphertext, plays the target video data, and destroys the temporary SM4 symmetric key. In this way, multiple clients can play video data that complies with the GB35114-2017 protocol specification Level C without relying on USB-Key hardware devices.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of video monitoring, and in particular to an encrypted video playing method and device, a storage medium and a computer device. BACKGROUND

[0002] In the application of the national standard GB35117-2017 protocol, when a user accesses real-time video or historical video of a C-level front-end security device or a C-level front-end security device of a subordinate platform of a video platform, the video data is encrypted. The video data is protected by symmetric encryption using VEK, and the VEK is protected by stack encryption using VKEK (Video Key Encryption Key). The VKEK is generated by the video platform and protected by asymmetric encryption and stored. In the process of transmitting the VKEK between the platform and the client, the VKEK needs to be encrypted using the user certificate and then transmitted. When the user uses the VKEK, the VKEK needs to be decrypted using the USB-Key device.

[0003] However, for client users using Android system, iOS system, MacOS system, HarmonyOS system, and Galaxy Kirin system, due to system or physical interface problems, or AI algorithm calculation of encrypted video, the decryption of VKEK cannot be completed by connecting and calling the USBKey, and therefore the video data conforming to the C-level of GB35114-2017 protocol cannot be played. SUMMARY

[0004] The purpose of the present application is to at least solve one of the above technical defects, in particular the technical defect that the client cannot play video data conforming to the C-level of GB35114-2017 protocol in the prior art.

[0005] In a first aspect, the present application provides an encrypted video playing method applied to a video platform, comprising:

[0006] In response to a playing request of target video data of a user in a client, an encrypted SM4 symmetric key is obtained from the playing request, the target video data being video data conforming to the C-level of GB35114-2017 protocol, and the encrypted SM4 symmetric key being obtained by encrypting a temporary SM4 symmetric key using a user certificate returned by the video platform when the client logs in;

[0007] A user certificate corresponding to the playing request is determined, and the encrypted SM4 symmetric key is decrypted using a private key of the user certificate to obtain the temporary SM4 symmetric key;

[0008] Determine the VKEK plaintext of the target video data, and encrypt the VKEK plaintext by using the temporary SM4 symmetric key to obtain the target VKEK ciphertext;

[0009] Return the target VKEK ciphertext to the client, so that the client decrypts the target VKEK ciphertext by using the temporary SM4 symmetric key, plays the target video data, and destroys the temporary SM4 symmetric key.

[0010] In one of the embodiments, the step of determining the user certificate corresponding to the playing request comprises:

[0011] Obtain the identity token from the playing request;

[0012] Verify the identity token, and when the identity token is verified, obtain the user certificate corresponding to the identity token.

[0013] In one of the embodiments, the process of returning the user certificate when the user logs in comprises:

[0014] In response to the login request of the user in the client, obtain the username and the password in the login request;

[0015] Verify the username and the password, and when the username and the password are both verified, generate the identity token of the username, and query the user certificate generated when the username is registered;

[0016] Return the identity token and the user certificate to the client.

[0017] In one of the embodiments, the process of returning the user certificate further comprises:

[0018] If the username or the password of the username is not verified, generate a login failure information, and return the login failure information to the client.

[0019] In one of the embodiments, the process of generating the user certificate when the username is registered comprises:

[0020] In response to the account creation request of the user in the client, obtain the username and the password in the account creation request;

[0021] When there is no duplicate username, generate the public-private key pair of the username;

[0022] Use the public key of the username to generate a certificate request file by taking the username as an identifier;

[0023] Use the certificate request file to request the certificate issuing authority to issue the user certificate, and obtain the user certificate of the username.

[0024] In one of the embodiments, the process of generating the user certificate when the username is registered further comprises:

[0025] When the username exists the duplicate username, error information for prompting that the username exists is generated, and the error information is returned to the client.

[0026] In one of the embodiments, the step of determining the VKEK plaintext of the target video data comprises:

[0027] The initial VKEK ciphertext of the target video data is encrypted by using the platform encryption certificate;

[0028] The private key corresponding to the platform encryption certificate is determined, and the initial VKEK ciphertext is decrypted by using the private key corresponding to the platform encryption certificate to obtain the VKEK plaintext.

[0029] In a second aspect, the application provides an encrypted video playing device, applied to a video platform, the device comprising:

[0030] The encrypted SM4 symmetric key obtaining module is configured to obtain the encrypted SM4 symmetric key from the playing request in response to the playing request of the target video data of the user in the client, the target video data being the video data of the C level of the GB35114-2017 protocol specification, and the encrypted SM4 symmetric key being obtained by encrypting the temporary SM4 symmetric key by using the user certificate returned by the video platform when the user logs in the client;

[0031] The encrypted SM4 symmetric key decryption module is configured to determine the user certificate corresponding to the playing request, and decrypt the encrypted SM4 symmetric key by using the private key of the user certificate to obtain the temporary SM4 symmetric key;

[0032] The target VKEK ciphertext determination module is configured to determine the VKEK plaintext of the target video data, and encrypt the VKEK plaintext by using the temporary SM4 symmetric key to obtain the target VKEK ciphertext;

[0033] The target video data playing module is configured to return the target VKEK ciphertext to the client, so that the client plays the target video data after decrypting the target VKEK ciphertext by using the temporary SM4 symmetric key, and destroys the temporary SM4 symmetric key.

[0034] In a third aspect, the application provides a storage medium: the storage medium stores computer readable instructions, and the computer readable instructions are executed by one or more processors to make the one or more processors execute the steps of the encrypted video playing method in any of the above embodiments.

[0035] In a fourth aspect, the application provides a computer device, comprising: one or more processors, and a memory;

[0036] The computer readable instructions stored in the memory are executed by one or more processors to perform the steps of the encrypted video playing method of any one of the above embodiments.

[0037] From the above technical solutions, the embodiments of the present application have the following advantages:

[0038] In the encrypted video playing method, device, storage medium and computer device provided by the present application, in the playing request stage, the temporary SM4 symmetric key is generated by user certificate encryption and securely transmitted to the video platform, realizing a more secure key delivery mode; the encrypted SM4 symmetric key is decrypted by the private key of the user certificate, so that the decryption process of the key is more flexible and efficient, and no longer depends on hardware devices such as USB-Key. For systems that do not support USB-Key, the private key decryption process of the user certificate solves the cross-platform compatibility problem, and also ensures that only legitimate users can access the key, enhancing the security of data access; by converting the VKEK plaintext into target VKEK ciphertext, the risk of directly exposing the VKEK plaintext in the transmission link is avoided, ensuring the encrypted delivery of the key; the client decrypts the target VKEK ciphertext to play video data, and destroys the temporary SM4 symmetric key after decryption, which helps to reduce the key exposure time and improve the security of key use. At the same time, the dynamic generation of the temporary SM4 symmetric key and its destruction after use improve the security and flexibility of key management. Based on this, the method eliminates the dependence on USB-Key hardware through the private key decryption mechanism of the user certificate, so that the client of the Android, iOS, MacOS, HarmonyOS, Kirin Galaxy, etc. system can also decrypt and play C-level encrypted video data conforming to the GB35114-2017 protocol without access to the USB-Key, expanding the compatibility range of video access. At the same time, the temporary SM4 symmetric key generated when the user logs in is protected by the user certificate during transmission and decryption, without the need for additional physical interfaces, greatly improving the security and user convenience. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0040] Figure 1 The flowchart of the encrypted video playing method provided by the embodiments of the present application is shown in the figure.

[0041] Figure 2One of the example diagrams of the encrypted video playing method provided by the embodiments of the present application;

[0042] Figure 3 The second example diagram of the encrypted video playing method provided by the embodiments of the present application;

[0043] Figure 4 The third example diagram of the encrypted video playing method provided by the embodiments of the present application;

[0044] Figure 5 The structural schematic diagram of the encrypted video playing device provided by the embodiments of the present application;

[0045] Figure 6 The internal structural schematic diagram of the computer device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0046] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0047] The present application provides an encrypted video playing method. The following embodiments take the application of the method to a video platform as an example for illustration. It can be understood that the video platform can be various devices with data processing functions, which can be but not limited to a single server and a server cluster, etc. As shown in the figure, the method can include the following steps: Figure 1

[0048] S101: In response to the playing request of the target video data of the user in the client, an encrypted SM4 symmetric key is obtained from the playing request.

[0049] Among them, the target video data is the video data of GB35114-2017 protocol specification C level, and the encrypted SM4 symmetric key is obtained by encrypting the temporary SM4 symmetric key with the user certificate returned by the video platform when the user logs in the client.

[0050] ​The play request is a request sent by the client to access and play the target video data. The target video data is the video content requested by the user to play, which complies with the C-level encryption standard of GB35114-2017 protocol. GB35114-2017 protocol is a national standard for data protection of secure video surveillance systems, which defines different encryption levels of video data to ensure the confidentiality and integrity of data during transmission and storage. SM4 symmetric key is a symmetric encryption key based on SM4 cryptographic algorithm. SM4 is used to encrypt data in video content and key transmission to ensure the security of data during transmission. The encrypted SM4 symmetric key means that the SM4 key itself has been further encrypted for protection. The key is generated by the video platform when the user logs in and encrypted by the user certificate to avoid interception or tampering during transmission. The user certificate is a digital certificate containing a pair of public and private keys of the user, used for identity authentication and data encryption and decryption. The user certificate ensures that the video data can only be decrypted and played on a legal client device.

[0051] In this step, after receiving the play request, the video platform verifies whether the user has the right to access the video data according to the user identity authentication information and authority in the request. If the authorization is passed, the platform will query the SM4 symmetric key generated and encrypted when the user logs in. When the user initiates the play request, the client generates a temporary SM4 symmetric key for the user, encrypts the key using the public key of the user certificate, and then sends the encrypted key to the video platform. The temporary SM4 symmetric key is a 124-bit one-time SM4 symmetric key generated temporarily when the user initiates the play request.

[0052] It can be understood that in the process of securely transmitting video content, directly transmitting the plaintext key may cause the risk of being maliciously intercepted or tampered by a third party. Therefore, the client encrypts the SM4 key through the user certificate, so that only the video platform and the client with the private key of the legal user certificate can decrypt and use the key, thereby avoiding the risk of key leakage. This way ensures that the user can only access the video data when he has an authorized device, meeting the C-level data protection requirements of GB35114-2017 protocol.

[0053] The dynamic generation and encryption management of the temporary SM4 symmetric key simplify the key management process, and the client can complete the temporary generation and encryption of the key when the user initiates the play request, avoiding the security risks caused by the long-term residence of the key in the platform or the client.

[0054] S102: Determine the user certificate corresponding to the play request, and decrypt the encrypted SM4 symmetric key using the private key of the user certificate to obtain the temporary SM4 symmetric key.

[0055] The private key is a key securely stored in the hardware cryptographic machine or cryptographic card of the platform, corresponding to the user certificate one-to-one, and is used to decrypt the encrypted data related to the user identity.

[0056] In this step, when the video platform receives a playback request, it first checks the user identity information contained in the request and searches for the corresponding user certificate record in the database of the video platform. The video platform confirms the authorization certificate of the requesting user according to the user login status, certificate storage, and other conditions to ensure that the request comes from a valid and legitimate user. After the video platform retrieves the user certificate, the encrypted SM4 symmetric key is decrypted to generate a temporary SM4 key.

[0057] It can be understood that determining the user certificate corresponding to the playback request ensures that the playback request comes from a legitimate user with valid authorization. By verifying the user certificate, the video platform can effectively prevent unauthorized requests and ensure that only the correct user can access specific video data, thereby reducing the possibility of illegal access and meeting the requirements of security protocols. By decrypting the encrypted SM4 key using the private key, the security of the encryption key is ensured, and even if it is intercepted during transmission, it cannot be decrypted, thereby preventing key leakage.

[0058] S103: Determine the VKEK plaintext of the target video data, and encrypt the VKEK plaintext using the temporary SM4 symmetric key to obtain the target VKEK ciphertext.

[0059] The VKEK plaintext is the plaintext version of the main key used to encrypt the target video data. VKEK is the core key for encrypting video content and can symmetrically encrypt video data for protection. The target VKEK ciphertext is the VKEK encrypted by the video platform using the temporary SM4 symmetric key, which contains the key information required to decrypt the target video data and is protected by double-layer encryption to ensure its safety during transmission.

[0060] In this step, the video platform first retrieves the corresponding VKEK plaintext according to the video data ID requested by the user. After obtaining the VKEK plaintext, it is encrypted using the temporary SM4 symmetric key.

[0061] It can be understood that using the temporary SM4 symmetric key to encrypt the VKEK plaintext provides a basis for double-layer encryption. This process ensures that the VKEK plaintext remains encrypted during transmission and cannot be decrypted even if it is intercepted. Because the VKEK ciphertext can only be decrypted by the client holding the temporary SM4 key, this greatly enhances the security of transmission. In addition, the dynamic protection mechanism of VKEK improves the confidentiality of the key and the security of transmission, reducing the risk of long-term storage and transmission, thereby more effectively protecting video content and user privacy.

[0062] S104: Return the target VKEK ciphertext to the client, so that the client decrypts the target VKEK ciphertext with the temporary SM4 symmetric key, plays the target video data, and destroys the temporary SM4 symmetric key.

[0063] In this step, the video platform sends the target VKEK ciphertext back to the client after encrypting the VKEK plaintext, so that the client continues the playback process. During data transmission, the video platform performs identity verification and integrity check on the target VKEK ciphertext to ensure that the ciphertext has not been tampered with and is only transmitted to authorized clients. The client receives the encrypted VKEK ciphertext from the video platform, then uses the temporary SM4 symmetric key obtained in the session to decrypt the VKEK ciphertext and obtain the VKEK plaintext. After obtaining the VKEK plaintext, the key is used to decrypt and play the target video data. After playback is complete, the temporary SM4 symmetric key is deleted to prevent its improper use or leakage, enhancing the security of video data.

[0064] It can be understood that the secure transmission of the target VKEK ciphertext to the client ensures that the VKEK will not be intercepted or tampered with during transmission, avoiding the dependence on the USB-Key hardware device, allowing multi-platform clients such as Android, iOS, MacOS, HarmonyOS, and Kirin Galaxy to successfully decrypt videos even if they cannot connect to the USB-Key, significantly improving the compatibility and user experience of the video platform. The client destroys the temporary SM4 key after being able to play the target video, which helps to reduce the risk of long-term storage of sensitive keys. This key life cycle management mechanism enhances the security and confidentiality of data transmission and reduces the possibility of key leakage, effectively protecting user privacy and the security of video data.

[0065] In the above embodiment, in the playing request stage, the temporary SM4 symmetric key is generated by user certificate encryption and securely transmitted to the video platform, realizing a more secure key delivery method; the encrypted SM4 symmetric key is decrypted by the private key of the user certificate, making the decryption process of the key more flexible and efficient, and no longer relying on hardware devices such as USB-Key. For systems that do not support USB-Key, the private key decryption process of the user certificate solves the cross-platform compatibility problem, and also ensures that only legitimate users can access the key, enhancing the security of data access; by converting the VKEK plaintext into target VKEK ciphertext, the risk of exposing the VKEK plaintext directly in the transmission link is avoided, ensuring the encrypted delivery of the key; the client decrypts the target VKEK ciphertext to play video data, and destroys the temporary SM4 symmetric key after decryption, which helps to reduce the key exposure time and improve the security of key use. At the same time, the dynamic generation and use-after-destruction of the temporary SM4 symmetric key improves the security and flexibility of key management. Based on this, through the private key decryption mechanism of the user certificate, the method eliminates the dependence on USB-Key hardware, so that the clients of Android, iOS, MacOS, HarmonyOS, and Kirin Galaxy systems can also decrypt and play C-level encrypted video data conforming to the GB35114-2017 protocol without accessing USB-Key, expanding the compatibility range of video access. At the same time, the temporary SM4 symmetric key generated when the user logs in is protected by the user certificate during transmission and decryption, without the need for additional physical interfaces, greatly improving security and user convenience.

[0066] In one embodiment, the step of determining the user certificate corresponding to the playing request comprises:

[0067] Obtaining an identity token from the playing request;

[0068] Verifying the identity token, and when the identity token verification passes, obtaining the user certificate corresponding to the identity token.

[0069] The identity token is a kind of security credential for identity verification, which is usually generated by the video platform after the user successfully logs in. The identity token contains user identity information and access rights, which is used to verify the legitimacy of the user in subsequent requests.

[0070] Specifically, upon receiving a playback request, the video platform first parses the request content to extract the identity token. The identity token is usually attached in the request header or the request body as part of the request. The video platform verifies the extracted identity token, checking its validity and integrity. For example, the identity token can be decrypted to confirm its signature, check the token's expiration time, and compare it with the record on the server. Once the identity token passes the verification, the video platform retrieves the corresponding user certificate from the database or key management system based on the user information, such as the user ID, in the identity token.

[0071] In this embodiment, extracting the identity token from the playback request is the first step to ensure user identity, ensuring that the video platform can track the request of a specific user and process it accordingly, thereby laying the foundation for secure access to video data. Verifying the identity token is a core step to ensure secure access. Through verification, it can effectively prevent fake or expired tokens from being used for improper access, enhancing the security of the system. At the same time, this process can also prevent unauthorized users from accessing sensitive video content, in line with the platform's security policy.

[0072] Retrieving the user certificate based on the valid identity token ensures that subsequent operations can be carried out under secure conditions. The user certificate not only serves the subsequent decryption process but also provides user authentication, ensuring that only authorized users can access specific video content. This mechanism enhances user experience and safeguards user data and video content security, in line with relevant security protocols and standards.

[0073] In one embodiment, the process of returning the user certificate when the user logs in includes:

[0074] In response to the user's login request in the client, the username and its password in the login request are obtained;

[0075] The username and its password are checked, and when both the username and its password pass the check, the identity token of the username is generated, and the user certificate generated when the username is registered is queried;

[0076] The identity token and the user certificate are returned to the client.

[0077] Specifically, upon receiving a login request, the video platform first parses the request content to obtain the username and password. The video platform uses user information in the database, such as registered usernames and password hashes, to verify the username and password in the login request. If the username exists and the password matches, the verification passes. For example, the input password can be hashed using a secure hash algorithm and compared with the hash value stored in the database.

[0078] Once the verification is successful, the video platform generates an identity token for the user, typically containing the user's unique identifier, generation time, and expiration time. At the same time, the video platform queries the user's certificate generated during user registration based on the username. Finally, the video platform sends the generated identity token and the queried user certificate back to the client through a response message.

[0079] In this embodiment, verifying the username and password is a key step in authenticating the user's identity. This process prevents unauthorized access and ensures that only the correct user can log in, protecting user data and platform security. The generation of an identity token provides a secure credential for subsequent user operations, allowing the user to avoid re-entering the username and password in multiple requests, improving user experience. In addition, the expiration period of the identity token can enhance security, preventing potential risks caused by long-term use.

[0080] Immediately after the user logs in, the user certificate is queried and returned, ensuring that the user has the necessary permissions and identity verification in subsequent encryption and decryption operations. This further improves the security of data transmission and user experience, ensuring that users can smoothly access their authorized content.

[0081] Returning the identity token and user certificate to the client ensures smooth subsequent operations. This design not only simplifies the user's interaction process but also enhances the security of the entire system, reducing potential security risks caused by multiple inputs of sensitive information.

[0082] In one embodiment, the process of returning the user certificate also includes:

[0083] If the username or password does not pass the verification, a login failure information is generated and returned to the client.

[0084] The login failure information is feedback information generated when the user inputs an incorrect username or password during the login process. This information typically contains a description of the error type, such as "username does not exist" or "password error," so that the user can understand the reason for the login failure.

[0085] Specifically, during the verification of the username and password, if it is found that the username does not exist or the input password does not match the stored hash value, the video platform will create a login failure information. After generating the login failure information, the video platform will send the information back to the client through HTTP response or other methods.

[0086] In this embodiment, if the verification fails during the user login process, it is crucial to generate and provide detailed failure information in a timely manner for user experience. The operation of returning the login failure information to the client ensures that the user can obtain timely feedback during the login process, avoids repeated attempts by the user due to incorrect input, and effectively prevents brute force attacks that may be caused by malicious login attempts.

[0087] In one embodiment, when a user name is registered, the process of generating a user certificate includes:

[0088] In response to a user account creation request in the client, the username and its password in the account creation request are obtained;

[0089] When the username does not exist, a public-private key pair of the username is generated;

[0090] The username is used as an identifier, and the public key of the username is used to generate a certificate request file;

[0091] Using the certificate request file, a user certificate is requested from a certificate issuing authority, and the user certificate of the username is obtained.

[0092] The account creation request is a request sent by the client to the video platform for creating a new user account. The request contains the username and password that the user wants to register, and other necessary information. The public-private key pair is a key pair generated by an asymmetric encryption algorithm, where the public key is used to encrypt data and the private key is used to decrypt data. The certificate request file is a file containing user identity information and public key, usually used to apply for digital certificate, and the file is used when requesting a certificate from a certificate issuing authority. The certificate issuing authority is a trusted third-party entity responsible for verifying user identity and issuing digital certificates to ensure the legality and security of the certificate.

[0093] Specifically, when the video platform receives the account creation request from the client, it first parses the request content and extracts the username and password in the request. Query the database to check if the username has been registered. If the username does not exist, the video platform will generate a public-private key pair using a cryptography library, and use the generated public key and username to create a certificate request file containing user identity information and public key. The video platform sends the certificate request file to the certificate issuing authority to apply for a user certificate. After authentication, the authority will return a user certificate containing the public key and user identity information.

[0094] In this embodiment, ensuring the uniqueness of the username is crucial for maintaining system data integrity and user experience. By preventing duplicate usernames, the video platform can avoid user confusion and identity conflicts, ensuring that each user has a unique identifier. Generating a public-private key pair is the foundation for providing secure communication and data protection for users. The public key can be used for encryption, while the private key is used for decryption, enhancing the security of the data. Creating a certificate request file is a necessary step in applying for a user certificate from a certificate authority, ensuring the smooth progress of subsequent processes. This file provides a secure authentication credential for the user, ensuring the authenticity of the user's identity. By requesting a user certificate from a certificate authority, the video platform can provide formal identity authentication for users. This not only improves the security of user accounts, but also provides a necessary trust foundation for users in subsequent encryption and decryption operations, ensuring the confidentiality and integrity of data.

[0095] In one embodiment, when the username is registered, the process of generating the user certificate further includes:

[0096] When there is a duplicate username, an error message prompting that the username already exists is generated, and the error message is returned to the client.

[0097] Specifically, after receiving the user's registration request, the video platform will first query the database to verify whether the input username already exists. If a record matching the input username is found in the database, it indicates that the username has been registered. If a duplicate username is found, the video platform will generate an error message, usually including a clear prompt such as "This username has been registered, please choose another username". After generating the error message, the video platform will send the message back to the client through HTTP response or other means, informing the user of the reason for the failed registration.

[0098] In this embodiment, specific error messages are generated and provided in a timely manner, and the error messages are fed back to the client, so that the platform can ensure that the user knows exactly where the problem is. This not only helps users complete the registration process smoothly, but also reduces the system burden caused by unnecessary repeated attempts, improving the stability and response speed of the system.

[0099] In one embodiment, the step of determining the VKEK plaintext of the target video data includes:

[0100] Obtaining the initial VKEK ciphertext of the target video data, the initial VKEK ciphertext being encrypted using the platform encryption certificate;

[0101] Determining the key corresponding to the platform encryption certificate, and decrypting the initial VKEK ciphertext using the private key corresponding to the platform encryption certificate to obtain the VKEK plaintext.

[0102] Wherein, in the video platform, the initial VKEK ciphertext is the VKEK key encrypted by the platform encryption certificate. The platform encryption certificate is a digital certificate used by the video platform, usually issued by a certificate authority, containing the public key and identity information of the platform, used for encrypting and decrypting data to ensure the security of data transmission.

[0103] Specifically, when a user requests to play a specific video data, the video platform will retrieve the initial VKEK ciphertext related to the video data from the database, which is generated and stored during the processing of the video data, ensuring the secure storage of the key related to the specific video. The video platform will find and confirm the private key associated with the currently used encryption certificate. The confirmed private key is used to decrypt the initial VKEK ciphertext to obtain the VKEK plaintext.

[0104] In this embodiment, obtaining the initial VKEK ciphertext of the target video data ensures that the video platform can accurately retrieve the encryption key corresponding to the specific video data. By confirming the correct key, the video platform can ensure the security and effectiveness of the data decryption process, and ensure that only authorized operations can access the key, preventing potential security risks and data leakage. The decryption operation converts the ciphertext into plaintext that can be used, enabling smooth encryption and decryption of video data.

[0105] To facilitate understanding of the scheme of the present application, specific examples are provided below for illustration.

[0106] As shown in Figure 2 , the process for creating a user certificate is as follows:

[0107] Step 1: When creating a user, the platform needs to fill in the username and password information;

[0108] Step 2: The platform determines whether the username is unique. If the username is duplicated with the platform's existing username, an exception error is returned;

[0109] Step 3: If the username uniqueness check is passed, the platform calls the hardware password machine to generate a pair of public and private keys for the user information;

[0110] Step 4: The platform uses the public key to generate a user certificate request file using the username as an identifier;

[0111] Step 5: The platform uses the user certificate request file to apply for issuing a user certificate to the CA certificate system;

[0112] Step 6: Complete the creation of a new user.

[0113] As shown in Figure 3 , the process for the client to obtain the user certificate is as follows

[0114] The first step, when the user logs in, the client inputs the username and password, and requests the platform to log in;

[0115] The second step, the platform checks the username and password, if the check is not passed, return the error information of login failure;

[0116] The third step, if the username and password check is passed, the platform will generate Token for interface access, and query the user certificate corresponding to the username to the certificate system;

[0117] The fourth step, the platform returns Token and PEM format user certificate;

[0118] The fifth step, the client saves Token and PEM format user certificate, which is used for subsequent play business.

[0119] As shown in Figure 4 , the business process of client accessing encrypted video

[0120] The first step, when the client requests to play GB35114 protocol C level front-end device video data, a one-time 128-bit SM4 symmetric key is generated, and the user certificate obtained during login is used to encrypt the symmetric key;

[0121] The second step, the client carries the encrypted SM4 symmetric key to request the platform interface to obtain the VKEK information of encrypted video data;

[0122] The third step, the platform uses the private key corresponding to the user certificate in the hardware cryptographic machine to decrypt the encrypted symmetric key, and obtains the plaintext SM4 symmetric key;

[0123] The fourth step, the platform queries and obtains the VKEK information saved in accordance with the security specification, and uses the corresponding private key in the hardware cryptographic machine to decrypt, and then uses the SM4 symmetric key to encrypt, to obtain the encrypted VKEK data;

[0124] The fifth step, the platform returns the encrypted VKEK data to the client;

[0125] The sixth step, the client uses the symmetric key to decrypt the encrypted VKEK data to obtain the plaintext VKEK data, and the client can use the VKEK to play the encrypted video data pushed by the GB35114 protocol C level front-end device;

[0126] The seventh step, the client destroys the used symmetric key, and generates a new SM4 symmetric key when the VKEK is needed next time.

[0127] The encrypted video playing device provided by the embodiments of the present application is described below, and the encrypted video playing device described below can be correspondingly referred to the encrypted video playing method described above. As shown in Figure 5 The present application provides an encrypted video playing device, applied to a video platform, the device comprising:

[0128] The encrypted SM4 symmetric key obtaining module 201 is configured to obtain an encrypted SM4 symmetric key from the playing request in response to a playing request of target video data of a user in a client, the target video data being video data of C level of GB35114-2017 protocol specification, and the encrypted SM4 symmetric key being obtained by encrypting a temporary SM4 symmetric key with a user certificate returned by the video platform when the user logs in the client;

[0129] The encrypted SM4 symmetric key decryption module 202 is configured to determine the user certificate corresponding to the playing request, and decrypt the encrypted SM4 symmetric key with a private key of the user certificate to obtain the temporary SM4 symmetric key;

[0130] The target VKEK ciphertext determining module 203 is configured to determine the VKEK plaintext of the target video data, and encrypt the VKEK plaintext with the temporary SM4 symmetric key to obtain the target VKEK ciphertext;

[0131] The target video data playing module 204 is configured to return the target VKEK ciphertext to the client, so that the client decrypts the target VKEK ciphertext with the temporary SM4 symmetric key to play the target video data, and destroys the temporary SM4 symmetric key.

[0132] In one embodiment, the encrypted SM4 symmetric key decryption module 202 comprises:

[0133] The identity token obtaining unit is configured to obtain the identity token from the playing request;

[0134] The user certificate obtaining unit is configured to check the identity token, and obtain the user certificate corresponding to the identity token when the identity token passes the check.

[0135] In one embodiment, the encrypted SM4 symmetric key obtaining module 201 comprises:

[0136] The username obtaining unit is configured to obtain the username and its password in the login request in response to a login request of a user in a client;

[0137] The user certificate querying unit is configured to check the username and its password, generate the identity token of the username when the username and its password both pass the check, and query the user certificate generated when the username is registered;

[0138] The user certificate returning unit is configured to return the identity token and the user certificate to the client.

[0139] In one embodiment, the encrypted SM4 symmetric key obtaining module 201 further comprises:

[0140] The login failure information returning unit is configured to generate login failure information if the username or the password of the username fails to pass the verification, and return the login failure information to the client.

[0141] In one embodiment, the user certificate querying unit comprises:

[0142] The account creation request response sub-unit is configured to obtain a username and a password in an account creation request in response to an account creation request of a user in the client.

[0143] The public-private key pair generating sub-unit is configured to generate a public-private key pair of the username when the username does not exist.

[0144] The certificate request file generating sub-unit is configured to generate a certificate request file using a public key of the username with the username as an identifier.

[0145] The user certificate obtaining sub-unit is configured to request a certificate issuing authority to issue a user certificate using the certificate request file, and obtain the user certificate of the username.

[0146] In one embodiment, the user certificate querying unit further comprises:

[0147] The error information returning sub-unit is configured to generate error information for prompting that the username already exists when the username exists, and return the error information to the client.

[0148] In one embodiment, the target VKEK ciphertext determining module 203 comprises:

[0149] The initial VKEK ciphertext obtaining unit is configured to obtain an initial VKEK ciphertext of the target video data, the initial VKEK ciphertext being encrypted by a platform encryption certificate.

[0150] The VKEK plaintext obtaining unit is configured to determine a private key corresponding to the platform encryption certificate, and decrypt the initial VKEK ciphertext by using the private key corresponding to the platform encryption certificate to obtain VKEK plaintext.

[0151] In one embodiment, the present application further provides a storage medium, wherein the storage medium stores computer readable instructions, and the computer readable instructions are executed by one or more processors to make the one or more processors execute the steps of the encryption video playing method in any one of the above embodiments.

[0152] In one embodiment, the present application also provides a computer device having computer readable instructions stored therein, which, when executed by one or more processors, cause the one or more processors to perform the steps of the method for playing encrypted video as described in any of the above embodiments.

[0153] As shown schematically, Figure 6 Figure 6 An internal structure diagram of a computer device provided by an embodiment of the present application is shown in FIG. 3. The computer device 300 can be provided as a server. As shown in FIG. 3, Figure 6 The computer device 300 includes a processing component 302, which further includes one or more processors, and a memory resource represented by a memory 301 for storing instructions, such as application programs, executable by the processing component 302. The application programs stored in the memory 301 can include one or more than one module each corresponding to a set of instructions. In addition, the processing component 302 is configured to execute the instructions to perform the method for playing encrypted video of any of the above embodiments.

[0154] The computer device 300 can also include a power supply component 303 configured to perform power management of the computer device 300, a wired or wireless network interface 304 configured to connect the computer device 300 to a network, and an input / output (I / O) interface 305. The computer device 300 can operate based on an operating system stored in the memory 301, such as Windows Server TM, Mac OS X TM, Unix TM, Linux TM, Free BSD TM, or the like.

[0155] Those skilled in the art can understand that Figure 6 The structure shown in FIG. 3 is merely a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or less components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0156] ​Finally, it should be noted that the terms "first" and "second", and the like, herein do not denote any order, quantity, combination or importance, but are used to identify one element from another, and do not imply that the specific identities thereof are essential or that the identities are chronological or related in their occurrence. Also, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element. Also, "a", "an", "the", and "said" are used to refer to one or more than one (i.e., to "at least one") of the referenced elements, unless otherwise specified. A plurality also means two or more, such as 2, 3, 5, or 8, etc. "And / or" includes any and all combinations of one or more of the associated listed items.

[0157] The various embodiments described in this specification are presented by way of example, and are not intended to limit the scope of the application. Each embodiment is presented in a way that emphasizes the differences between that embodiment and other embodiments, but the embodiments can be combined according to the needs of the user.

[0158] The above description of disclosed embodiments provides enabling disclosure sufficient for one of ordinary skill in the art to practice the application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and generic principles defined herein can be applied to other embodiments without departing from the spirit or scope of the application. Thus, the present application is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for playing encrypted video, characterized in that: Applied to a video platform, the method includes: In response to a request by a user on a client to play target video data, obtaining an encrypted SM4 symmetric key from the play request, where the target video data is video data compliant with the GB35114-2017 protocol specification Level C, and the encrypted SM4 symmetric key is obtained by encrypting a temporary SM4 symmetric key using the user certificate returned by the video platform when the user logged in, by the client; Determine the user certificate corresponding to the play request, and use the private key of the user certificate to decrypt the encrypted SM4 symmetric key to obtain the temporary SM4 symmetric key; Determine the VKEK plaintext of the target video data, and encrypt the VKEK plaintext using the temporary SM4 symmetric key to obtain a target VKEK ciphertext; The target VKEK ciphertext is returned to the client, so that the client uses the temporary SM4 symmetric key to decrypt the target VKEK ciphertext, plays the target video data, and destroys the temporary SM4 symmetric key.

2. The encrypted video playback method according to claim 1, wherein: The step of determining the user certificate corresponding to the playback request includes: Obtaining an identity token from the playback request; The identity token is verified, and when the identity token passes the verification, a user certificate corresponding to the identity token is obtained.

3. The encrypted video playback method according to claim 2, wherein: The process of returning the user certificate when the user logs in includes: In response to a login request from the user in the client, obtaining the user name and password in the login request; Verify the username and password. If both the username and password are verified, generate an identity token for the username and query the user certificate generated when the username was registered. The identity token and the user certificate are returned to the client.

4. The encrypted video playback method according to claim 3, wherein: The process of returning the user certificate further includes: If the user name or the password of the user name fails to pass the verification, a login failure message is generated and returned to the client.

5. The encrypted video playback method according to claim 3, wherein: When registering the user name, the process of generating the user certificate includes: In response to the user's account creation request in the client, obtaining the user name and password in the account creation request; When there is no duplicate username, generate a public-private key pair for the username; Using the user name as an identifier, and using the public key of the user name to generate a certificate request file; Use the certificate request file to request a certificate issuing authority to issue a user certificate, and obtain a user certificate for the user name.

6. The encrypted video playback method according to claim 5, wherein: When registering the user name, the process of generating the user certificate further includes: When there is a duplicate username, an error message is generated to prompt that the username already exists, and the error message is returned to the client.

7. The encrypted video playback method according to any one of claims 1 to 6, characterized in that: The step of determining the VKEK plaintext of the target video data includes: Obtaining an initial VKEK ciphertext of the target video data, where the initial VKEK ciphertext is encrypted using a platform encryption certificate; Determine the key corresponding to the platform encryption certificate, and use the private key corresponding to the platform encryption certificate to decrypt the initial VKEK ciphertext to obtain the VKEK plaintext.

8. An encrypted video playback device, characterized in that: Applied to a video platform, the device includes: An encrypted SM4 symmetric key acquisition module is configured to respond to a request by a user on a client to play target video data and obtain an encrypted SM4 symmetric key from the play request, wherein the target video data is video data of level C in accordance with the GB35114-2017 protocol specification, and the encrypted SM4 symmetric key is obtained by encrypting a temporary SM4 symmetric key using the user certificate returned by the video platform when the user logs in. An encrypted SM4 symmetric key decryption module is used to determine the user certificate corresponding to the play request, and use the private key of the user certificate to decrypt the encrypted SM4 symmetric key to obtain the temporary SM4 symmetric key; a target VKEK ciphertext determination module, configured to determine the VKEK plaintext of the target video data and encrypt the VKEK plaintext using the temporary SM4 symmetric key to obtain a target VKEK ciphertext; The target video data playback module is used to return the target VKEK ciphertext to the client, so that the client uses the temporary SM4 symmetric key to decrypt the target VKEK ciphertext, plays the target video data, and destroys the temporary SM4 symmetric key.

9. A storage medium, characterized in that: The storage medium stores computer-readable instructions, which, when executed by one or more processors, enable the one or more processors to perform the steps of the encrypted video playback method according to any one of claims 1 to 7.

10. A computer device, characterized in that: include: one or more processors, and memory; The memory stores computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the steps of the encrypted video playback method according to any one of claims 1 to 7 are performed.

Images