Cross-domain streaming media protocol data high-concurrency security isolation transmission method and device

Abstract

The invention discloses a cross-domain streaming media protocol data high-concurrency security isolation transmission method and device, and the method comprises the steps: optimizing a proxy forwarding path of a streaming media protocol based on a streaming media protocol data on-demand transparent connection strategy at an edge video monitoring cloud system side, the identification efficiency and the transmission security of the streaming media protocol data are improved based on a streaming media protocol data parallel security check strategy; on the two sides of a cross-domain data isolation and exchange system, the concurrent transmission throughput of streaming media data in a cross-security domain isolation scene is improved based on a cross-domain one-way multi-channel transmission task scheduling strategy. The cross-security-domain real-time transmission of the streaming media data can be realized, the concurrent transmission throughput of the streaming media data in a cross-security-domain isolation scene is improved, the transformation difficulty of a traditional video monitoring system is reduced, and the method has important practical significance for improving the construction of a cross-domain data isolation and exchange system.

Description

Technical Field

[0001] The present invention relates to the technical field of streaming media protocol data transmission, and in particular to a cross-domain streaming media protocol data high-concurrency secure isolation transmission method and device. Background Art

[0002] With the development of edge computing, cloud computing, and artificial intelligence technologies, and combined with traditional video surveillance systems, an intelligent video surveillance system based on a cloud environment has been formed, including an edge video surveillance cloud system, a cross-domain data isolation and exchange system, and a central video surveillance cloud system. It provides all-weather real-time monitoring, intelligent detection and early warning, and on-demand video playback and retrieval capabilities, meeting the needs of authorized users to obtain unified video surveillance services at any time and any place.

[0003] The edge video surveillance cloud system centrally manages scattered front-end cameras in different regions. By collecting regional data, it realizes image analysis and preprocessing, identifies and stores useful video data, and provides video stream pulling and video recording and playback functions. The data isolation exchange system realizes controlled data transmission across security domains through physical isolation one-way network gates, and realizes physical isolation of video business systems. The central video surveillance cloud serves as a control center and intelligent computing center, gathering global video data, centralized storage and intelligent analysis, and identifying and alarming abnormal situations.

[0004] Since one-way gateway devices usually use the one-way data ferrying function through interface calls, when the cloud-based intelligent video surveillance system exchanges video data across the Internet and the corporate intranet through one-way gateway devices, there are often problems such as difficulty in transforming the traditional video surveillance system and poor real-time performance of data isolation transmission.

[0005] Patent CN202011367475.6 discloses an audio and video monitoring system for cross-domain network transmission and its communication method. The patent describes the composition of the audio and video monitoring system and the audio and video cross-domain forward proxy mechanism, including the central node of the audio and video monitoring system, the edge node of the audio and video monitoring system, the data acquisition terminal and the network equipment, and adopts the streaming media server cluster technology and RTMP protocol to achieve cross-domain transmission of audio and video data in a complex network environment, solving the problem of high bandwidth cost or difficulty in implementation in a complex network environment in the existing technology. This method is used in the field of audio and video monitoring and cross-domain network communication technology, but does not involve transparent connection and security inspection of streaming media protocol data, and high-concurrency isolation transmission scheduling mechanism of streaming media.

[0006] Patent CN202011376016.4 discloses a cross-domain video data forwarding method. The patent describes a video data forwarding method between routers at the borders of different domains. By establishing a cross-domain video data forwarding method, video programs between multiple autonomous domains can be forwarded efficiently. The patent is used for cross-domain video data forwarding, but does not involve cross-domain unidirectional transmission scenarios. Summary of the invention

[0007] Aiming at the scenario of high-concurrency secure isolation transmission of streaming media data across security domains, the present invention proposes a method and device for high-concurrency secure isolation transmission of cross-domain streaming media protocol data, which adopts on-demand transparent connection of streaming media protocol data, parallel security inspection of streaming media protocol data and unidirectional multi-channel transmission task scheduling mechanism to realize real-time transmission of streaming media data across security domains, improve the concurrent transmission throughput of streaming media data in cross-security domain isolation scenarios, reduce the difficulty of transforming traditional video surveillance systems, and have important practical significance for improving the construction of cross-domain data isolation exchange systems.

[0008] The technical solution adopted by the present invention is as follows:

[0009] A cross-domain streaming media protocol data high-concurrency secure isolation transmission method, comprising:

[0010] On the edge video surveillance cloud system side, the streaming protocol proxy forwarding path is optimized based on the on-demand transparent connection strategy for streaming protocol data, and the recognition efficiency and transmission security of streaming protocol data are improved based on the streaming protocol data parallel security inspection strategy;

[0011] On both sides of the cross-domain data isolation exchange system, the concurrent transmission throughput of streaming media data in cross-security domain isolation scenarios is improved based on the cross-domain unidirectional multi-channel transmission task scheduling strategy.

[0012] Furthermore, the on-demand transparent access strategy for streaming media protocol data includes:

[0013] Input the address and port information of the edge video surveillance cloud system and the central video surveillance cloud system configured by the administrator through the streaming media cross-domain transmission management module, and select the traffic diversion mechanism;

[0014] The streaming media cross-domain transmission management module generates a corresponding five-tuple-based traffic diversion strategy based on the address, port information and traffic diversion mechanism of the edge video surveillance cloud system and the central video surveillance cloud system;

[0015] The application layer protocol header is parsed by the streaming protocol parsing module, matched with the streaming protocol header feature library, the streaming protocol data is identified, and stored in the streaming data cache queue.

[0016] Furthermore, the traffic redirection mechanism includes a netfilter transparent redirection mode and an ebpf transparent redirection mode;

[0017] If it is the netfilter transparent routing mode, the streaming media cross-domain transmission management module generates an iptables tproxy traffic routing policy based on the five-tuple, which takes effect through the iptables command configuration, and routes the streaming media data packets to the streaming media protocol parsing module;

[0018] If it is the eBPF transparent connection mode, the streaming media cross-domain transmission management module generates an eBPF traffic connection strategy based on the five-tuple, generates eBPF bytecode and calls the eBPF library interface to load and take effect, and connects the streaming media data packet to the streaming media protocol parsing module.

[0019] Furthermore, the streaming media protocol data parallel security check strategy includes:

[0020] The streaming media cross-domain transmission management module sends the streaming media protocol inspection policy configured by the administrator to the streaming media protocol security inspection module, and the streaming media protocol security inspection module configures the streaming media security inspection function according to the sent streaming media protocol security inspection policy;

[0021] The streaming media cross-domain transmission management module generates a streaming media protocol processing thread pool and a streaming media protocol security check module matching strategy and a cross-domain unidirectional transmission channel matching information according to the streaming media protocol proxy task information configured by the administrator, and sends it to the streaming media protocol processing thread pool; the streaming media protocol processing thread pool creates a streaming media protocol processing thread, associates the streaming media protocol security check module and starts the streaming media protocol processing thread;

[0022] The streaming media protocol processing thread extracts the streaming media protocol data packet from the streaming media data cache queue, calls the streaming media protocol security check module interface, and performs a streaming media data security check;

[0023] The streaming media protocol processing thread calls the cross-domain unidirectional transmission channel module data sending interface, and passes the data packet that passes the security check and the streaming media protocol agent task number to the cross-domain unidirectional transmission channel module.

[0024] Furthermore, the streaming media protocol processing thread extracts the streaming media protocol data packet from the streaming media data cache queue, calls the streaming media protocol security check module interface, and performs a streaming media data security check. If the streaming media data security check fails, an alarm log is recorded and the data packet is discarded; if the streaming media data security check passes, the next step is performed.

[0025] Furthermore, on the downlink channel sending side of the cross-domain data isolation exchange system, the cross-domain unidirectional multi-channel transmission task scheduling strategy includes:

[0026] The streaming media cross-domain transmission management module sends the downlink channel sending side data isolation exchange task information and streaming media protocol proxy task information configured by the administrator to the cross-domain unidirectional transmission channel module;

[0027] The cross-domain unidirectional transmission channel module calls the cross-domain data transmission plug-in interface according to the data isolation exchange task information, creates a cross-domain transmission session with the cross-domain data isolation exchange system, associates it with the exchange task number in the data isolation exchange task information, and adds it to the streaming media protocol cross-domain transmission session pool;

[0028] The cross-domain unidirectional transmission channel module queries the streaming protocol cross-domain transmission session matching the exchange task number from the streaming protocol cross-domain transmission session pool according to the streaming protocol proxy task number transmitted by the streaming protocol processing thread;

[0029] The cross-domain unidirectional transmission channel module calls the data sending interface of the streaming protocol cross-domain transmission session based on the matching streaming protocol cross-domain transmission session, and sends the streaming data packets transmitted by the streaming protocol processing thread to the cross-domain data isolation exchange system.

[0030] Furthermore, on the downlink channel receiving side of the cross-domain data isolation exchange system, the cross-domain unidirectional multi-channel transmission task scheduling strategy includes:

[0031] The streaming media cross-domain transmission management module sends the downlink channel receiving side data isolation exchange task information and streaming media protocol proxy task information configured by the administrator to the cross-domain unidirectional transmission channel module;

[0032] The cross-domain unidirectional transmission channel module calls the cross-domain data transmission plug-in interface according to the data isolation exchange task information, creates a cross-domain transmission session with the cross-domain data isolation exchange system, associates it with the exchange task number in the data isolation exchange task information, and adds it to the streaming media protocol cross-domain transmission session pool;

[0033] The streaming media cross-domain transmission management module queries the cross-domain transmission session corresponding to the exchange task number from the streaming media protocol cross-domain transmission session pool according to the data isolation exchange task information, and receives signaling data from the cross-domain data isolation exchange system;

[0034] The streaming media cross-domain transmission management module creates a raw socket to send out the signaling data packet according to the streaming media protocol agent task information, and the operating system kernel protocol stack addresses it and sends it to the edge video surveillance cloud system.

[0035] Furthermore, on the uplink channel sending side of the cross-domain data isolation exchange system, the cross-domain unidirectional multi-channel transmission task scheduling strategy includes:

[0036] The streaming media cross-domain transmission management module sends the uplink channel sending side data isolation exchange task information and streaming media protocol proxy task information configured by the administrator to the cross-domain unidirectional transmission channel module;

[0037] The cross-domain unidirectional transmission channel module calls the cross-domain data transmission plug-in interface according to the data isolation exchange task information, creates a cross-domain transmission session with the cross-domain data isolation exchange system, associates it with the exchange task number in the data isolation exchange task information, and adds it to the streaming media protocol cross-domain transmission session pool;

[0038] The cross-domain unidirectional transmission channel module queries the streaming media protocol cross-domain transmission session matching the exchange task number from the streaming media protocol cross-domain transmission session pool according to the transmitted streaming media protocol proxy task number;

[0039] The cross-domain unidirectional transmission channel module calls the data sending interface of the cross-domain transmission session of the streaming media protocol to send the streaming media data to the cross-domain data isolation exchange system.

[0040] Furthermore, on the uplink channel receiving side of the cross-domain data isolation exchange system, the cross-domain unidirectional multi-channel transmission task scheduling strategy includes:

[0041] The streaming media cross-domain transmission management module sends the uplink channel receiving side data isolation exchange task information and streaming media protocol proxy task information configured by the administrator to the cross-domain unidirectional transmission channel module;

[0042] The cross-domain unidirectional transmission channel module calls the cross-domain data transmission plug-in interface according to the data isolation exchange task information, creates a cross-domain transmission session with the cross-domain data isolation exchange system, associates it with the exchange task number in the data isolation exchange task information, and adds it to the streaming media protocol cross-domain transmission session pool;

[0043] The cross-domain unidirectional transmission channel module queries the streaming protocol cross-domain transmission session matching the protocol proxy task number from the streaming protocol cross-domain transmission session pool according to the streaming protocol proxy task number in the streaming protocol proxy task information;

[0044] The cross-domain unidirectional transmission channel module calls the data receiving interface of the cross-domain transmission session of the streaming media protocol to receive the streaming media data from the cross-domain data isolation exchange system;

[0045] The cross-domain unidirectional transmission channel module creates a raw socket based on the streaming protocol agent task information to send out the streaming protocol data packet, which is then addressed by the operating system kernel protocol stack and sent to the central video surveillance cloud system.

[0046] A cross-domain streaming media protocol data high-concurrency secure isolation transmission device, comprising:

[0047] The streaming protocol data on-demand transparent access module is deployed on the edge video surveillance cloud system side to optimize the streaming protocol proxy forwarding path;

[0048] The streaming protocol data parallel security check module is deployed on the edge video surveillance cloud system side to improve the recognition efficiency and transmission security of streaming protocol data;

[0049] The cross-domain unidirectional multi-channel transmission task scheduling module is deployed on both sides of the cross-domain data isolation exchange system to improve the concurrent transmission throughput of streaming media data in cross-security domain isolation scenarios.

[0050] The beneficial effects of the present invention are:

[0051] Aiming at the scenario of real-time high-concurrency isolated transmission of streaming media data across security domains, the present invention proposes a method for transparent connection and security inspection of streaming media protocol data and a method for scheduling high-concurrency isolated transmission of streaming media. The present invention adopts an on-demand transparent connection mechanism for streaming media protocol data, optimizes the streaming media protocol proxy forwarding path, and reduces the difficulty of transformation of the video surveillance system; adopts parallel security inspection of streaming media protocol data to improve the efficiency of streaming media protocol data identification and transmission security; adopts a unidirectional multi-channel transmission task scheduling mechanism to improve the concurrent transmission throughput of streaming media data in cross-security domain isolation scenarios, which has important practical significance for improving the construction of cross-domain data isolation exchange systems, and the present invention can also be further extended to other similar demand scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 Streaming media protocol data security and transparent connection process;

[0053] Figure 2 Parallel security check process for streaming protocol data;

[0054] Figure 3 The cross-domain unidirectional multi-channel transmission task scheduling process on the downlink sending side;

[0055] Figure 4 The cross-domain unidirectional multi-channel transmission task scheduling process on the downlink receiving side;

[0056] Figure 5 The uplink sending side cross-domain unidirectional multi-channel transmission task scheduling process;

[0057] Figure 6 The uplink receiving side cross-domain unidirectional multi-channel transmission task scheduling process. DETAILED DESCRIPTION

[0058] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, the specific implementation methods of the present invention are now described. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention, that is, the embodiments described are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0059] Example 1

[0060] like Figure 1 As shown, this embodiment provides a method for high-concurrency secure isolation transmission of cross-domain streaming protocol data, including: on the edge video surveillance cloud system side, optimizing the streaming protocol proxy forwarding path based on the on-demand transparent connection strategy of streaming protocol data, and improving the recognition efficiency and transmission security of streaming protocol data based on the parallel security inspection strategy of streaming protocol data; on both sides of the cross-domain data isolation exchange system, improving the concurrent transmission throughput of streaming media data in the cross-security domain isolation scenario based on the cross-domain unidirectional multi-channel transmission task scheduling strategy, as described below.

[0061] 1. On-demand transparent access strategy for streaming protocol data

[0062] The streaming protocol data on-demand transparent connection strategy is implemented by the streaming cross-domain transmission management module, the streaming protocol parsing module and the streaming data cache queue, and is implemented at the end close to the edge video surveillance cloud system. The streaming protocol data connection process is as follows: Figure 1 shown.

[0063] Preferably, the on-demand transparent connection strategy of streaming media protocol data in this embodiment can be implemented by the following steps:

[0064] (1) The streaming media cross-domain transmission management module receives the address and port information of the edge video surveillance cloud system and the central video surveillance cloud system configured by the administrator, and selects the traffic redirection mechanism. The traffic redirection mechanism options include the netfilter transparent redirection mode and the ebpf transparent redirection mode.

[0065] (2) The streaming media cross-domain transmission management module generates a corresponding five-tuple-based traffic redirection strategy based on the address and port information of the edge video surveillance cloud system and the central video surveillance cloud system and according to the traffic redirection mechanism options;

[0066] 1) If it is the netfilter transparent induction mode, generate the iptables tproxy traffic induction policy based on the five-tuple, and configure it to take effect through the iptables command to induct the streaming media data packets to the streaming media protocol parsing module;

[0067] 2) If it is eBPF transparent induction mode, generate an eBPF traffic induction strategy based on the five-tuple, generate eBPF bytecode and call the eBPF library interface to load and take effect, and induct the streaming media data packet to the streaming media protocol parsing module;

[0068] (3) The streaming protocol parsing module parses the application layer protocol header, matches it with the streaming protocol header feature library (including SIP, RTCP, RTSP, RTP, RTMP, SDP and other streaming protocol header features), identifies the streaming protocol data, and stores it in the streaming data cache queue.

[0069] 2. Streaming protocol data parallel security check strategy

[0070] The streaming protocol data parallel security check strategy is executed by the streaming cross-domain transmission management module, streaming data cache queue, streaming protocol processing thread pool, streaming protocol security check module and cross-domain unidirectional transmission channel module, and is implemented at one end close to the edge video surveillance cloud system. The streaming protocol data parallel security check process is as follows: Figure 2 shown.

[0071] Preferably, the streaming media protocol data parallel security check strategy of this embodiment can be implemented by the following steps:

[0072] (1) The streaming media cross-domain transmission management module sends the streaming media protocol inspection policy configured by the administrator to the streaming media protocol security inspection module, and the streaming media protocol security inspection module configures the streaming media security inspection function according to the sent streaming media protocol security inspection policy;

[0073] (2) The streaming media cross-domain transmission management module generates a streaming media protocol processing thread pool and a streaming media protocol security check module matching strategy, as well as cross-domain unidirectional transmission channel matching information, based on the streaming media protocol proxy task information configured by the administrator, and sends it to the streaming media protocol processing thread pool. The streaming media protocol processing thread pool creates a streaming media protocol processing thread, associates the streaming media protocol security check module, and starts the streaming media protocol processing thread;

[0074] (3) The streaming media protocol processing thread extracts the streaming media protocol data packet from the streaming media data cache queue, calls the streaming media protocol security check module interface, and performs a streaming media data security check;

[0075] 1) If the streaming media data security check fails, an alarm log is recorded and the data packet is discarded;

[0076] 2) The streaming media data security check passes, and the next step is carried out;

[0077] (4) The streaming media protocol processing thread calls the data sending interface of the cross-domain unidirectional transmission channel module, and passes the data packet that has passed the security check and the streaming media protocol agent task number to the cross-domain unidirectional transmission channel module.

[0078] 3. Cross-domain unidirectional multi-channel transmission task scheduling strategy

[0079] The cross-domain unidirectional multi-channel transmission task scheduling strategy is executed by the streaming media cross-domain transmission management module, the cross-domain unidirectional transmission channel module, the streaming media protocol cross-domain transmission session pool and the cross-domain data transmission plug-in, and is implemented on both sides of the cross-domain data isolation exchange system.

[0080] Preferably, the cross-domain unidirectional multi-channel transmission task scheduling strategy of this embodiment can be implemented in the following manner.

[0081] (1) Downlink channel sending side

[0082] The cross-domain unidirectional multi-channel transmission task scheduling process on the downlink channel sending side is as follows: Figure 3 The specific steps are described as follows:

[0083] 1) The streaming media cross-domain transmission management module sends the downlink channel sending side data isolation exchange task information and streaming media protocol proxy task information configured by the administrator to the cross-domain unidirectional transmission channel module;

[0084] 2) The cross-domain unidirectional transmission channel module calls the cross-domain data transmission plug-in interface according to the data isolation exchange task information, creates a cross-domain transmission session with the cross-domain data isolation exchange system, associates it with the exchange task number in the data isolation exchange task information, and adds it to the streaming media protocol cross-domain transmission session pool;

[0085] 3) The cross-domain unidirectional transmission channel module queries the streaming media protocol cross-domain transmission session matching the exchange task number from the streaming media protocol cross-domain transmission session pool according to the streaming media protocol proxy task number transmitted by the streaming media protocol processing thread;

[0086] 4) The cross-domain unidirectional transmission channel module calls the data sending interface of the streaming protocol cross-domain transmission session based on the matching streaming protocol cross-domain transmission session, and sends the streaming data packet (signaling) transmitted by the streaming protocol processing thread to the cross-domain data isolation exchange system.

[0087] (2) Downlink channel receiving side

[0088] The cross-domain unidirectional multi-channel transmission task scheduling process on the receiving side of the downlink channel is as follows: Figure 4 The specific steps are described as follows:

[0089] 1) The streaming media cross-domain transmission management module sends the downlink channel receiving side data isolation exchange task information and streaming media protocol proxy task information configured by the administrator to the cross-domain unidirectional transmission channel module;

[0090] 2) The cross-domain unidirectional transmission channel module calls the cross-domain data transmission plug-in interface according to the data isolation exchange task information, creates a cross-domain transmission session with the cross-domain data isolation exchange system, associates it with the exchange task number in the data isolation exchange task information, and adds it to the streaming media protocol cross-domain transmission session pool;

[0091] 3) The streaming media cross-domain transmission management module queries the cross-domain transmission session corresponding to the exchange task number from the streaming media protocol cross-domain transmission session pool according to the data isolation exchange task information, and receives signaling data from the cross-domain data isolation exchange system;

[0092] 4) The streaming media cross-domain transmission management module creates a raw socket to send out the signaling data packet according to the streaming media protocol agent task information, and the operating system kernel protocol stack addresses and sends it to the edge video surveillance cloud system.

[0093] (3) Uplink channel sending side

[0094] The cross-domain unidirectional multi-channel transmission task scheduling process on the uplink channel sending side is as follows: Figure 5 The specific steps are described as follows:

[0095] 1) The streaming media cross-domain transmission management module sends the uplink channel sending side data isolation exchange task information and streaming media protocol proxy task information configured by the administrator to the cross-domain unidirectional transmission channel module;

[0096] 2) The cross-domain unidirectional transmission channel module calls the cross-domain data transmission plug-in interface according to the data isolation exchange task information, creates a cross-domain transmission session with the cross-domain data isolation exchange system, associates it with the exchange task number in the data isolation exchange task information, and adds it to the streaming media protocol cross-domain transmission session pool;

[0097] 3) The cross-domain unidirectional transmission channel module queries the streaming media protocol cross-domain transmission session matching the exchange task number from the streaming media protocol cross-domain transmission session pool according to the transmitted streaming media protocol proxy task number;

[0098] 4) The cross-domain unidirectional transmission channel module calls the data sending interface of the cross-domain transmission session of the streaming media protocol to send the streaming media data (audio and video data) to the cross-domain data isolation exchange system.

[0099] (4) Uplink channel receiving side

[0100] The cross-domain unidirectional multi-channel transmission task scheduling process on the uplink channel receiving side is as follows: Figure 6 The specific steps are described as follows:

[0101] 1) The streaming media cross-domain transmission management module sends the uplink channel receiving side data isolation exchange task information and streaming media protocol proxy task information configured by the administrator to the cross-domain unidirectional transmission channel module;

[0102] 2) The cross-domain unidirectional transmission channel module calls the cross-domain data transmission plug-in interface according to the data isolation exchange task information, creates a cross-domain transmission session with the cross-domain data isolation exchange system, associates it with the exchange task number in the data isolation exchange task information, and adds it to the streaming media protocol cross-domain transmission session pool;

[0103] 3) The cross-domain unidirectional transmission channel module queries the streaming media protocol cross-domain transmission session matching the protocol proxy task number from the streaming media protocol cross-domain transmission session pool according to the streaming media protocol proxy task number in the streaming media protocol proxy task information;

[0104] 4) The cross-domain unidirectional transmission channel module calls the data receiving interface of the cross-domain transmission session of the streaming media protocol to receive the streaming media data from the cross-domain data isolation exchange system;

[0105] 5) The cross-domain unidirectional transmission channel module creates a raw socket to send out the streaming protocol data packet according to the streaming protocol agent task information, and the operating system kernel protocol stack addresses it and sends it to the central video surveillance cloud system.

[0106] Example 2

[0107] This embodiment is based on embodiment 1:

[0108] This embodiment provides a cross-domain streaming media protocol data high-concurrency secure isolation transmission device, including:

[0109] The streaming protocol data on-demand transparent access module is deployed on the edge video surveillance cloud system side to optimize the streaming protocol proxy forwarding path;

[0110] The streaming protocol data parallel security check module is deployed on the edge video surveillance cloud system side to improve the streaming protocol data recognition efficiency and transmission security;

[0111] The cross-domain unidirectional multi-channel transmission task scheduling module is deployed on both sides of the cross-domain data isolation exchange system to improve the concurrent transmission throughput of streaming media data in cross-security domain isolation scenarios.

[0112] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity of description, they are expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

Claims

1. A cross-domain streaming media protocol data high-concurrency secure isolation transmission method, characterized in that: include: On the edge video surveillance cloud system side, the streaming protocol proxy forwarding path is optimized based on the on-demand transparent induction strategy of streaming protocol data, and the recognition efficiency and transmission security of streaming protocol data are improved based on the streaming protocol data parallel security inspection strategy; On both sides of the cross-domain data isolation exchange system, the concurrent transmission throughput of streaming media data in cross-security domain isolation scenarios is improved based on the cross-domain unidirectional multi-channel transmission task scheduling strategy.

2. According to claim 1, a cross-domain streaming media protocol data high-concurrency secure isolation transmission method is characterized in that: The on-demand transparent access strategy for streaming media protocol data includes: Input the address and port information of the edge video surveillance cloud system and the central video surveillance cloud system configured by the administrator through the streaming media cross-domain transmission management module, and select the traffic diversion mechanism; The streaming media cross-domain transmission management module generates a corresponding five-tuple-based traffic diversion strategy based on the address, port information and traffic diversion mechanism of the edge video surveillance cloud system and the central video surveillance cloud system; The application layer protocol header is parsed by the streaming protocol parsing module, matched with the streaming protocol header feature library, the streaming protocol data is identified, and stored in the streaming data cache queue.

3. According to claim 2, a cross-domain streaming media protocol data high-concurrency secure isolation transmission method is characterized in that: The traffic redirection mechanism includes a netfilter transparent redirection mode and an ebpf transparent redirection mode; If it is the netfilter transparent routing mode, the streaming media cross-domain transmission management module generates an iptables tproxy traffic routing policy based on the five-tuple, which takes effect through the iptables command configuration, and routes the streaming media data packets to the streaming media protocol parsing module; If it is the eBPF transparent connection mode, the streaming media cross-domain transmission management module generates an eBPF traffic connection strategy based on the five-tuple, generates eBPF bytecode and calls the eBPF library interface to load and take effect, and connects the streaming media data packet to the streaming media protocol parsing module.

4. According to claim 1, a cross-domain streaming media protocol data high-concurrency secure isolation transmission method is characterized in that: The streaming media protocol data parallel security check strategy includes: The streaming media cross-domain transmission management module sends the streaming media protocol inspection policy configured by the administrator to the streaming media protocol security inspection module, and the streaming media protocol security inspection module configures the streaming media security inspection function according to the sent streaming media protocol security inspection policy; The streaming media cross-domain transmission management module generates a streaming media protocol processing thread pool and a streaming media protocol security check module matching strategy and a cross-domain unidirectional transmission channel matching information according to the streaming media protocol proxy task information configured by the administrator, and sends it to the streaming media protocol processing thread pool; the streaming media protocol processing thread pool creates a streaming media protocol processing thread, associates the streaming media protocol security check module and starts the streaming media protocol processing thread; The streaming media protocol processing thread extracts the streaming media protocol data packet from the streaming media data cache queue, calls the streaming media protocol security check module interface, and performs a streaming media data security check; The streaming media protocol processing thread calls the cross-domain unidirectional transmission channel module data sending interface, and passes the data packet that passes the security check and the streaming media protocol agent task number to the cross-domain unidirectional transmission channel module.

5. According to claim 4, a cross-domain streaming media protocol data high-concurrency secure isolation transmission method is characterized in that: The streaming media protocol processing thread extracts a streaming media protocol data packet from the streaming media data cache queue, calls the streaming media protocol security check module interface, and performs a streaming media data security check. If the streaming media data security check fails, an alarm log is recorded and the data packet is discarded; If the streaming media data security check passes, proceed to the next step.

6. According to claim 1, a cross-domain streaming media protocol data high-concurrency secure isolation transmission method is characterized in that: On the downlink channel sending side of the cross-domain data isolation exchange system, the cross-domain unidirectional multi-channel transmission task scheduling strategy includes: The streaming media cross-domain transmission management module sends the downlink channel sending side data isolation exchange task information and streaming media protocol proxy task information configured by the administrator to the cross-domain unidirectional transmission channel module; The cross-domain unidirectional transmission channel module calls the cross-domain data transmission plug-in interface according to the data isolation exchange task information, creates a cross-domain transmission session with the cross-domain data isolation exchange system, associates it with the exchange task number in the data isolation exchange task information, and adds it to the streaming media protocol cross-domain transmission session pool; The cross-domain unidirectional transmission channel module queries the streaming protocol cross-domain transmission session matching the exchange task number from the streaming protocol cross-domain transmission session pool according to the streaming protocol proxy task number transmitted by the streaming protocol processing thread; The cross-domain unidirectional transmission channel module calls the data sending interface of the streaming protocol cross-domain transmission session based on the matching streaming protocol cross-domain transmission session, and sends the streaming data packets transmitted by the streaming protocol processing thread to the cross-domain data isolation exchange system.

7. According to claim 1, a cross-domain streaming media protocol data high-concurrency secure isolation transmission method is characterized in that: On the downlink channel receiving side of the cross-domain data isolation exchange system, the cross-domain unidirectional multi-channel transmission task scheduling strategy includes: The streaming media cross-domain transmission management module sends the downlink channel receiving side data isolation exchange task information and streaming media protocol proxy task information configured by the administrator to the cross-domain unidirectional transmission channel module; The cross-domain unidirectional transmission channel module calls the cross-domain data transmission plug-in interface according to the data isolation exchange task information, creates a cross-domain transmission session with the cross-domain data isolation exchange system, associates it with the exchange task number in the data isolation exchange task information, and adds it to the streaming media protocol cross-domain transmission session pool; The streaming media cross-domain transmission management module queries the cross-domain transmission session corresponding to the exchange task number from the streaming media protocol cross-domain transmission session pool according to the data isolation exchange task information, and receives signaling data from the cross-domain data isolation exchange system; The streaming media cross-domain transmission management module creates a raw socket to send out the signaling data packet according to the streaming media protocol agent task information, and the operating system kernel protocol stack addresses it and sends it to the edge video surveillance cloud system.

8. According to claim 1, a cross-domain streaming media protocol data high-concurrency secure isolation transmission method is characterized in that: On the uplink channel sending side of the cross-domain data isolation exchange system, the cross-domain unidirectional multi-channel transmission task scheduling strategy includes: The streaming media cross-domain transmission management module sends the uplink channel sending side data isolation exchange task information and streaming media protocol proxy task information configured by the administrator to the cross-domain unidirectional transmission channel module; The cross-domain unidirectional transmission channel module calls the cross-domain data transmission plug-in interface according to the data isolation exchange task information, creates a cross-domain transmission session with the cross-domain data isolation exchange system, associates it with the exchange task number in the data isolation exchange task information, and adds it to the streaming media protocol cross-domain transmission session pool; The cross-domain unidirectional transmission channel module queries the streaming media protocol cross-domain transmission session matching the exchange task number from the streaming media protocol cross-domain transmission session pool according to the transmitted streaming media protocol proxy task number; The cross-domain unidirectional transmission channel module calls the data sending interface of the cross-domain transmission session of the streaming media protocol to send the streaming media data to the cross-domain data isolation exchange system.

9. A cross-domain streaming media protocol data high-concurrency secure isolation transmission method according to claim 1, characterized in that: On the uplink channel receiving side of the cross-domain data isolation exchange system, the cross-domain unidirectional multi-channel transmission task scheduling strategy includes: The streaming media cross-domain transmission management module sends the uplink channel receiving side data isolation exchange task information and streaming media protocol proxy task information configured by the administrator to the cross-domain unidirectional transmission channel module; The cross-domain unidirectional transmission channel module calls the cross-domain data transmission plug-in interface according to the data isolation exchange task information, creates a cross-domain transmission session with the cross-domain data isolation exchange system, associates it with the exchange task number in the data isolation exchange task information, and adds it to the streaming media protocol cross-domain transmission session pool; The cross-domain unidirectional transmission channel module queries the streaming protocol cross-domain transmission session matching the protocol proxy task number from the streaming protocol cross-domain transmission session pool according to the streaming protocol proxy task number in the streaming protocol proxy task information; The cross-domain unidirectional transmission channel module calls the data receiving interface of the cross-domain transmission session of the streaming media protocol to receive the streaming media data from the cross-domain data isolation exchange system; The cross-domain unidirectional transmission channel module creates a raw socket based on the streaming protocol agent task information to send out the streaming protocol data packet, which is then addressed by the operating system kernel protocol stack and sent to the central video surveillance cloud system.

10. A cross-domain streaming media protocol data high-concurrency secure isolation transmission device, characterized in that: include: The streaming protocol data on-demand transparent access module is deployed on the edge video surveillance cloud system side to optimize the streaming protocol proxy forwarding path; The streaming protocol data parallel security check module is deployed on the edge video surveillance cloud system side to improve the streaming protocol data recognition efficiency and transmission security; The cross-domain unidirectional multi-channel transmission task scheduling module is deployed on both sides of the cross-domain data isolation exchange system to improve the concurrent transmission throughput of streaming media data in cross-security domain isolation scenarios.

Images