LED (light-emitting diode) screen safe delivery system with password module

Abstract

The invention discloses an LED screen safe delivery system carrying a cipher module. The LED screen safe delivery system comprises a management terminal, a playing server and a playing card. The management terminal is used for auditing videos, verifying signatures, uploading files and issuing instructions; the playing server carries out terminal access authentication and auditor authentication and outputs a video signal; and the playing card is connected with the server and the LED screen and converts the digital signal into an analog signal to drive and display. Encrypted transmission is carried out between the management terminal and the server through a secure channel. Illegal access and data tampering are prevented through dual authentication and a secure channel, and the security of the whole link is guaranteed; the playing card improves the signal stability and the anti-interference capability; the system simplifies the deployment process, reduces the cost, supports auditing and authority real-time management, and improves the compliance of public information delivery.

Description

Technical Field

[0001] The present invention relates to an LED screen delivery system, and more particularly to an LED screen security delivery system equipped with a password module. Background Art

[0002] In contemporary society, LED screens have become part of the urban landscape, playing a vital role in advertising, information dissemination, and public services. However, with the widespread use of LED screens, their security issues have also received increasing attention. Cyber ​​attackers may interfere with or tamper with the screen content through various means, or even use these screens as a tool to spread malicious information, which may not only cause public panic, but also disrupt social order and damage the reputation of individuals or groups.

[0003] At present, many companies have proposed their own security solutions, such as the Hexie series security products launched by Jiangshu Technology, the Sendun Cloud series products launched by Ruisen Network Security, and the public display screen content security guards of Dishi Technology. The current solutions are all based on the feature library of bad content recognition models to review and filter the content of LED screens. Although this method can reduce security risks to a certain extent, it still has some shortcomings, such as high false alarm rate and missed alarm rate, high resource consumption, and the need to constantly update and maintain the feature library, and high operation and maintenance costs. Summary of the invention

[0004] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a LED screen security delivery system equipped with a password module which adopts a national secret algorithm to perform content review, signature verification, and encryption and decryption processing on video files delivered to LED screens, so as to ensure the compliance of the video content, as well as the authenticity and integrity during the storage and transmission process, thereby effectively ensuring the security of LED screen video delivery.

[0005] To achieve the above purpose, the present invention provides the following technical solution: a LED screen security delivery system equipped with a password module, comprising: A management terminal, which is used for video content review, signing and verification, video file upload and playback instruction issuance; a playback server, which is connected to the management terminal in communication, and is used for management terminal access authentication, content auditor identity authentication and output of video playback digital signals; a playback card, which is connected to the playback server in communication, and is also connected to an external LED screen to receive the video playback digital signal output by the playback server, and convert the digital signal into an analog signal and input it into the external LED screen, so that the LED screen displays the content; wherein a secure channel is established between the management terminal and the playback server to encrypt and transmit information between the management terminal and the playback server.

[0006] A further improvement of the present invention is that the specific steps for establishing a secure channel between the management terminal and the playback server are as follows: Step 1, perform the first handshake, the management terminal holds a pair of SM2 public and private keys Kce and Kcd based on national encryption, and generates a random number Rc, and sends a "Client Hello" message containing the random number Rc to the playback server. The playback server receives the random number Rc, generates a random number Rs by itself, and sends a "Server Hello" message containing the random number Rs to the management terminal. The management terminal receives the random number Rs, and the first handshake ends; Step 2, perform the second handshake, the management terminal sends the Client's SM2 digital certificate, the playback server verifies the certificate, obtains the management terminal digital certificate, the management terminal sends the Client's digital signature to the playback server again, the playback server verifies the signature, the server authenticates the management terminal, and the second handshake ends; Step three, the third handshake is performed, the playback server generates a pre-master key PMS, the playback server encrypts the pre-master key with the public key of the management terminal certificate, and sends it to the management terminal. The management terminal decrypts it with the private key to obtain the pre-master key PMS. At this point, both parties hold the random numbers Rc, Rs and the pre-master key PMS. The two parties exchange key parameters and generate the session master key KMS based on the SM4 algorithm, and the third handshake ends; Step four, the management terminal and the playback server use the session key to encrypt and transmit information, send encrypted "Finish" information to each other for verification, and if the verification is successful, the secure channel is successfully established.

[0007] A further improvement of the present invention is that the management terminal performs user security authentication during the user login process. The specific method of the user security authentication is as follows: first, the management terminal inputs the Username and the corresponding password, uses the session key to encrypt the Username and attaches the hash value of the password, uses the SM3 hash algorithm, expressed as E(Username || Hash(password), Ks), and sends it to the playback server. After that, the server uses the session key to authenticate the management terminal. After the authentication is successful, the user logs in to perform subsequent operations.

[0008] A further improvement of the present invention is that the specific manner in which the management terminal performs video content review is as follows: the user reviews the video content through the management terminal, and after the review is passed, the digital certificate based on the SM2 national encryption algorithm stored in the USB KEY in the management terminal is used to sign the video that has passed the review, and the private key of the certificate in the USBKEY is called to sign the video, and the video signature file is stored in the management terminal.

[0009] A further improvement of the present invention is that the specific method for uploading the video file in the management terminal is as follows: verify the signature of the video file, use the session key and the national secret SM3 algorithm to generate HMAC, calculate the HMAC value of the data Data, splice the original data and its HMAC value together, and finally use the key Ks to encrypt the spliced ​​data, expressed as E(Data || HMAC(Data), Ks), then the playback server decrypts the data, authenticates the authenticity of the management terminal identity, and saves the video file to the server after authentication to achieve secure video transmission.

[0010] A further improvement of the present invention is that the specific manner in which the playback server outputs the video playback digital signal is as follows: the management terminal sends a playback request to the playback server, the playback server uses the SM3 hash function to calculate the video file, and returns the hash value to the management terminal. The management terminal verifies the signature of the video file. If the signature verification passes, the playback server plays the video.

[0011] The beneficial effects of the present invention are as follows: the LED screen security delivery system equipped with a password module of the present invention builds a secure channel based on national secret technology, adopts information security technologies such as digital signatures, message authentication codes, encryption and decryption to ensure the safe delivery of videos, and can resist various intrusions from the network and tampering with video content. Compared with traditional content-filtering-based methods, it is more efficient and secure, better solves the security risks of large LED screens, and has a wide range of application scenarios and social benefits. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a module block diagram of the LED screen security delivery system equipped with a password module of the present invention; Figure 2 Schematic diagram of the process of establishing a secure channel; Figure 3 This is a flowchart of the video delivery process; Figure 4 A schematic diagram of a specific client; Figure 5 Schematic diagram of successful establishment of a secure channel; Figure 6 A schematic diagram of user registration details; Figure 7 This is a schematic diagram of the successful login interface; Figure 8 A schematic diagram of the video security signature interface; Fig. 9 This is a schematic diagram of the video security transmission interface; Fig.10 This is a schematic diagram of the video security playback interface. DETAILED DESCRIPTION

[0013] The present invention will be further described below in detail with reference to the embodiments shown in the accompanying drawings.

[0014] Reference Figure 1 As shown, the overall schematic diagram of the LED screen delivery system is shown in Figure 1. The system consists of a management terminal, a playback server, a playback card and an LED screen, wherein the management terminal and the playback server are connected by a network cable, the playback server and the playback card are connected by HDMI, and the playback card is connected to the LED screen by HUB75, including: A management terminal, which is used for video content review, signature and signature verification, video file upload and playback instruction issuance; A playback server, which is connected to the management terminal for management terminal access authentication, content auditor identity authentication and output of video playback digital signals; A playback card, which is connected to the playback server and is also connected to an external LED screen to receive the video playback digital signal output by the playback server, and converts the digital signal into an analog signal and inputs it into the external LED screen, so that the LED screen displays the content; Among them, a secure channel is established between the management terminal and the playback server to encrypt and transmit information between the management terminal and the playback server. Through the combination of the management terminal, the playback server and the playback card, the functional decoupling of control, processing and signal conversion is achieved through a modular architecture, reducing the risk of system paralysis due to single point failure. At the same time, the secure channel ensures the confidentiality of core data transmission, and uses the secure channel to encrypt the audited video content during video playback. During the playback process, the video content to be played is checked by means of a key. In this way, the video content is replaced during the video transmission process, which can avoid problems in the playback of the video content.

[0015] Reference Figure 2 As shown, in this embodiment, a secure channel is established by a three-way handshake, as follows: Step 1: Perform the first handshake. The management terminal holds a pair of SM2 public and private keys Kce and Kcd based on national encryption, generates a random number Rc, and sends a "Client Hello" message containing the random number Rc to the playback server. The playback server receives the random number Rc, generates a random number Rs, and sends a "Server Hello" message containing the random number Rs to the management terminal. The management terminal receives the random number Rs, and the first handshake ends. Step 2: Perform a second handshake. The management terminal sends the Client's SM2 digital certificate. The playback server verifies the certificate and obtains the management terminal's digital certificate. The management terminal then sends the Client's digital signature to the playback server. The playback server verifies the signature. The server authenticates the management terminal and the second handshake ends. Step 3: Perform the third handshake. The playback server generates a pre-master key PMS. The playback server encrypts the pre-master key with the public key of the management terminal certificate and sends it to the management terminal. The management terminal decrypts it with the private key to obtain the pre-master key PMS. At this point, both parties hold the random numbers Rc, Rs and the pre-master key PMS. The two parties exchange key parameters and generate the session master key KMS based on the SM4 algorithm. The third handshake ends. Step 4: The management terminal and the playback server use the session key to encrypt and transmit information, and send encrypted "Finish" information to each other for verification. If the verification is successful, the secure channel is successfully established. A three-way handshake is used to complete key exchange, identity authentication, and key generation in stages to reduce the impact of single-point vulnerabilities on the overall system. In the handshake process, random numbers are involved in the handshake, and the randomness of Rc and Rs is used to ensure the uniqueness of each session to prevent attackers from establishing illegal connections by replaying old handshake records. Then, two-way identity authentication (SM2 digital certificate and signature) is used to ensure the legitimacy of both communicating parties. A high-strength session key (SM4) is dynamically generated by combining random numbers (Rc / Rs) and the pre-master key (PMS) encrypted by SM2. This not only meets the national cryptographic compliance requirements, but also ensures the forward confidentiality and anti-replay attack capabilities of key negotiation. At the same time, SM4 is used to efficiently encrypt and transmit data, taking into account both security and performance. It is suitable for core scenarios such as government affairs and finance that require domestic cryptographic technology support.

[0016] Further, see Figure 3 As shown, this embodiment uses the following method to achieve safe delivery of videos. First, the user identity needs to be authenticated before delivery to ensure that the operating user is a management account, so there is the following video delivery process.

[0017] User security authentication: The management terminal enters the username and the corresponding password, encrypts the username with the session key and attaches the hash value of the password, uses the SM3 hash algorithm, expressed as E(Username || Hash(password), Ks), and sends it to the playback server. The server uses the session key to authenticate the management terminal. If the authentication is successful, it proceeds to the next step.

[0018] Video security review: The management terminal reviews the content of video files, and the digital certificate based on the SM2 national encryption algorithm is stored in the USB KEY. The private key of the certificate in the USB KEY is used to sign the video that has passed the review, and the video signature file is saved in the management terminal.

[0019] Video secure upload: Verify the signature of the video file, use the session key and the national secret SM3 algorithm to generate HMAC, calculate the HMAC value of the data Data, splice the original data and its HMAC value together, and finally use the key Ks to encrypt the spliced ​​data, expressed as E(Data || HMAC(Data), Ks). The playback server decrypts the data, authenticates the authenticity of the management terminal identity, and saves the video file to the server after authentication to achieve secure video transmission.

[0020] Video safe playback: The management terminal sends a playback request to the playback server, which uses the SM3 hash function to calculate the video file and returns the hash value to the management terminal. The management terminal verifies the signature of the video file. If the signature is verified, the playback server plays the video, which can easily and conveniently achieve safe delivery of video content.

[0021] In the encoding process, the SM2 algorithm, SM3 algorithm and SM4 algorithm are used to effectively utilize the characteristics of each algorithm to achieve encryption during the transmission of the above video content. Specifically: The SM2 algorithm is based on the elliptic curve cryptography system and is efficient, secure and reliable. Its security is mainly based on the elliptic curve discrete logarithm problem. The main contents of the SM2 algorithm include digital signature algorithm, key exchange protocol and public key encryption algorithm.

[0022] Identity authentication: USB KEY combined with SM2 certificate can achieve strong two-factor authentication. Users insert the USB KEY and enter the PIN code for identity authentication, ensuring the authenticity of the identity.

[0023] Digital signature: SM2 algorithm can be used to generate digital signatures to ensure the integrity and non-repudiation of files. Auditors can use the SM2 private key in the USB KEY to sign files and generate signature files.

[0024] File encryption: Before transferring files, you can use the public key of the SM2 certificate to verify the signature of the video file to ensure that the file content has not been tampered with, and then transfer the file through a secure channel.

[0025] Secure communication: During the secure channel handshake process, the SM2 algorithm can be used for key exchange, identity authentication, and message encryption, providing secure communication protection.

[0026] SM3 is a cryptographic hash function, mainly used for digital signature and verification, message authentication code generation and verification, random number generation, etc. Its algorithm is public. For a message of length l (l<264) bits, the SM3 hash algorithm generates a hash value after padding, alternate compression and output selection, and the hash value output length is 256 bits. According to the National Cryptography Administration, its security and efficiency are equivalent to SHA-256, providing higher security. HMAC (Hash-based Message Authentication Code) is a mechanism for verifying the integrity and authenticity of a message. It combines a key and a hash function to generate a unique identification code to ensure that the message has not been tampered with during transmission and can verify the identity of the sender. When HMAC is implemented using the SM3 algorithm, that is, HMAC-SM3, it provides an implementation for the message authentication code based on the national secret SM3 algorithm. It has many characteristics such as high security, fast speed, fixed output length, flexible input length, certification by the National Cryptography Administration, strong anti-collision, suitable for digital signatures, and compatibility with existing systems.

[0027] Data integrity check: Save the user name information on the playback server, use the SM3 algorithm to hash the data, and generate a summary of the data to verify whether the data has been tampered with during transmission or storage.

[0028] Digital signature generation and verification: Generate digital signatures using the SM3 algorithm to ensure the origin and integrity of files and messages while providing non-repudiation.

[0029] Identity authentication: A message authentication code is generated during the authentication process to ensure the authenticity and integrity of the message.

[0030] Secure communication: In the communication between the client terminal and the playback server, HMAC based on the SM3 algorithm is used to verify the integrity and authenticity of the message.

[0031] Secure channel: Based on the GMSSL protocol, the GMSSL logic of the national encryption algorithm is constructed on TCP. The high security and fast computing power of the SM3 algorithm make it an ideal choice for verifying the integrity of messages in encrypted communications. The SM3 algorithm can be used for key derivation, generating symmetric keys or HMAC keys, and enhancing the security of encrypted communications. The SM3 algorithm can effectively prevent data from being tampered with during transmission, thereby improving the security of communications.

[0032] SM4 is a block cipher algorithm proposed by the China National Cryptography Administration. The block length of the algorithm is 128 bits and the key length is 128 bits. The SM4 algorithm uses a 32-round iteration mechanism in the encryption and decryption process.

[0033] In this project, the SM4 algorithm is mainly used in the expansion phase of key generation. In the extraction phase, the client terminal and the playback server first process the initial key material (IKM) and Salt through the HMAC-SM3 function to generate a pseudo-random key (PRK). In the expansion phase, PRK is used as the basic key material and the HKDF-Expand function is used to generate a session key (session_KEY) of the required length. The SM4 algorithm uses this generated session key as its symmetric encryption key for subsequent encryption and decryption operations, thereby ensuring the security of the communication content. As a national symmetric encryption algorithm, SM4's role in this process is to ensure the confidentiality and integrity of data transmission.

[0034] The SM4 algorithm is efficient, secure, and flexible, and complies with national encryption standards, providing a guarantee for the implementation of the implementation example. This embodiment provides corresponding examples to further explain in detail: Open the LED safety delivery system, you can see Figure 4 The client interface is shown, and then the secure channel is established. If the establishment is successful, the handshake is completed. Figure 5 As shown, then log in to the administrator account and register a user in the user management interface. Figure 6 As shown in the figure, for user registration requirements, the password must be no less than 15 characters and contain uppercase and lowercase letters, numbers and special symbols, and the correct registration code must be entered. After successful registration, it will be displayed in the user list and user security authentication can be performed. User security authentication, the user enters the user name and password for login authentication. Figure 7 As shown, then conduct a video security review, such as Figure 8 As shown, click the "Select Video" button, select the video file content that needs to be reviewed locally, click "Preview Video" to review the content, and after the auditor reviews the video, click "Sign Video" to sign the video file, save it locally, and then start video security transmission. Fig. 9 As shown in the video security transmission, obtain the video list in the video security transmission interface, click "Video Verification" to verify the selected video file, and click "Upload File" to upload it after the verification is successful. Finally, play the video safely. Click the "Video Verification" button to verify the video to be played in the video list of the playback server. After the verification is successful, play the video, as shown in the figure below. Fig.10 Video safe to play as shown.

[0035] To sum up, the LED screen security delivery system equipped with a password module in this embodiment establishes a secure channel between the management terminal and the playback server, so that the video content is encrypted during the video delivery process, avoiding the effect that the LED screen cannot be safely delivered due to the replacement of the video content during the video content transmission process.

[0036] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A LED screen security delivery system equipped with a password module, characterized by: include: Management terminal, which is used for video content review, signature and signature verification, video file upload and playback command issuance; The playback server is connected to the management terminal for performing management terminal access authentication, content auditor identity authentication and outputting video playback digital signals; The playback card is connected to the playback server and is also connected to the external LED screen to receive the video playback digital signal output by the playback server, and convert the digital signal into an analog signal and input it into the external LED screen, so that the LED screen displays the content; A secure channel is established between the management terminal and the playback server to encrypt and transmit information between the management terminal and the playback server.

2. The LED screen security delivery system equipped with a password module according to claim 1 is characterized in that: The specific steps of establishing a secure channel between the management terminal and the playback server are as follows: Step 1: Perform the first handshake. The management terminal holds a pair of SM2 public and private keys Kce and Kcd based on national encryption, generates a random number Rc, and sends a "Client Hello" message containing the random number Rc to the playback server. The playback server receives the random number Rc, generates a random number Rs, and sends a "Server Hello" message containing the random number Rs to the management terminal. The management terminal receives the random number Rs, and the first handshake ends. Step 2: Perform a second handshake. The management terminal sends the Client's SM2 digital certificate. The playback server verifies the certificate and obtains the management terminal's digital certificate. The management terminal then sends the Client's digital signature to the playback server. The playback server verifies the signature. The server authenticates the management terminal and the second handshake ends. Step 3: Perform the third handshake. The playback server generates a pre-master key PMS. The playback server encrypts the pre-master key with the public key of the management terminal certificate and sends it to the management terminal. The management terminal decrypts it with the private key to obtain the pre-master key PMS. At this point, both parties hold the random numbers Rc, Rs and the pre-master key PMS. The two parties exchange key parameters and generate the session master key KMS based on the SM4 algorithm. The third handshake ends. Step 4: The management terminal and the playback server use the session key to encrypt and transmit information, and send encrypted "Finish" information to each other for verification. If the verification is successful, the secure channel is successfully established.

3. The LED screen security delivery system equipped with a password module according to claim 2 is characterized in that: The management terminal performs user security authentication during the user login process. The specific method of the user security authentication is as follows: first, the management terminal inputs the Username and the corresponding password, uses the session key to encrypt the Username and attaches the hash value of the password, uses the SM3 hash algorithm, expressed as E(Username || Hash(password), Ks), and sends it to the playback server. After that, the server uses the session key to authenticate the management terminal. After the authentication is successful, the user logs in for subsequent operations.

4. The LED screen security delivery system equipped with a password module according to any one of claims 1 to 3, characterized in that: The specific method for the management terminal to review video content is as follows: the user reviews the video content through the management terminal. After the review is passed, the digital certificate based on the SM2 national encryption algorithm stored in the USB KEY in the management terminal is used, and then the private key of the certificate in the USB KEY is called to sign the reviewed video, and the video signature file is saved in the management terminal.

5. The LED screen security delivery system equipped with a password module according to claim 4 is characterized in that: The specific method for uploading the video file in the management terminal is as follows: verify the signature of the video file, use the session key and the national secret SM3 algorithm to generate HMAC, calculate the HMAC value of the data Data, splice the original data and its HMAC value together, and finally use the key Ks to encrypt the spliced ​​data, expressed as E(Data || HMAC(Data), Ks), then the playback server decrypts the data, authenticates the authenticity of the management terminal identity, and saves the video file to the server after authentication to achieve secure video transmission.

6. The LED screen security delivery system equipped with a password module according to any one of claims 1 to 3, characterized in that: The specific method in which the playback server outputs the video playback digital signal is as follows: the management terminal sends a playback request to the playback server, the playback server uses the SM3 hash function to calculate the video file, and returns the hash value to the management terminal. The management terminal verifies the signature of the video file. If the signature verification passes, the playback server plays the video.

Images