Bit stream, bit stream signature and authentication method

Abstract

The invention discloses a bit stream, a bit stream signature and an authentication method, and relates to the technical field of multimedia. The bit stream signature method comprises the steps that a computing device obtains a security parameter set and authentication data and then outputs a bit stream, and the bit stream comprises the security parameter set and the authentication data. Wherein the security parameter set comprises an identifier, and the identifier is used for indicating a calculation mode of the abstract; the authentication data comprises signature data, the signature data is obtained by signing secondary abstract data, and the secondary abstract data is obtained by processing abstract data of each data unit of a group of data units in the bit stream according to an abstract calculation mode indicated by the identifier. In the embodiment of the invention, the calculation equipment determines the calculation mode of the abstract of one group of data units according to the identifier in the security parameter set, so that the calculation mode of the abstract of the data units can be flexibly selected according to factors such as the calculation performance of the end-side equipment, and the applicability of the abstract is improved.

Description

[0001] This application claims the priority of a Chinese patent application with the application number 202410104552.0 and the application title "A Bitstream, Bitstream Signature and Digest Calculation Method" filed with the National Intellectual Property Administration on January 24, 2024, the entire content of which is incorporated herein by reference. Technical Field

[0002] This application relates to the field of multimedia technologies, and in particular, to a bitstream, a bitstream signature, and an authentication method. Background Art

[0003] In many audio and video encoding and decoding scenarios (such as surveillance, live broadcast, video-on-demand, etc.), there are certain requirements for the authenticity and integrity of audio and video content; therefore, in order to ensure the security of audio and video content during transmission and prevent the audio and video content from being tampered with during transmission, it is necessary to sign the audio and video content.

[0004] Currently, the process of signing a bitstream is as follows: generate digests corresponding to access units in the bitstream, and then use a digital signature algorithm to sign the digests, and thus write the signature into the bitstream. However, in the signature process, only a fixed digest calculation method is adopted, which cannot be flexibly adjusted according to the calculation performance factors of the terminal device, and the applicability is poor. Summary of the Invention

[0005] This application provides a bitstream, a bitstream signature, and an authentication method to solve the problem that in the signature process, only a fixed digest calculation method is adopted, which cannot be flexibly adjusted according to the calculation performance factors of the terminal device, and the applicability is poor.

[0006] This application adopts the following technical solutions.

[0007] In a first aspect, an embodiment of this application provides a bitstream signature method. This bitstream signature method is executed by a computing device or a chip in the computing device. For example, the computing device may refer to a mobile phone, a computer, etc. Exemplarily, the method includes: the computing device obtains authentication data, and then outputs a bitstream, where the bitstream includes a security parameter set and authentication data. The security parameter set includes an identifier, and the identifier is used to indicate the digest calculation method; the authentication data includes signature data, and the signature data is obtained by signing secondary digest data, and the secondary digest data is obtained by processing the digest data of each data unit in a group of data units in the bitstream according to the digest calculation method indicated by the identifier.

[0008] In this application, the computing device determines the digest calculation method for a group of data units according to the identifier in the security parameter set, and thus can flexibly select the digest calculation method for the data units according to factors such as the calculation performance of the terminal device, improving the applicability of the digest.

[0009] In a possible scenario, the authentication data of a set of data units corresponds to a set of security parameters.

[0010] In a possible implementation, the identifier is a first value, and the first value is used to indicate that the calculation method of the digest is to concatenate the digest data of each data unit in a set of data units, and calculate the secondary digest of the concatenated digest data to obtain the secondary digest data.

[0011] In a possible implementation, the identifier is a second value, and the second value is used to indicate that the calculation method of the digest is to concatenate the (n + 1)-th combined digest data and the digest data of the (n + 2)-th data unit in the bitstream order, calculate the digest of the concatenated data to obtain the (n + 2)-th combined digest data, until the digest data of each data unit in a set of data units participates in the concatenation to obtain the secondary digest data; the (n + 1)-th combined digest data is obtained by calculating the digest after concatenating the n-th combined digest data and the digest data of the (n + 1)-th data unit, where n is a positive integer.

[0012] In a possible implementation, the data unit is a Network Abstraction Layer (NAL) unit.

[0013] In a possible implementation, the data unit is a layer unit, and the layer unit includes Network Abstraction Layer (NAL) units with the same layering identifier.

[0014] In a possible implementation, the data unit is an access unit.

[0015] In a possible implementation, the authentication data further includes the digest data of each data unit in a set of data units.

[0016] In a possible implementation, the computing device obtains a set of security parameters and authentication data, including: generating a set of security parameters and authentication data.

[0017] In a possible implementation, before the computing device outputs the bitstream, the above bitstream signature method further includes: the computing device adds the authentication data to the bitstream.

[0018] In a possible implementation, the set of security parameters corresponds to the authentication data. For example, the above authentication data is the authentication data corresponding to the security parameter set of the display image.

[0019] In a second aspect, an embodiment of the present application provides a bitstream. The bitstream includes a set of data units, a set of security parameters, and authentication data. Among them, the set of security parameters includes an identifier, and the identifier is used to indicate the calculation method of the digest; the authentication data includes signature data, and the signature data is obtained by signing the secondary digest data, and the secondary digest data is obtained by processing the digest data of each data unit in a set of data units in the bitstream according to the calculation method of the digest indicated by the identifier.

[0020] In a possible implementation, the identifier is a first value, and the first value is used to indicate that the calculation method of the digest is to concatenate the digest data of each data unit in a group of data units, and calculate the secondary digest of the concatenated digest data to obtain the secondary digest data.

[0021] In a possible implementation, the identifier is a second value, and the second value is used to indicate that the calculation method of the digest is to concatenate the (n + 1)-th combined digest data and the digest data of the (n + 2)-th data unit in the bitstream order, calculate the digest of the concatenated data to obtain the (n + 2)-th combined digest data, until the digest data of each data unit in a group of data units participates in the concatenation to obtain the secondary digest data; the (n + 1)-th combined digest data is obtained by calculating the digest after concatenating the n-th combined digest data and the digest data of the (n + 1)-th data unit, where n is a positive integer.

[0022] In a possible implementation, the data unit is a Network Abstraction Layer (NAL) unit.

[0023] In a possible implementation, the data unit is a layer unit, and the layer unit includes Network Abstraction Layer (NAL) units with the same layering identifier.

[0024] In a possible implementation, the data unit is an access unit.

[0025] In a possible implementation, the authentication data further includes the digest data of each data unit in a group of data units.

[0026] In a third aspect, an embodiment of the present application provides a bitstream authentication method. The bitstream authentication method is executed by a computing device or a chip in the computing device. For example, the computing device may be a mobile phone or a computer, etc. Exemplarily, the method includes: the computing device determines the first digest data of each data unit in a group of data units in the bitstream, and obtains the authentication data from the bitstream. Further, if the signature data is successfully verified, then based on the first digest data of each data unit in a group of data units in the bitstream, the multiple second digest data in the authentication data is verified. Among them, the authentication data includes: signature data and the second digest data of each data unit in a group of data units. The signature data is obtained by signing the secondary digest data, and the secondary digest data is obtained by processing the second digest data of each data unit in a group of data units in the bitstream according to the digest calculation method indicated by the identifier. The security parameter set in the bitstream includes the identifier.

[0027] In a possible implementation, the identifier is a first value, and the first value is used to indicate that the calculation method of the digest is to concatenate the second digest data of each data unit in a group of data units, and calculate the secondary digest of the concatenated second digest data to obtain the secondary digest data.

[0028] In a possible implementation, the identifier is a second value, and the second value is used to indicate that the calculation method of the digest is to concatenate the (n + 1)-th combined digest data and the second digest data of the (n + 2)-th data unit in the bitstream order, calculate the digest of the concatenated data to obtain the (n + 2)-th combined digest data, until the digest data of each data unit in a group of data units participates in the concatenation to obtain the second-level digest data; the (n + 1)-th combined digest data is obtained by calculating the digest after concatenating the n-th combined digest data and the second digest data of the (n + 1)-th data unit, where n is a positive integer.

[0029] In a possible implementation, the data unit is a Network Abstraction Layer (NAL) unit.

[0030] In a possible implementation, the data unit is a layer unit, and the layer unit includes Network Abstraction Layer (NAL) units with the same layering identifier.

[0031] In a possible implementation, the data unit is an access unit.

[0032] In a fourth aspect, an embodiment of the present application provides a bitstream authentication method. The bitstream authentication method is executed by a computing device or a chip in the computing device. For example, the computing device may be a mobile phone or a computer, etc. Exemplarily, the method includes: the computing device determines the first digest data of a group of data units in the bitstream, obtains the authentication data from the bitstream, and then uses the first digest data to verify the signature data. Among them, the authentication data includes the signature data, the signature data is obtained by signing the second-level digest data, the second-level digest data is obtained by processing the second digest data of each data unit in a group of data units in the bitstream according to the digest calculation method indicated by the identifier, and the security parameter set in the bitstream includes the identifier.

[0033] In a possible implementation, the computing device determines the first digest data of a group of data units in the bitstream, including: the computing device determines the third digest data of each data unit in a group of data units in the bitstream, and then processes the third digest data of each data unit in the group of data units according to the digest calculation method indicated by the identifier to obtain the first digest data of the group of data units.

[0034] In a possible implementation, the identifier is a first value, and the first value is used to indicate that the calculation method of the digest is to concatenate the digest data of each data unit in a group of data units and calculate the second-level digest of the concatenated digest data to obtain the second-level digest data.

[0035] In a possible implementation, the identifier is a second value, and the second value is used to indicate that the calculation method of the digest is to concatenate the (n + 1)-th combined digest data and the digest data of the (n + 2)-th data unit in the bitstream order, calculate the digest of the concatenated data to obtain the (n + 2)-th combined digest data, until the digest data of each data unit in a group of data units participates in the concatenation to obtain the secondary digest data; the (n + 1)-th combined digest data is obtained by calculating the digest after concatenating the n-th combined digest data and the digest data of the (n + 1)-th data unit, where n is a positive integer.

[0036] In a possible implementation, the data unit is a Network Abstraction Layer (NAL) unit.

[0037] In a possible implementation, the data unit is a layer unit, and the layer unit includes Network Abstraction Layer (NAL) units with the same layering identifier.

[0038] In a possible implementation, the data unit is an access unit.

[0039] In a fifth aspect, the present application provides a bitstream signature device. The bitstream signature device includes a module for executing the method of the first aspect or any possible implementation of the first aspect.

[0040] In a sixth aspect, the present application provides a bitstream authentication device. The bitstream authentication device includes a module for executing the method of the third aspect or any possible implementation of the third aspect, or the bitstream authentication device includes a module for executing the method of the fourth aspect or any possible implementation of the fourth aspect.

[0041] In a seventh aspect, an embodiment of the present application provides a computing device. The computing device includes: a memory and a processor; the memory stores program instructions, and when the program instructions are executed by the processor, the computing device executes the bitstream signature method in the first aspect or any possible implementation of the first aspect, or executes the bitstream authentication method in the third aspect or any possible implementation of the third aspect, or executes the bitstream authentication method in the fourth aspect or any possible implementation of the fourth aspect.

[0042] In an eighth aspect, an embodiment of the present application provides a chip. The chip includes one or more interface circuits and one or more processors; the one or more processors receive or send data through the one or more interface circuits, and when the one or more processors execute computer instructions, the steps of the bitstream signature method in the first aspect or any possible implementation of the first aspect are executed, or the steps of the bitstream authentication method in the third aspect or any possible implementation of the third aspect are executed, and the steps of the bitstream authentication method in the fourth aspect or any possible implementation of the fourth aspect are executed.

[0043] In a ninth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when running on a computer or a processor, causes the computer or the processor to execute the bitstream signature method in the first aspect or any possible implementation manner of the first aspect, or execute the bitstream authentication method in the third aspect or any possible implementation manner of the third aspect, or execute the bitstream authentication method in the fourth aspect or any possible implementation manner of the fourth aspect.

[0044] In a tenth aspect, an embodiment of the present application provides a computer program product. The computer program product includes computer instructions, which, when executed by a computer or a processor, cause the computer or the processor to execute the bitstream signature method in the first aspect or any possible implementation manner of the first aspect, or execute the bitstream authentication method in the third aspect or any possible implementation manner of the third aspect, or execute the bitstream authentication method in the fourth aspect or any possible implementation manner of the fourth aspect.

[0045] In an eleventh aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium. The computer-readable storage medium stores the bitstream in the second aspect or any possible implementation manner of the second aspect.

[0046] In a twelfth aspect, an embodiment of the present application provides a device for storing a bitstream. The device includes: a receiver and at least one storage medium, and the receiver is configured to receive the bitstream in the second aspect or any possible implementation manner of the second aspect.

[0047] In a thirteenth aspect, an embodiment of the present application provides a device for transmitting a bitstream. The device includes: a transmitter and at least one storage medium, and at least one storage medium is configured to store the bitstream in the second aspect or any possible implementation manner of the second aspect; the transmitter is configured to obtain the bitstream from the storage medium and send the bitstream to an end-side device through a transmission medium.

[0048] In a fourteenth aspect, an embodiment of the present application provides a system for distributing a bitstream. The system includes: at least one storage medium for storing at least one bitstream in the second aspect or any possible implementation manner of the second aspect; a streaming media device for obtaining a target bitstream from at least one storage medium and sending the target bitstream to an end-side device, where the streaming media device includes a content server or a content distribution server.

[0049] Regarding the beneficial effects of the second aspect to the fourteenth aspect, reference may be made to the description of any implementation manner in the first aspect or the second aspect, and details are not described herein again. Based on the implementation manners provided in the above aspects of the present application, further combinations can be made to provide more implementation manners. Description of the Drawings

[0050] Figure 1 Schematic diagram of the application scenario provided for this application;

[0051] Figure 2 Schematic diagram of the structure of the signature and authentication system provided for this application;

[0052] Figure 3 Flow schematic of a bitstream signature method provided for this application Figure 1 ;

[0053] Figure 4 Schematic of the digest calculation of a set of data units provided for this application Figure 1 ;

[0054] Figure 5 Schematic of the digest calculation of a set of data units provided for this application Figure 2 ;

[0055] Figure 6 Flow schematic of a bitstream signature method provided for this application Figure 2 ;

[0056] Figure 7 Flow schematic of a bitstream authentication method provided for this application Figure 1 ;

[0057] Figure 8 Flow schematic of a bitstream authentication method provided for this application Figure 2 ;

[0058] Figure 9 Schematic diagram of the bitstream signature device provided for this application;

[0059] Figure 10a Schematic of the bitstream authentication device provided for this application Figure 1 ;

[0060] Figure 10b Schematic of the bitstream authentication device provided for this application Figure 2 ;

[0061] Figure 11 Schematic diagram of the computing device provided for this application. Detailed implementation manners

[0062] The present application provides a bitstream signature method, which includes: a computing device obtains a set of security parameters and authentication data, and then outputs a bitstream, which includes the set of security parameters and the authentication data. Among them, the set of security parameters includes an identifier, which is used to indicate the calculation method of the digest; the authentication data includes signature data, which is obtained by signing secondary digest data, and the secondary digest data is obtained by processing the digest data of each data unit in a group of data units in the bitstream according to the calculation method of the digest indicated by the identifier.

[0063] In the present application, the computing device determines the calculation method of the digest of a group of data units according to the identifier in the set of security parameters, and then can flexibly select the calculation method of the digest of the digest data of the data units according to factors such as the computing performance of the end-side device, improving the applicability of the calculation of the secondary digest data.

[0064] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the following described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without making creative efforts belong to the scope of protection of the present application.

[0065] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist simultaneously, and B exists alone.

[0066] The terms "first" and "second" etc. in the description and claims of the embodiments of the present application are used to distinguish different objects, rather than to describe a specific order of the objects. For example, the first target object and the second target object etc. are used to distinguish different target objects, rather than to describe the specific order of the target objects.

[0067] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design solution described as "exemplary" or "for example" in the embodiments of the present application should not be construed as being more preferred or more advantageous than other embodiments or design solutions. Exactly speaking, using words such as "exemplary" or "for example" aims to present relevant concepts in a specific manner.

[0068] In the description of the embodiments of the present application, unless otherwise specified, the meaning of "a plurality" refers to two or more. For example, a plurality of processing units refers to two or more processing units; a plurality of systems refers to two or more systems.

[0069] The following gives an introduction to related technologies.

[0070] Bitstream, the binary data stream formed by encoding image / audio frames. Both NAL unit stream and byte stream can be referred to as bitstream.

[0071] Network abstract layer unit (NAL unit), a syntax structure that contains the type indication of the subsequent data and the number of bytes included (located in the NAL header), and the data appears in the form of raw byte sequence payload (RBSP), which may also include scattered anti-counterfeiting bytes when necessary. For example, the NAL unit includes the security parameter set NAL unit (which can also be referred to as the security data set) or the authentication data NAL unit (which can also be referred to as the authentication data).

[0072] Layer unit (LU) is a set of NAL units with the same layer identification (layer_id) value that are associated with each other according to specified rules and are consecutive in the decoding order.

[0073] Access unit (AU), a group of NAL units that are associated with each other according to specified rules and are consecutive in the decoding order, constituting a compressed video bitstream (which can also be referred to as bitstream). Bitstream represents the binary data stream formed by encoding image / audio frames.

[0074] Data unit, the basic syntax structure of the encoded bitstream, which can be an NAL unit, a layer unit, or an access unit. This data unit can also be referred to as the basic unit or the basic data unit.

[0075] Layer_id, an unsigned integer of 2 bits, used to indicate the layer identification of the current image. The value range of the layer identification is 0 to MAX_LAYER - 1. The layer_id of the picture header NAL unit and all coded slice NAL units of an encoded image should be the same. The value of LayerId is equal to the value of layer_id. The LayerId of an encoded image or layer unit is the LayerId of the coded slice NAL units within that encoded image or layer unit.

[0076] When the nal_unit_type of a NAL unit is 5, 7, 8, 9, 10, or 15, the LayerId should be 0.

[0077] When the nal_unit_type of a NAL unit is 6 and the NAL unit includes a supplementary enhancement payload with PayloadType of 19, 25, 26, or 127, the LayerId should be 0.

[0078] It should be noted that MAX_LAYER is specified by the grade.

[0079] It should be noted that, from another dimension, the data unit may also include a coded picture.

[0080] A coded picture is the coded representation of a picture.

[0081] A coded video sequence is the highest-level syntax structure of a bitstream and contains one or more consecutive access units. A coded video sequence starts with an access unit of an IDR picture (instantaneous decoding refresh picture), an access unit of a RAPI picture (random access point I picture), an access unit of a leading library picture of an RL picture, or an access unit of a display knowledge picture. The end of the bitstream NAL unit or the end of the coded video sequence NAL unit indicates the end of a coded video sequence. Each coded video sequence contains at most one IDR picture, RAPI picture, leading library picture of an RL picture, or display knowledge picture. The access units are arranged in bitstream order in the bitstream, and the bitstream order should be the same as the decoding order. The decoding order may not be the same as the display order.

[0082] The RBSP of the security parameter set (SEC) includes some parameters that can be used by one or more other types of NAL units. The foregoing parameters are configuration parameters required for signing and authenticating the compressed video bitstream. The knowledge picture is encrypted or authenticated independently of the display picture, and the knowledge picture identification (sec_is_library_flag) in the security parameter data RBSP is used to distinguish whether it is the security parameter set of the knowledge picture. The bitstream may contain multiple security parameter sets, which are distinguished by the security parameter set ID (sec_para_set_id), and up to 3 security parameter sets are supported simultaneously. There should be a security parameter set NAL unit before the random access point access unit or the first knowledge picture access unit of the random access segment (RAS), which acts on the current RAS or knowledge picture. The security parameter set provides parameters for the encryption and authentication of the current RAS or knowledge picture access unit. In the case of multiple security parameter sets, the sec_para_set_id is used to distinguish; if there is no security parameter set NAL unit in the random access point access unit of the RAS, it is considered that the current RAS (excluding non-display knowledge picture access units) is not encrypted and does not participate in authentication; if there is no security parameter set NAL unit in the first knowledge picture access unit, it is considered that the current knowledge picture is not encrypted and does not participate in authentication. The security parameter set NAL unit should be in the same access unit as the sequence parameter set NAL unit, and the security parameter set NAL unit should be before the sequence parameter set NAL unit. If the access unit includes an access unit delimiter NAL unit, the security parameter set NAL unit should be after the access unit delimiter NAL unit.

[0083] The knowledge picture is a reference picture other than the current bitstream used when decoding the current bitstream. Each frame of picture corresponds to a sequence parameter set, and the coded picture with the knowledge bitstream flag of 1 in the corresponding sequence set parameters. The NAL unit type of the coded slice of the knowledge picture is 12, 17 or 18, and the knowledge picture is associated with the privacy coded slice.

[0084] The output library picture is a coded picture with the knowledge bitstream flag of 1 and the knowledge picture mode index of 1 in the corresponding sequence set parameters for each frame of picture. The NAL unit type of the coded slice of the output library picture is 17. The output library picture is a random access point picture, and the output library picture as the RL preamble knowledge picture is not a random access point picture.

[0085] Non-output library picture. Each frame of picture corresponds to a sequence parameter set, and the coded picture has a knowledge bitstream flag of 1 and a knowledge picture mode index of 0 or 2 in the corresponding sequence set parameters. The NAL unit type of the coded slice of the non-output library picture is 12 or 18.

[0086] Leading library picture of an RL picture. It is a non-output library picture whose bitstream order is before an associated RL picture or a display library picture newly appearing before an RL picture after bitstream editing. There is no access unit of other pictures between the access unit where the first coded slice of the knowledge picture is located and the access unit of the associated RL picture. The leading library picture of an RL picture is not a random access point picture.

[0087] It should be noted that if the leading library picture of an RL picture is a display library picture, the display library picture does not need to be output at this time, and it can be identified through the display information SEI payload of the display library picture (library_display_flag should be '0').

[0088] Non-leading library picture of an RL picture. It is a non-output library picture whose bitstream order is before an associated RL picture. There is at least one access unit of other pictures between the access unit where the first coded slice of the non-output library picture is located and the access unit of the associated RL picture. The non-leading library picture of an RL picture is not a random access point picture.

[0089] Output picture. It is an RL picture, IDR picture, P picture, B picture or RAPI picture whose reconstructed picture is output after being decoded by the decoder. It should be noted that both the display library picture and the non-output library picture do not belong to the output picture defined in this case.

[0090] An image is a frame of an encoded video sequence, and its encoded data is contained in one or more access units. Its encoded image consists of an image header NAL unit, supplementary enhancement information (if any), and all encoded slice NAL units of the image. Specifically, the encoded image of an IDR image includes an image header NAL unit, zero or more supplementary extension description NAL units of the IDR image, and all IDR image encoded slice NAL units of the IDR image. The encoded image of a RAPI image includes an image header NAL unit, zero or more supplementary extension description NAL units of the RAPI image, and all RAPI image encoded slice NAL units of the RAPI image. The encoded images of P images and B images include an image header NAL unit, zero or more supplementary extension description NAL units of the P image or B image, and all non-random access point picture (NRAP) encoded slice NAL units of the P image or B image. The encoded image of an RL image includes an image header NAL unit, zero or more supplementary extension description NAL units of the RL image, and all RL image encoded slice NAL units of the RL image. The encoded image of a knowledge image consists of an image header NAL unit, one or more knowledge image encoded slice NAL units, and one or more privacy image encoded slice NAL units. The RL pre-knowledge image, the privacy image encoded slice NAL units, and all encoded slice NAL units in the encoded image of the display knowledge image are consecutive. Its access unit contains all NAL units of the encoded image. The encoded slices of non-RL pre-knowledge images can be interleaved with the access units of the display images as access units.

[0091] The first encoded slice NAL unit of an image shall immediately follow the image header NAL unit of the image. For the encoded images of IDR images, RAPI images, RL images, or knowledge images, the image header NAL shall immediately follow an image parameter set NAL unit, and the image parameter set NAL shall immediately follow a sequence parameter set NAL unit.

[0092] Specifically, one or more bitstreams of display images can be interleaved between multiple knowledge image bitstream slices of non-RL pre-knowledge images, but the interleaved display image bitstreams shall not be access units of RL images, IDR images, or RAPI images. All knowledge image bitstream slices of an RL pre-knowledge image or a display knowledge image shall be consecutive. After each knowledge image bitstream slice, it can be interleaved with privacy image encoded slice NAL units (if any), but not with the bitstreams of display images.

[0093] The bitstreams of all slices of a knowledge image should be located before the bitstream of the first RL image that references the knowledge image. The knowledge image bitstream slices of different knowledge images cannot be interleaved. The knowledge image referenced by an RL image is the knowledge image represented by the access unit of the first knowledge image found in reverse order in the decoding order starting from the RL access unit in the bitstream.

[0094] Hash period (hash_period_in_doi_minus), 8-bit unsigned integer, value range 0 ~ (MAX_HASH_PERIOD / NumOfLayers-1), MAX_HASH_PERIOD is set to 256. HashPeriodInDoi is equal to hash_period_in_doi_minus1+1. Indicates the number of access units involved in signature authentication related to one authentication data. This number is less than or equal to HashPeriodInDoi.

[0095] According to the HashPeriodInDoi configured by the user, set hash_period_in_doi_minus1 to HashPeriodInDoi minus 1. HashPeriodInDoi is 1, which means that a single access unit is independently signed, and the authentication data NAL unit carrying the signature should be located in the access unit associated with the signature or the first access unit after it. HashPeriodInDoi greater than 1 means that multiple access units are jointly signed.

[0096] NumOfLayers is the number of spatial domain stratification layers.

[0097] It should be noted that the present application does not group the data units, but for the convenience of description, uses "a group of data units" to describe.

[0098] Exemplarily, a group of data units may include n data units, all of which are data units that need to be authenticated, and n is a positive integer. Correspondingly, the authentication data may include n summary data, and the n summary data correspond one-to-one to the n data units. Exemplarily, "a group of data units" may also be described as "n data units".

[0099] Exemplarily, a plurality of summary data of a group of data units may constitute a summary data list; that is, the authentication data may include the summary data list.

[0100] Exemplarily, the authentication data may be Auth.

[0101] Exemplarily, the signature data may be signature.

[0102] Exemplarily, the digest data may also be referred to as authentication digest data or digest.

[0103] Exemplarily, the bitstream may be an audio compression bitstream (or referred to as an audio compression code stream) or a video compression bitstream (or referred to as a video compression code stream), and the present application does not limit this. The present application takes the signing and authentication of a video compression bitstream as an example for illustration.

[0104] As Figure 1 shown, Figure 1 it is a schematic diagram of the application scenario provided by the present application. Figure 1 It shows a monitoring scenario, a live broadcast scenario, and an on-demand scenario.

[0105] Referring to Figure 1 , exemplarily, in the monitoring scenario, the camera 11 may sign the monitoring video bitstream to obtain the signed monitoring video bitstream 101. Then, the signed monitoring video bitstream 101 is sent to the laptop 13 through the network 12. After that, the laptop 13 may authenticate the signed monitoring video bitstream 101 to obtain the authentication result 105 and display it, and play the monitoring video 104.

[0106] Referring to Figure 1 , exemplarily, in the live broadcast scenario, the mobile phone 14 may sign the live broadcast video bitstream to obtain the signed live broadcast video bitstream 102. Then, the signed live broadcast video bitstream 102 is sent to the mobile phone 15 through the network 12. After that, the mobile phone 15 may authenticate the signed live broadcast video bitstream 102 to obtain the authentication result 107 and display it, and play the live broadcast video 106.

[0107] Referring to Figure 1 , exemplarily, in the on-demand scenario, the personal computer 16 may sign the on-demand video bitstream to obtain the signed on-demand video bitstream 103. Then, the signed on-demand video bitstream 103 is sent to the mobile phone 17 through the network 12. After that, the mobile phone 17 may authenticate the signed on-demand video bitstream 103 to obtain the authentication result 109 and display it, and play the on-demand video 108.

[0108] It should be understood that the present application can also be used in other scenarios of audio and video encoding and decoding, such as the digital content trust scenario, etc., and the present application does not limit this.

[0109] As Figure 2 shown, Figure 2 it is a schematic diagram of the structure of the signing and authentication system provided by the present application. The Figure 2 in Figure 1 explains the authentication and signing processes in the above

[0110] Referring toFigure 2 , exemplarily, the authentication and signature system 200 may include a signature end 210 and an authentication end 220.

[0111] For example, the signature end 210 may be the above-mentioned Figure 1 camera 11, mobile phone 14, and personal computer 16, and the authentication end 220 may be the above-mentioned Figure 1 laptop 13, mobile phone 15, and mobile phone 17.

[0112] It should be understood that the same terminal device may serve as both the signature end 210 and the authentication end 220, and this application does not limit this.

[0113] Continuing to refer to Figure 2 , exemplarily, after the signature end 210 obtains the video data 201, it may perform video encoding 21 on the video data 201 to obtain a bitstream 202; and perform video signature 22 on the bitstream 202 to obtain a signed bitstream 203.

[0114] For example, the video data 201 may be the surveillance video captured by the above-mentioned Figure 1 camera 11, the live video recorded by the mobile phone 14, or the on-demand video produced by the personal computer 16.

[0115] For example, the signed bitstream 203 may be the signed surveillance video bitstream 101, the signed live video bitstream 102, or the signed on-demand video bitstream 103 in the above-mentioned Figure 1 .

[0116] It should be noted that the two operations of video encoding 21 and video signature 22 may be executed in parallel.

[0117] In a possible implementation, the signature end 210 may include an encoder, and the encoder performs video encoding 21 and video signature 22. In a possible way, the signature end 210 may include an encoder and a signature module, and the encoder performs video encoding 21 and the signature module performs video signature 22. In a possible way, the signature end 210 may include a signature module, and the signature module performs video encoding 21 and video signature 22.

[0118] After that, the signature end 210 may send the signed bitstream 203 to the authentication end 220.

[0119] Continuing to refer to Figure 2 , exemplarily, after the authentication end 220 receives the signed bitstream 203, it may perform video authentication 23 on the signed bitstream 203 to obtain an authentication result 205; and may perform video decoding 24 on the bitstream 202 in the signed bitstream 203 to obtain decoded video data 204.

[0120] For example, the decoded video data 204 may be the surveillance video 104, the live video 106, or the on-demand video 108 described above. Figure 1

[0121] For example, the authentication result 205 may be the authentication result 105, the authentication result 107, or the authentication result 109 described above. Figure 1

[0122] It should be noted that the two operations of video authentication 23 and video decoding 24 can be executed in parallel.

[0123] In a possible implementation, the authentication end 220 may include a decoder, and the decoder performs video decoding 24 and video authentication 23.

[0124] In a possible implementation, the authentication end 220 may include a decoder and an authentication module. The decoder performs video decoding 24 and the authentication module performs video authentication 23.

[0125] In a possible implementation, the authentication end 220 may include an authentication module, and the authentication module performs video decoding 24 and video authentication 23.

[0126] It should be noted that when the signing end 210 performs lossless encoding, the video data is the same as the decoded video data; when the signing end 210 performs lossy encoding, there are differences between the video data and the decoded video data.

[0127] It should be noted that the encoder, decoder, and authentication module can be implemented by software or hardware, and this application does not limit this.

[0128] The following describes in detail the implementation manners of the embodiments of the present application with reference to the accompanying drawings.

[0129] Figure 3 is a flowchart of a bitstream signature method provided by the present application Figure 1 , and this bitstream signature method can be applied to Figure 2 the signature and authentication system shown in Figure 2 . For example, this bitstream signature method can be implemented by the processing device 300. In a possible example, the processing device 300 may be the signing end 210 shown in

[0130] S310. The processing device 300 obtains a security parameter set and authentication data.

[0131] Among them, the security parameter set includes an identifier, which is used to indicate the calculation method of the digest; the authentication data includes signature data, which is obtained by signing the secondary digest data, and the secondary digest data is obtained by processing the digest data of each data unit in a set of data units in the bitstream according to the calculation method of the digest indicated by the identifier.

[0132] Exemplarily, the secondary digest data may also be referred to as the secondary digest value.

[0133] Exemplarily, when authentication needs to be supported, the number n of data units to be authenticated can be determined. Wherein, n is a positive integer.

[0134] Refer to Figure 3 , exemplarily, the n data units to be authenticated in the bitstream a are respectively: data unit 1, data unit 2,..., data unit n. These n data units to be authenticated can be referred to as a set of data units. A set of data units involved subsequently all refers to the data units to be authenticated.

[0135] Exemplarily, refer to Figure 3 , the processing device 300 can independently calculate a digest for each data unit in a set of data units, and the digests of each data unit in the set of data units can be obtained. The n digests can include: digest data 1, digest data 2,..., digest data n; wherein, the n digest data correspond one-to-one with the n data units; for example, digest data 1 corresponds to data unit 1, digest data 2 corresponds to data unit 2,..., digest data n corresponds to data unit n.

[0136] It should be noted that the present application does not group the data units, but for the convenience of description, the term "a set of data units" is used to describe.

[0137] Exemplarily, the identifier may be the authentication_hash_mode, which is used to indicate the calculation method of the digest. The authentication_hash_mode is configured by the user in the security parameter set as needed. The calculation method of the digest may also be referred to as the calculation method of the secondary digest.

[0138] For the above identifier, the following two possible implementation manners are provided.

[0139] In the first possible implementation manner, the above identifier is a first value (such as 0), and the first value is used to indicate that the secondary digest is calculated in a concatenation manner, that is, the calculation method of the digest is to concatenate the digest data of each data unit in a set of data units and calculate the secondary digest of the concatenated digest data to obtain the secondary digest data. The above calculation of the secondary digest may also be referred to as the calculation of the secondary digest.

[0140] For the first possible implementation described above, a possible embodiment is provided below. As Figure 4 shown, Figure 4 This is a schematic diagram of the digest calculation of a group of data units provided by this application Figure 1 .

[0141] After the processing device 300 confirms that the identifier is the first value from the security parameter set, it concatenates the digests of each data unit in a group of data units and then calculates the secondary digest of the group of data units to obtain the secondary digest data.

[0142] The following takes the data unit as a layer unit as an example for illustration. The processing device 300 concatenates the digest values Hpic1, Hpic2,..., Hpicn of each layer unit in a group of layer units in bitstream order, and calculates the digest of the concatenated digest (digest data) to obtain the secondary digest data, that is, uses the concatenation method to perform the secondary digest. For example, for the digest values Hpic1, Hpic2,..., Hpicn of each layer unit in bitstream order, refer to Figure 4 Use the concatenation method to perform the secondary digest.

[0143] For example, if the above group of layer units includes 50 layer units, and the data volume of the digest data of one layer unit is 32 bits (bytes), therefore, the processing device 300 needs to calculate the digest 50 times first to obtain the digest data of each layer unit in a group of layer units. Further, the digest data of 50 layer units are spliced to obtain the spliced digest data (data volume is 32 * 50 bytes), and then a digest is calculated for the spliced digest data to obtain the secondary digest data of a group of layer units. The entire process may take time T1, and the measured T1 is 90.7901 ms.

[0144] In this application, the digest calculation process needs to be implemented using a key module. Since each call to the key module needs to be configured first, and this operation takes a long time, therefore, the above-mentioned obtained digest Hg only needs to calculate the digest n + 1 times to obtain, reducing the number of times of calculating the digest, thereby reducing the time and computing performance required for calculating the digest, and improving the efficiency of calculating the digest.

[0145] In the second possible implementation, the above identifier is the second value (such as 1), and this second value is used to indicate that the tree-top method is used to calculate the secondary digest, that is, the calculation method of the digest is to use the tree-top digest calculated based on the digest data of each data unit in a group of data units as the secondary digest data.

[0146] For example, the processing device 300 concatenates the (n + 1)-th combined digest data and the digest data of the (n + 2)-th data unit in the bitstream order, calculates the digest of the concatenated data to obtain the (n + 2)-th combined digest data, and so on until the digest data of each data unit in a group of data units participates in the concatenation to obtain the secondary digest data; the (n + 1)-th combined digest data is obtained by calculating the digest after concatenating the n-th combined digest data and the digest data of the (n + 1)-th data unit, or the (n + 1)-th combined digest data is obtained by calculating the digest after concatenating the digest data of the n-th data unit and the digest data of the (n + 1)-th data unit, where n is a positive integer.

[0147] Among them, the (n + 1)-th data unit and the (n + 2)-th data unit are arranged in sequence in the bitstream order.

[0148] For the above second possible implementation manner, a possible embodiment is provided below. As Figure 5 shown, Figure 5 is a schematic diagram of digest calculation for a group of data units provided by this application Figure 2 . This digest value can also be called digest data. Hereinafter, taking the data unit as a layer unit as an example for description.

[0149] A value of '1' indicates that the tree-top method is used to calculate the secondary digest, that is, for the digest values Hpic1, Hpic2,..., Hpicn of each layer unit in a group of layer units, Hpic1 and Hpic2 are concatenated together in the bitstream order, and the digest of the concatenated Hpic1 and Hpic2 is calculated to obtain the combined digest data Hpic1,2. Then, Hpic1,2 and Hpic3 are concatenated together, and the digest of the concatenated Hpic1,2 and Hpic3 is calculated to obtain the combined digest data Hpic1,3, and so on, until Hpic1,n - 1 and Hpicn are concatenated together, and the digest of the concatenated Hpic1,n - 1 and Hpicn is calculated to obtain Hpic1,n, that is, until the digest value of each layer unit in a group of layer units participates in the concatenation, thereby obtaining the tree-top digest, that is, using the tree-top method to perform the secondary digest. For example, for the layer unit digest values Hpic1, Hpic2,..., Hpicn, referring to Figure 5 using the tree-top method to perform the secondary digest to obtain the tree-top digest. This tree-top digest is the secondary digest data.

[0150] It should be noted that the above n is the number of layer units included in a group of layer units, and the maximum value of n is the number of layer units in an access unit indicated by (hash_period_in_doi_minus1 + 1) multiplied by layer_id.

[0151] For example, if a set of layer units includes 3 layer units, and the summary data of these 3 layer units are H1, H2, and H3 in sequence along the bitstream order, when calculating the top summary of this set of layer units using the top - down method, that is, the processing device 300 connects H1 and H2, calculates the summary of the connected H1 and H2 to obtain the combined summary data H1,2, then connects the combined summary data H1,2 with H3, and calculates the summary of the connected H1,2 and H3 to obtain the combined summary data H1,3. This combined summary data H1,3 is also the secondary summary data of this set of layer units.

[0152] For example, if the above - mentioned set of layer units includes 50 layer units, and the data volume of the summary data of one layer unit is 32 bytes. Therefore, the processing device 300 needs to calculate the summary 50 times first to obtain the summary data of each layer unit in the set of layer units. Then, using the top - down calculation method, it calculates the summary (the data volume is 32 * 2 bytes each time) n - 1 (i.e., 49) times to obtain the top summary, which is also the secondary summary data of the set of layer units. The entire process may take time T2, and the measured value of T2 is 120.8181 ms.

[0153] In this application, the processing device 300 needs to calculate the summary 2n - 1 times to obtain H1 / n. The number of summary calculation times is relatively small, that is, it reduces the number of summary calculations, thereby reducing the time required for calculating the summary and improving the efficiency of calculating the summary.

[0154] Exemplarily, the above - mentioned method of splicing summaries can be to directly splice the strings corresponding to the summaries together.

[0155] It should be noted that the above - mentioned first value being 0 and the second value being 1 are only examples and should not be construed as limitations to this application. In this application, the first value can be 1 and the second value can be 0; or, the first value is 1 and the second value is 2, etc. Or, it can also include a third value, and this third value corresponds to other summary calculation methods.

[0156] It should be noted that the maximum number of data units included in a set of data units can be determined according to hash_period_in_doi_minus1 in the security parameter set and / or NumOfLayers in the sequence parameter set, that is, the maximum value of n in the first possible implementation manner above and n + 2 in the second possible implementation manner is determined according to hash_period_in_doi_minus1 and / or NumOfLayers. For example, the maximum number of access units included in a set of access units is equal to hash_period_in_doi_minus1 + 1. The maximum number of layer units included in a set of layer units is equal to the sum of the number of layer units in hash_period_in_doi_minus1 + 1 access units, such as the number of layer units in one access unit indicated by (hash_period_in_doi_minus1 + 1) multiplied by NumOfLayers. The maximum number of NAL units included in a set of NAL units is equal to the sum of the number of NAL units in hash_period_in_doi_minus1 + 1 access units.

[0157] It should be noted that the value of the above hash_period_in_doi_minus1 can be written in binary form into the security parameter set.

[0158] In a possible implementation manner, the processing device 300 can sign according to the above secondary summary data to obtain signature data (signature).

[0159] In a possible example, the processing device 300 uses a signature algorithm and a private key to sign the secondary summary data to obtain signature data.

[0160] Optionally, the summary data of each data unit in a set of data units in the authentication data can form a summary list (authentication_hash) {summary data 1, summary data 2,..., summary data n}.

[0161] Optionally, the processing device 300 can generate authentication data (Auth) according to the signature data and the summary data of each data unit in a set of data units. In this way, the authentication data can be {summary data 1, summary data 2,..., summary data n, signature}.

[0162] In a possible situation, the security parameter set corresponds to the authentication data.

[0163] S320. The processing device 300 outputs a bitstream.

[0164] The bitstream includes the security parameter set and the authentication data.

[0165] Exemplarily, after obtaining the authentication data and the set of security parameters, the processing device 300 adds the authentication data and the set of security parameters to the bitstream a to obtain the signed bitstream b, and thus outputs the bitstream b, which is the signed bitstream 203 in the above Figure 2 signed bitstream.

[0166] It should be noted that the above S310 and S320 may be executed by the encoder in the signature end 210, or may be executed by the signature module in the signature end 210, or may also be executed in cooperation by the encoder and the authentication module in the signature end 210 (the encoder executes S320, and the authentication module executes S310). This application does not limit this.

[0167] In this embodiment, the bitstream signature method is described in detail by taking the data unit as the layer unit as an example. As Figure 6 shown, Figure 6 is a schematic flowchart of a bitstream signature method provided by this application Figure 2 . Among them, Figure 6 the method shown can be implemented by the processing device 300, and the processing device 300 can be implemented by the signature end 210 in Figure 2 . The bitstream signature method may include the following steps S610-S640.

[0168] S610. The processing device 300 generates a set of security parameter NAL units and inserts them into the bitstream (compressed video bitstream).

[0169] Exemplarily, when video image authentication needs to be supported, a set of security parameters is generated.

[0170] In a possible implementation manner, to generate the RBSP (also referred to as the security parameter set RBSP) in the set of security parameter NAL units, the scope of action of the set of security parameters is a single random access sequence (RAS) in the bitstream, also referred to as a random access segment, and all layer units (access units) participating in the authentication cannot cross the RAS.

[0171] Exemplarily, configure the security parameter set ID (sec_para_set_id), knowledge image identifier (sec_is_library_flag), authentication enable flag (authentication_enable_flag), authentication_hash_mode, hash type (hash_type), non-random access point image hash authentication flag (hash_discard_nrap_pictures_flag), hash period (hash_period_in_doi_minus1), authentication flag (authentication_idc), and authentication data identifier (authentication_data_id) in the security parameter set.

[0172] Among them, sec_para_set_id is the security parameter set ID, a 2-bit unsigned integer. It is used to distinguish different security parameter sets acting on the same RAS or knowledge image access unit, and the value range is 1 to 3.

[0173] sec_is_library_flag is a binary variable. A value of '1' indicates that this security parameter set acts on the knowledge image, and a value of '0' indicates that this security parameter set acts on the display image.

[0174] authentication_enable_flag is a binary variable. A value of '1' indicates that authentication of the current RAS or knowledge image is supported. The NAL units that can participate in authentication include the coded slices of the display image or knowledge image in the current RAS, as well as the sequence parameter set, picture parameter set, security parameter set, extended data unit, and supplementary enhancement information transmitted in this access unit. The authentication data is transmitted through the NAL unit with nal_unit_type equal to 10. A value of '0' indicates that the current security parameter set does not support authentication of the RAS or knowledge image, and there should be no NAL unit with nal_unit_type equal to 10 for this RAS or knowledge image generated using this security parameter set.

[0175] The knowledge image only supports independent signature authentication, and the display image supports joint signature authentication. Multiple display image access units participating in joint signature authentication should be located in the same RAS. The image types in multiple access units participating in joint signature can be display images. For the independent signature authentication of the knowledge image, an independent security parameter set independent of the display image is used for independent signature authentication, and sec_is_library_flag is used to distinguish in the security parameter set.

[0176] If there are NAL units in an access unit with authentication_idc greater than 0 and nal_unit_type equal to 1 - 3, 5 - 9, 12, 14, 17, 18, and 19, for the NAL units in each layer unit of the access unit with the same authentication_idc value greater than 0 and the same layer_id value, after arranging them in bitstream order, perform a digest calculation to generate the digest data of the NumOfLayers layer units corresponding to the authentication_idc of the access unit. The digest calculation method is specified by hash_type.

[0177] For hash_period_in_doi_minus1 + 1 access units, calculate the digest of each layer unit in each access unit in bitstream order. The scope of the authentication data should not cross RAS; then calculate the secondary digest in the method shown by authentication_hash_mode in sequence.

[0178] Perform a digital signature on the secondary digest value to generate the authentication data RBSP and pack it into the authentication data RBSP NAL unit.

[0179] Note: If the authentication_enable_flag and encryption_enable_flag values of multiple sets of security parameters in the bitstream are equal to 1, that is, the current RAS or knowledge image supports both encryption and authentication, then it should be encrypted first and then authenticated, that is, the data used for authentication should be the encrypted NAL unit.

[0180] hash_discard_nrap_pictures_flag is a binary variable. A value of '1' means that non-random access point images are not authenticated; equal to 0 means that non-random access point images can be authenticated. If hash_discard_nrap_pictures is not in the bitstream, its default value is equal to 1.

[0181] authentication_idc, an unsigned integer of 2 bits, with a value range of 0 to 3. If the nal_unit_type of this NAL unit is 10, the value of authentication_idc should be equal to the security parameter set ID sec_para_set_id corresponding to the authentication data contained in this NAL unit, indicating that the authentication data carried in this authentication data NAL unit is generated based on the security parameter set corresponding to the security parameter set ID sec_para_set_id; otherwise (the nal_unit_type of this NAL unit is not 10), it indicates whether the NAL unit is authenticated. At this time, a value of '0' means that this NAL unit is not authenticated, and a value other than '0' means that this NAL unit is authenticated by the authentication method specified by the security parameter set with sec_para_set_id equal to authentication_idc.

[0182] When the nal_unit_type of a NAL unit is 10, this NAL unit does not participate in signature authentication.

[0183] When the nal_unit_type of a NAL unit is 11, 15 or 16, authentication_idc should be 0.

[0184] When the nal_unit_type of a NAL unit is 6 and it contains a payload with PayloadType equal to 25 or 26, authentication_idc should be 0.

[0185] authentication_data_id, an unsigned integer of 2 bits. The value range is 0 to 1, which is the identifier of the authentication data for the signature authentication participated by this NAL unit, and should be consistent with the authentication_data_id in the authentication data RBSP for the signature authentication participated by it. The authentication_data_id of the NAL units participating in authentication corresponding to the same authentication data should be the same and consistent with the authentication_data_id in the authentication data. The authentication_data_id of a set of display picture coding slice NAL units participating in joint signature authentication should be different from the authentication_data_id of the previous set of display picture coding slice NAL units with the same authentication_idc participating in joint signature authentication.

[0186] When the nal_unit_type of a NAL unit is 10, this authentication_data_id shall be consistent with the authentication_data_id in the authentication data RBSP of this NAL unit.

[0187] In a possible example, on the premise of not affecting the decoding process of NAL units with nal_unit_type not equal to 11 and not affecting the compliance of this case (standard), NAL units with nal_unit_type equal to 11 can be discarded by the decoder. When the nal_unit_type value of an encoded slice NAL unit is equal to 1, 2, 4, 12, or 17, the nal_unit_type values of all other encoded slice NAL units encoding the same picture shall be the same. If UserPermission is equal to 0, NAL units with nal_unit_type value equal to 19 can be discarded by the decoder. When the nal_unit_type value of an encoded slice NAL unit is equal to 19, the RBSP data contains the encoded unit data of several encoded slices in the picture.

[0188] When the number of encoded slices of a knowledge picture is equal to 1, the nal_unit_type of this knowledge picture encoded slice NAL unit shall be 12 or 17. When the number of encoded slices of a non-display knowledge picture is greater than 1, the nal_unit_type of the first and the last knowledge picture encoded slice NAL units in decoding order shall be 18, and the nal_unit_type of the remaining knowledge picture encoded slice NAL units shall be 12.

[0189] The above nal_unit_type being 0 is used to indicate the coded slice of an IDR picture, and the IDR picture is a random access point picture. nal_unit_type being 1 is used to indicate the coded slice of an NRAP picture, and the NRAP picture is a P picture or a B picture. nal_unit_type being 2 is used to indicate the coded slice of a RAPI picture, and the RAPI picture is a random access point picture. nal_unit_type being 3 is used to indicate the picture header, and the picture header is a syntax structure that contains syntax elements acting on a picture. Each coded picture contains and only contains one picture header NAL unit. nal_unit_type being 5 is used to indicate the extended data unit, nal_unit_type being 6 is used to indicate the supplementary enhancement information, nal_unit_type being 7 is used to indicate the sequence parameter set, nal_unit_type being 8 is used to indicate only the picture parameter set, nal_unit_type being 9 is used to indicate the security parameter set, nal_unit_type being 10 is used to indicate the authentication data. nal_unit_type being 10 is used to indicate the end of the stream, nal_unit_type being 12 is used to indicate the coded slice of a non-display knowledge picture, nal_unit_type being 14 is used to indicate the coded slice of a RL picture, and the RL picture is a P picture or a B picture that only uses knowledge pictures as reference pictures for inter-frame prediction decoding, and the RL picture is a random access point picture. nal_unit_type being 17 is used to indicate the coded slice of a display knowledge picture, nal_unit_type being 18 is used to indicate the coded slice at the boundary of a non-display knowledge picture, and nal_unit_type being 19 is used to indicate the coded slice of a privacy picture.

[0190] In a possible example, the processing device 300 sets sec_para_set_id according to the configuration settings, sets the above sec_is_library_flag to 0, authentication_enable_flag to 1 (indicating the start of authentication), hash_type to 0 (using the SM3 algorithm), sets the value of authentication_hash_mode to 0 or 1 according to the configuration (using the concatenation method or the tree-top method to calculate the secondary digest), and sets hash_discard_nrap_pictures_flag according to the configuration. If it is necessary to authenticate non-random access point pictures, it is set to 0, otherwise it is set to 1. According to the configured hash period HashPeriodInDoi, it sets hash_period_in_doi_minus1 to HashPeriodInDoi minus 1; HashPeriodInDoi being 1 means independent signature for a single access unit, and HashPeriodInDoi being greater than 1 means joint signature for multiple access units.

[0191] Furthermore, the processing device 300 packs the set of security parameters into a security parameter set NAL unit. For example, the processing device 300 sets the authentication_idc of the security parameter set NAL unit. Since the layer_id of the security parameter set NAL unit is 0, when the authentication_idc is non-zero, the authentication_idc is set to the authentication_idc of the layer unit with layer_id of 0, that is, the sec_para_set_id of the security parameter set selected for authenticating the layer unit where it is located.

[0192] The processing device 300 sets the authentication_data_id of the security parameter set NAL unit to 0 or 1, and it is recommended that it be different from the authentication_data_id of the NAL unit participating in the authentication with the same sec_para_set_id and authentication_idc as the previous group.

[0193] The processing device 300 adds the security parameter set NAL unit before the picture sequence parameter set NAL unit and inserts it into the bitstream.

[0194] In a possible example, the processing device 300 can code the above fields into the security parameter set according to the syntax table shown in Table 1 according to a preset syntax.

[0195] Table 1

[0196]

[0197]

[0198] Among them, the encryption_enable_flag is an encryption enable flag, a binary variable. A value of '1' indicates support for encrypting the coded slice of the display picture, or the picture sequence parameter set of the display picture, or the picture parameter set of the display picture, or the non-display knowledge picture coded slice, or the display knowledge picture coded slice, or the knowledge picture sequence parameter set, or the knowledge picture parameter set, or the extended data unit, that is, the RBSP in the NAL unit may be encrypted. A value of '0' indicates that encryption of the RBSP in the NAL unit is not supported.

[0199] The encryption_unit_mode is the encryption basic unit, a 2-bit unsigned integer. It indicates the encryption basic unit. A value of '0' means encryption is performed on a NAL unit basis; a value of '1' means encryption is performed on an access unit basis, where all the parts of the RBSP of NAL units in the access unit are concatenated in bitstream order and encrypted, and then restored to the encrypted NAL units after encryption; a value of '2' means encryption is performed on a layer unit basis, where all the parts of the RBSP of NAL units in the layer unit are concatenated in bitstream order and encrypted, and then restored to the encrypted NAL units after encryption; a value of '3' is reserved. Each encryption requires re-initializing the IV.

[0200] The encryption_level_mode is the encryption level mode, a 2-bit unsigned integer. It indicates the encryption level mode. A value of '0' means that when encrypting all types of NAL units, the encryption object is all the RBSP data (except the last byte of the RBSP); a value of '1' means that when encrypting NAL units with nal_unit_type equal to 1, 2, 4, 12, 14, 17, 18, and 19, the encryption object is the first encryptionByte bytes of the RBSP, and when encrypting other types of NAL units, the encryption object is all the RBSP data (except the last byte of the RBSP); a value of '2' means that when encrypting NAL units with nal_unit_type equal to 1, 2, 4, 5, 12, 14, 17, 18, and 19, the encryption object is the first encryptionByte bytes of the RBSP, and when encrypting other types of NAL units, the encryption object is all the RBSP data (except the last byte of the RBSP); a value of '3' is reserved. Among them, encryptionByte = Min(EncryptionNum * EncryptionBaseByte, NumBytesInPayload - 1).

[0201] The encryption_num_minus1 is the number of encryption basic byte lengths, an 8-bit unsigned integer. It indicates the number of encryption basic byte lengths. The value of the number of encryption basic byte lengths EncryptionNum is equal to the value of encryption_num_minus1 plus 1.

[0202] encryption_base_byte is the length of the encryption base byte, an unsigned integer of 2 bits. It indicates the length of the encryption base byte. A value of '0' means the value of EncryptionBaseByte for the encryption base byte length is 16, a value of '1' means the value of EncryptionBaseByte for the encryption base byte length is 64, a value of '2' means the value of EncryptionBaseByte for the encryption base byte length is 256, and a value of '3' means the value of EncryptionBaseByte for the encryption base byte length is 1024.

[0203] encryption_type is the encryption type, an unsigned integer of 4 bits. It indicates the algorithm used for encryption. The specific corresponding relationships are shown in Table 2.

[0204] Table 2

[0205]

[0206]

[0207] vek_flag is the video encryption key flag, a binary variable. A value of '1' means carrying vek, and a value of '0' means not carrying vkek.

[0208] iv_flag is the initialization vector flag, a binary variable. A value of '1' means carrying iv, and a value of '0' means not carrying iv.

[0209] vek_encryption_type is the encryption type of the video encryption key, an unsigned integer of 4 bits. It indicates the encryption type of the video encryption key.

[0210] evek_length_minus1 is the length of the encrypted video encryption key, an unsigned integer of 8 bits. It indicates the length of the encrypted video encryption key, in bytes.

[0211] evek is the encrypted video encryption key, an unsigned integer of n bits. It represents the encrypted video encryption key for encryption calculation, with a length of evek_length_minus1 + 1 bytes.

[0212] vkek_version length_minus1 is the length of the video encryption key version number, an unsigned integer of 8 bits. It indicates the length of the video encryption key version number, in bytes.

[0213] vkek_version is the video encryption key version number, an unsigned integer of n bits. It indicates the video encryption key version number, with a length of vkek_version_length_minus1 + 1 bytes.

[0214] iv_length_minus1 is an 8-bit unsigned integer representing the length of the initial vector. It indicates the length of the initial vector in bytes.

[0215] iv is the initial vector, an n-bit unsigned integer. It indicates the initial vector for block encryption, with a length of iv_length_minus1 + 1 bytes. hash_type is the hash type, a 2-bit unsigned integer. It indicates the algorithm used for authentication, and the specific correspondence is shown in Table 3.

[0216] Table 3

[0217] Value of hash_type Authentication algorithm Digest data length (bytes) 0 SM3 32 1～3 Reserved Reserved

[0218] signature_type is the digital signature type, a 2-bit unsigned integer. It indicates the algorithm for digitally signing the digest data of the image, as shown in Table 4.

[0219] Table 4

[0220] Value of signature_type Signature algorithm 0 SM2 1～3 Reserved

[0221] signature_fmt is the signature data format, a 2-bit unsigned integer. It indicates the signature data format, and the specific regulations on the correspondence between the value meanings of signature_fmt and the syntax of signature_type are shown in Table 5.

[0222] Table 5

[0223]

[0224] For the knowledge image in this step, sec_is_library_flag of the security parameter set 2 is 1, indicating independent signature authentication for the knowledge image, and the scope of the security parameter set is a single knowledge image. The participating knowledge images in the authentication cannot cross RAS and cannot be in two RASs. Each knowledge image, including the displayed knowledge image and the non-displayed knowledge image, should be independently signed and authenticated.

[0225] S620. The processing device 300 calculates the digest data of the security parameter set corresponding to the displayed images participating in the signature in RAS.

[0226] When calculating the digest of an access unit, for the NAL units of the layer units that need to be authenticated in the access unit (including the security parameter set NAL unit (if any), the picture sequence parameter set NAL unit (if any), the picture parameter set NAL unit (if any), the picture header NAL unit, the displayed image hierarchical coded slice NAL unit, the extended data NAL unit (if any), the supplementary enhancement information NAL unit (if any), etc.).

[0227] The calculation method of the summary data for displaying an image can be as follows:

[0228] Step 1: The processing device 300 sets the authentication_idc in the header information of these NAL units to the sec_para_set_id in the security parameter set; (Note: When generating the bitstream, if the authentication_idc of the NAL units with the same layer_id is non-zero, it is recommended to use the security parameter set with the same sec_para_set_id.).

[0229] Step 2: The processing device 300 sets the authentication_data_id of the current NAL unit. If there is a previous NAL unit participating in authentication with the same authentication_data_id, the authentication_data_id should be different from that of the previous group; otherwise, if this NAL unit participates in authentication together with the security parameter set NAL unit, the authentication_data_id also needs to be consistent with the authentication_data_id of the security parameter set NAL unit; otherwise, it is set to 0 or 1.

[0230] Step 3: The processing device 300 then splices all the NAL units participating in authentication in this layer unit together to calculate the summary of this layer unit.

[0231] The processing device 300 extracts the HashPeriodInDoi access units participating in authentication from the compressed video bitstream output by the encoder according to the configuration, and calculates the summaries H1, H2,..., Hn of each layer unit in each access unit in the order of the bitstream, where n is equal to the total number of layer units participating in authentication in all access units. The scope of action of the authentication data should not cross RAS, so the number of access units authenticated together in the last group in each RAS may be less than HashPeriodInDoi.

[0232] Calculate the secondary summary based on each summary value in the manner specified by authentication_hash_mode.

[0233] The above group of layer units is the layer units included in the HashPeriodInDoi access units participating in authentication extracted from the bitstream.

[0234] S630: The processing device 300 signs the summary data of a group of layer units to obtain the signature data.

[0235] The summary data of the set of layer units is the secondary summary value of the set of layer units above.

[0236] For the details of S630, refer to the two possible examples shown under S310 above, which will not be elaborated here.

[0237] S640. The processing device 300 generates an authentication data NAL unit for the security parameter set corresponding to the display image and adds it to the bitstream.

[0238] Among them, the multiple summary data corresponding to the multiple layer units in a set of layer units are arranged in sequence in the authentication data according to the bitstream order of the multiple layer units.

[0239] In a possible case, the above authentication data NAL includes signature data.

[0240] In another possible case, the above authentication data NAL unit includes signature data and the summary data of each layer unit in a set of layer units corresponding to the display image.

[0241] Regarding the content of generating the authentication data NAL unit, a possible example is provided below.

[0242] Step 1. The processing device 300 sets for_current_ras_idc to 0 and auth_is_library_flag to 0;

[0243] Step 2. The processing device 300 sets the authentication_data_id of the current authentication data, and this authentication_data_id is the same as the authentication_data_id of the NAL unit participating in the authentication this time;

[0244] Step 3. The processing device 300 sets authentication_hash_list_flag according to the configuration. 0 means the authentication data does not contain a summary list, and 1 means the authentication data contains a summary list. When authentication_hash_list_flag is 1, set authentication_hash_number_minus1 to the number of summaries minus 1, and authentication_hash is the summary values {H1, H2,..., Hn} of the display image.

[0245] Step 4. The processing device 300 writes the signature data into authentication_data and sets authentication_data_length_minus1 to the actual length of authentication_data minus 1.

[0246] The processing device 300 packs the authentication data into an authentication data NAL unit, and then inserts the authentication data NAL unit into the last access unit of this authentication or after it, before the next authentication data NAL unit, and before the next-next access unit that is not a random access point access unit of a display knowledge image. Set the temporal_id and layer_id of the authentication data NAL unit header to 0. In particular, the last authentication data in each RAS is allowed to be placed in the next RAS. In this case, set for_current_ras_idc in the authentication data to 0. The interval between the authentication data and the layer unit in the last access unit participating in the authentication shall not exceed HashPeriodInDoi (equal to hash_period_in_doi_minus1 + 1 in the security parameter set corresponding to this authentication) access units (excluding non-display knowledge image access units). Set the authentication_idc of the authentication data NAL unit to the sec_para_set_id in the corresponding security parameter set, and set the authentication_data_id to the authentication_data_id in the NAL unit header of the layer unit participating in the authentication.

[0247] The authentication data of the displayed image can be located in the access unit where the last displayed image coded slice is located; it can also be located in the access unit of the displayed image coded slice of the next RAS. The authentication data NAL unit shall be located after all other types of NAL units in the access unit except the NAL unit at the end of the stream and the NAL unit at the end of the coded video sequence.

[0248] As a possible implementation, the definition of the authentication data RBSP can be as shown in Table 6.

[0249] Table 6

[0250]

[0251]

[0252] Among them, for_current_ras_idc is an authentication data location identifier, a binary variable. Its value of '1' indicates that all access units corresponding to the digests in the digest list in this authentication data are within the current random access segment. If it is '0', it indicates that all access units corresponding to the digests in the digest list in this authentication data are not within the current random access segment. All access units with a common signature shall be within the same random access segment.

[0253] auth_is_library_flag is the flag bit for knowledge image authentication data, a binary variable. A value of '1' indicates that the authentication data is the signature data of the knowledge image; a value of '0' indicates that the authentication data is the signature data of the display image or the displayed knowledge image. The value of AuthIsLibraryFlag is equal to the value of auth_is_library_flag. If auth_is_library_flag does not exist in the bitstream, the value of AuthIsLibraryFlag is 0.

[0254] authenticaion_library_picture_index is the index of the authenticated knowledge image.

[0255] authentication_hash_list_flag is the authentication digest list identifier, a binary variable. A value of '1' indicates that the authentication data carries the digest list of the access unit that generates the signature in this authentication data. A value of '0' indicates that the authentication data does not carry the digest list of the access unit that generates the signature in this authentication data.

[0256] authentication_hash_number_minus1 is the number of authentication digests, an 8-bit unsigned integer with a value range of 0 to 255. authentication_hash_number_minus1 plus 1 represents the number of authentication digest data.

[0257] authentication_data_length_minus1 is the length of the signature data, an 8-bit unsigned integer. Adding 1 represents the length of the signature data in bytes, and the value should be in the range of 0 to 255.

[0258] authentication_data[i] is the number of bytes of the signature data, an 8-bit unsigned integer. The i-th byte of a signature data. The authentication data NAL unit should be located after all other types of NAL units in the access unit except for the NAL unit at the end of the stream and the NAL unit at the end of the coded video sequence. The order of the authentication data NAL units corresponding to the same set of security parameters in the bitstream should be the same as the bitstream order of their corresponding access units, that is, if the first authentication data NAL unit is before the second authentication data NAL unit, then any access unit associated with the first authentication data NAL unit is before any access unit associated with the second authentication data NAL unit.

[0259] The authentication data NAL unit for the display image shall be located in or after the last access unit of this authentication, before the next authentication data NAL unit, and before the next-next access unit that is not a random access point access unit for the display knowledge image. In particular, the last authentication data in each RAS is allowed to be placed in the next RAS. In this case, set for_current_ras_idc in the authentication data to 0. The interval between the authentication data and the layer unit in the last access unit participating in the authentication shall not exceed HashPeriodInDoi (equal to hash_period_in_doi_minus1 + 1 in the security parameter set corresponding to this authentication) access units (excluding non-display knowledge image access units). The authentication data for the display image can be located in the access unit where the last display image coded slice is located; it can also be located in the access unit of the display image coded slice in the next RAS.

[0260] The authentication data NAL unit for the knowledge image shall be located in or after the last access unit of this authentication, before the next authentication data NAL unit, and before the next-next random access point access unit.

[0261] The interval between the authentication data for the display knowledge image and the display knowledge image access unit shall not exceed HashPeriodInDoi (equal to hash_period_in_doi_minus1 + 1 in the security parameter set corresponding to this authentication) access units. The authentication data for the display knowledge image can be located in the access unit where the last display knowledge image coded slice is located; it can also be located in the access unit of the display image coded slice in the next RAS.

[0262] The authentication data for the non-display knowledge image is located in the access unit where the last non-display knowledge image coded slice is located.

[0263] Write the above authentication data RBSP into the authentication data NAL unit.

[0264] In a possible implementation, the above embodiment further includes that the processing device 300 outputs a bitstream including the security parameter set and the authentication data.

[0265] Such as the processing device 300 outputs a bitstream including the security parameter set and the authentication data to Figure 2 the authentication end 220 in.

[0266] In other embodiments of the present application, the data unit can also be a NAL unit or an access unit. For the content of the bitstream signature method for the data unit being a NAL unit or an access unit, reference can be made to the description of the bitstream signature method when the data unit is a layer unit above, which will not be elaborated here. Figure 6 in.

[0267] In a possible embodiment, only the above-mentioned Figure 3 and Figure 4 As shown, the following bitstream can be obtained.

[0268] The bitstream includes: a set of data units, a security parameter set, and authentication data;

[0269] Among them, the security parameter set includes an identifier, which is used to indicate the calculation method of the digest; the authentication data includes signature data, which is obtained by signing the secondary digest data, and the secondary digest data is obtained by processing the digest data of each data unit in a set of data units in the bitstream according to the calculation method of the digest indicated by the identifier.

[0270] For more details about a set of data units, authentication data, or the security data set, reference can be made to the description shown above Figures 3 - 6 and will not be elaborated here.

[0271] The bitstream in this embodiment can be Figure 3 the bitstream b shown in

[0272] After introducing the above bitstream signature method, the processing device 300 can send the bitstream obtained by the above bitstream signature method to Figure 2 the authentication end 220 shown in for processing. Based on this, the embodiments of the present application also provide two bitstream authentication methods.

[0273] Figure 7 Schematic flow of a bitstream authentication method provided by the present application Figure 1 , and this bitstream authentication method can be applied to Figure 2 the signature and authentication system shown in, for example, this bitstream authentication method can be implemented by the processing device 700. In a possible example, the processing device 700 can be Figure 2 the authentication end 220 shown in, the bitstream in this embodiment can be Figure 3 the bitstream b in, and this bitstream authentication method can include the following steps S710 - S730.

[0274] S710. The processing device 700 determines the first digest data of each data unit in a set of data units in the bitstream.

[0275] Exemplarily, the processing device 700 determines each layer unit in a set of layer units in the bitstream. Taking one layer unit as an example, it confirms the NAL units participating in authentication in this layer unit, splices the NAL units participating in authentication together, and calculates the digest of the spliced NAL units to obtain the first digest data of this layer unit.

[0276] It should be noted that during the process of the processing device 700 continuously receiving the bitstream, the first digest data of the layer units will be continuously calculated and cached. In addition, the processing device 700 can calculate the first digest data in the order of receiving the layer units and cache them in sequence.

[0277] In a possible scenario, all access units of a group of layer units are stored in a digest list.

[0278] For example, the processing device 700 caches the first digest data into the memory of the processing device 700.

[0279] It should be noted that the above description takes the data unit as an example of the layer unit. In other embodiments of the present application, the data unit can also be a NAL unit or an access unit.

[0280] S720. The processing device 700 obtains authentication data from the bitstream.

[0281] Among them, the authentication data includes: signature data and the second digest data of each data unit in a group of data units. The signature data is obtained by signing the secondary digest data. The secondary digest data is obtained by processing the second digest data of each data unit in a group of data units in the bitstream according to the digest calculation method indicated by the identifier. The security parameter set in the bitstream includes the identifier.

[0282] For more details about the authentication data or the security parameter set, reference can be made to the above Figures 3 - 6 shown content, which will not be elaborated here.

[0283] S730. If the processing device 700 successfully verifies the signature data, it verifies the multiple second digest data in the authentication data according to the first digest data of each data unit in a group of data units in the bitstream.

[0284] In a possible implementation manner, the signature data can be verified in the following way.

[0285] The processing device 700 obtains the public key, and then determines the secondary digest data corresponding to a group of data units according to the second digest data of each data unit in the group of data units included in the authentication data, so as to verify the signature data according to the public key, the secondary digest data and the signature algorithm.

[0286] For the description of the secondary digest data, reference can be made to the content of the secondary digest data shown under S310 above Figure 3 and will not be elaborated here.

[0287] Exemplarily, when the digital signature type signature_type is parsed from the code stream security parameter set RBSP, the processing device 300 may determine the signature algorithm according to the signature algorithm indicated by signature_type. signature_type is a 2-bit unsigned integer and is used to indicate the algorithm for digitally signing the digest data of the image.

[0288] Exemplarily, the processing device 700 may determine the signature algorithm according to a pre-agreed signature algorithm.

[0289] Exemplarily, when the camera certificate identifier camera_idc is obtained from the security parameter set RBSP of the code stream, the processing device 300 may search for the public key in the authentication certificate indicated by camera_idc.

[0290] Exemplarily, the processing device 700 may parse and obtain the public key from the authentication data RBSP of the code stream.

[0291] Exemplarily, the processing device 700 may obtain the public key pre-built in the authentication end 220.

[0292] In a possible scenario, the second digest data respectively corresponding to multiple data units in a group of data units are arranged in sequence in the authentication data according to the bit stream order of the multiple data units.

[0293] In a possible implementation manner, the processing device 700 verifies multiple second digest data in the authentication data according to the first digest data of each data unit in a group of data units in the bit stream, including:

[0294] The processing device 700 sequentially matches the first digest data with the second digest according to the arrangement order of the multiple second digest data in the authentication data and the multiple first digest data of a group of data units.

[0295] In a possible example, the processing device 700 matches the first digest data of multiple data units included in a group of data units with the multiple second digest data in the authentication data in sequence. If the match is successful, the data unit corresponding to the successfully matched first digest data is successfully authenticated and the data unit is valid (usable); if the match fails, the data unit corresponding to the first digest data with the failed match is failed to be authenticated (unusable).

[0296] It should be noted that the above matching also includes position matching. For example, when determining that abstract data a in multiple second abstract data matches abstract data b in multiple first abstract data, it is determined whether the next abstract data of abstract data a in the multiple second abstract data matches the next abstract data of abstract data a in the multiple first abstract data. If they match, the data unit corresponding to the next abstract data of this abstract data a is valid.

[0297] In a possible implementation, the processing device 700 calculates the first abstract data based on the data units in the bitstream, stores the first abstract data in the first abstract list, and stores the second abstract data obtained from the authentication data in the second abstract list. The processing device 700 can match the identifier of the second abstract list with the abstract list cached locally by the processing device 700. If it is determined that the identifier of the second abstract list matches the identifier of the first abstract list, the step of "verifying multiple second abstract data in the authentication data based on the first abstract data of each data unit in a set of data units in the bitstream" in S730 above is executed.

[0298] In a possible example, the above identifiers can be sec_para_set_id, authentication_data_id.

[0299] In a possible scenario, the processing device 700 stores the first abstract data and the third abstract data calculated based on the data units in the bitstream into the first abstract list and the third abstract list respectively. The first abstract list includes the first abstract data of each data unit in a set of data units, and the third abstract list includes the third abstract data of each data unit in a set of data units. It should be noted that the processing device 700 stores the obtained first abstract list and third abstract list into the memory of the processing device 700, such as memory or hard disk or cache, etc. The authentication data also includes a second abstract list, and this second abstract list includes the second abstract data of each data unit in a set of data units.

[0300] Furthermore, if the identifier of the first abstract list is consistent with the identifier of the second abstract list, and the identifier of the third abstract list is inconsistent with the identifier of the second abstract list, then the set of data units corresponding to the third abstract list fails authentication.

[0301] It should be noted that the set of data units corresponding to this third abstract list is sorted before the set of data units corresponding to the first abstract list in the bitstream.

[0302] In a possible example, the above identifiers can be sec_para_set_id, authentication_data_id.

[0303] Figure 8 Flow schematic of a bitstream authentication method provided for this application Figure 2 The bitstream authentication method can be applied to Figure 2 the signature and authentication system shown in, for example, the bitstream authentication method can be implemented by the processing device 700. In a possible example, the processing device 700 can be Figure 2 the authentication end 220 shown in, and the bitstream in this embodiment can be Figure 3 the bitstream b in, and the bitstream authentication method can include the following steps S810 - S830.

[0304] S810. The processing device 700 determines the first digest data of a group of data units in the bitstream.

[0305] Among them, the first digest data is the above - mentioned secondary digest data.

[0306] In a possible implementation manner, the processing device 700 determines the third digest data of each data unit in a group of data units, and then determines the first digest data corresponding to the group of data units according to the third digest data of each data unit in the group of data units. The first digest data is the secondary digest data corresponding to the group of data units.

[0307] Exemplarily, the processing device 700 splices together the third digest data of all data units in a group of data units to obtain the spliced third digest data, and calculates the digest of the spliced third digest data to obtain the first digest data.

[0308] For example, the processing device 700 directly splices together the strings corresponding to the third digest data of all data units to obtain the spliced third digest data.

[0309] Exemplarily, the processing device 300 connects the (n + 1) - th combined digest data with the second digest data of the (n + 2) - th data unit in the order of the bitstream, calculates the digest of the connected data to obtain the (n + 2) - th combined digest data, until the digest data of each data unit in the group of data units participates in the connection to obtain the secondary digest data. The (n + 1) - th combined digest data is obtained by calculating the digest after connecting the n - th combined digest data with the second digest data of the (n + 1) - th data unit, where n is a positive integer.

[0310] For the content of S810 and the content of the above - mentioned possible implementation manner, reference can be made to the content of calculating the secondary digest data of a group of data units in S310 above, and details are not repeated here.

[0311] It should be noted that during the process of the processing device 700 continuously receiving the bitstream, the digest data of the data units will be continuously calculated and cached. Moreover, the processing device 700 can calculate the digest data in the order of receiving the layer units (i.e., the bitstream order) and cache them in sequence, and then calculate the first digest data of a set of data units based on the digest data of each data unit in the set of data units.

[0312] This first digest data can be stored in the memory of the processing device 700.

[0313] S820. The processing device 700 obtains the authentication data from the bitstream.

[0314] Among them, the authentication data includes signature data, the signature data is obtained by signing the secondary digest data, the secondary digest data is obtained by processing the digest data of each data unit in a set of data units in the bitstream according to the calculation method of the digest indicated by the identifier, and the security parameter set in the bitstream includes the identifier.

[0315] For more details about the authentication data, the security parameter set or the secondary digest data, reference can be made to the content shown above Figures 3 - 6 and will not be elaborated here.

[0316] S830. The processing device 700 verifies the signature data using the first digest data.

[0317] In a possible implementation, the processing device 300 verifies the signature data using the first digest data, including: the processing device obtains the public key, and then verifies the signature data according to the public key, the first digest data, and the signature algorithm.

[0318] For the details of S830, reference can be made to the description of verifying the signature data in S730 above and will not be elaborated here.

[0319] In a possible implementation, the processing device 700 determines the identifier of the first digest data that matches the identifier of the authentication data from the memory. If the identifier of the first digest data matches the identifier of the authentication data, the above steps of verifying the signature data using the first digest data are executed.

[0320] In a possible scenario, the processing device 700 calculates the first digest data based on the first set of data units in the bitstream and the fourth digest data calculated based on the second set of data units. It should be noted that the processing device 700 stores the obtained first digest data and fourth digest data in the memory of the processing device 700, such as the memory, hard disk, or cache, etc. Both the first digest data and the fourth digest data are secondary digest data.

[0321] Furthermore, if the identifier of the first digest data is the same as that of the authentication data, and the identifier of the fourth digest data is different from that of the authentication data, the authentication of the second set of data units corresponding to the fourth digest data fails.

[0322] It should be noted that the sorting of the second set of data units in the bitstream is before that of the first set of data units.

[0323] In a possible example, the above identifier can be sec_para_set_id, authentication_data_id.

[0324] In this embodiment, the data unit is taken as the layer unit and the identifier is taken as the second value as an example to elaborate on the bitstream authentication method. For the bitstream authentication method, a complete embodiment is provided below. This embodiment includes the following steps ①-③.

[0325] Step ①: The processing device 700 inputs a bitstream (compressed video bitstream), and then obtains the secure parameter set NAL unit in the bitstream.

[0326] The processing device 700 obtains one or more secure parameter set NAL units of the RAS, and obtains sec_para_set_id, authentication_enable_flag, authentication_data_id, hash_type, authentication_hash_mode, hash_discard_nrap_pictures_flag, hash_period_in_doi_minus1 from the secure parameter set. If the authentication_enable_flag in the secure parameter set is 0, the secure parameter set does not support authenticating the displayed image. If the hash_discard_nrap_pictures_flag in the secure parameter set is 1, the secure parameter set does not support authenticating non-random access point images.

[0327] For each secure parameter set, authenticate the layer units participating in the authentication according to steps 2 and 3.

[0328] Step ②: The processing device 700 obtains the display image access unit in the RAS for a secure parameter set and calculates the digest data of the display image.

[0329] Calculate the digest:

[0330] The processing device 700 receives the NAL data of hash_period_in_doi_minus1 + 1 display image access units in the RAS, and splices together the NAL units of the layer units participating in authentication in the access unit to calculate the digest of the layer units. The last set of data participating in authentication in the RAS may be less than hash_period_in_doi_minus1 + 1.

[0331] The processing device 700 calculates a secondary digest based on each digest value in the bitstream order, and stores the secondary digest value in the local cache with sec_para_set_id and authentication_data_id as identifiers.

[0332] For example, the processing device 700 stores the digests of multiple layer units with consecutive and identical authentication_data_id in the local cache as a digest list {H1’, H2’, …, Hm’} with sec_para_set_id and authentication_data_id as identifiers in the bitstream order, where m is equal to the total number of layer units participating in authentication in the access unit. If there is a previous unauthenticated digest list with authentication_data_id as the identifier, the layer units generating this digest list fail authentication, and the new digest list overwrites the old one.

[0333] Step ③: Obtain the display image authentication data to complete the authentication of the display image.

[0334] The processing device 700 calculates up to the maximum hash_period_in_doi_minus1 + 1 access units starting from the access unit where the last display image coded slice participating in authentication is located, and obtains the authentication data.

[0335] When for_current_ras_idc in the authentication data is 1, it indicates that the authentication data is the authentication data of the current RAS; when for_current_ras_idc is 0, it indicates that the authentication data is the last authentication data of the previous RAS.

[0336] In a possible scenario, when authentication_hash_list_flag in the authentication data is 0, the secondary digest value is used for authentication.

[0337] The processing device 700 looks up the secondary digest value in the local cache according to the sec_para_set_id and authentication_data_id in the authentication data. If the secondary digest value is found, the digital signature in the authentication data is verified with the secondary digest value. If the signature verification is successful, the layer unit participating in generating the secondary digest value is successfully authenticated. If the verification fails, the layer unit participating in generating the secondary digest value fails the authentication.

[0338] If the processing device 700 finds that the sec_para_set_id, authentication_data_id are the same as those of the sec_para_set_id and authentication_data_id of the latest received layer unit sequence, and at this time there are other secondary digest values whose identifiers are not equal to sec_para_set_id and authentication_data_id and have not been authenticated, then the authentication data corresponding to the unauthenticated secondary digest value is lost, and the layer units corresponding to these unauthenticated secondary digest values fail the authentication. If the secondary digest value of the layer unit corresponding to the authentication_data_id is not found, the authentication data is invalid and the authentication fails.

[0339] In another possible scenario, when the authentication_hash_list_flag is 1, digest list authentication is used.

[0340] 1. Parse the authentication_data_id and the corresponding digest list {H1, H2,..., Hn} from the authentication data NAL unit, and calculate the secondary digest. If the authentication_hash_mode is 0, the concatenation method is used for secondary digest calculation. If the authentication_hash_mode is 1, the tree-top method is used for secondary digest calculation.

[0341] 2. Use the secondary digest value to verify the signature data parsed from the authentication data NAL unit, and determine whether the digest list {H1, H2,..., Hn} transmitted in the authentication data NAL unit passes the verification. If the verification fails, the digest list data in the authentication data is untrustworthy and the digest list authentication fails.

[0342] 3. Determine the layer units participating in the signature according to the parameters in the authentication data NAL unit. Search for the digest list of the layer units cached locally according to sec_para_set_id and authentication_data_id. If found, the layer units to be authenticated can be confirmed through the digest list. If found and the sec_para_set_id, authentication_data_id are consistent with those of the sec_para_set_id and authentication_data_id of the latest received layer unit sequence, at this time, if there are still unauthenticated digest lists with other identifiers not equal to sec_para_set_id and authentication_data_id, the authentication data corresponding to the unauthenticated digest lists is lost, and the layer unit authentication corresponding to these unauthenticated digest lists fails. If the digest list of the layer units corresponding to sec_para_set_id and authentication_data_id is not found, the authentication data is invalid and the authentication fails.

[0343] 4. Sequentially match the digest list {H1’, H2’, …, Hm’} of the layer units and the digest list {H1, H2, …, Hn} in the authentication data to implement the authentication of the layer units. First, search for H1’ in the digest list in the authentication data. After successful search, record the position of the digest list in the authentication data, and the layer unit corresponding to H1’ is successfully authenticated; then start searching for H2’ from the next position of this position in the digest list in the authentication data. If the search is successful, update the position of the digest list in the authentication data, and the layer unit corresponding to H2’ is successfully authenticated; continue to search for the subsequent H3’, …, Hm’. If the search is successful, the corresponding layer unit is successfully authenticated. If the search fails, the corresponding layer unit is authenticated as failed.

[0344] In other embodiments of the present application, the data unit may also be a NAL unit or an access unit. For the content of the bitstream authentication method for the data unit being a NAL unit or an access unit, reference may be made to the description of the bitstream authentication method when the data unit is a layer unit in the above steps ①-③, which will not be elaborated here.

[0345] It can be understood that in order to implement the functions in the above embodiments, the processing device 300 and the processing device 700 include the corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should easily realize that, in combination with the units and method steps of each example described in the embodiments disclosed in the present application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in the way of hardware or computer software driving hardware depends on the specific application scenario and design constraint conditions of the technical solution.

[0346] In the foregoing, in combination with Figures 3 to 6 , the bitstream signature method provided according to this embodiment is described in detail. Next, in combination with Figure 9 , the bitstream signature device provided according to this embodiment will be described.

[0347] Figure 9 FIG. is a schematic diagram of a bitstream signature device provided by the present application. The schematic diagram of the bitstream signature device can be used to execute the method of the foregoing embodiment. Therefore, the beneficial effects that can be achieved by it can refer to the beneficial effects in the corresponding method provided above, and will not be elaborated here. Exemplarily, the bitstream signature device 900 includes:

[0348] An obtaining module 910, configured to obtain a set of security parameters and authentication data. The set of security parameters includes an identifier, and the identifier is used to indicate the calculation method of the digest; the authentication data includes signature data, and the signature data is obtained by signing the secondary digest data, and the secondary digest data is obtained by processing the digest data of each data unit in a set of data units in the bitstream according to the calculation method of the digest indicated by the identifier.

[0349] An output module 920, configured to output a bitstream, where the bitstream includes a set of security parameters and authentication data.

[0350] For more implementable content of the bitstream signature device 900, reference may be made to the steps executed by the processing device 300 in the foregoing method embodiment. The bitstream signature device 900 can be used to implement the functions of the processing device 300 in the foregoing method embodiment, and thus can also achieve the beneficial effects of the foregoing method embodiment.

[0351] In the foregoing, in combination with Figure 7 , the bitstream authentication method provided according to this embodiment is described in detail. Next, in combination with Figure 10a , the bitstream authentication device provided according to this embodiment will be described. Figure 10a FIG. is a schematic diagram of a bitstream authentication device provided by the present application Figure 1 , the schematic diagram of the bitstream authentication device can be used to execute the method of the foregoing embodiment. Therefore, the beneficial effects that can be achieved by it can refer to the beneficial effects in the corresponding method provided above, and will not be elaborated here. Exemplarily, the bitstream authentication device 1000a includes:

[0352] A first determination module 1011, configured to determine first digest data of each data unit in a set of data units in the bitstream.

[0353] The first acquisition module 1021 is configured to acquire authentication data from the bitstream. The authentication data includes: signature data and second digest data of each data unit in a set of data units. The signature data is obtained by signing the secondary digest data, and the secondary digest data is obtained by processing the second digest data of each data unit in a set of data units in the bitstream according to the digest calculation method indicated by the identifier. The security parameter set in the bitstream includes the identifier.

[0354] The first verification module 1031 is configured to, if the verification of the signature data is successful, verify multiple second digest data in the authentication data according to the first digest data of each data unit in a set of data units in the bitstream.

[0355] For more functions that can be implemented by the bitstream authentication device 1000a, reference may be made to the steps performed by the processing device 700 in the foregoing method embodiments. The bitstream authentication device 1000a can be used to implement the functions of the processing device 700 in the foregoing method embodiments, and thus can also achieve the beneficial effects of the foregoing method embodiments.

[0356] In the foregoing text, in combination with Figure 8 , the bitstream authentication method provided according to this embodiment is described in detail. Next, in combination with Figure 10b , the bitstream authentication device provided according to this embodiment will be described below. Figure 10b The schematic diagram of the bitstream authentication device provided in this application Figure 2 , the schematic diagram of the bitstream authentication device can be used to execute the method of the foregoing embodiment. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, which will not be elaborated here. Exemplarily, the bitstream authentication device 1000b includes:

[0357] The second determination module 1012 is configured to determine the first digest data of a set of data units in the bitstream.

[0358] The second acquisition module 1022 is configured to acquire authentication data from the bitstream. The authentication data includes signature data, and the signature data is obtained by signing the secondary digest data. The secondary digest data is obtained by processing the second digest data of each data unit in a set of data units in the bitstream according to the digest calculation method indicated by the identifier. The security parameter set in the bitstream includes the identifier.

[0359] The second verification module 1032 is configured to verify the signature data by using the first digest data.

[0360] For more functions that can be implemented by the bitstream authentication device 1000b, reference may be made to the steps performed by the processing device 700 in the foregoing method embodiments. The bitstream authentication device 1000b can be used to implement the functions of the processing device 700 in the foregoing method embodiments, and thus can also achieve the beneficial effects of the foregoing method embodiments.

[0361] It is understandable that Figure 10a or Figure 10b The devices shown are only examples provided in this embodiment. Depending on the bitstream signature or authentication process, different devices may include more or fewer units, which are not limited in this application.

[0362] When Figure 10a or Figure 10b the devices shown are implemented by hardware, the hardware can be implemented by a processor or a chip system. The chip system includes one or more chips, and each chip includes a processor and a power supply circuit. The power supply circuit is used to supply power to the processor, and the processor is used to implement the method of any possible implementation manner in the above embodiment through logic circuits or by executing code instructions. The beneficial effects can be referred to the description of any aspect in the above embodiment, which will not be elaborated here.

[0363] It can be understood that the processor in the embodiments of this application can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The general-purpose processor can be a microprocessor or any conventional processor.

[0364] An embodiment of this application also provides a computing device. Figure 9 The bitstream signature device 900 shown Figure 10a the bitstream authentication device 1000a shown or Figure 10b the bitstream authentication device 1000b shown can be implemented by a computing device. As shown in Figure 11 shown Figure 11 is a schematic structural diagram of the computing device provided in this application. The computing device 1100 includes: a memory 1110 and at least one processor 1120. The processor 1120 can implement the bitstream signature method or the bitstream authentication method provided in the above embodiment, and the memory 1110 is used to store software instructions corresponding to the above bitstream signature method or bitstream authentication method. For example, the computing device can be Figure 1 the camera 11 or the mobile phone 15 in

[0365] As an alternative implementation, in terms of hardware implementation, the computing device 1100 may refer to a chip or a chip system encapsulating one or more processors 1120. By way of example, when the computing device 1100 is used to implement the method steps in the above embodiments, the processor 1120 included in the computing device 1100 executes the steps and their possible sub-steps of the processing device 300 or the processing device 700 in the above method. In an alternative scenario, the computing device 1100 may further include a communication interface 1130, which can be used to send and receive data. For example, the communication interface 1130 is used to receive bitstreams, etc.; the communication interface 1130 can be implemented through the interface circuit included in the computing device 1100. Therefore, in some examples, the communication interface 1130 may also be referred to as the transceiver of the computing device. In this embodiment, the communication interface 1130 supports wired connection using the unified multimedia interconnect interface.

[0366] In the embodiments of the present application, the communication interface 1130, the processor 1120, and the memory 1110 may be connected through a bus 1140. The bus 1140 may be divided into an address bus, a data bus, a control bus, etc. The bus 1140 may be a peripheral component interconnect express (PCIe) bus, or an extended industry standard architecture (EISA) bus, a unified bus (Ubus or UB), a compute express link (CXL), a cache coherent interconnect for accelerators (CCIX), or other types of buses, etc.

[0367] The processor 1120 may include a CPU, a graphics processing unit (GPU), an embedded neural-network processing unit (NPU), a microprocessor (MP), a digital signal processor (DSP), an ASIC, an FPGA, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof.

[0368] The memory 1110 may include volatile memory, such as random access memory (RAM). The memory 1110 may also include non-volatile memory, such as read only memory (ROM), flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0369] It is noted that the computing device 1100 may also execute Figure 9 the functions of the bitstream signature device 900 shown, Figure 10a the bitstream authentication device 1000a shown, or Figure 10b the bitstream authentication device 1000b shown, which will not be elaborated here. All relevant contents of the steps involved in the above method embodiments can be cited in the function descriptions of the corresponding functional modules and will not be elaborated here.

[0370] Embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium may be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a digital video disc (DVD)), or a semiconductor medium (e.g., a solid state drive), etc. The computer-readable storage medium stores instructions that direct the computing device to execute a bitstream signature method or a bitstream authentication method. The computer-readable storage medium may also store the bitstream pointed out above, such as the bitstream obtained by the Figures 3 - 6 method shown.

[0371] Embodiments of the present application also provide a computer program product containing instructions. The computer program product may be software or a program product containing instructions that can run on a computing device or be stored in any available medium. When the computer program product runs on at least one computing device, at least one computing device is caused to execute a bitstream signature method or a bitstream authentication method.

[0372] In addition, embodiments of the present application also provide a device, which may specifically be a chip, a component, or a module. The device may include a processor and a memory connected thereto; wherein, the memory is used to store computer-executable instructions, and when the device runs, the processor may execute the computer-executable instructions stored in the memory so that the chip executes the methods in the above method embodiments.

[0373] Among them, the computing device, computer-readable storage medium, computer program product or chip provided in this embodiment are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be elaborated here.

[0374] From the descriptions of the above embodiments, those skilled in the art can understand that for the convenience and brevity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be allocated to different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.

[0375] In several embodiments provided in this application, it should be understood that the disclosed device and method can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of modules or units is only a logical function division. In actual implementation, there can be other division methods. For example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection between each other can be through some interfaces. The indirect coupling or communication connection of the device or unit can be in electrical, mechanical or other forms.

[0376] The unit described as a separated component may or may not be physically separated. The component displayed as a unit may be a physical unit or multiple physical units, that is, it can be located in one place, or it can be distributed to multiple different places. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0377] In addition, each functional unit in each embodiment of this application can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

[0378] Any content of each embodiment of this application, as well as any content of the same embodiment, can be freely combined. Any combination of the above content is within the scope of this application.

[0379] When an integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on such an understanding, the technical solution of the embodiments of the present application, in essence, or the part that contributes to the prior art, or all or part of this technical solution, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions for causing a device (which can be a single-chip microcomputer, a chip, etc.) or a processor to execute all or part of the steps of the methods of the various embodiments of the present application. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical discs that can store program codes.

[0380] The steps of the methods or algorithms described in combination with the disclosed content of the embodiments of the present application can be implemented in a hardware manner or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in RAM, flash memory, ROM, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, compact disc read-only memory (CD-ROM), or any other form of storage medium well-known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0381] Those skilled in the art should be able to realize that in one or more of the above examples, the functions described in the embodiments of the present application can be implemented by hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. The computer-readable medium includes a computer-readable storage medium and a communication medium, where the communication medium includes any medium that facilitates the transmission of a computer program from one place to another. The storage medium can be any available medium accessible by a general-purpose or special-purpose computer.

[0382] The embodiments of the present application have been described above in conjunction with the accompanying drawings. However, the present application is not limited to the above specific embodiments. The above specific embodiments are merely illustrative and not restrictive. Under the inspiration of the present application, those of ordinary skill in the art can also make many forms without departing from the purpose of the present application and the scope protected by the claims, and all of them fall within the protection scope of the present application.

Claims

1. A bitstream signature method, characterized in that, The method includes: Obtaining a security parameter set and authentication data; Wherein, the security parameter set includes an identifier, and the identifier is used to indicate the calculation method of the digest; the authentication data includes the signature data, and the signature data is obtained by signing the secondary digest data, and the secondary digest data is obtained by processing the digest data of each data unit in a group of data units in the bitstream according to the calculation method of the digest indicated by the identifier; Outputting a bitstream, where the bitstream includes the security parameter set and the authentication data.

2. The method according to claim 1, characterized in that, The identifier is a first value, and the first value is used to indicate that the calculation method of the digest is to concatenate the digest data of each data unit in the group of data units, and calculate the secondary digest of the concatenated digest data to obtain the secondary digest data.

3. The method according to claim 1, wherein The identifier is a second value, and the second value is used to indicate that the calculation method of the digest is to concatenate the (n + 1)-th combined digest data with the digest data of the (n + 2)-th data unit in sequence along the bitstream, and calculate the digest of the concatenated data to obtain the (n + 2)-th combined digest data, until the digest data of each data unit in a group of data units all participates in the concatenation to obtain the secondary digest data; the (n + 1)-th combined digest data is obtained by calculating the digest after concatenating the n-th combined digest data with the digest data of the (n + 1)-th data unit, and n is a positive integer.

4. The method according to any one of claims 1 to 3, characterized in that The data unit is a Network Abstraction Layer (NAL) unit.

5. The method according to any one of claims 1 to 3, characterized in that The data unit is a layer unit, and the layer unit includes Network Abstraction Layer (NAL) units with the same layering identifier.

6. The method according to any one of claims 1 to 3, characterized in that The data unit is an access unit.

7. The method according to any one of claims 1 to 6, characterized in that The authentication data further includes the digest data of each data unit in a group of data units.

8. The method according to any one of claims 1 to 7, characterized in that, The obtaining of the security parameter set and the authentication data includes: Generating the security parameter set and the authentication data.

9. The method according to any one of claims 1 to 8, characterized in that, Before outputting the bitstream, the method further includes: Adding the authentication data to the bitstream.

10. The method according to any one of claims 1 to 9, characterized in that, The security parameter set corresponds to the authentication data.

11. A bitstream, characterized in that, The bitstream includes: A group of data units, a security parameter set, and authentication data; Wherein, the security parameter set includes an identifier, and the identifier is used to indicate the calculation method of the digest; the authentication data includes signature data, and the signature data is obtained by signing the secondary digest data, and the secondary digest data is obtained by processing the digest data of each data unit in a group of data units in the bitstream according to the calculation method of the digest indicated by the identifier.

12. The bitstream according to claim 11, wherein The identifier is a first value, and the first value is used to indicate that the calculation method of the digest is to concatenate the digest data of each data unit in the group of data units, and calculate the secondary digest of the concatenated digest data to obtain the secondary digest data.

13. The bitstream according to claim 11, wherein, The identifier is a second value, and the second value is used to indicate that the calculation method of the digest is to concatenate the (n + 1)-th combined digest data and the digest data of the (n + 2)-th data unit in the bitstream order, calculate the digest of the concatenated data to obtain the (n + 2)-th combined digest data, until the digest data of each data unit in a group of data units participates in the concatenation to obtain the secondary digest data; the (n + 1)-th combined digest data is obtained by calculating the digest after concatenating the n-th combined digest data and the digest data of the (n + 1)-th data unit, where n is a positive integer.

14. The bitstream according to any one of claims 11 to 13, characterized in that, The data unit is a Network Abstraction Layer (NAL) unit.

15. The bitstream according to any one of claims 11 to 13, characterized in that, The data unit is a layer unit, and the layer unit includes Network Abstraction Layer (NAL) units with the same layering identifier.

16. The bitstream according to any one of claims 11 to 13, characterized in that, The data unit is an access unit.

17. The bit stream according to any one of claims 11 to 16, characterized in that, The authentication data further includes the digest data of each data unit in a group of data units.

18. A bitstream authentication method, characterized in that, The method includes: Determining the first digest data of each data unit in a group of data units in the bitstream; Obtaining authentication data from the bitstream; the authentication data includes: signature data and the second digest data of each data unit in the group of data units, the signature data is obtained by signing the secondary digest data, the secondary digest data is obtained by processing the second digest data of each data unit in a group of data units in the bitstream according to the digest calculation method indicated by the identifier, and the security parameter set in the bitstream includes the identifier; If the verification of the signature data is successful, then verify the multiple second digest data in the authentication data according to the first digest data of each data unit in the group of data units in the bitstream.

19. The method according to claim 18, characterized in that, The identifier is a first value, and the first value is used to indicate that the calculation method of the digest is to concatenate the second digest data of each data unit in the group of data units and calculate the secondary digest of the concatenated second digest data to obtain the secondary digest data.

20. The method according to claim 18, characterized in that, The identifier is a second value, and the second value is used to indicate that the calculation method of the digest is to concatenate the (n + 1)-th combined digest data and the second digest data of the (n + 2)-th data unit in the bitstream order, calculate the digest of the concatenated data to obtain the (n + 2)-th combined digest data, until the digest data of each data unit in a group of data units participates in the concatenation to obtain the secondary digest data; the (n + 1)-th combined digest data is obtained by calculating the digest after concatenating the n-th combined digest data and the second digest data of the (n + 1)-th data unit, where n is a positive integer.

21. The method according to any one of claims 18 to 20, characterized in that, The data unit is a Network Abstraction Layer (NAL) unit.

22. The method according to any one of claims 18 to 20, characterized in that, The data unit is a layer unit, and the layer unit includes Network Abstraction Layer (NAL) units with the same layering identifier.

23. The method according to any one of claims 18 to 20, characterized in that The data unit is an access unit.

24. A bitstream authentication method, characterized in that, The method includes: Determining the first digest data of each data unit in a group of data units in the bitstream; Obtaining authentication data from the bitstream, the authentication data includes signature data, the signature data is obtained by signing the secondary digest data, the secondary digest data is obtained by processing the second digest data of each data unit in a group of data units in the bitstream according to the digest calculation method indicated by the identifier, and the security parameter set in the bitstream includes the identifier; Verify the signature data by using the first digest data of the bitstream.

25. The method according to claim 24, wherein The determination of the first digest data of a set of data units of the bitstream includes: Determine the third digest data of each data unit in the set of data units of the bitstream; Process the third digest data of each data unit in the set of data units according to the digest calculation method indicated by the identifier, to obtain the first digest data of the set of data units.

26. The method according to claim 24 or 25, characterized in that, The identifier is a first value, and the first value is used to indicate that the digest calculation method is to concatenate the digest data of each data unit in the set of data units, and calculate the second-level digest of the concatenated digest data to obtain the second-level digest data.

27. The method according to claim 24 or 25, characterized in that, The identifier is a second value, and the second value is used to indicate that the digest calculation method is to concatenate the (n + 1)-th combined digest data with the second digest data of the (n + 2)-th data unit in the bitstream order, and calculate the digest of the concatenated data to obtain the (n + 2)-th combined digest data, until the digest data of each data unit in the set of data units participates in the concatenation to obtain the second-level digest data; the (n + 1)-th combined digest data is obtained by calculating the digest after concatenating the n-th combined digest data with the second digest data of the (n + 1)-th data unit, where n is a positive integer.

28. The method according to any one of claims 24 to 27, characterized in that, The data unit is a Network Abstraction Layer (NAL) unit.

29. The method according to any one of claims 24 to 27, characterized in that, The data unit is a layer unit, and the layer unit includes Network Abstraction Layer (NAL) units with the same layering identifier.

30. The method according to any one of claims 24 to 27, characterized in that, The data unit is an access unit.

31. A bitstream signature device, characterized in that, The apparatus includes: An acquisition device, configured to acquire a security parameter set and authentication data; wherein, the security parameter set includes an identifier, and the identifier is used to indicate the digest calculation method; the authentication data includes the signature data, and the signature data is obtained by signing the second-level digest data, and the second-level digest data is obtained by processing the digest data of each data unit in a set of data units in the bitstream according to the digest calculation method indicated by the identifier; An output device, configured to output a bitstream, and the bitstream includes the security parameter set and the authentication data.

32. The device according to claim 31, characterized in that, The identifier is a first value, and the first value is used to indicate that the digest calculation method is to concatenate the digest data of each data unit in the set of data units, and calculate the second-level digest of the concatenated digest data to obtain the second-level digest data.

33. The device according to claim 31, wherein, The identifier is a second value, and the second value is used to indicate that the digest calculation method is to concatenate the (n + 1)-th combined digest data with the digest data of the (n + 2)-th data unit in the bitstream order, and calculate the digest of the concatenated data to obtain the (n + 2)-th combined digest data, until the digest data of each data unit in the set of data units participates in the concatenation to obtain the second-level digest data; the (n + 1)-th combined digest data is obtained by calculating the digest after concatenating the n-th combined digest data with the digest data of the (n + 1)-th data unit, where n is a positive integer.

34. The device according to any one of claims 31 to 33, characterized in that, The data unit is a Network Abstraction Layer (NAL) unit.

35. The device according to any one of claims 31 to 33, characterized in that, The data unit is a layer unit, and the layer unit includes Network Abstraction Layer (NAL) units with the same layering identifier.

36. The device according to any one of claims 31 to 33, characterized in that, The data unit is an access unit.

37. The device according to any one of claims 31 to 36, characterized in that, The authentication data further includes the digest data of each data unit in a set of data units.

38. The device according to any one of claims 31 to 37, characterized in that, The obtaining module is specifically configured to generate the set of security parameters and the authentication data.

39. The device according to any one of claims 31 to 38, characterized in that, The device further includes an adding module, and the adding module is configured to add the authentication data to the bitstream.

40. The device according to any one of claims 31 to 39, characterized in that, The set of security parameters corresponds to the authentication data.

41. A bitstream authentication device, characterized in that, The device includes: A first determination module, configured to determine the first digest data of each data unit in a set of data units in the bitstream; A first obtaining module, configured to obtain authentication data from the bitstream; the authentication data includes: signature data and the second digest data of each data unit in the set of data units, the signature data is obtained by signing the secondary digest data, and the secondary digest data is obtained by processing the second digest data of each data unit in the set of data units in the bitstream according to the digest calculation method indicated by the identifier, and the set of security parameters in the bitstream includes the identifier; A first verification module, configured to, if the verification of the signature data is successful, verify the multiple second digest data in the authentication data according to the first digest data of each data unit in the set of data units in the bitstream.

42. The device according to claim 41, wherein, The identifier is a first value, and the first value is used to indicate that the digest calculation method is to concatenate the second digest data of each data unit in the set of data units, and calculate the secondary digest of the concatenated second digest data to obtain the secondary digest data.

43. The apparatus according to claim 41, wherein, The identifier is a second value, and the second value is used to indicate that the digest calculation method is to concatenate the (n + 1)-th combined digest data with the digest data of the (n + 2)-th data unit in sequence along the bitstream, and calculate the digest of the concatenated data to obtain the (n + 2)-th combined digest data, until the digest data of each data unit in the set of data units participates in the concatenation to obtain the secondary digest data; the (n + 1)-th combined digest data is obtained by calculating the digest after concatenating the n-th combined digest data with the digest data of the (n + 1)-th data unit, and n is a positive integer.

44. The device according to any one of claims 41 to 43, characterized in that, The data unit is a Network Abstraction Layer (NAL) unit.

45. The device according to any one of claims 41 to 43, characterized in that, The data unit is a layer unit, and the layer unit includes Network Abstraction Layer (NAL) units with the same layering identifier.

46. The device according to any one of claims 41 to 43, characterized in that, The data unit is an access unit.

47. A bitstream authentication device, characterized in that, The device includes: A second determination module, configured to determine the first digest data of a set of data units in the bitstream; A second obtaining module, configured to obtain authentication data from the bitstream, the authentication data includes signature data, and the signature data is obtained by signing the secondary digest data, and the secondary digest data is obtained by processing the second digest data of each data unit in the set of data units in the bitstream according to the digest calculation method indicated by the identifier, and the set of security parameters in the bitstream includes the identifier; A second verification module, configured to verify the signature data by using the first digest data.

48. The device according to claim 47, characterized in that, The determination module is specifically configured to determine the third digest data of each data unit in a set of data units of the bitstream, and then process the third digest data of each data unit in the set of data units according to the digest calculation method indicated by the identifier to obtain the first digest data of the set of data units.

49. The device according to claim 47 or 48, characterized in that, The identifier is a first value, and the second value is used to indicate that the calculation method of the digest is to concatenate the (n + 1)-th combined digest data and the second digest data of the (n + 2)-th data unit in the bitstream order, calculate the digest of the concatenated data to obtain the (n + 2)-th combined digest data, until the digest data of each data unit in a group of data units participates in the concatenation to obtain the secondary digest data; the (n + 1)-th combined digest data is obtained by calculating the digest after concatenating the n-th combined digest data and the second digest data of the (n + 1)-th data unit, where n is a positive integer.

50. The device according to claim 47 or 48, characterized in that, The identifier is a second value, and the second value is used to indicate that the calculation method of the digest is to use the tree-top digest calculated based on the digest data of each data unit in the group of data units as the secondary digest data.

51. The device according to any one of claims 47 to 50, characterized in that, The data unit is a network abstraction layer (NAL) unit.

52. The device according to any one of claims 47 to 50, characterized in that, The data unit is a layer unit, and the layer unit includes network abstraction layer (NAL) units with the same layering identifier.

53. The device according to any one of claims 47 to 50, characterized in that, The data unit is an access unit.

54. A computing device, characterized in that, Comprising: A memory and a processor, where the memory is used to store computer instructions; when the processor executes the computer instructions, it implements the method described in any one of claims 1 to 10, or implements the method described in any one of claims 18 to 30.

55. A non-transitory computer-readable storage medium, characterized in that, The computer program or instruction is stored in the storage medium, and when the computer program or instruction is executed by a processing device, it implements the method described in any one of claims 1 to 10; and / or when the computer program or instruction is executed by a processing device, it implements the method described in any one of claims 18 to 30.

56. A computer program product, characterized in that, The computer program product includes computer instructions, and when the computer instructions are executed by a computer or a processor, the steps of the method described in any one of claims 1 to 10 are executed, or the steps of the method described in any one of claims 18 to 30 are executed.

57. A non-transitory computer-readable storage medium, characterized in that, The computer-readable storage medium stores the bitstream described in any one of claims 11 to 17.

Images