Security and protection monitoring system information signature encryption device based on national cryptographic algorithm

Abstract

The invention discloses a security and protection monitoring system information signature encryption device based on a national cryptographic algorithm, and the device comprises an IPC end module which collects video stream data in real time; the video stream signature module based on the national cryptographic algorithm is used for signing the input video stream data and storing the signed video stream data into a user-defined SEI of the video stream data; the video encryption and decryption module based on the national cryptographic algorithm is used for carrying out encryption processing on an I frame and filling data in the video stream data, storing the encrypted I frame in an original region of the I frame, storing the encrypted filling data in a user-defined SEI, and inserting the user-defined SEI in front of the I frame; and the NVR end module is used for storing the signed and encrypted video stream data. Before the video stream is transmitted, a series of onvif control signaling interaction is carried out, the integrity and confidentiality of the signaling are controlled, and the integrity and confidentiality of video data transmission are protected.

Description

Technical Field

[0001] The present invention relates to the field of security monitoring, and in particular, to an information signature encryption device for a security monitoring system based on national cryptographic algorithms. Background Art

[0002] Recording videos using network cameras and transmitting them to a digital video recorder (DVR) for video storage is a currently widely applied video security solution. For better compatibility, devices from various manufacturers usually support the ONVIF protocol and use the H.264 / H.265 encoding format for video transmission.

[0003] H.264 is a video coding format jointly developed by the International Telecommunication Union and the International Organization for Standardization in 2003. Due to its advantages of high coding efficiency, high video quality, strong network adaptability, and strong error tolerance, it is not only widely used in high-definition television broadcasting, Blu-ray storage, and network streaming media consumption fields, but also used in various industry scenarios such as video conferencing and remote monitoring. It is one of the most widely used video compression technologies. The H.265 encoding format is further evolved from H.264 and has a higher compression efficiency without sacrificing video quality.

[0004] Existing H.264 / H.265 encoding formats mainly focus on data encoding and compression and do not provide a ready-to-use security mechanism to protect data confidentiality and integrity. The following are some defects when using H.264 / H.265 to transmit video data between an IPC (Internet Protocol Camera) and an NVR (Network Video Recorder):

[0005] 1. Transmission risk: Usually, the IPC and the NVR are connected by a network cable and are at a relatively long distance. There is a risk that data can be accessed and tampered with by a third party during the transmission process; Storage risk: The NVR stores video data and retrieves the data from the NVR again during preview and playback. There is a risk that the video data in the NVR can be tampered with.

[0006] 2. Integrity and source verification: The transmitted video stream does not contain a signature for the integrity of the video data, and the receiving end cannot confirm whether the video data is complete or whether the source is valid; Privacy: The transmitted video stream does not contain privacy encryption for the video data, and the receiving end cannot confirm whether the video data has been leaked.

[0007] 3. Compatibility: Using the signature encryption functions built into the IPC and the NVR may cause compatibility problems, resulting in abnormal use of devices from different manufacturers; Performance impact: Using the signature functions built into the IPC and the NVR may affect device performance and further affect the clarity and smoothness of the video.

[0008] In addition, if the IPC and the NVR have been deployed and do not support the security protection of the video stream, then updating the devices will bring additional expenditures in terms of manpower, material resources, and financial resources. Summary of the Invention

[0009] The present invention provides an information signature encryption device for a security monitoring system based on national cryptographic algorithms. Before the video stream is transmitted, a series of ONVIF control signaling interactions are carried out to control the integrity and confidentiality of the control signaling, and to protect the integrity and confidentiality of the video data transmission. See the following description for details:

[0010] An information signature encryption device for a security monitoring system based on national cryptographic algorithms, the device includes: an IPC end module for real-time acquisition of video stream data;

[0011] A video stream signature module based on national cryptographic algorithms, used to sign the input video stream data and store it in the custom SEI of the video stream data;

[0012] A video encryption and decryption module based on national cryptographic algorithms, used to encrypt the I-frame and padding data in the video stream data, store the encrypted I-frame in the original area of the I-frame, store the encrypted padding data in the custom SEI, and insert the custom SEI before the I-frame;

[0013] An NVR end module for storing the signed and encrypted video stream data.

[0014] Wherein, when reading the video stream data, the device further includes:

[0015] A video stream signature verification module based on national cryptographic algorithms, reads the signature value in the custom SEI of the output video stream data and performs signature verification. If the signature verification passes, the video encryption and decryption module is executed;

[0016] A video encryption and decryption module based on national cryptographic algorithms, reads the I-frame data and the encrypted padding data in the output video stream data, decrypts them, stores the decrypted data in the I-frame, and outputs the decrypted video stream data.

[0017] Wherein, the video stream signature module includes:

[0018] A first recognition unit, used to recognize the original video code stream, recognize the video stream NALU according to the code stream encapsulation format; parse the NALU to obtain the I-frame data;

[0019] A calculation unit, used to calculate the I-frame digest value by applying the SM3 algorithm, and then calculate the signature value by applying the SM2 algorithm to the digest value;

[0020] A setting unit, used to place the signature value in the custom SEI.

[0021] Wherein, the video encryption and decryption module includes:

[0022] A second recognition unit, configured to recognize the signed bitstream, recognize the video stream NALU according to the bitstream encapsulation format; parse the video stream NAL to obtain the I-frame data and the signature value in the SEI.

[0023] Among them, the video stream signature verification module based on the national cryptographic algorithm includes:

[0024] A signature verification unit, configured to calculate the I-frame digest value by applying the SM3 algorithm, and then perform the signature verification of the SM2 algorithm on the digest value and the signature value.

[0025] The beneficial effects of the technical solution provided by the present invention are:

[0026] 1. Security: Applying the national cryptographic algorithm to sign and encrypt the video bitstream can provide high security, ensuring that the video data is not tampered with and accessed;

[0027] 2. Compliance: Facing the increasing requirements of the country for security, using the national cryptographic algorithm to sign and encrypt the video data meets the security requirements;

[0028] 3. Economy: A large number of currently used NVR / IPC devices support the H264 / H265 video coding format, and this proposal can be applied without replacing the devices, reducing various losses caused by replacing the devices;

[0029] 4. Efficiency: Signing and encrypting on the device avoids the performance loss caused by signing and encrypting on the original device. Description of the Drawings

[0030] Figure 1 It is a schematic structural diagram of an information signature encryption device for a security monitoring system based on the national cryptographic algorithm;

[0031] Figure 2 It is an example diagram of the bitstream encapsulation format;

[0032] Figure 3 It is an example diagram of the onvif control signaling data format. Detailed Embodiments

[0033] To make the objectives, technical solutions and advantages of the present invention clearer, the embodiments of the present invention will be further described in detail below.

[0034] The following gives an explanation of the special terms or English abbreviations involved in the embodiments of the present invention, as detailed in the following description:

[0035] ONVIF: Open Network Video Interface Forum, an open network video interface forum;

[0036] H264 / H265: High-efficiency Video Coding (HEVC), a highly compressed digital video codec standard;

[0037] IPC: IP CAMERA, a network infrared camera;

[0038] NVR: Network Video Recorder;

[0039] NALU: Network Abstract Layer Unit;

[0040] I-frame: Intra Frame, a key frame of the internal picture;

[0041] SEI: Supplemental Enhancement Information;

[0042] SM2: A national cryptographic elliptic curve public key cryptography algorithm;

[0043] SM3: A national cryptographic hashing algorithm;

[0044] SM4: A national cryptographic block cipher algorithm.

[0045] An embodiment of the present invention proposes an information signature encryption device for a security monitoring system based on national cryptographic algorithms. See Figure 1 , the device includes:

[0046] First aspect, a video stream signature scheme based on national cryptographic algorithms

[0047] 1. Identify the original video code stream. See Figure 2 , identify the NALU of the video stream according to the code stream encapsulation format; parse the NALU to obtain the I-frame data;

[0048] Taking the H264 code stream as an example, identify the PPS frame in the RTP packet. The standard reference is <rfc-3984>。

[0049] The bitstream sent by IPC is usually encapsulated into RTP data packets. The first byte of the data payload in the RTP data packet is the NALU Header. The last five bits of the NALU Header identify the type of NALU. According to the protocol, the value 7 represents that this frame is the SPS frame of the H264 bitstream.

[0050] 2. Calculate the digest value of the I-frame using the SM3 algorithm, and then perform SM2 calculation on the digest value to obtain the signature value; place the signature value in the custom SEI and insert it before the I-frame;

[0051] Taking the H264 bitstream as an example, the custom SEI format is as follows:

[0052] SEI custom identifier: 17 bytes

[0053] Encryption identifier: 1 byte

[0054] I-frame length: 4 bytes

[0055] IP to which the I-frame belongs: 16 bytes

[0056] Signature value: 64 bytes

[0057] Supplementary part of encrypted data: 16 bytes

[0058] 3. Identify the signed bitstream, identify the video stream NALU according to the bitstream encapsulation format; parse the video stream NALU to obtain the I-frame data and the signature value in the SEI;

[0059] 4. Calculate the digest value of the I-frame using the SM3 algorithm, and then perform signature verification on the digest value and the signature value using the SM2 algorithm.

[0060] Among them, the signature verification result is sent to the front-end web for use, and the web will display the signature verification result in real time and generate a signature verification report.

[0061] Second aspect, video encryption and decryption solution based on national cryptographic algorithms

[0062] 1. Identify the original video bitstream, identify the video stream NALU according to the bitstream encapsulation format, parse the video stream NALU to obtain the I-frame data;

[0063] 2. Calculate the padding length of the I-frame data, perform symmetric encryption on the padded data using the SM4 algorithm, replace the encrypted data into the original bitstream, save the padding data in the custom SEI, and insert the custom SEI before the I-frame;

[0064] 3. Identify the encrypted video bitstream, identify the video stream NALU according to the bitstream encapsulation format, parse the video stream NALU to obtain the encrypted I-frame data and the encrypted padding data in the SEI;

[0065] 4. Perform symmetric decryption on the encrypted data using the SM4 algorithm, and refill the decrypted data into the bitstream.

[0066] Among them, decrypt the encrypted data, and put the decrypted original I-frame back into the data stream for subsequent preview and playback.

[0067] Among them, both encryption and decryption use the SM4 algorithm. It is required that the data length is an integer multiple of 16. Therefore, the data to be encrypted that is not an integer multiple needs to be filled with data to an integer multiple of 16 first, and then encrypted. The same is true for decryption. It is necessary to decrypt first and then delete the padding data. Therefore, when transmitting encrypted data, the ciphertext data of the original data length is carried by the original data packet, and the filled ciphertext is carried by the SEI field. When decrypting, the two are combined first and then decrypted.

[0068] Third aspect, a dual-end device for a security monitoring system

[0069] The dual-end device provided by the embodiment of the present invention can be used as a client on the IPC side, bound to the IPC, and the client directly provides an interface to the outside; it can also be used as a server on the NVR side, bound to the NVR, and the server directly provides an interface to the outside. The following are the modules included in the device, as described in detail below:

[0070] 1. Video data parsing and filling module, used to identify and fill onvif control signaling data packets and video data packets in the video data;

[0071] Among them, parse and identify the parts in the data stream that need to be signed and encrypted, such as some protocol interactions of the onvif protocol, I-frames of the video stream, etc. Signing does not need to change the original data stream, only the signature result needs to be put into the SEI and transmitted together with the video stream for subsequent verification. Encryption needs to change the original data, and the original data needs to be replaced with encrypted data. Both filling the SEI and replacing the encrypted data require a data filling module.

[0072] 2. Video signature verification module, used to sign the video I-frame and verify the signed data stream;

[0073] 3. Video encryption and decryption module, used to encrypt the video I-frame and decrypt the encrypted data stream;

[0074] 4. Device authentication module, used for dual-end device authentication, key interaction and key management.

[0075] Among them, the main functions of the above video data parsing and filling module are as follows:

[0076] 1) Identify ONVIF control signaling data. Before the NVR pulls the original IPC code stream, ONVIF control signaling data interaction will occur. This signaling data is in the HTTP protocol format and requires the ability to parse the HTTP protocol format and determine the key signaling according to the ONVIF protocol;

[0077] See Figure 3 , the HTTP protocol format. For specific details, refer to the data required to be transmitted in the ONVIF protocol.

[0078] 2) Identify the video data flow direction. When the device acts as a server, the video data transmitted from the IPC to the NVR and the video data used for preview and playback with third-party devices will both be processed. Therefore, it is necessary to be able to identify the ownership of the video stream;

[0079] 3) Parse the key frames of the video stream. Identify the NALU according to different video raw code stream packet formats and further identify the I frames in the NALU, and save the I frame data;

[0080] For example: Identify the correct encapsulation format according to the encapsulation format of the H264 / H265 data stream.

[0081] 4) Parse the SEI frames of the video stream. Identify the NALU according to different video raw code stream packet formats and further identify the SEI frames in the NALU, and obtain the signature encryption data in the custom SEI frame;

[0082] Among them, determine the SEI field by identifying the type identifier of the SEI in the code stream, and then identify whether the SEI is the SEI field to be used according to the above custom 17-byte SEI identifier.

[0083] 5) Video stream data filling. Before forwarding the data, the video code stream should be filled and modified according to the needs of signature, encryption, and decryption.

[0084] Among them, the main functions of the video signature verification module are as follows:

[0085] 1) Apply the SM3 algorithm to the unsigned data of the obtained video I frame to calculate the digest value, and then apply SM2 to the digest value to obtain the signature value;

[0086] 2) Apply the SM3 algorithm to the signed data of the obtained video I frame to calculate the digest value, and then verify the signature value obtained from the SEI through the SM2 algorithm.

[0087] Among them, the main functions of the video encryption and decryption module are as follows:

[0088] 1) Apply data filling to the unencrypted data of the obtained video I frame and then perform symmetric encryption using the SM4 algorithm. Re-fill the original length back into the data stream, and the filling length is carried by the SEI frame;

[0089] Among them, the SM4 encryption algorithm is adopted, and the original data needs to be padded, that is, the length of the encrypted data should be an integer multiple of 16. The padded part exceeding the length of the original data after encryption is carried by the 16-byte encrypted data supplement part in the SEI field.

[0090] 2) Apply the SM4 algorithm for symmetric decryption according to the obtained encrypted data of the video I-frame and the encrypted padding data in the SEI, and refill the decrypted data back into the data stream.

[0091] Among them, the main functions of the device authentication module are as follows:

[0092] 1) When both ends of the device are used simultaneously, device authentication is given priority before protecting the integrity and confidentiality of video transmission.

[0093] 2) Exchange the certificates and keys required for signature verification, encryption, and decryption.

[0094] In summary, an information signature and encryption device for an anti-theft monitoring system based on the national cryptographic algorithm provided by the embodiment of the present invention protects the security of video data transmission. Installing the device on both the IPC side and the NVR side can effectively protect the transmission integrity and confidentiality of video data; it protects the security of video data storage. Before the NVR stores video data, the device can perform integrity and confidentiality protection on the video data, and can verify signatures and decrypt video stream data during preview and playback; it has a high security factor. The device uses the national cryptographic algorithm to sign and encrypt video stream data, and the national cryptographic algorithm has high security and recognition; it is compatible with mainstream devices. The device can be compatible with mainstream H264 / H265 coding formats without replacing devices; it is compatible with deployed devices. The device can be directly added to the existing network to protect the video stream without redeploying devices.

[0095] Embodiment 1

[0096] An embodiment of implementing the integrity and confidentiality protection of anti-theft monitoring video stream data by deploying a device client on the IPC side and a device server on the NVR side:

[0097] After the device is powered on, identity recognition and key exchange are performed at both ends; the NVR sends an onvif control signaling to the IPC side to prepare to pull the video stream, and the server and the client recognize the signaling and perform encrypted transmission; that is, if the IPC and NVR network communications are normal and the NVR has added the IPC, the NVR will start pulling the video stream of the IPC.

[0098] After the video stream starts to be sent, the client recognizes the video stream I-frame and performs signature encryption on the I-frame, puts the signature encryption information into a custom SEI, and inserts the code stream before the I-frame.

[0099] The server identifies the I-frame and SEI-frame of the video stream, verifies and decrypts the I-frame according to the signature encryption information in the SEI-frame, and restores the video bitstream to the original bitstream and sends it to the NVR.

[0100] Embodiment 2

[0101] An embodiment for deploying a device server on the NVR side to achieve data storage integrity and confidentiality protection of the security monitoring video stream:

[0102] The server identifies the I-frame of the input video stream and performs signature encryption on the I-frame, puts the signature encryption information into a custom SEI, and inserts the bitstream before the I-frame;

[0103] Use a third-party host to log in to the NVR for video preview and playback. The server identifies the I-frame of the playback video stream and performs signature verification and decryption on the I-frame, and fills the decrypted data back into the original bitstream;

[0104] The third-party host can preview and play normally, but the NVR side cannot preview and playback normally.

[0105] For the models of each device in the embodiments of the present invention, unless otherwise specified, the models of other devices are not limited, and any device that can perform the above functions can be used.

[0106] Those skilled in the art can understand that the drawings are only schematic diagrams of a preferred embodiment, and the serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments.

[0107] The above are only the preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An information signature encryption device for a security monitoring system based on national cryptographic algorithms, characterized in that The device includes: An IPC end module that collects video stream data in real time; A video stream signature module based on national cryptographic algorithms, which is used to sign the input video stream data and store it in the custom SEI of the video stream data; A video encryption and decryption module based on national cryptographic algorithms, which is used to encrypt the I frames and padding data in the video stream data, store the encrypted I frames in the original area of the I frames, store the encrypted padding data in the custom SEI, and insert the custom SEI before the I frames; An NVR end module, which is used to store the signed and encrypted video stream data.

2. The information signature and encryption device for the security monitoring system based on the national cryptographic algorithm according to claim 1, characterized in that, When reading the video stream data, the device further includes: A video stream signature verification module based on national cryptographic algorithms, which reads the signature value in the custom SEI of the output video stream data and performs signature verification. If the signature verification passes, it executes the video encryption and decryption module; A video encryption and decryption module based on national cryptographic algorithms, which reads the I frame data and the encrypted padding data in the output video stream data, decrypts them, stores the decrypted data in the I frames, and outputs the decrypted video stream data.

3. An information signature and encryption device for a security monitoring system based on the national cryptographic algorithm according to claim 1, characterized in that, The video stream signature module includes: A first recognition unit, which is used to recognize the original video code stream, recognize the video stream NALU according to the code stream encapsulation format; parse the NALU to obtain the I frame data; A calculation unit, which is used to calculate the I frame digest value by applying the SM3 algorithm, and then calculate the signature value by applying the SM2 algorithm to the digest value; A setting unit, which is used to place the signature value in the custom SEI.

4. An information signature encryption device for a security monitoring system based on the national cryptographic algorithm according to claim 1, characterized in that The video encryption and decryption module includes: A second recognition unit, which is used to recognize the signed code stream, recognize the video stream NALU according to the code stream encapsulation format; parse the video stream NAL to obtain the I frame data and the signature value in the SEI.

5. The information signature and encryption device for the security monitoring system based on the national cryptographic algorithm according to claim 2, characterized in that, The video stream signature verification module based on national cryptographic algorithms includes: A signature verification unit, which is used to calculate the I frame digest value by applying the SM3 algorithm, and then perform the signature verification of the SM2 algorithm on the digest value and the signature value.

Images