Identity authentication method for railway comprehensive video monitoring system

Abstract

The invention relates to an identity authentication method for a railway comprehensive video monitoring system. The system comprises a video management platform, terminal equipment, front-end equipment, password equipment and a key management system, a digital certificate representing a unique identity identifier is stored in the key management system; the password device provides encryption and decryption services; the step of identity verification of the terminal equipment and the front-end equipment comprises the following steps: the video management platform receives identity registration messages of the terminal equipment and the front-end equipment, calls a key management system interface to query a digital certificate of the equipment, and verifies the identity information of the equipment; the identity authentication of the video management platform comprises the following steps: the terminal equipment acquires digital certificates of the equipment and the video management platform through a serial port intelligent storage device, sends an identity registration message and verifies the identity of the video management platform; and the front-end equipment obtains the digital certificates of the equipment and the video management platform through the security chip in the equipment, sends an identity registration message, and verifies the identity of the video management platform.

Description

Technical Field

[0001] The present invention relates to the technical field of video surveillance in the field of railway transportation, and particularly to a method for identity authentication of a railway integrated video surveillance system. Background Art

[0002] At present, there are many potential risks in the information security of railway video surveillance systems. The identity authentication between front-end devices, back-end services, and end-users adopts the traditional username and password authentication method. This authentication method has the risks of easy password cracking and easy identity forgery, resulting in illegal users being able to easily access the system.

[0003] How to achieve the secure authentication of the identities and signaling information between front-end devices and node devices, and between node devices and end-user devices, enhance the security of the video surveillance system, ensure the authenticity of data sources, and ensure the confidentiality and integrity of data transmission has become an urgent problem to be solved. Summary of the Invention

[0004] In view of the above problems, the object of the present invention is to provide a method for identity authentication of a railway integrated video surveillance system, which solves the problem that the video management platform of existing video node devices only supports the identity authentication method of username and password, and the client software of video surveillance terminal devices only supports the login method of username and password. Based on the digital certificate identity authentication technology of a preset encryption algorithm (national encryption algorithm), it ensures that each user and device accessing the system undergoes strict identity authentication.

[0005] To achieve the above object, the present invention adopts the following technical solutions: In a first aspect, a method for identity authentication of a railway integrated video surveillance system is provided. The railway integrated video surveillance system includes: a video management platform, terminal devices, front-end devices, password devices, and a key management system; digital certificates representing the unique identity identifiers of the video management platform, terminal devices, and front-end devices are stored in the key management system; the password devices provide encryption and decryption services for the video management platform and the key management system; The method includes: steps for the video management platform to verify the identities of terminal devices and front-end devices, and steps for the video management platform to authenticate the identities of node devices; Among them, the steps for the video management platform to verify the identities of terminal devices and front-end devices include: the video management platform receives the identity registration messages of terminal devices and front-end devices, calls the key management system interface to query the digital certificates of the devices, and verifies the device identity information; Steps for identity authentication of node devices in a video management platform, including: The terminal device obtains the digital certificates of the device and the video management platform through the serial port intelligent storage device, sends an identity registration message, and verifies the identity of the video management platform; The front-end device obtains the digital certificates of the device and the video management platform through the security chip in the device, sends an identity registration message, and verifies the identity of the video management platform.

[0006] In one implementation, the identity verification of the terminal device includes: The terminal device software integrates a serial port intelligent storage device that supports a preset encryption algorithm. The serial port intelligent storage device internally stores the private key and digital certificate of the terminal device and the digital certificate of the video management platform; The terminal device negotiates the passwords of both parties in the current session with the node device. The password is encrypted with the public key in the other party's digital certificate using the first cryptographic algorithm and sent to the other party. The other party decrypts it with the private key using the corresponding first cryptographic algorithm to ensure the confidentiality of the password; When the terminal device performs identity authentication, it signs the message content to be sent and the original text of the session password of both parties using the second cryptographic algorithm and the private key and sends it to the video management platform. After receiving the response message from the video management platform, it verifies the signature of the original text of the response message and the session password of both parties using the second cryptographic algorithm and the public key in the digital certificate of the video management platform.

[0007] In one implementation, the identity authentication process of the terminal device specifically includes: After the video terminal software of the terminal device starts, it first detects whether the serial port intelligent storage device is connected to the terminal device. When the serial port intelligent storage device is not detected, it prompts the user to insert the serial port intelligent storage device and waits; After detecting the serial port intelligent storage device, the video terminal software reads the terminal application user certificate from the serial port intelligent storage device, parses the user code, and displays the user login interface; The user enters the personal identity number, and the serial port intelligent storage device verifies whether the personal identity number is correct; After the personal identity number verification passes, it connects to the node device according to the configuration information. If the connection fails, it displays a prompt message; After the connection is successful, it sends a registration message to the node device, and the registration message carries identity authentication information; After the terminal device receives the response message from the node device, it parses the message content, calls the serial port intelligent storage device interface, and decrypts the session password using the first cryptographic algorithm and the private key in the serial port intelligent storage device to obtain the original password; The terminal device creates its own session password and encrypts the passwords of both parties using the first cryptographic algorithm and the public key of the node device digital certificate saved in the serial port intelligent storage device; The terminal device calls the serial port intelligent storage device interface to sign the original text of the session password of both parties using the second cryptographic algorithm and the private key, and then sends the signature and the ciphertext of the passwords of both parties to the node device; After the terminal device receives the node device response message, it judges the login result. If the return is a failure, it prompts the management platform that the verification fails. If the return is a success, it verifies the identity of the node device's video management platform, calls the serial port intelligent storage device interface to decrypt the session password ciphertext of both parties to obtain the original text, verifies the received message and the original password text using the second cryptographic algorithm and the public key in the node device digital certificate, and judges the verification result; If the verification fails, it prompts the management platform that the identity verification fails. If the verification is successful, the identity verification process ends and the video terminal main interface is displayed; Monitor the event of the serial port intelligent storage device being unplugged. After detecting that the serial port intelligent storage device is unplugged, immediately disconnect the connection, interrupt the service and return to the login interface.

[0008] In one implementation, the process of authenticating the node device of the video management platform includes: The video management platform software integrates a password device with a preset encryption algorithm and a key management system interface. The password device stores the private key of the video management platform, queries the certificate through the key management system interface. The video management platform negotiates the password of both parties in the current session with the device. The password is encrypted using the first cryptographic algorithm with the public key in the other party's digital certificate and sent to the other party. The other party decrypts it using the private key with the corresponding first cryptographic algorithm to ensure the confidentiality of the password. After the video management platform receives the device's registration information, it verifies the received message and the original session password text of both parties using the second cryptographic algorithm and the public key in the device digital certificate, and signs the response message and the original session password text of both parties using the second cryptographic algorithm and the private key of the video management platform and sends it to the device.

[0009] In one implementation, it specifically includes: After the video management platform of the node device is started, it first connects to the key management system; if the connection fails, the service exits and the startup fails; if the connection is successful, the network listening port is started to listen for device connections; after the video management platform receives a device message, it determines whether the device is already registered. If it is already registered, it processes the received message; if the device is not registered, it parses the received message to obtain the device code and determines whether the system allows the device to connect; if the device is not allowed to connect, it closes the current connection and ends the session; if the device is allowed to connect, it calls the key management system interface to look up the device digital certificate based on the device code and determines the validity of the certificate. If the certificate is invalid, it sends a message indicating that the device certificate is invalid and closes the current connection to end the session; if the certificate is valid, it determines whether the message carries authentication information; if there is no authentication information, it generates a session password, calls the cryptographic device interface to encrypt the password using the first cryptographic algorithm and the public key of the device digital certificate, and the video management platform generates a return message with the encrypted password and sends it to the device; if there is authentication information, it calls the cryptographic device interface to decrypt the session password using the first cryptographic algorithm and the private key in the cryptographic device to obtain the original password, verifies the received message and the original password using the second cryptographic algorithm and the public key in the device digital certificate, and determines the verification result; if the verification fails, it returns "verification failed by the management platform" to the device and closes the connection; if the verification is successful, it calls the cryptographic device interface to encrypt the passwords of both parties using the first cryptographic algorithm and the public key of the device digital certificate; after the video management platform calls the cryptographic device interface to sign the original session passwords of both parties using the second cryptographic algorithm and the private key, it sends the signature and the encrypted passwords of both parties to the device and returns successful verification.

[0010] In a second aspect, the present application provides a railway integrated video surveillance authentication system, including: a video management platform, a terminal device, a front-end device, a cryptographic device, and a key management system; Among them, the key management system stores digital certificates representing the unique identity identifiers of the video management platform, the terminal device, and the front-end device; the cryptographic device provides encryption and decryption services for the video management platform and the key management system; The video management platform receives the identity registration messages of the terminal device and the front-end device, calls the key management system interface to query the digital certificates of the devices, and verifies the device identity information; the terminal device obtains the digital certificates of the device and the video management platform through a serial port intelligent storage device (such as a UKey), sends an identity registration message, and verifies the identity of the video management platform; the front-end device obtains the digital certificates of the device and the video management platform through the security chip in the device, sends an identity registration message, and verifies the identity of the video management platform.

[0011] In one implementation, the authentication process of the terminal device includes: the terminal device software integrates a UKey that supports a preset encryption algorithm. The private key of the terminal device, digital certificate, and the digital certificate of the video management platform are stored inside the UKey. The terminal device negotiates the passwords of both parties in the current session with the node device. The password is encrypted using the public key in the other party's digital certificate with the first cipher (such as SM2) algorithm and sent to the other party. The other party decrypts it using the private key with the SM2 algorithm to ensure the confidentiality of the password. When the terminal device performs identity authentication, it signs the sent message content and the original text of the session password of both parties using the SM2+SM3 algorithm and the private key and sends it to the video management platform. After receiving the response message from the video management platform, it verifies the signature of the original text of the response message and the session password of both parties using the second cipher (SM2+SM3) algorithm and the public key in the digital certificate of the video management platform.

[0012] In one implementation, the authentication process of the terminal device specifically includes: After the video terminal software of the terminal device starts, it first detects whether the UKey is connected to the terminal device. When the UKey is not detected, it prompts the user to insert the UKey and waits. After the UKey is detected, the video terminal software reads the terminal application user certificate from the UKey, parses the user code, and displays the user login interface. The user inputs the personal identification number PIN, and the UKey verifies whether the PIN is correct. After the PIN verification passes, it connects to the node device according to the configuration information. If the connection fails, it displays a prompt message. After the connection is successful, it sends a registration message to the node device, and the identity authentication information is carried in the registration message. After the terminal device receives the response message from the node device, it parses the message content, calls the UKey interface to decrypt the session password using the SM2 algorithm and the private key in the UKey to obtain the original password. The terminal device creates its own session password and encrypts the passwords of both parties using the SM2 algorithm and the public key of the node device digital certificate saved in the UKey. The terminal device calls the UKey interface to sign the original text of the session password of both parties, and then sends the signature and the ciphertext of the passwords of both parties to the node device. After the terminal device receives the response message from the node device, it judges the login result. If it returns failure, it prompts that the verification of the management platform fails. If it returns success, it verifies the identity of the video management platform of the node device, calls the UKey interface to decrypt the ciphertext of the session password of both parties to obtain the original text, verifies the signature of the received message and the original password using the SM2+SM3 algorithm and the public key in the digital certificate of the node device, and judges the verification result. If the signature verification fails, it prompts that the identity verification of the management platform fails. If the signature verification is successful, the identity authentication process ends, and the main interface of the video terminal is displayed. Monitor the event of unplugging the UKey. After detecting the unplugging of the UKey, immediately disconnect the connection, interrupt the service, and return to the login interface.

[0013] In one implementation, the process of authenticating the node device of the video management platform includes: The video management platform software integrates a password device with a preset encryption algorithm and a key management system interface. The password device stores the private key of the video management platform, queries the certificate through the key management system interface. The video management platform negotiates the passwords of both parties in the current session with the device. The password is encrypted using the public key in the other party's digital certificate with the first password (SM2) algorithm and sent to the other party. The other party decrypts it using the private key with the SM2 algorithm to ensure the confidentiality of the password. After the video management platform receives the registration information of the device, it verifies the signature of the received message and the original text of the session password of both parties using the second password (SM2+SM3) algorithm and the public key in the device digital certificate, and signs the response message and the original text of the session password of both parties using the SM2+SM3 algorithm and the private key of the video management platform and sends it to the device.

[0014] In one implementation, it specifically includes: After the video management platform of the node device is started, it first connects to the key management system; if the connection fails, the service exits and the startup fails; if the connection is successful, it starts the network listening port to monitor device connections; after the video management platform receives a device message, it determines whether the device has been registered. If it has been registered, it processes the received message; if the device is not registered, it parses the received message to obtain the device code and determines whether the system allows the device to connect; if the device connection is not allowed, it closes the current connection and ends the session; if the device connection is allowed, it calls the key management system interface to find the device digital certificate according to the device code and determines the validity of the certificate. If the certificate is invalid, it sends a message indicating that the device certificate is invalid and closes the current connection and ends the session; if the certificate is valid, it determines whether the message carries identity authentication information; if there is no identity authentication information, it generates a session password, calls the password device interface to encrypt the password using the SM2 algorithm and the public key of the device digital certificate, and the video management platform generates a return message with the encrypted password and sends it to the device; if there is identity authentication information, it calls the password device interface to decrypt the session password using the SM2 algorithm and the private key in the password device to obtain the original password, verifies the signature of the received message and the original password using the SM2+SM3 algorithm and the public key in the device digital certificate, and determines the verification result; if the verification fails, it returns "management platform signature verification failed" to the device and closes the connection; if the verification is successful, it calls the password device interface to encrypt the passwords of both parties using the SM2 algorithm and the public key of the device digital certificate; the video management platform calls the password device interface to sign the original text of the session password of both parties, and then sends the signature and the encrypted passwords of both parties to the device and returns the verification success.

[0015] In the railway integrated video surveillance system of the present invention, cryptographic techniques are used to encrypt and sign communication data, realizing the security authentication of device identities and signaling information between front-end devices and node devices, and between node devices and terminal devices. It can enhance the security of the video surveillance system, ensure the authenticity of data sources, ensure the confidentiality and integrity of data transmission, and also improve the anti-attack ability of the system and promote the unification of security management standards. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] By reading the detailed description of the preferred embodiments below, various other advantages and benefits will become clear to those of ordinary skill in the art. The drawings are only for the purpose of showing the preferred embodiments and are not considered to be a limitation of the present invention. Throughout the drawings, the same reference numerals are used to represent the same components. In the drawings: Figure 1 is the logical architecture diagram of the railway integrated video surveillance identity authentication system in the embodiment of the present invention; Figure 2 is the authentication flow chart of the terminal device; Figure 3 is the authentication flow chart of the node device. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings of the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the described embodiments of the present invention fall within the scope of protection of the present invention.

[0018] In response to the problems of the prior art, the technical solution of the present invention correspondingly provides a railway integrated video surveillance system, including: a video management platform, terminal devices, front-end devices, cryptographic devices, and a key management system; Among them, the key management system stores digital certificates representing the unique identity identifiers of the video management platform, terminal devices, and front-end devices; the cryptographic device provides encryption and decryption services for the video management platform and the key management system; The video management platform receives the identity registration messages of the terminal devices and front-end devices, calls the key management system interface to query the digital certificates of the devices, and verifies the device identity information; the terminal devices obtain the digital certificates of the devices and the video management platform through the UKey, send the identity registration messages, and verify the identity of the video management platform; the front-end devices obtain the digital certificates of the devices and the video management platform through the security chips in the devices, send the identity registration messages, and verify the identity of the video management platform.

[0019] The logical architecture diagram of the video surveillance security system is as shown in Figure 1 Figure Figure 1 , which consists of a video management platform (certificate identity authentication module), terminal devices (certificate identity authentication module), front-end devices (certificate identity authentication module), cryptographic devices, and a key management system. Each device has a digital certificate representing a unique identity, and communicates through the TCP / IP protocol. The video management platform (certificate identity authentication module) receives the identity registration messages of the terminal devices and front-end devices, calls the key management system interface to query the digital certificates of the devices, and verifies the device identity information. The terminal device (certificate identity authentication module) obtains the digital certificates of the device and the video management platform through the UKey, sends the identity registration message, and verifies the identity of the video management platform. The front-end device (certificate identity authentication module) obtains the digital certificates of the device and the video management platform through the security chip in the device, sends the identity registration message, and verifies the identity of the video management platform. The cryptographic device provides encryption and decryption services for the video management platform and the key management system. The key management system issues digital certificates for the video management platform and devices, and provides services such as certificate query and verification for the video surveillance security management platform. Identity authentication mainly includes: terminal device authentication and node device authentication.

[0020] Terminal device authentication: The terminal device software integrates a UKey that supports national cryptographic algorithms. The private key, digital certificate of the terminal device, and the digital certificate of the video management platform are stored inside the UKey. The terminal device negotiates the passwords of both parties in the current session with the node device. The password is encrypted using the public key in the other party's digital certificate by the SM2 algorithm and sent to the other party. The other party decrypts it using the private key by the SM2 algorithm to ensure the confidentiality of the password. When authenticating the identity of the terminal device, the message content to be sent and the original passwords of both parties in the session are signed using the SM2+SM3 algorithm and the private key and sent to the video management platform. After receiving the response message from the video management platform, the original response message and the original passwords of both parties in the session are verified using the SM2+SM3 algorithm and the public key in the digital certificate of the video management platform to ensure data anti-tampering and anti-repudiation.

[0021] Node device authentication: The video management platform software integrates a cryptographic device that supports national cryptographic algorithms and a key management system interface. The cryptographic device stores the private key of the video management platform and queries the certificate through the key management system interface. The video management platform negotiates the passwords of both parties in the current session with the device. The password is encrypted using the public key in the other party's digital certificate by the SM2 algorithm and sent to the other party. The other party decrypts it using the private key by the SM2 algorithm to ensure the confidentiality of the password. After receiving the registration information of the device, the video management platform verifies the received message and the original passwords of both parties in the session using the SM2+SM3 algorithm and the public key in the device's digital certificate to ensure data anti-tampering and anti-repudiation, and signs the response message and the original passwords of both parties in the session using the SM2+SM3 algorithm and the private key of the video management platform and sends it to the device.

[0022] In a more detailed example, the authentication of the terminal device and the node device is as follows: Terminal device authentication process: As Figure 2 shown, after the video terminal software of the terminal device is started, it first detects whether the UKey is connected to the terminal device. When the UKey is not detected, it prompts the user to insert the UKey and waits. After the UKey is detected, the video terminal software reads the terminal application user certificate from the UKey, parses the user code, and displays the user login interface. The user enters the PIN, and the UKey verifies whether the PIN is correct. After the PIN verification passes, it connects to the node device according to the configuration information. If the connection fails, a prompt message is displayed. After the connection is successful, it sends a registration message to the node device. The registration message carries the identity authentication capabilities, including encryption algorithms, digest algorithms, signature algorithms, etc. After the terminal device receives the response message from the node device, it parses the message content, calls the UKey interface, and uses the SM2 algorithm and the private key in the UKey to decrypt the session password to obtain the original password. The terminal device creates its own session password and encrypts the passwords of both parties using the SM2 algorithm and the public key of the node device digital certificate saved in the UKey. After the terminal device calls the UKey interface to sign the original session passwords of both parties, it sends the signature and the ciphertext of the passwords of both parties to the node device. After the terminal device receives the response message from the node device, it judges the login result. If the return is a failure, it prompts that the verification of the management platform fails. If the return is a success, it verifies the identity of the video management platform of the node device, calls the UKey interface to decrypt the ciphertext of the session passwords of both parties to obtain the original text, verifies the signature of the received message and the original password using the SM2+SM3 algorithm and the public key in the node device digital certificate, and judges the signature verification result. If the signature verification fails, it prompts that the identity verification of the management platform fails. If the signature verification is successful, the identity authentication process ends, the main interface of the video terminal is displayed, and the UKey unplug event is monitored. After the UKey is detected to be unplugged, the connection is immediately disconnected, the service is interrupted, and the login interface is returned.

[0023] Node device authentication process: As Figure 3As shown in the figure, after the video management platform of the node device is started, it first connects to the key management system. If the connection fails, the service exits and the startup fails. If the connection is successful, the network listening port is started to listen for device connections. After the video management platform receives a device message, it determines whether the device is already registered. If it is already registered, the received message is processed. If the device is not registered, the received message is parsed to obtain the device code, and it is determined whether the system allows the device to connect. If the device is not allowed to connect, the current connection is closed and the session ends. If the device is allowed to connect, the key management system interface is called to find the device digital certificate according to the device code, and the validity of the certificate is judged. If the certificate is invalid, a device certificate invalid message is sent, the current connection is closed, and the session ends. If the certificate is valid, it is judged whether the message carries authentication information. If there is no authentication information, a session password is generated, the password device interface is called to encrypt the password using the SM2 algorithm and the public key of the device digital certificate, and the video management platform generates a return message with the password ciphertext and sends it to the device. If there is authentication information, the password device interface is called to decrypt the session password using the SM2 algorithm and the private key in the password device to obtain the original password, and the received message and the original password are verified using the SM2+SM3 algorithm and the public key in the device digital certificate, and the verification result is judged. If the verification fails, the device is returned with "Verification failed by the management platform", and the connection is closed. If the verification is successful, the password device interface is called to encrypt the passwords of both parties using the SM2 algorithm and the public key of the device digital certificate. After the video management platform calls the password device interface to sign the original session passwords of both parties, the signature and the password ciphertexts of both parties are sent to the device and the verification success is returned.

[0024] Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices, and units described above can refer to the corresponding processes in the foregoing method embodiments and will not be elaborated here.

[0025] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the above division of units is only a logical function division, and there can be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection between each other can be through some interfaces, and the indirect coupling or communication connection of devices or units can be in electrical, mechanical or other forms.

[0026] The integrated unit implemented in the form of software functional units can be stored in a computer-readable storage medium. The above-mentioned software functional units are stored in a storage medium and include several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute some steps of the methods in the various embodiments of the present invention. The foregoing storage medium includes: various media that can store program codes such as USB flash drives, mobile hard disks, read-only memories, random access memories, magnetic disks, or optical discs.

[0027] The above are only the preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A method for identity authentication of a railway integrated video surveillance system, characterized in that The railway integrated video monitoring system includes: a video management platform, terminal devices, front-end devices, cryptographic devices, and a key management system; digital certificates representing the unique identity identifiers of the video management platform, terminal devices, and front-end devices are stored in the key management system; the cryptographic devices provide encryption and decryption services for the video management platform and the key management system; The method includes: steps for the video management platform to verify the identities of the terminal devices and front-end devices, and steps for the identity authentication of the node devices of the video management platform; Among them, the steps for the video management platform to verify the identities of the terminal devices and front-end devices include: the video management platform receives the identity registration messages of the terminal devices and front-end devices, calls the key management system interface to query the digital certificates of the devices, and verifies the device identity information; The steps for the identity authentication of the node devices of the video management platform include: the terminal devices obtain the digital certificates of the devices and the video management platform through the serial port intelligent storage device, send the identity registration message, and verify the identity of the video management platform; the front-end devices obtain the digital certificates of the devices and the video management platform through the security chip in the devices, send the identity registration message, and verify the identity of the video management platform.

2. The method for identity authentication of the railway integrated video surveillance system according to claim 1, characterized in that, The identity verification of the terminal devices includes: the terminal device software integrates a serial port intelligent storage device supporting a preset encryption algorithm, and the private key, digital certificate of the terminal device, and the digital certificate of the video management platform are stored inside the serial port intelligent storage device; the terminal device negotiates the passwords of both parties in the current session with the node device, and the password is encrypted with the public key in the other party's digital certificate using the first cryptographic algorithm and sent to the other party, and the other party decrypts it with the private key using the corresponding first cryptographic algorithm to ensure the confidentiality of the password; when the terminal device conducts identity authentication, it signs the message content to be sent and the original text of the session password of both parties using the second cryptographic algorithm and the private key and sends it to the video management platform. After receiving the response message from the video management platform, it verifies the signature of the response message original text and the session password of both parties using the second cryptographic algorithm and the public key in the digital certificate of the video management platform.

3. The method for identity authentication of the railway integrated video surveillance system according to claim 2, characterized in that, The identity authentication process of the terminal device specifically includes: After the video terminal software of the terminal device starts, it first detects whether the serial port intelligent storage device is connected to the terminal device. When the serial port intelligent storage device is not detected, it prompts the user to insert the serial port intelligent storage device and waits; After detecting the serial port intelligent storage device, the video terminal software reads the terminal application user certificate from the serial port intelligent storage device, parses the user code, and displays the user login interface; The user enters the personal identification number, and the serial port intelligent storage device verifies whether the personal identification number is correct; After the personal identification number verification passes, it connects to the node device according to the configuration information. If the connection fails, it displays a prompt message; After the connection is successful, it sends a registration message to the node device, and the registration message carries the identity authentication information; After the terminal device receives the response message from the node device, it parses the message content, calls the serial port intelligent storage device interface, and decrypts the session password using the first cryptographic algorithm and the private key in the serial port intelligent storage device to obtain the original password; The terminal device creates the local session password, and encrypts the passwords of both parties using the first cryptographic algorithm and the public key of the node device digital certificate saved in the serial port intelligent storage device; The terminal device calls the serial port intelligent storage device interface to sign the original session password of both parties using the second cryptographic algorithm and the private key, and then sends the signature and the ciphertext of the passwords of both parties to the node device; After the terminal device receives the node device response message, it judges the login result. If the return is failure, it prompts the management platform that the verification fails. If the return is success, it verifies the identity of the video management platform of the node device, calls the serial port intelligent storage device interface to decrypt the ciphertext of the session password of both parties to obtain the original text, verifies the signature of the received message and the original password using the second cryptographic algorithm and the public key in the node device digital certificate, and judges the signature verification result; If the signature verification fails, it prompts the management platform that the identity verification fails. If the signature verification is successful, the identity authentication process ends, and the main interface of the video terminal is displayed; Listen for the event of the serial port intelligent storage device being unplugged. After detecting that the serial port intelligent storage device is unplugged, immediately disconnect the connection, interrupt the service, and return to the login interface.

4. The method for identity authentication of the railway integrated video surveillance system according to claim 1, characterized in that, The process of authenticating the node device of the video management platform includes: The video management platform software integrates a password device with a preset encryption algorithm and a key management system interface. The password device stores the private key of the video management platform. The certificate is queried through the key management system interface. The video management platform negotiates the passwords of both parties in the current session with the device. The password is encrypted using the first cryptographic algorithm with the public key in the other party's digital certificate and sent to the other party. The other party decrypts it using the private key with the corresponding first cryptographic algorithm to ensure the confidentiality of the password. After the video management platform receives the registration information of the device, it verifies the signature of the received message and the original text of the session password of both parties using the second cryptographic algorithm and the public key in the device digital certificate, and signs the response message and the original text of the session password of both parties using the second cryptographic algorithm and the private key of the video management platform and sends it to the device.

5. The method for identity authentication of the railway integrated video surveillance system according to claim 4, characterized in that, Specifically include: After the video management platform of the node device starts, it first connects to the key management system; If the connection fails, the service exits and the startup fails; If the connection is successful, start the network listening port to listen for device connections; After the video management platform receives the device message, it judges whether the device has been registered; If it has been registered, process the received message; If the device is not registered, parse the received message to obtain the device code, and judge whether the system allows the device to connect; if the device is not allowed to connect, close the current connection and end the session; If the device is allowed to connect, call the key management system interface, find the device digital certificate according to the device code, and judge the validity of the certificate; If the certificate is invalid, send a message that the device certificate is invalid, close the current connection, and end the session; If the certificate is valid, judge whether the message carries identity authentication information; If there is no identity authentication information, a session password is generated, and the password device interface is called to encrypt the password using the first cryptographic algorithm and the public key of the device digital certificate. The video management platform generates a return message with the encrypted password and sends it to the device. If there is identity authentication information, the password device interface is called to decrypt the session password using the first cryptographic algorithm and the private key in the password device to obtain the original password. The received message and the original password are verified using the second cryptographic algorithm and the public key in the device digital certificate, and the verification result is judged. If the verification fails, "Verification failed by the management platform" is returned to the device, and the connection is closed. If the verification is successful, the password device interface is called to encrypt the passwords of both parties using the first cryptographic algorithm and the public key of the device digital certificate. After the video management platform calls the password device interface to sign the original session passwords of both parties using the second cryptographic algorithm and the private key, the signature and the encrypted passwords of both parties are sent to the device and "Verification successful" is returned.

Images