Key self-checking method and computer device

Abstract

The application relates to a key self-checking method and computer equipment, obtaining a to-be-verified user password of to-be-decrypted video coding data, and extracting target verification ciphertext and a preset check code from the to-be-decrypted video coding data; the target verification ciphertext is decrypted by using the to-be-verified user password to obtain a to-be-verified decryption key corresponding to the target verification ciphertext; the to-be-verified decryption key is subjected to check calculation to obtain a to-be-verified check code corresponding to the to-be-verified decryption key; in the case that the to-be-verified check code is consistent with the preset check code, the verification result of the to-be-verified decryption key is determined as success; while guaranteeing decryption security, the key management process is simplified, local decryption key storage and legality verification are realized, and the accuracy and reliability of the decryption operation are ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a key self-checking method and a computer device. BACKGROUND

[0002] With the wide application of digital multimedia content, the security of video data is increasingly concerned, and how to effectively prevent unauthorized access and dissemination becomes a problem to be solved. At present, the common video encryption scheme usually distributes the decryption key through an independent key management system, and lacks a verification mechanism for the accuracy of the decryption key in the decryption process, so as to ensure the accuracy of video data decryption.

[0003] In view of the problem that the related art cannot guarantee the accuracy of the decryption key, no effective solution has been proposed so far. SUMMARY

[0004] Therefore, it is necessary to provide a key self-checking method and a computer device in view of the above technical problems.

[0005] In a first aspect, the present application provides a key self-checking method, which comprises:

[0006] obtaining a to-be-verified user password of to-be-decrypted video encoding data, and extracting a target verification ciphertext and a preset check code from the to-be-decrypted video encoding data;

[0007] decrypting the target verification ciphertext by using the to-be-verified user password to obtain a to-be-verified decryption key corresponding to the target verification ciphertext;

[0008] performing check calculation on the to-be-verified decryption key to obtain a to-be-verified check code corresponding to the to-be-verified decryption key;

[0009] in a case where the to-be-verified check code is consistent with the preset check code, determining that a verification result of the to-be-verified decryption key is successful.

[0010] In one of the embodiments, the decrypting the target verification ciphertext by using the to-be-verified user password to obtain a to-be-verified decryption key corresponding to the target verification ciphertext comprises:

[0011] performing key derivation operation on the to-be-verified user password to obtain a first derived key corresponding to the to-be-verified user password;

[0012] decrypting the target verification ciphertext by using the first derived key to obtain the to-be-verified decryption key corresponding to the target verification ciphertext.

[0013] In one of the embodiments, the key derivation operation on the to-be-verified user password to obtain the first derived key corresponding to the to-be-verified user password comprises:

[0014] extracting a preset salt value from the to-be-decrypted video coding data;

[0015] performing pseudo-random iteration calculation on the to-be-verified user password and the preset salt value to obtain the first derived key corresponding to the to-be-verified user password.

[0016] In one of the embodiments, the decryption of the target verification ciphertext by using the first derived key to obtain the to-be-verified decryption key corresponding to the target verification ciphertext comprises:

[0017] performing XOR operation on the target verification ciphertext and the first derived key to obtain the to-be-verified decryption key corresponding to the target verification ciphertext.

[0018] In one of the embodiments, the method further comprises:

[0019] obtaining the user encryption password and the encryption key corresponding to the original video coding data corresponding to the to-be-decrypted video coding data;

[0020] performing key derivation operation on the user encryption password to obtain the second derived key corresponding to the user encryption password;

[0021] encrypting the encryption key by using the second derived key to obtain the ciphertext corresponding to the encryption key;

[0022] determining the ciphertext corresponding to the encryption key as the target verification ciphertext corresponding to the to-be-decrypted video coding data;

[0023] storing the target verification ciphertext to the target data unit of the to-be-decrypted video coding data.

[0024] In one of the embodiments, the method further comprises:

[0025] performing verification calculation on the encryption key corresponding to the original video coding data to obtain the verification code corresponding to the encryption key;

[0026] determining the verification code corresponding to the encryption key as the preset verification code corresponding to the to-be-decrypted video coding data;

[0027] storing the preset verification code to the target data unit.

[0028] In one of the embodiments, the video coding data to be decrypted comprises a plurality of network abstraction layer units; the network abstraction layer unit comprises cipher data; the method further comprises:

[0029] In the case that the verification result of the decryption key to be verified is successful, for each network abstraction layer unit in the video coding data to be decrypted, the cipher data corresponding to the network abstraction layer unit is decrypted by using the decryption key to be verified, to obtain target plain data corresponding to the cipher data.

[0030] In one of the embodiments, the step of decrypting the cipher data corresponding to the network abstraction layer unit by using the decryption key to be verified to obtain target plain data corresponding to the cipher data comprises:

[0031] extracting a preset initialization vector corresponding to the network abstraction layer unit from the video coding data to be decrypted;

[0032] performing key stream calculation according to the decryption key to be verified and the preset initialization vector, to obtain a first key stream corresponding to the network abstraction layer unit;

[0033] decrypting the cipher data by using the first key stream, to obtain target plain data corresponding to the cipher data.

[0034] In one of the embodiments, the method further comprises:

[0035] obtaining original video coding data; the original video coding data comprises a plurality of network abstraction layer units to be encrypted;

[0036] determining an encryption key corresponding to the original video coding data, and a preset initialization vector corresponding to each network abstraction layer unit to be encrypted in the original video coding data;

[0037] for each network abstraction layer unit to be encrypted, performing key stream calculation according to the encryption key and the preset initialization vector, to obtain a second key stream corresponding to the network abstraction layer unit to be encrypted;

[0038] encrypting the network abstraction layer unit to be encrypted by using the second key stream, to obtain a network abstraction layer unit;

[0039] determining video coding data to be decrypted according to a plurality of network abstraction layer units.

[0040] In a second aspect, the application further provides a key self-checking device, which comprises:

[0041] The acquisition module is configured to acquire a to-be-verified user password of to-be-decrypted video coding data, and extract a target verification ciphertext and a preset check code from the to-be-decrypted video coding data.

[0042] The decryption module is configured to decrypt the target verification ciphertext by using the to-be-verified user password to obtain a to-be-verified decryption key corresponding to the target verification ciphertext.

[0043] The check module is configured to perform check calculation on the to-be-verified decryption key to obtain a to-be-verified check code corresponding to the to-be-verified decryption key.

[0044] The comparison module is configured to determine that a verification result of the to-be-verified decryption key is successful in a case where the to-be-verified check code is consistent with the preset check code.

[0045] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, the memory stores a computer program, and the processor implements the steps of the method in any one of the embodiments of the first aspect when executing the computer program.

[0046] In a fourth aspect, the present application further provides a computer readable storage medium, which stores a computer program, and the computer program implements the steps of the method in any one of the embodiments of the first aspect when executed by a processor.

[0047] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, and the computer program implements the steps of the method in any one of the embodiments of the first aspect when executed by a processor.

[0048] The key self-checking method and the computer device, the target verification ciphertext and the preset check code are carried in the to-be-decrypted video coding data, the to-be-verified user password of the to-be-decrypted video coding data is acquired, and the target verification ciphertext and the preset check code are extracted from the to-be-decrypted video coding data; the to-be-verified user password is used to decrypt the target verification ciphertext, and a to-be-verified decryption key corresponding to the target verification ciphertext is obtained; the decryption key is embedded in the to-be-decrypted video coding data, thereby avoiding the limitation caused by the distribution of the decryption key by the external key management system in the traditional decryption process, especially the poor flexibility and the limited application scene existing in the offline environment, realizing the local storage of the decryption key; further, the to-be-verified decryption key is checked and calculated to obtain a to-be-verified check code corresponding to the to-be-verified decryption key; the to-be-verified check code is compared with the preset check code embedded in the to-be-decrypted video coding data, and in the case that the to-be-verified check code is consistent with the preset check code, the verification result of the to-be-verified decryption key is determined to be successful, thereby simplifying the key management process, realizing the local decryption key storage and the legality verification, and ensuring the accuracy and reliability of the decryption operation while guaranteeing the decryption security. BRIEF DESCRIPTION OF DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present application or the related art. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0050] Figure 1 The application environment diagram of the key self-checking method in an embodiment;

[0051] Figure 2 The flowchart of the key self-checking method in an embodiment;

[0052] Figure 3 The flowchart of the target verification ciphertext generation step in an embodiment;

[0053] Figure 4 The flowchart of the preset check code generation step in an embodiment;

[0054] Figure 5 The flowchart of the network abstraction layer unit decryption step in an embodiment;

[0055] Figure 6 The structure diagram of the pre-SEI data unit in an embodiment;

[0056] Figure 7A flowchart of a network abstraction layer unit encryption step in one embodiment;

[0057] Figure 8 A diagram of original video encoded data in one embodiment;

[0058] Figure 9 A diagram of video encoded data to be decrypted in one embodiment;

[0059] Figure 10 A diagram of an encryption key encryption process in one embodiment;

[0060] Figure 11 A diagram of a structure of a first SEI data unit in one embodiment;

[0061] Figure 12 A diagram of an original video encoded data encryption process in one embodiment;

[0062] Figure 13 A diagram of a key check process in one embodiment;

[0063] Figure 14 A diagram of a video encoded data to be decrypted decryption process in one embodiment;

[0064] Figure 15 A block diagram of a key self-checking device in one embodiment;

[0065] Figure 16 An internal structure diagram of a computer device in one embodiment. DETAILED DESCRIPTION

[0066] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application.

[0067] The key self-checking method provided by the embodiments of the present application can be applied to, for example, Figure 1The application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data required by the server 104 to process. The data storage system can be integrated on the server 104, or placed on the cloud or other network servers. The password of the user to be verified for obtaining the decrypted video coding data is obtained, and the target verification ciphertext and the preset check code are extracted from the decrypted video coding data; the target verification ciphertext is decrypted using the password of the user to be verified, and the target verification ciphertext corresponding to the decrypted key to be verified is obtained; the decrypted key to be verified is checked, and the decrypted key to be verified corresponding to the decrypted key to be verified is obtained; in the case that the decrypted key to be verified is consistent with the preset check code, the verification result of the decrypted key to be verified is determined to be successful. Among them, the terminal 102 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices, etc. The server 104 can be a standalone physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0068] In an exemplary embodiment, as Figure 2 shown, Figure 2 is a flowchart of the key self-checking method in an embodiment; this embodiment illustrates the method applied to a terminal, it can be understood that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is realized through the interaction of the terminal and the server. In this embodiment, the method includes the following steps:

[0069] Step S201, obtaining the password of the user to be verified for obtaining the decrypted video coding data, and extracting the target verification ciphertext and the preset check code from the decrypted video coding data.

[0070] Among them, the decrypted video coding data refers to the video coding stream after encryption processing; the decrypted video coding data includes a plurality of network abstraction layer units; wherein the network abstraction layer unit is a basic syntax structure unit in the video coding standard (such as H.264, H.265); the network abstraction layer unit is used to divide the decrypted video coding data into independent data packets for network transmission and decoding processing.

[0071] Among them, the target verification ciphertext and the preset check code are both stored in the target data unit of the decrypted video coding data; the target data unit can be, but is not limited to, the first SEI (Supplemental Enhancement Information) data unit in the decrypted video coding data; the first SEI data unit is a network abstraction layer unit carrying encryption parameter information related to the decrypted video coding data. Among them, the encryption parameter information can include, but is not limited to, the target verification ciphertext and the preset check code.

[0072] wherein, the target verification ciphertext is the ciphertext information generated by encrypting the encryption key. The encryption key is a content encryption key randomly generated for the original video coding data corresponding to the to-be-decrypted video coding data. In the video data encryption stage, the encryption key is used for encryption processing of the original video coding data; in the key verification stage, the encryption key is encrypted to generate the target verification ciphertext embedded in the to-be-decrypted video coding data, which is used to realize the local verification of the legality of the user password.

[0073] wherein, the preset check code is a check value obtained by performing check calculation on the encryption key in the original video coding data encryption stage (i.e. the to-be-decrypted video coding data generation stage); it can be understood that the preset check code is used for legality verification of the to-be-decrypted key in the key verification stage.

[0074] It should be noted that the preset check code can be, but is not limited to, generated based on a hash algorithm, which is not limited here; for example, based on the SM3 algorithm, the preset check code is obtained by performing check calculation on the encryption key.

[0075] It should be noted that the SM3 algorithm has a one-way property, i.e. the encryption key cannot be inversely deduced from the preset check code, thus ensuring the security of the preset check code in the to-be-decrypted video coding data.

[0076] wherein, the to-be-verified user password is the password input by the user for decryption operation; the to-be-verified user password is in the form of a string; for example, the to-be-verified user password includes uppercase and lowercase letters, numbers and special characters, etc.

[0077] Step S202, decrypting the target verification ciphertext using the to-be-verified user password to obtain a to-be-verified decryption key corresponding to the target verification ciphertext.

[0078] The method of decrypting the target verification ciphertext using the to-be-verified user password can be: decrypting the target verification ciphertext using the to-be-verified user password based on a symmetric decryption algorithm. The symmetric decryption algorithm refers to a type of encryption algorithm that uses the same key for encryption and decryption.

[0079] The to-be-verified decryption key is a potential effective decryption key decrypted from the target verification ciphertext.

[0080] It can be understood that the to-be-verified decryption key is recovered from the target verification ciphertext by the to-be-verified user password provided by the user through a specific decryption algorithm, and the effectiveness of the to-be-verified decryption key needs to be confirmed through an additional check step. Only after the check is successful, the to-be-verified decryption key can be identified as the real decryption key, and then can be used for decryption operation of the to-be-decrypted video coding data.

[0081] Step S203, a check calculation is performed on the to-be-verified decryption key to obtain a to-be-verified check code corresponding to the to-be-verified decryption key.

[0082] The to-be-verified check code refers to a code or value used to verify the legality of the to-be-verified decryption key.

[0083] In an exemplary embodiment, the method of performing a check calculation on the to-be-verified decryption key can be: performing a predetermined check algorithm on the to-be-verified decryption key, which can be but is not limited to a hash function, a message authentication code, etc., which is not specifically limited herein.

[0084] Step S204, in the case where the to-be-verified check code is consistent with the preset check code, it is determined that the verification result of the to-be-verified decryption key is successful.

[0085] Exemplarily, taking the case where the key self-checking method is applied to a playback terminal as an example, it is assumed that the encryption key corresponding to the original video coding data is vek, the preset check code corresponding to the encryption key is key_verify, and the encryption key vek is embedded in the first SEI data unit of the to-be-decrypted video coding data in the form of the target verification ciphertext evek after being encrypted.

[0086] When a user decrypts the to-be-decrypted video coding data, key self-checking needs to be performed first, which specifically includes: receiving, by the playback terminal, a to-be-verified user password Password' input by the user for the to-be-decrypted video coding data, extracting the target verification ciphertext evek and the preset check code key_verify from the first SEI data unit of the to-be-decrypted video coding data; decrypting, by the playback terminal, the target verification ciphertext evek by using the to-be-verified user password Password' to obtain a to-be-verified decryption key corresponding to the target verification ciphertext, denoted as vek'; further performing a check calculation on the to-be-verified decryption key vek' to obtain a to-be-verified check code corresponding to the to-be-verified decryption key vek', denoted as key_verify'; determining whether the to-be-verified check code key_verify' is consistent with the preset check code key_verify, if the to-be-verified check code key_verify' is consistent with the preset check code key_verify, it is determined that the verification result of the to-be-verified decryption key key_verify' is successful, and the decryption operation on the to-be-decrypted video coding data can be performed based on the to-be-verified decryption key key_verify'; otherwise, the decryption process is terminated to prevent unauthorized data access and ensure the security of the video content.

[0087] In the embodiment, by embedding the decryption key in the to-be-decrypted video coding data, the limitation brought by the distribution of the decryption key by the external key management system in the traditional decryption process is avoided, especially the poor flexibility and limited application scenarios existing in the offline environment, local storage of the decryption key is realized; further, the to-be-verified decryption key is verified and calculated to obtain a to-be-verified check code corresponding to the to-be-verified decryption key; the to-be-verified check code is compared with a preset check code embedded in the to-be-decrypted video coding data, and in the case that the to-be-verified check code is consistent with the preset check code, the verification result of the to-be-verified decryption key is determined as success, while ensuring the decryption security, the key management process is simplified, the local decryption key storage and legality verification are realized, and the accuracy and reliability of the decryption operation are ensured.

[0088] In one embodiment, the target verification ciphertext is decrypted by using the to-be-verified user password to obtain a to-be-verified decryption key corresponding to the target verification ciphertext, including the following steps:

[0089] Step 1, performing key derivation operation on the to-be-verified user password to obtain a first derived key corresponding to the to-be-verified user password.

[0090] Among them, the key derivation operation refers to converting the to-be-verified user password into fixed-length and high-strength key data based on a preset derivation algorithm. Among them, the preset derivation algorithm can be but is not limited to PBKDF2, bcrypt, scrypt, or Argon2, etc., which is not specifically limited here.

[0091] In one exemplary embodiment, step 1 performs key derivation operation on the to-be-verified user password to obtain a first derived key corresponding to the to-be-verified user password, including the following steps:

[0092] Step 1.1, extracting a preset salt value from the to-be-decrypted video coding data.

[0093] Among them, the preset salt value is a random value randomly generated in the key encryption stage and embedded in the target data unit of the to-be-decrypted video coding data.

[0094] Step 1.2, performing pseudo-random iteration calculation on the to-be-verified user password and the preset salt value to obtain a first derived key corresponding to the to-be-verified user password.

[0095] Exemplarily, assuming that the to-be-verified user password is Password', the preset salt value is Salt, and the preset salt value Salt is embedded in the first SEI data unit of the to-be-decrypted video coding data; in the key verification stage, the PBKDF2 function is used to perform pseudo-random iteration calculation (iteration times N times) on the to-be-verified user password Password' and the preset salt value Salt to obtain a first derived key Hash' corresponding to the to-be-verified user password, wherein the symbol "||" represents concatenation.

[0096] Step 2, decrypt the target verification ciphertext by using the first derived key to obtain a to-be-verified decryption key corresponding to the target verification ciphertext.

[0097] For example, taking the first derived key Hash' as an example, the target verification ciphertext is decrypted by using the first derived key Hash' based on a symmetric decryption algorithm to obtain a to-be-verified decryption key corresponding to the target verification ciphertext.

[0098] In one exemplary embodiment, step 2, decrypting the target verification ciphertext by using the first derived key to obtain a to-be-verified decryption key corresponding to the target verification ciphertext, comprises:

[0099] XORing the target verification ciphertext and the first derived key to obtain a to-be-verified decryption key corresponding to the target verification ciphertext.

[0100] The XOR operation can be used for data recovery; for example, A XOR B XOR B again can restore to A, that is, the XOR of two B themselves can be offset.

[0101] For example, taking the first derived key Hash' as an example, assuming that the target verification ciphertext is evek, XORing the target verification ciphertext evek and the first derived key Hash' to obtain a to-be-verified decryption key vek' corresponding to the target verification ciphertext evek, wherein the symbol "XOR" represents XOR operation.

[0102] In this embodiment, the first derived key is obtained based on a preset salt value embedded in the to-be-decrypted video coding data and a to-be-verified user password, and the target verification ciphertext embedded in the to-be-decrypted video coding data is decrypted by using the first derived key to obtain a to-be-verified decryption key, which realizes the localization extraction and autonomous derivation of key information, and avoids the problems of limited key acquisition and poor flexibility in an offline environment in the prior art.

[0103] In one embodiment, as shown in Figure 3 , Fig. 1 is a flowchart of the target verification ciphertext generation step in one embodiment; the key self-checking method further comprises the following steps: Figure 3

[0104] Step S301, obtaining a user encryption password and an encryption key corresponding to original video coding data corresponding to the to-be-decrypted video coding data.

[0105] ​​​The original video encoding data refers to an original video stream without encryption. It can be understood that the corresponding to-be-decrypted video encoding data can be obtained by encrypting the original video stream. The original video stream refers to a standard format video stream output by a video encoder.

[0106] The user encryption password refers to an identity credential in the form of a string set by a content provider or an encryption initiator.

[0107] The encryption key is a content encryption key randomly generated for the original video encoding data. In the video data encryption stage, the encryption key is used to encrypt the original video encoding data. In the key verification stage, the encryption key is embedded in the to-be-decrypted video encoding data after being encrypted to generate a target verification ciphertext, which is used to verify the legality of the user password locally.

[0108] In step S302, a key derivation operation is performed on the user encryption password to obtain a second derived key corresponding to the user encryption password.

[0109] The key derivation operation refers to converting the user encryption password into fixed-length and high-strength key data based on a preset derivation algorithm. The preset derivation algorithm can be, but is not limited to, PBKDF2, bcrypt, scrypt, or Argon2, and is not limited herein.

[0110] In an exemplary embodiment, the method of performing a key derivation operation on the user encryption password to obtain a second derived key corresponding to the user encryption password can be: generating a preset salt value randomly, performing a pseudo-random iteration calculation on the user encryption password and the preset salt value to obtain the second derived key corresponding to the user encryption password. It can be understood that the preset salt value is a random number used to ensure the security of the key derivation operation. Different preset salt values ensure that different second derived keys are calculated for different original video encoding data even if the same user encryption password is used.

[0111] For example, assume that the user encryption password is Password, the preset salt value is Salt, and the iteration number of the PBKDF2 function is N. The PBKDF2 function is used to perform a pseudo-random iteration calculation on the user encryption password Password and the preset salt value Salt to obtain a second derived key Hash corresponding to the user encryption password Password. , wherein the symbol “ ” represents concatenation.

[0112] It should be noted that the preset salt value needs to be embedded in the target data unit of the to-be-decrypted video coding data, so as to generate the first derived key corresponding to the to-be-verified user password based on the preset salt value in the key verification stage, and then decrypt the target verification ciphertext based on the first derived key.

[0113] In step S303, the encryption key is encrypted by using the second derived key to obtain the ciphertext corresponding to the encryption key.

[0114] In step S304, the ciphertext corresponding to the encryption key is determined as the target verification ciphertext corresponding to the to-be-decrypted video coding data.

[0115] In step S305, the target verification ciphertext is stored in the target data unit of the to-be-decrypted video coding data.

[0116] In an exemplary embodiment, the method of encrypting the encryption key by using the second derived key to obtain the ciphertext corresponding to the encryption key can be: performing an exclusive OR operation on the encryption key and the second derived key to obtain the ciphertext corresponding to the encryption key.

[0117] The exclusive OR operation can be used for data recovery; for example, A XOR B and then XOR B again can restore to A, that is, the exclusive OR of twice B can offset.

[0118] Exemplarily, assuming that the encryption key is vek and the second derived key is Hash, performing an exclusive OR operation on the encryption key vek and the second derived key Hash obtains the ciphertext corresponding to the encryption key vek , and the symbol " " represents the exclusive OR operation, and is determined as the target verification ciphertext and stored in the target data unit of the to-be-decrypted video coding data.

[0119] It can be understood that based on the first derived key Hash' recorded in the above embodiment, by performing an exclusive OR operation on the target verification ciphertext and the first derived key Hash', the to-be-verified decryption key is obtained. If the first derived key Hash' and the second derived key are consistent, it can be determined that the to-be-verified decryption key vek' is consistent with the encryption key vek.

[0120] It should be noted that since the password-based key encapsulation method is adopted, when the video content is redistributed or authorized to be updated, it is not necessary to re-encrypt all video data, but only needs to re-calculate and update the target verification ciphertext evek in the first SEI data unit according to the new user encryption password, so that the update of the key information can be completed, and the system maintenance cost and resource overhead are significantly reduced.

[0121] In this embodiment, the second derived key for protecting the encryption key is generated by performing a key derivation operation on the user encryption password corresponding to the original video coding data, and the encryption key is encrypted using the second derived key to obtain the target verification ciphertext; then the target verification ciphertext is embedded into the target data unit of the to-be-decrypted video coding data, realizing the secure packaging and binding of the encryption key, so that the key information required for decryption can be transmitted or stored together with the video content, and the local key recovery and verification can be completed without relying on an external key management system.

[0122] In one embodiment, as shown in Figure 4 , Figure 4 is a flowchart of the preset check code generation step in one embodiment; the key self-checking method includes the following steps:

[0123] Step S401, performing check calculation on the encryption key corresponding to the original video coding data to obtain the check code corresponding to the encryption key.

[0124] Step S402, determining the check code corresponding to the encryption key as the preset check code corresponding to the to-be-decrypted video coding data.

[0125] Step S403, storing the preset check code to the target data unit.

[0126] It should be noted that in this embodiment, when performing check calculation on the encryption key corresponding to the original video coding data, the preset check algorithm used should be consistent with the preset check algorithm used when performing check calculation on the decryption key to be verified in the key check stage, so as to ensure the effectiveness of consistency and legality verification.

[0127] It can be understood that by using the same preset check algorithm (such as a hash algorithm), the preset check code and the check code to be verified can be ensured to have comparability, thereby realizing accurate judgment on the legality of the decryption key. This method not only ensures the consistency and security of the key check process, but also provides basic support for the local key verification process.

[0128] For example, based on the SM3 national algorithm, the encryption key vek is checked and calculated to obtain the check code key_verify = SM3(vek) corresponding to the encryption key, and key_verify = SM3(vek) is stored as the preset check code corresponding to the to-be-decrypted video coding data in the encryption parameter field of the first SEI data unit in the to-be-decrypted video coding data.

[0129] It should be noted that the SM3 algorithm has a one-way property, i.e., the encryption key cannot be inversely deduced from the preset check code, and therefore the security of the preset check code in the to-be-decrypted video coding data can be ensured.

[0130] In the embodiment, the encryption key corresponding to the original video coding data is verified to obtain a verification code corresponding to the encryption key, thereby providing a reference standard for accurately judging the legality of the decryption key and ensuring consistency and security of the key verification process.

[0131] In one embodiment, the key self-checking method further comprises:

[0132] In a case where the verification result of the decryption key to be verified is successful, for each network abstraction layer unit in the video coding data to be decrypted, the network abstraction layer unit corresponding ciphertext data is decrypted by using the decryption key to be verified to obtain target plaintext data corresponding to the ciphertext data.

[0133] The video coding data to be decrypted comprises a plurality of network abstraction layer units; and each network abstraction layer unit comprises ciphertext data. The network abstraction layer unit is a basic syntax structure unit in a video coding standard (such as H.264, H.265); and the network abstraction layer unit is used to divide the video coding data to be decrypted into independent data packets for network transmission and decoding processing.

[0134] It can be understood that the video coding data to be decrypted is obtained by encrypting original video coding data; and the original video coding data comprises a plurality of network abstraction layer units to be encrypted. Each network abstraction layer unit to be encrypted comprises header data and payload data. The header data is a fixed-length field located before the main part of the network abstraction layer unit and is used to describe the basic properties of the network abstraction layer unit. The payload data is a data part in the network abstraction layer unit that carries actual video content.

[0135] It can be understood that a delimiter is arranged between each network abstraction layer unit to be encrypted or each network abstraction layer unit. The delimiter refers to a special byte sequence used to identify the start of a network abstraction layer unit. The delimiter can be multiple bytes, for example, the delimiter can be three bytes of 00 00 01 or four bytes of 00 00 00 01, which is not limited herein.

[0136] In an exemplary embodiment, in the video data encryption stage, for each network abstraction layer unit to be encrypted, the payload data in the network abstraction layer unit to be encrypted is encrypted to obtain corresponding ciphertext data, and the header data and the ciphertext data are re-encapsulated into a network abstraction layer unit. Finally, a plurality of network abstraction layer units are combined to form video coding data to be decrypted. Each network abstraction layer unit included in the video coding data to be decrypted is the result of encryption of the network abstraction layer unit to be encrypted. The ciphertext data is the result of encryption of the payload data in the network abstraction layer unit to be encrypted.

[0137] It can be understood that the verification result of the to-be-verified decryption key is successful, indicating that the to-be-verified decryption key can be used to perform a decryption operation on the to-be-decrypted video coding data. Specifically, for each network abstraction layer unit in the to-be-decrypted video coding data, the ciphertext data corresponding to the network abstraction layer unit is decrypted using the to-be-verified decryption key to obtain target plaintext data corresponding to the ciphertext data. The target plaintext data is the payload data corresponding to the network abstraction layer unit to be encrypted.

[0138] In the embodiment, when the verification result of the to-be-verified decryption key is successful, the fine-grained control of the video coding structure is realized by taking the network abstraction layer unit as the basic encryption and decryption unit, which not only improves the flexibility and efficiency of the encryption and decryption operation, but also ensures the good compatibility of the encrypted video content under different coding standards, avoids the problem of low encryption and decryption processing efficiency and poor flexibility caused by the overall encryption of the entire video file or frame structure, and avoids the adaptability problem caused by the difference in coding format in the traditional video encryption technology.

[0139] In one embodiment, Figure 5 A flowchart of the network abstraction layer unit decryption step in one embodiment; the ciphertext data corresponding to the network abstraction layer unit is decrypted using the to-be-verified decryption key to obtain target plaintext data corresponding to the ciphertext data, including the following steps:

[0140] Step S501, extracting a preset initialization vector corresponding to a network abstraction layer unit from to-be-decrypted video coding data.

[0141] It should be noted that each network abstraction layer unit in the to-be-decrypted video coding data is provided with a corresponding front SEI data unit; the front SEI data unit is used to store unit encryption parameters corresponding to the corresponding network abstraction layer unit; wherein the unit encryption parameters can include but are not limited to the preset initialization vector, the length of the payload data.

[0142] For example, the structure of the front SEI data unit AddSeiData is as shown in Figure 6 ; wherein uint8_t IV

[16] is used to store a 128-bit (16-byte) preset initialization vector (IV); unsigned int encrypt_length is used to store the length of the payload data, and the payload data refers to the actual data part that needs to be encrypted in the network abstraction layer unit to be encrypted.

[0143] It can be understood that each network abstraction layer unit has a unique preset initialization vector corresponding thereto, so that even if the same encryption key is used, the actual encryption key stream of different network abstraction layer units is different, and the security of the overall encryption is improved. In addition, the pre-SEI data unit conforms to mainstream video coding standards (such as H.264, H.265), has good player compatibility, and does not affect the normal decoding process. Based on the pre-SEI data unit, the secure carrying and transmission of the encryption parameters are realized without affecting the video playback compatibility.

[0144] The preset initialization vector corresponding to the network abstraction layer unit is randomly generated in the video data encryption stage, so as to ensure that the encryption result of each network abstraction layer unit to be encrypted has uniqueness. It should be noted that the length of the preset initialization vector is consistent with that of the encryption key.

[0145] In step S502, a key stream is calculated according to the to-be-verified decryption key and the preset initialization vector, and a first key stream corresponding to the network abstraction layer unit is obtained.

[0146] The key stream calculation refers to generating a pseudo-random bit sequence, that is, a key stream.

[0147] The first key stream is used for performing bitwise XOR operation with the ciphertext data to obtain target plaintext data corresponding to the ciphertext data.

[0148] Optionally, the SM4-CTR mode is used to realize the key stream calculation in the present embodiment. By using the SM4-CTR mode to realize the key stream calculation, the data length in the encryption process can be ensured to be unchanged, and the encryption and decryption efficiency and security can be ensured. The SM4 is a national standard symmetric encryption algorithm, and the CTR mode is a counter mode, which is commonly used for stream encryption and has the advantages of high efficiency, strong parallel processing capability, and no data expansion. In other embodiments, the OFB (Output Feedback) can also be used to realize the key stream calculation, which is not limited here.

[0149] In step S503, the ciphertext data is decrypted by using the first key stream to obtain target plaintext data corresponding to the ciphertext data.

[0150] The method of decrypting the ciphertext data by using the first key stream can be XOR operation between the first key stream and the ciphertext data.

[0151] For example, in the video data decryption stage, taking one Network Abstraction Layer (NEL) unit as an example, the preset initialization vector (IV) corresponding to that NLB unit is extracted from the preceding SEI data unit. Using SM4-CTR, keystream calculation is performed on the successfully verified decryption key vek' and the preset initialization vector IV to obtain the first keystream KeyStream corresponding to the NLB unit. An XOR operation is performed on the first keystream KeyStream and the ciphertext data Cipher to obtain the target plaintext data Payload (i.e., payload data) corresponding to the ciphertext data Cipher. This process is repeated to achieve the decryption operation of the ciphertext data corresponding to each NLB unit.

[0152] In this embodiment, by extracting the preset initialization vector corresponding to the network abstraction layer unit from the video encoding data to be decrypted, and calculating and generating the corresponding first key stream based on the decryption key to be verified, the encrypted data is decrypted using the key stream. This achieves accurate and secure decryption of each network abstraction layer unit, ensuring data integrity and security while avoiding data length expansion, and improving encryption and decryption efficiency and video structure compatibility.

[0153] In one embodiment, such as Figure 7 As shown, Figure 7 This is a flowchart illustrating the encryption steps of the network abstraction layer unit in one embodiment; the key self-verification method further includes the following steps:

[0154] Step S701: Obtain the raw video encoding data.

[0155] Here, raw video encoded data refers to the unencrypted raw video stream; raw video stream refers to the standard format video stream output by the video encoder. Raw video encoded data includes multiple Network Abstraction Layer (NET) units to be encrypted. Each NET unit to be encrypted includes header data and payload data.

[0156] Step S702: Determine the encryption key corresponding to the original video encoded data, and the preset initialization vector corresponding to each network abstraction layer unit to be encrypted in the original video encoded data.

[0157] It should be noted that the encryption key corresponding to the original video encoded data is randomly generated. The preset initialization vector corresponding to each network abstraction layer unit to be encrypted in the original video encoded data is also randomly generated.

[0158] Step S703: For each network abstraction layer unit to be encrypted, calculate the key stream based on the encryption key and the preset initialization vector to obtain the second key stream corresponding to the network abstraction layer unit to be encrypted.

[0159] The algorithm used for the key stream calculation according to the encryption key and the preset initialization vector should be consistent with the algorithm used for the key stream calculation according to the to-be-verified decryption key and the preset initialization vector, so as to ensure consistency of the encryption and decryption logic. Exemplarily, the key stream calculation is implemented by using an SM4-CTR working mode.

[0160] In step S704, the second key stream is used to encrypt the to-be-encrypted network abstraction layer unit, to obtain a network abstraction layer unit.

[0161] It should be noted that, in the embodiment, the encryption of the to-be-encrypted network abstraction layer unit refers to the encryption of the payload data in the to-be-encrypted network abstraction layer unit, to further obtain the ciphertext data corresponding to the payload data.

[0162] It should be noted that, in the embodiment, only the payload data is encrypted, and the delimiters between the network abstraction layer units are reserved, to facilitate the distinction of each network abstraction layer unit. Because different application scenarios may encapsulate the network abstraction layer units into different video formats, such as MP4, PS files and the like, if the delimiters are also encrypted, the upper-layer application cannot segment each network abstraction layer unit, resulting in the failure of encapsulation. In addition, the non-encryption of the delimiters and the header data does not affect the security, because the actual video data information is only related to the payload data. Therefore, in the embodiment, only the payload data is encrypted, which can ensure the data security and does not affect the encapsulation of the application layer.

[0163] In step S705, the to-be-decrypted video coding data is determined according to the plurality of network abstraction layer units.

[0164] Exemplarily, the encryption key vek corresponding to the original video coding data and the preset initialization vector corresponding to each to-be-encrypted network abstraction layer unit in the original video coding data are randomly generated. Taking one to-be-encrypted network abstraction layer unit as an example, it is assumed that the preset initialization vector corresponding to the to-be-encrypted network abstraction layer unit is IV. The SM4-CTR working mode is used to perform key stream calculation on the encryption key vek and the preset initialization vector IV, to obtain the second key stream KeyStream0 corresponding to the to-be-encrypted network abstraction layer unit. The payload data Payload in the to-be-encrypted network abstraction layer unit and the second key stream KeyStream0 are subjected to exclusive or operation, to obtain the ciphertext data Cipher. The header data and the ciphertext data Cipher are re-encapsulated to obtain the network abstraction layer unit.

[0165] The video coding data before and after encryption, refer to Figure 8 and Figure 9 , Figure 8 and Figure 9The separator and the header data are included in each red box. The separator is used to distinguish each network abstraction layer unit to be encrypted or each network abstraction layer unit. As shown in the following table, the separator in the first red box is 00 00 00 01, the header data is 40 01, and the data after the header data 40 01 and before the separator in the second red box is the payload data. By encrypting the payload data, the encrypted data is obtained. Figure 8 As shown in the following table, the separator and the header data in each red box remain in plaintext, and the remaining payload data has been encrypted into ciphertext data. Figure 9 As shown in the following table, the separator and the header data in each red box remain in plaintext, and the remaining payload data has been encrypted into ciphertext data.

[0166] In this embodiment, by keeping the separator and the header data unchanged and only encrypting the payload data, the encrypted video can still be recognized and parsed by a standard decoder, thereby ensuring security while enhancing the usability and expansion capability of the system in various application scenarios.

[0167] In one specific embodiment, taking H.265 encoding as an example, referring to the following table, the separator and the header data in each red box remain in plaintext, and the remaining payload data has been encrypted into ciphertext data. Figure 10 The encryption key encryption process is as follows: a 16-byte encryption key vek is randomly generated; the 16-byte encryption key vek is represented as 729438651c181403063aadae7268b8fc in a hexadecimal string. Based on the SM3 algorithm, the encryption key vek is hashed to obtain the check code key_verify corresponding to the encryption key vek: c94c24a77ee26916fc9724f8e056847165554cc4f0dadad0be8a8bf2144e86b3.

[0168] Further, the user encryption password Password and the preset salt value Salt are obtained, and the PBKDF2 function is used to perform pseudo-random iteration calculation on the user encryption password Password and the preset salt value Salt to obtain the second derived key Hash corresponding to the user encryption password; wherein the user encryption password Password is "test_password", the preset salt value Salt is "0123456789ABCDEF", the PBKDF2 function internally uses the SHA256 function for iteration, and the iteration number is one hundred thousand times. The calculated hash value, i.e., the second derived key Hash, is: 91db34e3e30f724f8fec296c1aad4fec1f9cdd4ed6bb40943129f87f598b9b86.

[0169] Further, the first 16 bytes of the second derived key Hash are taken and XORed with the 16-byte encryption key vek to obtain the ciphertext evek corresponding to the encryption key vek, and evek is e34f0c86ff17664c89d684c268c5f710.

[0170] The ciphertext evek is stored as the target verification ciphertext corresponding to the to-be-decrypted video coding data in the encryption parameter field of the first SEI data unit of the to-be-decrypted video coding data. The structure of the first SEI data unit is as shown in Figure 11 The encryption_flag: encryption flag, 0x01 indicates that the data has been encrypted, and 0x00 indicates that it has not been encrypted. The authentication_flag: authentication flag, there is no authentication function in the current system, so it is fixed as no authentication. The encryption_type: encryption algorithm type, 0x01 indicates that the SM4 encryption algorithm is used. The hash_type: hash algorithm type, 0x01 indicates that the SM3 hash algorithm is used. The vek_flag: encryption key storage flag, indicates whether the encryption key is stored. The evek_length: length of the encryption key. The evek: ciphertext form of the encryption key, the length is 16 bytes. The salt_length: length of the preset salt value. The salt: preset salt value, the length is 16 bytes, used to increase the security of the key. The key_verify_length: length of the preset verification code, fixed as 32 bytes. The key_verify: preset verification code, the length is 32 bytes, used to verify the correctness of the to-be-decrypted key. The tail: tail marker, fixed as 0xFF.

[0171] In one specific embodiment, referring to Figure 12 The original video coding data encryption process includes: for each to-be-encrypted network abstraction layer unit in the original video coding data, a preset initialization vector IV of the to-be-encrypted network abstraction layer unit is randomly generated; for example, the preset initialization vector IV of one to-be-encrypted network abstraction layer unit is fdda108b20cf3c9f228d367cc236349e; the SM4-CTR mode is used to perform key stream calculation on the encryption key vek and the preset initialization vector IV to obtain a second key stream KeyStream corresponding to the to-be-encrypted network abstraction layer unit. The second key stream KeyStream and the payload data Payload in the to-be-encrypted network abstraction layer unit are subjected to exclusive or operation to obtain corresponding ciphertext data Cipher.

[0172] In one specific embodiment, the decryption process of the to-be-decrypted video coding data includes two stages, the first stage is the key verification stage, and the second stage is the video data decryption stage; it can be understood that only in the case of successful verification in the first stage, the second stage can be executed.

[0173] Specifically, referring to Figure 13, the first stage, i.e., the key verification stage, includes: reading a target verification ciphertext evek and a preset salt value Salt from a first SEI data unit in the to-be-decrypted video coding data; performing pseudo-random iteration calculation on the to-be-verified user password Password' and the preset salt value Salt by using a PBKDF2 function to obtain a first derived key Hash' corresponding to the to-be-verified user password; performing exclusive OR operation on the target verification ciphertext evek and the first derived key Hash' to obtain a to-be-verified decryption key vek'; further, performing hash calculation on the to-be-verified decryption key vek' based on an SM3 algorithm to obtain a to-be-verified verification code key_verify' corresponding to the to-be-verified decryption key vek'; reading a preset verification code key_verify from the first SEI data unit in the to-be-decrypted video coding data, and judging whether the to-be-verified verification code key_verify' is consistent with the preset verification code key_verify; if yes, the second stage is executed; otherwise, the decryption operation is stopped.

[0174] Referring to Figure 14 , the second stage, i.e., the video data decryption stage, includes: in the case that the verification result of the to-be-verified decryption key vek' is successful, indicating that the to-be-verified decryption key vek' is the same as the encryption key vek; for each network abstraction layer unit in the to-be-decrypted video coding data, reading a preset initialization vector IV corresponding to the network abstraction layer unit from a preceding SEI data unit corresponding to the network abstraction layer unit; performing key stream calculation on the to-be-verified decryption key vek' = vek and the preset initialization vector IV by using an SM4-CTR mode to obtain a first key stream KeyStream corresponding to the network abstraction layer unit. Performing exclusive OR operation on the first key stream KeyStream and ciphertext data Cipher in the network abstraction layer unit to obtain corresponding payload data Payload.

[0175] The above key self-checking method has good encryption and decryption efficiency while ensuring high security, supports user key management through an easy-to-remember password, and improves the usability and deployment flexibility of the system. At the same time, it can be applied to video data generated by different coding standards, and by encrypting the network abstraction layer unit after video coding, good compatibility of multiple video coding formats (such as H.264, H.265, etc.) is achieved. The payload data in the network abstraction layer unit to be encrypted is encrypted by using the SM4-CTR mode, which improves the encryption and decryption efficiency on the basis of ensuring that the length of the encrypted data does not change; at the same time, it can also support a selective encryption mechanism, for example, only encrypting key frames, thereby further optimizing performance. By allocating an independent preset initialization vector (IV) to each network abstraction layer unit to be encrypted, the uniqueness of the second key stream of each network abstraction layer unit to be encrypted is ensured, which significantly enhances the overall encryption security.

[0176] Furthermore, a local self-verification mechanism for the key is implemented, enabling the playback end to verify the legitimacy of the decryption key by using the encryption parameter information carried in the first SEI data unit of the video encoding data to be decrypted, thus ensuring the security and controllability of the decryption process. Users can also easily set a user encryption password and generate the first derived key through the PBKDF2 key derivation mechanism to achieve secure protection of the encryption key vek.

[0177] Furthermore, due to the use of password-based key encapsulation, when video content is redistributed or authorization is updated, it is not necessary to re-encrypt all video data. Only the target verification ciphertext evek in the first SEI data unit needs to be recalculated and updated according to the new user encryption password to complete the key information update, which significantly reduces system maintenance costs and resource consumption.

[0178] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0179] Based on the same inventive concept, this application also provides a key self-verification device for implementing the key self-verification method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more key self-verification device embodiments provided below can be found in the limitations of the key self-verification method described above, and will not be repeated here.

[0180] In one exemplary embodiment, such as Figure 15 As shown, Figure 15 This is a structural block diagram of a key self-verification device in one embodiment; the key self-verification device includes: an acquisition module 1501, a decryption module 1502, a verification module 1503, and a comparison module 1504, wherein:

[0181] The acquisition module 1501 is used to acquire the user password to be verified from the video encoding data to be decrypted, and to extract the target verification ciphertext and preset verification code from the video encoding data to be decrypted.

[0182] The decryption module 1502 is configured to decrypt the target verification ciphertext by using the user password to be verified to obtain a decryption key to be verified corresponding to the target verification ciphertext;

[0183] The verification module 1503 is configured to perform a verification calculation on the decryption key to be verified to obtain a verification code to be verified corresponding to the decryption key to be verified;

[0184] The comparison module 1504 is configured to determine that the verification result of the decryption key to be verified is successful in a case where the verification code to be verified is consistent with the preset verification code.

[0185] The key self-verification device described above obtains the user password to be verified of the video coding data to be decrypted, and extracts the target verification ciphertext and the preset verification code from the video coding data to be decrypted. The target verification ciphertext is decrypted by using the user password to be verified to obtain the decryption key to be verified corresponding to the target verification ciphertext. The decryption key is embedded in the video coding data to be decrypted, which avoids the limitation caused by the distribution of the decryption key by the external key management system in the traditional decryption process, especially the poor flexibility and limited application scenarios in the offline environment, realizes the localized storage of the decryption key, and further performs the verification calculation on the decryption key to be verified to obtain the verification code to be verified corresponding to the decryption key to be verified. The verification code to be verified is compared with the preset verification code embedded in the video coding data to be decrypted. In a case where the verification code to be verified is consistent with the preset verification code, it is determined that the verification result of the decryption key to be verified is successful. In this way, the security of decryption is ensured, the key management process is simplified, the localized decryption key storage and legality verification are realized, and the accuracy and reliability of the decryption operation are ensured.

[0186] In one embodiment, the decryption module 1502 is further configured to perform a key derivation operation on the user password to be verified to obtain a first derived key corresponding to the user password to be verified;

[0187] The target verification ciphertext is decrypted by using the first derived key to obtain the decryption key to be verified corresponding to the target verification ciphertext.

[0188] In one embodiment, the decryption module 1502 is further configured to extract a preset salt value from the video coding data to be decrypted;

[0189] The pseudo-random iterative calculation is performed on the user password to be verified and the preset salt value to obtain the first derived key corresponding to the user password to be verified.

[0190] In one embodiment, the decryption module 1502 is further configured to perform an exclusive OR operation on the target verification ciphertext and the first derived key to obtain the decryption key to be verified corresponding to the target verification ciphertext.

[0191] In one embodiment, the key self-checking apparatus further comprises an encryption module, the encryption module configured to, for the original video coding data corresponding to the to-be-decrypted video coding data, obtain a user encryption password corresponding to the original video coding data and an encryption key;

[0192] perform a key derivation operation on the user encryption password to obtain a second derived key corresponding to the user encryption password;

[0193] encrypt the encryption key using the second derived key to obtain ciphertext corresponding to the encryption key;

[0194] determine the ciphertext corresponding to the encryption key as target verification ciphertext corresponding to the to-be-decrypted video coding data;

[0195] store the target verification ciphertext to a target data unit of the to-be-decrypted video coding data.

[0196] In one embodiment, the check module 1503 is further configured to perform a check calculation on the encryption key corresponding to the original video coding data to obtain a check code corresponding to the encryption key;

[0197] determine the check code corresponding to the encryption key as a preset check code corresponding to the to-be-decrypted video coding data;

[0198] store the preset check code to the target data unit.

[0199] In one embodiment, the to-be-decrypted video coding data comprises a plurality of network abstraction layer units; the network abstraction layer unit comprises ciphertext data; the decryption module 1502 is further configured to, in a case where the verification result of the to-be-verified decryption key is successful, for each network abstraction layer unit in the to-be-decrypted video coding data, use the to-be-verified decryption key to decrypt the ciphertext data corresponding to the network abstraction layer unit to obtain target plaintext data corresponding to the ciphertext data.

[0200] In one embodiment, the decryption module 1502 is further configured to extract a preset initialization vector corresponding to the network abstraction layer unit from the to-be-decrypted video coding data;

[0201] perform a key stream calculation according to the to-be-verified decryption key and the preset initialization vector to obtain a first key stream corresponding to the network abstraction layer unit;

[0202] use the first key stream to decrypt the ciphertext data to obtain target plaintext data corresponding to the ciphertext data.

[0203] In one embodiment, the encryption module is further configured to obtain the original video coding data; the original video coding data comprises a plurality of network abstraction layer units to be encrypted;

[0204] determine an encryption key corresponding to the original video coding data, and a preset initialization vector corresponding to each network abstraction layer unit to be encrypted in the original video coding data;

[0205] perform key stream calculation on each network abstraction layer unit to be encrypted according to the encryption key and the preset initialization vector, to obtain a second key stream corresponding to the network abstraction layer unit to be encrypted;

[0206] encrypt the network abstraction layer unit to be encrypted by using the second key stream, to obtain the network abstraction layer unit;

[0207] determine the video coding data to be decrypted according to the plurality of network abstraction layer units.

[0208] The modules in the key self-checking device can be implemented by software, hardware, or a combination thereof. The modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a memory in the computer device in software form, so as to be called and executed by a processor to perform operations corresponding to the modules.

[0209] In an exemplary embodiment, a computer device, which can be a server, has an internal structure as shown in Figure 16 . Figure 16 The computer device includes a processor, a memory, an input / output interface (I / O), and a communication interface. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The database of the computer device is configured to store key self-checking related data. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with external terminals through a network connection. The computer program is executed by the processor to implement a key self-checking method.

[0210] Those skilled in the art can understand that Figure 16 the structure shown in the above description is only a block diagram of part of the structure related to the scheme of the present application, and does not limit the computer device to which the scheme of the present application is applied. Specifically, the computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0211] In an embodiment, a computer device is also provided, comprising a memory and a processor, the memory storing a computer program, and the processor implementing the steps in the above method embodiments when executing the computer program.

[0212] In an embodiment, a computer readable storage medium is provided, storing a computer program, and the computer program implementing the steps in the above method embodiments when executed by a processor.

[0213] In an embodiment, a computer program product is provided, comprising a computer program, and the computer program implementing the steps in the above method embodiments when executed by a processor.

[0214] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0215] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. The non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. The volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., without being limited thereto.

[0216] The technical features of the above embodiments can be combined in any manner. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present application.

[0217] The above-described embodiments are merely illustrative of several embodiments of the present application, and the description is relatively specific and detailed, but should not be understood as a limitation on the scope of the patent. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A method of key self-checking, the method comprising: The method comprises: obtaining a to-be-verified user password of to-be-decrypted video coding data, and extracting a target verification ciphertext and a preset check code from the to-be-decrypted video coding data; decrypting the target verification ciphertext by using the to-be-verified user password to obtain a to-be-verified decryption key corresponding to the target verification ciphertext; performing check calculation on the to-be-verified decryption key to obtain a to-be-verified check code corresponding to the to-be-verified decryption key; in a case where the to-be-verified check code is consistent with the preset check code, determining that a verification result of the to-be-verified decryption key is successful; the to-be-decrypted video coding data comprises a plurality of network abstraction layer units; the network abstraction layer unit comprises ciphertext data; the method further comprises: in a case where the verification result of the to-be-verified decryption key is successful, for each network abstraction layer unit in the to-be-decrypted video coding data, extracting a preset initialization vector corresponding to the network abstraction layer unit from the to-be-decrypted video coding data; performing key stream calculation according to the to-be-verified decryption key and the preset initialization vector to obtain a first key stream corresponding to the network abstraction layer unit; decrypting the ciphertext data by using the first key stream to obtain target plaintext data corresponding to the ciphertext data.

2. The method of claim 1, wherein, The decrypting the target verification ciphertext by using the to-be-verified user password to obtain a to-be-verified decryption key corresponding to the target verification ciphertext comprises: performing key derivation operation on the to-be-verified user password to obtain a first derived key corresponding to the to-be-verified user password; decrypting the target verification ciphertext by using the first derived key to obtain a to-be-verified decryption key corresponding to the target verification ciphertext.

3. The method of claim 2, wherein, The performing key derivation operation on the to-be-verified user password to obtain a first derived key corresponding to the to-be-verified user password comprises: extracting a preset salt value from the to-be-decrypted video coding data; performing pseudo-random iteration calculation on the to-be-verified user password and the preset salt value to obtain the first derived key corresponding to the to-be-verified user password.

4. The method of claim 2, wherein, The decrypting the target verification ciphertext by using the first derived key to obtain a to-be-verified decryption key corresponding to the target verification ciphertext comprises: performing exclusive or operation on the target verification ciphertext and the first derived key to obtain the to-be-verified decryption key corresponding to the target verification ciphertext.

5. The method of claim 1, wherein, The method further comprises: for original video coding data corresponding to the to-be-decrypted video coding data, obtaining a user encryption password and an encryption key corresponding to the original video coding data; performing key derivation operation on the user encryption password to obtain a second derived key corresponding to the user encryption password; encrypting the encryption key by using the second derived key to obtain ciphertext corresponding to the encryption key; determining the ciphertext corresponding to the encryption key as the target verification ciphertext corresponding to the to-be-decrypted video coding data; storing the target verification ciphertext to a target data unit of the to-be-decrypted video coding data.

6. The method of claim 5, wherein, The method further comprises: performing check calculation on the encryption key corresponding to the original video coding data to obtain a check code corresponding to the encryption key; The check code corresponding to the encryption key is determined as a preset check code corresponding to the to-be-decrypted video coding data; The preset check code is stored in the target data unit.

7. The method of claim 1, wherein, The method further comprises: obtaining original video coding data; the original video coding data comprises a plurality of network abstract layer units to be encrypted; determining an encryption key corresponding to the original video coding data, and a preset initialization vector corresponding to each network abstract layer unit to be encrypted in the original video coding data; for each network abstract layer unit to be encrypted, performing key stream calculation according to the encryption key and the preset initialization vector to obtain a second key stream corresponding to the network abstract layer unit to be encrypted; encrypting the network abstract layer unit to be encrypted by using the second key stream to obtain a network abstract layer unit; determining to-be-decrypted video coding data according to a plurality of network abstract layer units.

8. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the steps of the method in any one of claims 1 to 7.

Images