Display equipment safety management system

Abstract

The invention discloses a display equipment security management system for the problems of display equipment security, network security and data security, and the system comprises a network security protection module which is used between display equipment and an information issuing end, and carries out the management and control of flow data through judging whether an accessed IP address and a port are trusted or not; the data encryption and decryption module is used for encrypting and decrypting the released flow data; the sensitive image interception module is used for performing content identification on the decrypted to-be-displayed image data, and if the decrypted to-be-displayed image data is a sensitive image, intercepting the decrypted to-be-displayed image data to prevent the display equipment from playing the sensitive image; and the peripheral interface control module is used for preventing illegal access of the peripheral interface. According to the invention, data playing of the display device can be protected, and malicious behaviors are prevented.

Description

TECHNICAL FIELD

[0001] The present application relates to information security technology, in particular to a display device security management system. BACKGROUND

[0002] Content review refers to the process of reviewing content on the Internet, mainly including text, images and videos, and other forms of content. With the popularity of the Internet and the increase in user-generated content, the importance of content review has also increased. Manual review cannot meet the demand, so it is necessary to use artificial intelligence technology to automate review. AI large models have broad application prospects in the field of content review and can help enterprises and organizations more effectively manage and review content.

[0003] The prior art first converts text, images and videos into images, and then further processes and analyzes them.

[0004] Image recognition refers to the process of computer processing and analyzing input images to identify objects, scenes or activities in the image. This process usually involves the following steps: image preprocessing, including image enhancement, size adjustment, grayscale, binarization, etc.; feature extraction, extracting features that help classification from images; model training, training models using feature and label data sets; prediction and classification, using trained models to classify new images.

[0005] The main tasks of image recognition include image classification, object detection and object recognition. Image classification is the task of classifying images into multiple categories, such as cats, dogs, birds, etc. Object detection is the task of finding specific objects in an image, such as face recognition, vehicle recognition, etc. Object recognition is the task of identifying specific objects in an image, such as people, animals, objects, etc. These tasks are important in practical applications and require different algorithms and techniques to solve.

[0006] The processed and analyzed images are processed and trained using convolutional neural networks, recurrent neural networks, etc.

[0007] Convolutional Neural Networks (CNN) is a deep learning model mainly used for image recognition and processing. The core idea of CNN is to use convolution and pooling operations to reduce the number of parameters and computational complexity, improving the efficiency and accuracy of the model.

[0008] Recurrent Neural Networks (RNN) is a deep learning model for processing sequential data. RNN can capture long-range dependencies in sequences, but its main problem is the vanishing or exploding gradient of long-range dependencies.

[0009] Finally, the establishment of the large model is completed through training, and the content review business operation is performed.

[0010] The prior art has the following problems: the content recognition accuracy is not high, and there are false negatives and false positives; the content recognition post-processing method is simple, most of which are processed by software means, and cannot be completely blocked; the content transmission after software processing is not encrypted, is easy to be replaced and cannot achieve the processing purpose; the near-source content publishing method is difficult to handle, and the mobile storage medium publishing needs separate means; most of the technologies are centralized data analysis, which will occupy the transmission channel bandwidth; in the case of offline content publishing, the cost of single-point content recognition is too high. SUMMARY

[0011] The present application aims at the deficiencies in the prior art, and provides a display device security management system, which can protect the data playing through power-off protection, encrypted protection of playing data, and abnormal behavior alarm of malicious plug-in and plug-out of the playing source interface, power supply control, video encrypted transmission, and the like of the USB interface of the multimedia screen, LED lintel screen, and the like.

[0012] To achieve the above object, the present application adopts the following technical solutions:

[0013] A display device security management system, comprising:

[0014] A network security protection module applied between the display device and the information publishing end, which controls the flow data by judging whether the accessed IP address and port are trusted or not;

[0015] A data encryption and decryption module for encrypting and decrypting the passing flow data;

[0016] A sensitive image interception module for identifying the content of the decrypted image data to be displayed, and intercepting if it is a sensitive image to prevent the display device from playing the sensitive image;

[0017] An external interface control module for preventing the external interface from being illegally accessed.

[0018] To optimize the above technical solutions, the specific measures taken further include:

[0019] Further, the controlling the flow data by judging whether the accessed IP address and port are trusted or not specifically includes:

[0020] Analyzing the protocol packet header message in the network flow to obtain the protocol type, matching the port with the protocol, and identifying the flow according to the protocol information corresponding to the port;

[0021] Setting the trusted IP address and port range, comprehensively analyzing the port and protocol information of the flow, and judging whether the IP address and port are trusted or not by establishing a rule table;

[0022] The data returned by the front-end device within the release trust range is returned, and if the data comes from a non-trusted IP address or a non-trusted port, the traffic data is discarded, and log data is formed.

[0023] Further, the encrypted and decrypted traffic data for release is specifically:

[0024] Determine the position of ESP in the IP packet protocol stack based on the transmission mode;

[0025] IP packets are formed, and upper layer protocols are encapsulated in the ESP header or ESP tail;

[0026] The sender adds a sequence number to the SA; the encryption algorithm is specified by the SA to encrypt the IP packet;

[0027] Calculate the integrity check value on each IP packet; the calculation range includes the security parameter index, the sequence number, the ciphertext form of the payload data, the padding, the padding length, and the next header field;

[0028] Process the fragmented IP packet by recombining the fragments, applying IPsec, and the flow of the new fragments;

[0029] Discard the IP packet with non-zero fragment offset or activated fragment flag, and record the security parameter index, reception timestamp, source address, destination address, sequence number, and information flow identifier when discarding the IP packet;

[0030] Decrypt the ESP payload data, padding, padding length, and next header using the SA specified key and decryption algorithm;

[0031] Reconstruct the original datagram by the original IP header and ESP payload data.

[0032] Further, the content recognition of the decrypted image data to be displayed is specifically:

[0033] Preprocess the image data;

[0034] Data enhancement is performed on the preprocessed image;

[0035] If the image data is an image with a document, recognize the text and perform semantic understanding to determine whether the text contains sensitive content;

[0036] Otherwise, target detection is performed on the image data, and the target is classified.

[0037] Further, the preprocessing of the image data specifically includes image denoising, edge cutting enhancement, bending correction, and moire removal; and the data enhancement of the preprocessed image specifically includes sharpening processing.

[0038] Further, the target detection on the image data and the classification of the target are specifically:

[0039] The image data is input into YOLO v3, and the bounding box of the target and the probability that the target belongs to the category c are output.

[0040] Further, the prevention of illegal access to the peripheral interface is specifically:

[0041] The peripheral interfaces of all display devices are closed through the escape number interface, the external power supply of the display device is connected through the interface controller, the internal circuit of the interface controller is controlled by the MCU, the electrical signal state of the peripheral interface is detected in real time, and if an abnormality occurs, the MCU cuts off the power supply.

[0042] Further, the peripheral interface is a USB interface, and the real-time detection of the electrical signal state of the peripheral interface is specifically:

[0043] The VBUS signal and the Idle signal of the USB interface are detected in real time, if the Idle signal disappears and the VBUS signal is powered off, a risk signal is triggered to the MCU.

[0044] Further, the interface controller also responds to the image content identified by the sensitive image interception module, and if it is a sensitive image, the power supply of the display device is cut off.

[0045] The beneficial effects of the present application are:

[0046] 1. Through AI recognition and multimedia information processing technology, various sensitive special content in the video is detected frame by frame and pixel by pixel with high precision.

[0047] 2. Decentralized operation architecture, application and data operation are processed by network center nodes and edge probes on the network.

[0048] 3. Modular deployment: the main function modules of the product are modularized and combined, which is suitable for user business changes, and the product has better flexibility, portability, stability and independence, and is convenient to maintain.

[0049] 4. Intelligent supervision: the management platform provides intuitive data such as violation information classification, real-time monitoring, disposal strategy, early warning strategy, data report, etc., helping users to master the risk dynamics in time and make decisions quickly.

[0050] 5. Network security protection: close unnecessary remote connections, control functions (such as WIFI, APP), carry out equipment safety rectification, eliminate hidden dangers, further strengthen the security protection of public media screens, implement strengthened access control measures, and prevent network attacks and malicious software from threatening the equipment.

[0051] 6. Data encryption transmission: using secure communication protocols and national encryption technology to ensure that the data transmission tunnel between the public media screen device and the related server is encrypted to prevent data leakage and content tampering.

[0052] 7. Peripheral interface control: strengthen the control of the physical interfaces of the public media screen USB, network port, etc. that can transmit data, prevent the abuse of the media screen device interface, including preventing unauthorized content release, malicious tampering and other illegal behaviors, and perfecting emergency disposal measures. Automatic power-off, network interruption and other disposal measures can be realized to discover illegal behaviors. BRIEF DESCRIPTION OF DRAWINGS

[0053] Figure 1 Load encryption schematic diagram;

[0054] Figure 2 Load encryption verification algorithm schematic diagram;

[0055] Figure 3 AI content recognition algorithm flowchart;

[0056] Figure 4 USB interface signal logic diagram;

[0057] Figure 5 The architecture diagram of the display device security management system in the embodiment. DETAILED DESCRIPTION

[0058] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0059] Embodiment one

[0060] The present application provides a display device security management system, and the display device of the present application is a general term for electronic devices used to display images, videos, text and other information. Including LED display screen, television display screen, touch display screen, etc. The display device security management system comprises:

[0061] The network security protection module is applied between the display device and the information publishing end, and controls the flow data by judging whether the accessed IP address and port are trusted;

[0062] The data encryption and decryption module is used for encrypting and decrypting the released flow data;

[0063] The sensitive image interception module is configured to perform content recognition on the decrypted image data to be displayed, and intercepts the sensitive image to prevent the display device from playing the sensitive image.

[0064] The peripheral interface control module is configured to prevent the peripheral interface from being illegally accessed.

[0065] (1) The specific process of controlling the traffic data by judging whether the accessed IP address and port are trusted is as follows:

[0066] The protocol packet header message in the network traffic is analyzed to obtain the protocol type, the port is matched with the protocol, and the traffic is identified according to the protocol information corresponding to the port.

[0067] The trusted IP address and port range are set, the port and protocol information of the traffic are comprehensively analyzed, and it is judged whether the IP address and port are trusted by establishing a rule table.

[0068] The data returned by the front-end device in the trusted range is released, and if the data comes from a non-trusted IP address or a non-trusted port, the traffic data is discarded, and log data is formed at the same time.

[0069] (2) The specific process of encrypting and decrypting the released traffic data is as follows:

[0070] The position of ESP (Encapsulating Security Payload) in the IP packet protocol stack is determined based on the transmission mode. In the transmission mode, ESP is inserted after the IP header and before the upper layer protocol, such as TCP, UCP, ICMP, etc., or before any IPsec header that has been inserted. In IPv6, ESP is regarded as an end-to-end payload, so it should appear after the hop-by-hop, routing and fragmentation extension headers. The destination option extension header can be before or after the ESP header, which is determined by the semantics. Tunnel mode ESP can be implemented on a host or a security gateway. ESP must use tunnel mode when implemented on a security gateway (to protect user transmission traffic).

[0071] IP packets are grouped, and the upper layer protocol is encapsulated in the ESP header or ESP tail, and the specified IP header (and all IP extension headers in IPv6) is retained. The construction of the external IP header / extension header during encapsulation processing is described in the security architecture document.

[0072] When the SA is established, the counter of the sender is initialized to 0. The sender increments the sequence number for the SA, inserting a new value into the sequence number field; the first packet sent using a given SA has sequence number 1. The IP packet is encrypted using the encryption algorithm specified by the SA; domestic cryptographic technology can be used: that is, the domestic cryptographic algorithm approved by the State Cryptography Administration. Mainly SM1, SM2, SM3, SM4. The key length and the packet length are both 128 bits. The payload encryption is shown in Figure 1 The embodiment adopts a symmetric encryption algorithm. Because the arriving IP packets can be out of order, each packet must carry all the required data to allow the receiver to establish encryption synchronization for decryption. This data can be explicitly loaded in the payload field. The verification algorithm is specified by the SA, and the payload encryption verification algorithm is shown in Figure 2 The verification algorithm includes a keyed message authentication code (MAC) based on a symmetric encryption algorithm (such as DES) or based on a one-way hash function (such as MD5 or SHA-1).

[0073] An integrity check value is calculated on each IP packet; the calculation range includes the security parameter index, the sequence number, the payload data in the form of ciphertext, the padding, the padding length, and the next header field; because encryption is performed before verification, the last 4 fields will be in the form of ciphertext.

[0074] The fragmented IP packet is processed by reassembling the fragments, applying IPsec, and processing the flow of the new fragments; in tunnel mode, ESP is applied to an IP packet, and its payload can be a fragmented IP packet. For example, the "block in the stack" and "block on the line" defined in the security gateway or security architecture document are based on IPsec implementation, and tunnel mode ESP can be applied to the fragmented IP packet.

[0075] The block in the stack and the block on the line can be implemented by first reassembling the fragmented packet by the local IP layer, then applying IPsec, and then fragmenting the resulting packet.

[0076] Discard the IP packet with a non-zero fragment offset or an activated fragment flag, and record the security parameter index, the reception timestamp, the source address, the destination address, the sequence number, and the information flow identifier when discarding the IP packet;

[0077] Decrypt the ESP payload data, the padding, the padding length, and the next header using the key and decryption algorithm specified by the SA;

[0078] Reconstruct the original datagram from the original IP header and the ESP payload data.

[0079] (3) The AI content recognition algorithm flow is shown in Figure 3As shown, AI large model refers to an artificial intelligence model with large-scale parameter quantity and complex structure, which is usually used to process complex tasks such as image recognition, natural language processing, etc. AI large model usually adopts deep learning technology such as convolutional neural network (CNN), recurrent neural network (RNN), etc. The specific process of content recognition on the decrypted image data to be displayed is as follows:

[0080] Data import and extraction: media files are imported through the data stream of the media application front end. Formats include text, pictures and videos. This process is introduced through video streaming, such as traffic migration of RTSP address or interception of file data traffic.

[0081] Preprocessing of image data; preprocessing specifically includes image denoising, edge enhancement, bending correction and moire removal; mainly used to solve the problems of noise, deformation and distortion in the image.

[0082] Data enhancement is performed on the preprocessed image; data enhancement specifically includes clear processing.

[0083] If the image data is a document image, recognize the text and perform semantic understanding to determine whether the text contains sensitive content; structure analysis, coding, and recognition of the document can be performed to automatically identify and extract information in the document, thereby improving the efficiency and accuracy of document processing, including structure analysis, semantic understanding and coding, text recognition, and table recognition.

[0084] Otherwise, target detection is performed on the image data, and the target is classified. This embodiment adopts YOLO v3 network, inputs the image data into YOLO v3, and outputs the bounding box of the target and the probability that the target belongs to the category c. After normalizing the input image, it is divided into S x S grids. If the coordinates of the center position of an object fall into a certain grid, then this grid is responsible for detecting this object. Each grid predicts B bounding boxes (bounding boxes) and their confidence, as well as C class probabilities. The bounding box information (x, y, w, h) is the offset of the center position of the object relative to the grid position and the width and height. The confidence reflects whether the object is contained and the accuracy of the position under the condition of containing the object.

[0085] The network structure adds a large number of shortcuts compared to general CNN to solve the problem of feature disappearance in deep network, and the model is based on three groups of masks with different sizes to construct three output layers, so that the model can detect more diverse target sizes.

[0086] (4) Preventing illegal access to peripheral interfaces specifically includes:

[0087] Deploying the OS-free MCU interface controller near the source (i.e. near the public media screen device).

[0088] All peripheral interfaces of all display devices are closed through the escape digital interface. There are digital signal and level signal interfaces through the phoenix terminal escape digital interface, such as USB, HDMI, LAN port, etc. All screen device digital interfaces are closed through the escape digital interface by the interface controller according to customization, and the screen device no longer has an open interface for access.

[0089] The external power supply of the display device is connected through the interface controller, and the internal circuit of the interface controller is controlled by the MCU. The electrical signal state of the peripheral interface is detected in real time, and if an abnormality occurs, the MCU cuts off the power supply.

[0090] The external power supply of the screen device is changed from the original power supply to the interface controller. The interface control can be more customized to form a 220v data current and multi-directional output power supply. The internal circuit of the interface controller is controlled by the MCU control unit. When the electrical signal monitoring appears risk, the MCU automatically cuts off the 220v circuit current. The screen power-off requirement is met.

[0091] There are electrical signal judgment measures in the design and use of digital interface. For example, standard USB, MiniUSB, Type-C all have VBUS (+5V) and GND design. Phoenix terminal only designs VBUS and GND line to standard interface. When the closure measure takes effect, there is current in the Idle state, as shown in Figure 4 Once the closure measure is forcibly pulled out, the Idle signal disappears, the VBUS is powered off, and the electrical signal monitoring logic circuit triggers a risk signal input to the MCU control unit, automatically guiding the 220v circuit to cut off, forming a screen power-off effect, ensuring that illegal access behavior cannot be realized due to screen power-off.

[0092] The interface controller also responds to the image content identified by the sensitive image interception module. If it is a sensitive image, the power supply of the display device is cut off.

[0093] Network control and AI content identification linkage:

[0094] The interface controller designs a control Ethernet interface. There can be a security gateway for control.

[0095] When there is an abnormal plug-in blocking measure, the interface controller completes the power-off action. After on-site verification, the security gateway control system must be used to restore power supply.

[0096] When the security gateway's identification algorithm detects abnormal content images, it will send a power-off command to the interface controller MCU control unit to complete the power-off action.

[0097] In specific implementation, the display device security management system of the present application is as shown in the figure Figure 5 The system uses a central security gateway to encrypt the load of all content published on the network. The system uses a branch security gateway to decrypt the encrypted data content of the content published on the network, and the decrypted content is identified frame by frame. All content analysis is completed on the side of the branch security gateway by a device with edge computing capability. The edge computing is completed, and the algorithm is built into the branch security gateway. The algorithm can be updated through the management system. Once abnormal content is identified, it can be replaced or deleted, and the power of the electronic display screen can also be turned off. To prevent near-source publishing risks, an interface controller is provided to electronically close all physical interfaces of the electronic display screen. Any operation that does not comply with the use of the physical interface of the electronic display screen will trigger a screen power-off operation. Local power supply cannot be restored and needs to be restored centrally. The near-source publishing side can choose to configure content recognition function. The present application fully considers the two main content publishing methods of network and near-source publishing, and provides security protection means for different publishing methods. The algorithm is preposed in the edge computing device, which has no pressure on network bandwidth, and the management system only receives event data. The algorithm is updated flexibly and can be centrally published and managed. AI analysis is built into the backend management system, which can use system idle time for logical reasoning calculation, continuously improve the accuracy and efficiency of content recognition in real business scenarios, and generate messages in the backend management system for all front-end events. The front-end recovery is managed uniformly by the backend, and centralized control is completed. All data transmission uses domestic cryptographic technology and chips to eliminate secondary network security risks.

[0098] Those skilled in the art can realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed in the present application can be realized by electronic hardware or a combination of electronic hardware and computer software. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Professionals can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0099] The above is only the preferred embodiment of the present application, and the protection scope of the present application is not limited to the above-mentioned embodiments. Any technical solution falling within the scope of the present application is within the protection scope of the present application. It should be noted that, for ordinary skilled persons in the art, some improvements and refinements without departing from the principles of the present application are considered as the protection scope of the present application.

Claims

1. A display device security management system, characterized in that: include: The network security protection module is applied between the display device and the information publishing terminal to control the traffic data by judging whether the accessed IP address and port are trusted; Data encryption and decryption module, used to encrypt and decrypt released traffic data; The sensitive image interception module is used to identify the content of the decrypted image data to be displayed, and intercept if it is a sensitive image to prevent the display device from playing the sensitive image; The peripheral interface control module is used to prevent illegal access to the peripheral interface.

2. The display device safety management system according to claim 1, wherein: The control of traffic data by judging whether the accessed IP address and port are trusted is specifically as follows: Analyze the protocol header messages in the network traffic to obtain the protocol type, match the port with the protocol, and identify the traffic based on the protocol information corresponding to the port; Set trusted IP addresses and port ranges, comprehensively analyze traffic port and protocol information, and establish a rule table to determine whether the IP address and port are trusted; Data returned by front-end devices within the trusted range is released. If the data comes from an untrusted IP address or untrusted port, the traffic data is discarded and log data is generated.

3. The display device safety management system according to claim 1, wherein: The encryption and decryption of the released traffic data are specifically as follows: Determine the location of ESP in the IP packet protocol stack based on the transport mode; Perform IP grouping and encapsulate the upper layer protocol in the ESP header or ESP trailer; The sender adds a sequence number to the SA; the SA specifies the encryption algorithm to encrypt the IP packet; An integrity checksum is calculated on each IP packet; the calculation scope includes the security parameter index, sequence number, ciphertext payload data, padding, padding length, and next header field; Processes fragmented IP packets by reassembling fragments, applying IPsec, and refragmenting them. Discard IP packets with non-zero fragment offset or activated fragment flag, and record security parameter index, receiving timestamp, source address, destination address, sequence number and information flow identifier when discarding IP packets; Decrypts the ESP payload data, padding, padding length, and next header using the SA-specified key and decryption algorithm; Reconstruct the original datagram using the original IP header and ESP payload data.

4. The display device safety management system according to claim 1, wherein: The content identification of the decrypted image data to be displayed is specifically performed as follows: Preprocess the image data; Perform data enhancement on the preprocessed image; If the image data is an image with a document, the text is recognized and semantic understanding is performed to determine whether the text contains sensitive content; Otherwise, target detection is performed on the image data and the target is classified.

5. The display device safety management system according to claim 4, wherein: The preprocessing of the image data specifically includes image denoising, edge enhancement, curvature correction and moiré removal; and the data enhancement of the preprocessed image specifically includes sharpening processing.

6. The display device safety management system according to claim 4, wherein: The target detection and target classification of image data are specifically as follows: Input the image data into YOLO v3 and output the bounding box of the target and the probability that the target belongs to category c.

7. The display device safety management system according to claim 1, wherein: The method of preventing the peripheral interface from being illegally accessed is specifically as follows: All peripheral interfaces of the display device are closed through the escape digital interface, and the external power supply of the display device is connected through the interface controller. The circuit relay control inside the interface controller is performed by the MCU, and the electrical signal status of the peripheral interface is detected in real time. If an abnormality occurs, the MCU cuts off the power supply.

8. The display device safety management system according to claim 7, wherein: The peripheral interface is a USB interface, and the real-time detection of the electrical signal state of the peripheral interface is specifically: Real-time detection of the VBUS signal and Idle signal of the USB interface. If the Idle signal disappears and the VBUS signal is powered off, a risk signal is triggered to the MCU.

9. The display device safety management system according to claim 7, wherein: The interface controller also responds to the image content identified by the sensitive image interception module and cuts off the power supply of the display device if the image is a sensitive image.

Images