Media stream detection method and device, electronic equipment and storage medium

Abstract

The invention provides a media stream detection method and device, electronic equipment and a storage medium, and the method comprises the steps: receiving a media stream, analyzing a security parameter set from the media stream, and determining the media stream security level of the media stream according to the security parameter set. And releasing the media stream under the condition that the security level of the media stream is matched with the session security level recorded in the associated session.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of network security, and in particular to a media stream detection method and device, an electronic device, and a storage medium. BACKGROUND

[0002] A public video monitoring networking system is an integrated video monitoring system that integrates front-end acquisition, network transmission, platform management and control, storage playback, and user access. It is the "nerve ending" of public security and is widely used in scenarios that require real-time monitoring, event warning, and post-event tracing. For example, cameras are deployed in urban roads, commercial districts, communities, and subway areas to achieve global coverage and real-time warning through a networking monitoring system. For another example, cameras are deployed in personnel-intensive areas such as airport terminals, shopping mall entrances, and school playgrounds to achieve personnel management, security checks, and emergency disposal through a networking monitoring system.

[0003] The core value of a public video monitoring networking system is to provide reliable video evidence, and media streams (video / audio streams) are the "data core" thereof. The security detection of media streams is related to public security. The national GB35114 standard specifies the security level standard for media streams, and the transmission of all media streams must comply with the specifications of this security level standard.

[0004] Related technologies limit the transmission IP address and port of media streams through firewall rules, allowing only media streams from trusted IP addresses or ports to pass through. Alternatively, abnormal traffic is detected by parsing the header field of the media stream protocol.

[0005] However, the above detection methods are mainly based on general security network methods and can only detect whether the content or source of the media stream is at risk, but lack detection methods to verify the compliance of the media stream. SUMMARY

[0006] To overcome the problems in the related art, the present specification provides a media stream detection method, device, electronic device, and storage medium.

[0007] According to a first aspect of an embodiment of the present specification, a media stream detection method is provided, the method comprising:

[0008] receiving a media stream and parsing a security parameter set from the media stream, determining a media stream security level of the media stream according to the security parameter set;

[0009] in a case where the media stream security level matches a session security level recorded in an associated session, releasing the media stream.

[0010] According to a second aspect of an embodiment of the present specification, a media stream detection device is provided, the device comprising:

[0011] a media stream security level determination module, configured to receive a media stream, and parse a security parameter set from the media stream, and determine a media stream security level of the media stream according to the security parameter set;

[0012] a media stream security control module, configured to release the media stream in a case where the media stream security level matches a session security level recorded in an associated session.

[0013] According to a third aspect of the embodiments of the present specification, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to the first aspect when executing the program.

[0014] According to a fourth aspect of the embodiments of the present specification, a computer readable storage medium is provided, which stores a computer program, wherein the program is executable on a processor to implement the steps of the method according to the first aspect.

[0015] The technical solutions provided by the embodiments of the present specification can include the following beneficial effects:

[0016] In the embodiments of the present specification, after receiving a media stream, a security parameter set is parsed from the media stream, a media stream security level of the media stream is determined according to the security parameter set, and the media stream security level is compared with a session security level recorded in an associated session. Only in the case where the media stream security level matches the session security level, the media stream is released.

[0017] It can be seen that the present solution provides a way to verify the compliance of the media stream, that is, by verifying whether the actual transmission security level is consistent with the security level declared in the session, the compliance of the media stream can be verified, and only the media stream with a compliant security level is released, thereby ensuring the credibility of the media stream.

[0018] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present specification. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings, which are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present specification, and together with the specification serve to explain the principles of the present specification.

[0020] Figure 1 is a flow chart of a media stream detection method according to an exemplary embodiment of the present specification.

[0021] Figure 2 is a schematic diagram of a media stream detection flow according to an exemplary embodiment of the present specification.

[0022] Figure 3 is a structural diagram of an electronic device according to an exemplary embodiment.

[0023] Figure 4 is a block diagram of a media stream detection apparatus according to an exemplary embodiment. DETAILED DESCRIPTION

[0024] The exemplary embodiments will be described in detail with reference to the accompanying drawings. In the following description, unless otherwise denoted, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments are not meant to represent all implementations consistent with the present description. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present description as detailed in the appended claims.

[0025] The terminology used in the present description is for the purpose of describing particular embodiments only and is not intended to be limiting of the present description. As used in the present description and the appended claims, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0026] It will be understood that, although the terms first, second, third, etc. can be used herein to describe various information, these terms are not intended to denote a temporal or chronological order. Rather, these terms are used only to distinguish different sets of information from one another. For example, a first information can be termed a second information, and similarly, a second information can also be termed a first information, without departing from the scope of the present description. As used herein, the word "if' can be interpreted to mean "when" or "upon" or "in response to determining" taking into account the context in which the term is used.

[0027] A public video monitoring networking system is an integrated video monitoring system that integrates front-end acquisition, network transmission, platform management and control, storage playback, and user access. It is the "nerve ending" of public safety and is widely used in scenarios that require real-time monitoring, event early warning, and post-event tracing. For example, cameras are deployed in urban roads, commercial districts, communities, and subway areas to achieve global coverage and real-time early warning through a networking monitoring system. For another example, cameras are deployed in personnel-intensive areas such as airport terminals, shopping mall entrances, and school playgrounds to achieve personnel management, security checks, and emergency disposal through a networking monitoring system.

[0028] The core value of a public video monitoring networking system is to provide reliable video evidence, and media streams (video / audio streams) are the "data core" thereof. The security detection of media streams is related to public safety.

[0029] The national standard GB35114 specifies security levels for media streams, with three security levels: A, B, and C. For example, Level A requires two-way authentication and is suitable for general areas such as residential entrances and parks. Level B requires two-way authentication and video signatures and is suitable for more sensitive areas such as shopping malls, hospitals, and schools. Level C requires two-way authentication, video signatures, and video encryption and is suitable for highly sensitive areas such as airports, train stations, and government agencies.

[0030] GB35114 is a national mandatory standard that requires public video surveillance network systems to select corresponding security levels for transmission of media streams according to scenarios, and the transmission of all media streams must comply with the specifications of the security level standards.

[0031] Related technologies restrict the transmission IP addresses and ports of media streams through firewall rules, allowing only media streams from trusted IP addresses or ports to pass through. Alternatively, they analyze the header fields of media stream protocols to detect abnormal traffic.

[0032] However, the above detection methods are mainly based on general security network methods, which can only detect whether the content or source of the media stream has risks, but lack detection methods to verify the compliance of the media stream.

[0033] For example, if a surveillance system requires that media streams be transmitted at a security level of B, but the actual media stream being transmitted is at level A, this indicates that the media stream is not compliant. However, general security network methods cannot determine whether the media stream is transmitted at the specified security level and cannot verify the compliance of the media stream.

[0034] In response to the above technical problems, this specification provides a method for detecting a media stream to verify the compliance of the media stream, thereby ensuring the credibility of the received media stream.

[0035] Next, the embodiments of this specification are described in detail.

[0036] like Figure 1 As shown, Figure 1 This is a flowchart of a method for detecting a media stream according to an exemplary embodiment of the present specification, including steps 101-102:

[0037] Step 101: Receive a media stream, parse a security parameter set from the media stream, and determine a media stream security level of the media stream according to the security parameter set.

[0038] Step 102: If the media stream security level matches the session security level recorded in the associated session, release the media stream.

[0039] In a video monitoring system, a session can refer to an interaction process between a front-end device (such as a camera) and a monitoring platform. A session can be established after interaction with control signaling, and the security level requirement of media stream transmission in the established session can be stored, i.e., the session security level.

[0040] After receiving the media stream, the security parameter set can be parsed from the media stream, and the media stream security level of the media stream can be determined according to the security parameter set. For example, for a media stream in an SVAC encoding format, the security parameter set describes the capability of encrypting and authenticating image data content, the encryption algorithm and the encryption key and its length. For example, the encryption_flag bit in the security parameter set indicates whether the media stream supports encryption of data frames, and the authentication_flag bit indicates whether the entire frame of image data content supports authentication. By parsing the security parameter set, encryption and signature markers can be obtained, and the media stream security level can be determined according to the markers. For example, if the encryption and signature markers are obtained from the security parameter set, the media stream security level is determined to be C level; if only the signature marker is obtained from the security parameter set, the media stream security level is determined to be B level; and if no encryption and signature markers are obtained from the security parameter set, the media stream security level is determined to be A level.

[0041] If the media stream security level matches the session security level recorded in the associated session, it means that the media stream of the session transmits data according to the declared security level, and no "security fraud" occurs. If the media stream security level does not match the session security level recorded in the associated session, it means that "security fraud" occurs, for example, the front-end device does not transmit the media stream according to the declared security level, such as the front-end device declares to transmit the media stream according to the C level, but the actually transmitted media stream is B level. In the case that the media stream security level does not match the session security level recorded in the associated session, the media stream can be blocked and / or alarmed.

[0042] In this embodiment, after receiving the media stream, the security parameter set is parsed from the media stream, the media stream security level of the media stream is determined according to the security parameter set, and the media stream security level is compared with the session security level recorded in the associated session. Only in the case that the media stream security level matches the session security level, the media stream is released.

[0043] It can be seen that the present scheme provides a way to verify the compliance of the media stream, i.e., by verifying whether the actual transmission security level is consistent with the security level declared in the session, the compliance of the media stream can be verified, and only the media stream with a compliant security level is released, thereby ensuring the credibility of the media stream.

[0044] In the monitoring system, the front-end device declares a security level (e.g., C level) through signaling, which is irrelevant to the actual transmission media stream security level (e.g., B level), resulting in "device lying" (declaring a high level but transmitting a low level), which leads to sensitive information leakage (e.g., unencrypted security check pictures in the airport are eavesdropped) or evidence tampering (e.g., unsigned theft videos in the mall are modified).

[0045] In an embodiment, the session security level can include a negotiated security level, receiving control signaling, determining the negotiated security level of the control signaling, and adding the negotiated security level to the session corresponding to the control signaling. The media stream is released if the media stream security level is consistent with the negotiated security level recorded in the associated session.

[0046] For example, the establishment of the session can be performed by the front-end device sending control signaling through the SIP protocol, the monitoring platform receiving the control signaling, determining the negotiated security level, establishing the session, recording the negotiated security level to the session, and returning the session ID to the front-end device.

[0047] After receiving the media stream carrying the session ID, the session associated with the media stream can be determined according to the session ID of the media stream. The media stream is released if the media stream security level is consistent with the negotiated security level recorded in the associated session.

[0048] The present scheme can timely find the media stream with inconsistent security level declared by the front-end device by verifying the consistency of the negotiated security level and the media stream security level.

[0049] In an embodiment, the session security level can include a preset policy restriction level. The policy restriction level can be stored in the session associated with the media stream. The media stream is released if the media stream security level meets the policy restriction level recorded in the associated session.

[0050] The policy restriction level can be a mandatory security requirement pre-configured by the monitoring platform, which is essentially the minimum security requirement of the platform for the media stream. For example, for some scenarios such as shopping malls and hospitals, the platform limits the policy restriction level to B level. Therefore, the policy restriction level of all front-end transmissions must not be lower than B level.

[0051] In the present embodiment, by verifying whether the media stream security level meets the policy restriction level, it can be ensured that the released media stream is the media stream that meets the mandatory security requirement of the platform.

[0052] In actual scenarios, the configured policy restriction level can be updated to increase / decrease some new security requirements, which involves version iteration of the policy restriction level. However, during synchronization of the policy restriction level version, if session synchronization is not timely, the old version policy can be used during verification, and a media stream that does not meet the latest policy version can be released.

[0053] To this end, in an embodiment, a policy version number corresponding to the policy restriction level can be stored in the session each time the policy restriction level in the session is updated. When verifying whether the security level of the media stream meets the restriction security level recorded in the associated session, the target policy version number corresponding to the media stream and the associated session can be determined, and it is verified whether the security level of the media stream meets the target policy restriction level corresponding to the target policy version number. In the case where the security level of the media stream meets the target policy restriction level corresponding to the target policy version number, the media stream is released.

[0054] In the present embodiment, in the scenario of updating the policy restriction level, the versions of different policy restriction levels are managed through the session, and the media stream and the policy restriction level are associated through the version number, thereby improving the timeliness of policy synchronization, so that the latest policy restriction level can be applied in time when verifying the security level of the media stream.

[0055] In an exemplary application scenario, there is a security verification requirement for control signaling. If the control signaling is forged or tampered with, it can lead to illegal device access. Of course, for some sensitive control signaling, even if the control signaling content is not risky, the platform can also want to prohibit access.

[0056] In an embodiment, the control signaling is received, and a target feature is extracted from the control signaling. In the case where the target feature matches a preset feature, the control signaling is blocked and / or alarmed.

[0057] The preset feature can be a preset feature of sensitive control signaling (such as registration, deregistration, etc.). The extracted target feature can be different fields of different domains of the control signaling, which can reflect the features of the control signaling. The target feature and the preset feature can be matched through a regular expression.

[0058] In one embodiment, when receiving a media stream, parsing a security parameter set from the media stream, and determining the media stream security level of the media stream based on the security parameter set, the media stream of the first packet in the same session cycle can be received, and the security parameter set can be parsed from the media stream of the first packet, and the media stream security level of the first packet can be determined based on the security parameter set. When releasing the media stream, if the media stream security level matches the session security level recorded in the associated session, the media stream of the first packet can be released, and media streams other than the first packet in the same session life cycle can be released. If the media stream security level of the first packet does not match the session security level recorded in the associated session, the media stream can be blocked and / or an alarm can be issued, and all media streams other than the first packet in the same session life cycle can be blocked and / or an alarm can be issued.

[0059] Parsing the security parameter set and verifying the security level for each media stream would consume a significant amount of computing resources. This solution, however, only verifies the first media stream within a session. Subsequent media streams reuse the verification results of the first stream, optimizing processing performance.

[0060] Furthermore, if the security level of the first media stream does not match the session requirements, all media streams in the entire session can be blocked to prevent the transmission of any media stream that does not meet the requirements.

[0061] like Figure 2 As shown, in an exemplary application scenario, policy configuration can be performed in the monitoring platform, such as one or more of a sensitive signaling verification policy, a media stream detection policy, and a security level restriction policy. When any policy is enabled, the verification rules corresponding to the policy can be executed.

[0062] For example, after enabling the sensitive signaling verification policy, upon receiving control signaling, target features can be extracted from the control signaling. If the target features match the preset features of sensitive signaling, the control signaling can be alerted and / or blocked; if they do not match, the control signaling can be allowed to pass. Sensitive signaling can be freely selected. For example, if control signaling such as registration and deregistration is identified as sensitive signaling, any such signaling sent by the front-end device will be alerted and / or blocked.

[0063] After enabling the media stream detection policy, the negotiated security level of the control signaling can be determined and added to the session corresponding to the control signaling. After receiving the media stream, the security parameter set can be parsed from the media stream and the media stream security level can be determined based on the security parameter set. If the media stream security level matches the negotiated security level, the media stream is allowed to pass; otherwise, an alarm is issued and / or blocked.

[0064] After the security level restriction policy is enabled, the policy restriction level and the policy version number of the current session can be recorded in the case that the control signaling meets the policy restriction level. After the media stream is received, a security parameter set can be parsed from the media stream, and the media stream security level of the media stream is determined according to the security parameter set. It is judged whether the session version policy is the latest, and if not, the policy restriction level and the policy version number in the session are updated. The latest policy restriction level is compared with the media stream security level, and in the case that the media stream security level meets the latest policy restriction level, the media stream is released, otherwise the media stream is alarmed and / or blocked. If the session version policy is the latest, the policy restriction level in the current session is compared with the media stream security level, and in the case that the media stream security level meets the current policy restriction level, the media stream is released, otherwise the media stream is alarmed and / or blocked.

[0065] Corresponding to the embodiments of the foregoing method, the specification also provides embodiments of an apparatus and a terminal to which the apparatus is applied.

[0066] Figure 3 is a structural schematic diagram of an electronic device according to an exemplary embodiment of the specification. As shown in Figure 3 the hardware level, the electronic device 300 includes a processor 302, an internal bus 304, a network interface 306, a memory 308, and a non-volatile memory 310, and of course can also include other hardware required by the business. One or more embodiments of the specification can be implemented in a software manner, such as reading a corresponding computer program from the non-volatile memory 310 into the memory 308 by the processor 302 and then running. Of course, in addition to the software implementation, one or more embodiments of the specification do not exclude other implementation manners, such as logic devices or a combination of software and hardware, and the like, that is, the execution subject of the following processing flow is not limited to each logical module, but can also be hardware or a logic device.

[0067] Figure 4 is a block diagram of a media stream detection apparatus according to an exemplary embodiment of the specification. As shown in Figure 4 the apparatus can be applied to the electronic device 300 as shown in Figure 3 to implement the technical solutions of the specification. The apparatus includes:

[0068] A media stream security level determination module 402 is configured to receive a media stream, parse a security parameter set from the media stream, and determine a media stream security level of the media stream according to the security parameter set.

[0069] The media stream security control module 404 is configured to release the media stream if the media stream security level matches a session security level recorded in the associated session.

[0070] Optionally, the session security level comprises a negotiated security level, and the apparatus further comprises a negotiated security level determination module configured to receive control signaling, determine a negotiated security level of the control signaling, and add the negotiated security level to a session corresponding to the control signaling. The media stream security control module 404 is specifically configured to release the media stream if the media stream security level matches the negotiated security level recorded in the associated session.

[0071] Optionally, the session security level comprises a preset policy restriction level, and the apparatus further comprises a policy restriction level storage module configured to store the policy restriction level to a session associated with the media stream. The media stream security control module 404 is specifically configured to release the media stream if the media stream security level meets the policy restriction level recorded in the associated session.

[0072] Optionally, the apparatus further comprises a version update module configured to store a policy version number corresponding to the policy restriction level to the session each time the policy restriction level in the session is updated. The media stream security control module 404 is specifically configured to determine a target policy version number corresponding to the media stream and the associated session, and release the media stream if the media stream security level meets a target policy restriction level corresponding to the target policy version number.

[0073] Optionally, the apparatus further comprises a sensitive signaling detection module configured to receive control signaling, extract a target feature from the control signaling, and block and / or alarm the control signaling if the target feature matches a preset feature.

[0074] Optionally, the media stream security control module 404 is further configured to block and / or alarm the media stream if the media stream security level does not match the session security level recorded in the associated session.

[0075] Optionally, the media stream security level determination module 402 is specifically configured to receive a first packet of media stream in a same session cycle, parse a security parameter set from the first packet of media stream, and determine a media stream security level of the first packet of media stream according to the security parameter set. The media stream security control module 404 is specifically configured to release the first packet of media stream if the media stream security level of the first packet of media stream matches a session security level recorded in the associated session, and release a non-first packet of media stream in the same session cycle.

[0076] The implementation process of the functions and roles of each module in the above apparatus is specifically described in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0077] For the apparatus embodiment, since it basically corresponds to the method embodiment, the relevant part can be referred to the part of the method embodiment. The apparatus embodiment described above is only illustrative, wherein the modules described as separate components can or can not be physically separated, and the components displayed as modules can or can not be physical modules, i.e., can be located in one place or distributed on multiple network modules. Part or all of the modules can be selected to achieve the purpose of the scheme of the present specification according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0078] The present specification also provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to implement the steps of the foregoing media stream detection method provided by the present application.

[0079] Specifically, the computer readable medium suitable for storing computer program instructions and data includes all forms of non-volatile memory, media and memory devices, including semiconductor memory devices (such as EPROM, EEPROM and flash memory devices), magnetic disks (such as internal hard disks or removable disks), magneto-optical disks and CD ROM and DVD-ROM disks.

[0080] The present specification also provides a computer program product, which includes computer program / instructions, and the computer program / instructions are executed by a processor to implement the steps of the foregoing media stream detection method.

Claims

1. A method for detecting a media stream, characterized in that: The method comprises: receiving a media stream, parsing a security parameter set from the media stream, and determining a media stream security level of the media stream according to the security parameter set; If the media stream security level matches the session security level recorded in the associated session, the media stream is released.

2. The method according to claim 1, characterized in that The session security level includes a negotiated security level, and the method further includes: receiving control signaling, determining a negotiated security level for the control signaling, and adding the negotiated security level to a session corresponding to the control signaling; The releasing the media stream when the security level of the media stream matches the session security level recorded in the associated session includes: If the security level of the media stream is consistent with the negotiated security level recorded in the associated session, the media stream is released.

3. The method according to claim 1, characterized in that The session security level includes a preset policy restriction level, and the method further includes: Storing the policy restriction level in a session associated with the media stream; The releasing the media stream when the security level of the media stream matches the session security level recorded in the associated session includes: If the security level of the media stream meets the policy restriction level recorded in the associated session, the media stream is released.

4. The method according to claim 3, characterized in that The method further comprises: Each time the policy restriction level in a session is updated, the policy version number corresponding to the policy restriction level is stored in the session; The releasing the media stream when the security level of the media stream satisfies the policy restriction level recorded in the associated session includes: Determine a target policy version number corresponding to a session associated with a media stream, and release the media stream if a security level of the media stream satisfies a target policy restriction level corresponding to the target policy version number.

5. The method according to claim 1, characterized in that The method further comprises: A control signaling is received, and a target feature is extracted from the control signaling. When the target feature matches a preset feature, the control signaling is blocked and / or an alarm is issued.

6. The method according to claim 1, characterized in that The method further comprises: In the case that the security level of the media stream does not match the session security level recorded in the associated session, the media stream is blocked and / or an alarm is issued.

7. The method according to claim 1, characterized in that The receiving a media stream, parsing a security parameter set from the media stream, and determining a media stream security level of the media stream according to the security parameter set includes: receiving a first media stream in a same session period, parsing a security parameter set from the first media stream, and determining a media stream security level of the first media stream according to the security parameter set; The releasing the media stream when the security level of the media stream matches the session security level recorded in the associated session includes: When the media stream security level of the first packet matches the session security level recorded in the associated session, the media stream of the first packet is released, and the media streams other than the first packet within the same session life cycle are also released.

8. A media stream detection device, characterized in that: The device comprises: a media stream security level determination module, configured to receive a media stream, parse a security parameter set from the media stream, and determine a media stream security level of the media stream based on the security parameter set; The media stream security control module is configured to release the media stream if the security level of the media stream matches the session security level recorded in the associated session.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images