Security signaling integration method, system, electronic device, and storage medium

Abstract

The application relates to a security signaling integration method, a system, an electronic device and a storage medium, wherein the security signaling integration method comprises the following steps: encapsulating a security signaling processing capability based on a bytecode enhancement tool to generate a service component; connecting the service component to a video monitoring signaling platform; and using the service component to provide proxy services for target information on the video monitoring signaling platform, wherein the target information refers to communication information between the video monitoring signaling platform and a target device. Through the application, the problems of strong invasiveness, platform binding and inability to be flexibly plugged in caused by the need to modify platform source code in the prior art security capability integration scheme are solved, and zero-invasion integration, cross-platform universality and dynamic pluggability of security signaling capability are achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of video monitoring security, and in particular to a security signaling integration method and system, an electronic device, and a storage medium. BACKGROUND

[0002] With the vigorous development of video monitoring technology, video monitoring networking construction and equipment access are continuously carried out in various parts of society, and the security problem of video networking has become increasingly prominent. In view of the problem of video security construction, corresponding security standards and requirements have been introduced. For the original signaling platform, it is necessary to upgrade it according to the new security signaling capability standard. The current conventional method is to modify the registration and control signaling on the original signaling platform. This way of directly modifying the source code of the SIP signaling platform is highly invasive and not universal, and cannot cope with various types of access equipment. At present, there is no effective solution to how to realize the superposition of new security capabilities on the original signaling platform in a zero-invasive manner in the related art. SUMMARY

[0003] The embodiments of the present application provide a security signaling integration method, system, electronic device and storage medium to at least solve the problem of realizing the superposition of new security capabilities on the original signaling platform in a zero-invasive manner in the related art.

[0004] In a first aspect, the embodiments of the present application provide a security signaling integration method, comprising:

[0005] encapsulating security signaling processing capabilities based on a bytecode enhancement tool to generate a service component;

[0006] accessing the service component to a video monitoring signaling platform;

[0007] using the service component to provide proxy services for target information on the video monitoring signaling platform; wherein the target information refers to communication information between the video monitoring signaling platform and a target device.

[0008] In some embodiments, encapsulating security signaling processing capabilities based on a bytecode enhancement tool to generate a service component comprises:

[0009] encoding the security logic of the security signaling processing capabilities as an independent function module;

[0010] converting the independent function module into the service component through a bytecode enhancement tool.

[0011] In some embodiments, accessing the service component to the video monitoring signaling platform comprises:

[0012] When the video monitoring signaling platform process is started, the service component is injected into the video monitoring signaling platform through a virtual machine parameter;

[0013] Or, when the video monitoring signaling platform process is running, the service component is injected into the running process of the video monitoring signaling platform through a preset dynamic loading interface.

[0014] In some embodiments, the target information includes incoming information and outgoing information; the incoming information refers to information sent by the target device to the video monitoring signaling platform, and the outgoing information refers to information sent by the video monitoring signaling platform to the target device; the proxy service of the target information by the service component includes:

[0015] The video monitoring signaling platform is monitored using a bytecode operation tool, the underlying UDP communication method of the video monitoring signaling platform is intercepted, and the target information is obtained;

[0016] A target device ID is parsed from the target information, and a security level of the target device is obtained from a cache server; based on the security level, a secure device and a non-secure device are determined from preset terminal devices;

[0017] The incoming information from the secure device is subjected to a signature verification / decryption operation; the incoming information from the non-secure device is directly sent to a lower-level processing;

[0018] The outgoing information sent to the secure device is subjected to a signature / encryption operation, and the encrypted signature information is attached to the message header of the outgoing information; the outgoing information sent to the non-secure device is directly sent to a lower-level processing.

[0019] In some embodiments, the signature verification / decryption operation on the incoming information from the secure device includes:

[0020] If the incoming information is a REGISTER request, the security level of the target device is determined according to the Authorization authentication header information in the REGISTER information request header;

[0021] The identity information carried by the video monitoring signaling platform request authentication header is verified for the secure device;

[0022] If the verification is passed, the incoming information is sent to a lower-level processing, and the security level of the secure device is saved; if the verification is not passed, the target device identity verification fails is replied;

[0023] If the incoming information is not a REGISTER request, the signature information in the header of the non-REGISTER request is verified; if the verification is successful, the processing is sent to the lower level, and if the verification fails, the target device is replied that the verification is not passed.

[0024] In some embodiments, the signing / encrypting operation on the outgoing information sent to the secure device includes:

[0025] If the outgoing information is a REGISTER response message of the video monitoring signaling platform, a security signature and encryption key information are added to the REGISTER response message, the information after the target operation is generated, and the information after the target operation is sent to the target device.

[0026] If the outgoing information is a non-REGISTER response message, the header and message body of the non-REGISTER response message are signed, the generated signature is spliced into the header to generate the information after the target operation, and the information after the target operation is sent to the target device.

[0027] In some embodiments, the method further includes: during the operation of the video monitoring signaling platform, the service component is unloaded through a preset dynamic loading interface.

[0028] In a second aspect, the embodiments of the present application provide a secure signaling integrated system, including a video monitoring signaling platform and a target device, wherein:

[0029] The video monitoring signaling platform is configured to access a service component; the service component is generated by encapsulating a secure signaling processing capability based on a bytecode enhancement tool;

[0030] The video monitoring signaling platform is further configured to use the service component to proxy a target information; wherein the target information refers to communication information between the video monitoring signaling platform and the target device.

[0031] In a third aspect, the embodiments of the present application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes the computer program to realize the secure signaling integrated method of the first aspect.

[0032] In a fourth aspect, the embodiments of the present application provide a storage medium having a computer program stored thereon, and the program is executed by a processor to realize the secure signaling integrated method of the first aspect.

[0033] Compared with the related art, the method for integrating the security signaling capability provided in the embodiments of the present application encapsulates the security signaling capability as a service component through a bytecode enhancement tool, and accesses the service component to a UDP communication layer of a video monitoring signaling platform, thereby performing proxy service on communication information between the video monitoring signaling platform and a target device, and solving the problems of strong invasiveness, platform binding and inability to be flexibly plugged in caused by the modification of platform source code in the existing security capability integration scheme, and realizing zero-invasion integration, cross-platform universality and dynamic pluggability of the security capability.

[0034] The details of one or more embodiments of the present application are presented in the following drawings and description to make other features, objects and advantages of the present application more clear and easy to understand. BRIEF DESCRIPTION OF DRAWINGS

[0035] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application and illustrate the illustrative embodiments of the present application and their description serves to explain the present application, and do not constitute improper limitations on the present application. In the drawings:

[0036] Figure 1 is a hardware block diagram of a security signaling integration method according to an embodiment of the present application;

[0037] Figure 2 is a flowchart of a security signaling integration method according to an embodiment of the present application;

[0038] Figure 3 is a structural block diagram of a security signaling integration system according to an embodiment of the present application. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical scheme and advantages of the present application more clear and understandable, the present application is described and explained below in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and do not limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by those of ordinary skill in the art without making creative efforts fall within the scope of protection of the present application. In addition, it can be understood that although the efforts made in this development process can be complex and lengthy, some design, manufacture or production changes made on the basis of the technical content disclosed in the present application by those of ordinary skill in the art related to the content disclosed in the present application are only routine technical means, and should not be understood as insufficient disclosure of the present application.

[0040] Reference to an "embodiment" in this application means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of other embodiments. It is expressly understood that the embodiments described in this application are merely possible embodiments and that it is intended to claim any potentially infringing subject matter under 35 U.S.C. 1 37(b) 1 as allowed by any applicable statute or regulation.

[0041] Unless otherwise defined, technical terms or scientific terms used in the present application shall have the ordinary meanings as understood by one of ordinary skill in the art to which this application pertains. The terms "a", "an", "one", "this", and the like, as used in the present application, do not denote a limitation of quantity and can mean one or more. The terms "including", "comprising", "having", and the like, as used in the present application, are intended to be open-ended terms that specifically permit the inclusion of unspecified steps, components, or elements. The terms "connected", "coupled", and the like, as used in the present application, are not limited to direct connections or physical connections, but can include indirect connections or electrical connections. The term "plurality" means two or more. The term "and / or" describes associated objects in association relationships, which means that there can be three relationships, for example, "A and / or B" can mean that A exists alone, A and B exist together, and B exists alone. The terms "first", "second", "third", and the like, are merely used to distinguish similar objects, and do not represent a specific order of the objects.

[0042] The method embodiments provided by the embodiments can be executed in a server, a computer, or a similar computing device. The computing device is usually a back-end service node deployed in a data center or a computer room. Figure 1 is a hardware structure block diagram of a computing device according to a security signaling integration method of the embodiments. As shown in Figure 1 the computing device can include one or more (only one is shown in Figure 1 the processor 102 (the processor 102 can include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data. Optionally, the above computing device can also include a transmission device 106 for communication function and an input and output device 108. Those skilled in the art can understand that Figure 1 The structure shown is only schematic, and does not limit the structure of the above computing device. For example, the computing device can also include more than Figure 1more or less components than those shown, or configured differently from those shown, as Figure 1

[0043] The memory 104 is operable to store computer programs, such as software programs of application software and modules, such as a computer program corresponding to the security signaling integration method in the embodiments of the present application. The processor 102 performs various functional applications and data processing, i.e., implements the method described above, by running the computer program stored in the memory 104. The memory 104 can include a high-speed random access memory, and can further include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 104 can further include a memory remotely disposed relative to the processor 102, which can be connected to the computing device through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0044] The transmission device 106 is operable to receive or send data via a network. A specific example of the network can include a wireless network provided by a communication provider of the computing device. In one example, the transmission device 106 includes a network adapter (NIC), which can be connected to other network devices through a base station so as to be able to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is operable to communicate with the Internet in a wireless manner.

[0045] The embodiments of the present application provide a security signaling integration method, Figure 2 The security signaling integration method according to the embodiments of the present application is shown in a flowchart as Figure 2 The flowchart includes the following steps:

[0046] In step S201, the security signaling processing capability is encapsulated based on a bytecode enhancement tool to generate a service component.

[0047] The security signaling processing capability refers to a set of security functions implemented according to a national information security standard (such as GB 35114), the core of which is to perform end-to-end security protection on video monitoring signaling. The capability mainly includes:

[0048] (1) Identity authentication capability: based on a digital certificate to verify the legality of an access device to prevent illegal devices from accessing.

[0049] (2) Message integrity protection capability: digitally signs and verifies signaling messages to ensure that they have not been tampered with during transmission.

[0050] ​(3) Data confidentiality capability: sensitive information or communication keys in signaling are encrypted to prevent data leakage.

[0051] In a specific implementation, this capability is realized by using a national secret algorithm (such as SM2, SM3, and SM4) and integrated into the underlying signaling platform through bytecode enhancement technology to realize automatic and non-perceptual security processing of signaling messages.

[0052] Bytecode enhancement tools refer to a class of technical libraries or frameworks that can dynamically read, modify, and regenerate compiled Java class files (.class) at the Java Virtual Machine (JVM) level. The operation object is Java bytecode (Bytecode), which is the intermediate instruction set executed by JVM. Representative tools include ByteBuddy, ASM, Javassist, CGLIB, etc.

[0053] Among them, the most representative ByteBuddy is a modern and high-performance Java bytecode operation and code generation library. It provides a type-friendly and stream-based API, allowing developers to dynamically create Java classes or modify the behavior of existing classes in a declarative manner without deep understanding of complex JVM instruction sets. ByteBuddy can conveniently build a Java Agent by implementing the net.bytebuddy.agent.builder.AgentBuilder interface. It internally uses the ASM library to access and modify bytecode, but hides its complexity from the outside; its main function is to rewrite (Rewrite) or intercept (Intercept) the methods of specified classes and insert custom logic (i.e., "enhance") before and after method execution.

[0054] The present application uses the above-mentioned bytecode enhancement tool to encapsulate the secure signaling capability, thereby generating a service component. Specifically, the following takes a running GB / T 28181 signaling platform developed based on Java as an example, which needs to implement the superposition of GB35114 security capability on this signaling platform to illustrate the implementation process of the method. The platform is deployed on a Linux server and interacts with the front-end device through the SIP signaling protocol.

[0055] Based on this, step S201 can be realized through the following process:

[0056] (1) Security logic development: First, implement the cryptographic algorithms (such as SM2, SM3, SM4) and protocol interaction processes (such as digital certificate authentication and signaling signature verification) required by GB 35114 standard as independent, functionally cohesive Java class libraries (e.g., named SecurityHandler and CertificateValidator). This part of the code focuses on implementing the core security algorithms and protocols defined in GB 35114 standard, and does not include code related to signaling platform business logic or underlying communication interception.

[0057] (2) Enhanced logic development: Then, use a bytecode enhancement tool (such as ByteBuddy) to write a bytecode transformer (ClassFileTransformer). The core responsibility of this transformer is not to directly implement security functions, but to define interception rules and enhancement points, i.e., to specify "where" (e.g., specify the specific class java.net.DatagramSocket and its methods send and receive to be enhanced) and "when" (e.g., before or after the method is called) to insert hook code to call the security logic module developed in step (1).

[0058] (3) Packaging and encapsulation: Finally, package the security logic library, bytecode transformer, and necessary description files (i.e., specify the Premain-Class attribute in MANIFEST.MF) into a standard JAR file. This JAR file is the "service component" described, which fully complies with the technical specifications of Java Agent and is in a deployable state. Through step S201, use the bytecode enhancement tool (e.g., ByteBuddy) to encapsulate the security signaling processing capabilities required by GB 35114 standard, separate the core security logic from the underlying interception and enhancement logic, and package them together to finally generate a standardized service component that complies with the Java Agent specification and can be directly recognized and loaded by JVM. The specific form is a JAR file with complete function definition and deployment meta-information (such as the specified Premain-Class).

[0059] In a traditional implementation, the security signaling capability code is usually directly hard-coded into the business logic of the signaling platform, resulting in tight coupling of the security function with the core business of the platform, making it difficult to separate, independently test and iteratively upgrade. At the same time, due to significant differences in architecture design and code implementation of signaling platforms of different manufacturers, rewriting and embedding security code for each platform separately not only requires heavy workload and high cost, but also makes it almost impossible to achieve generalization and standardization of the solution. However, the encapsulation method implemented by the above step S201 modularizes and componentizes the security signaling capability module, making it a software unit with clear function definition, standard interface, independent deployment and management, and achieving high cohesion and low coupling in function. As a result, the generated service component has high universality and can be applied to any GB / T 28181 signaling platform developed based on Java language, without the need for customized secondary development for different platforms. In addition, this method greatly improves the maintainability of the system, and subsequent function updates or vulnerability fixes for security capabilities can be completed by simply replacing and upgrading the independent service component, without the need to modify the code and architecture of the signaling platform main body, thereby significantly reducing the complexity and potential risks of system maintenance.

[0060] Step S202, the service component is connected to a video monitoring signaling platform.

[0061] Specifically, the JAR package service component generated in step S201 is loaded and integrated into the running environment of the signaling platform using the standard mechanism of the Java Virtual Machine (JVM).

[0062] Through step S202, the service component (Java Agent Jar) prepared in the first step is loaded into the JVM process where the signaling platform is located using the standard mechanism provided by the Java Virtual Machine (such as the -javaagent startup parameter or the runtime Attach API), making it part of the platform runtime. This solution fundamentally avoids the traditional strong invasive method of directly modifying the platform source code, configuration file or restarting the service to add functions, and does not modify the code, configuration or database structure of the original system, ensuring the stability and integrity of the original system. Furthermore, the dynamic access capability provided by this solution effectively solves the operation and maintenance problem of "must be integrated offline", meets the requirement of uninterrupted operation of core systems 7x24 hours, greatly improves the business continuity. In addition, the integration mechanism of this solution is flexible and easy to operate, and provides static (at startup) and dynamic (at runtime) access methods, allowing operation and maintenance personnel to flexibly choose the most suitable integration time and operation window according to the actual business impact and SLA requirements, significantly reducing the complexity and risk of the upgrade process.

[0063] Step S203, using the service component to proxy the target information on the video monitoring signaling platform; wherein the target information refers to the communication information between the video monitoring signaling platform and the target device.

[0064] Specifically, after the service component is accessed, the bytecode converter (ClassFileTransformer) embedded therein is immediately effective. When the signaling platform calls the enhanced underlying network communication method (such as java.net.DatagramSocket.send() and.receive()), the service component will first intercept the original, unprocessed communication packet (i.e. the target information). Subsequently, the component parses the packet, restores its SIP protocol message structure, and extracts the key identifier (such as the device ID) therefrom. According to the preset security policy (for example, querying the security capability level corresponding to the device ID in the distributed cache server), the service component decides and performs the corresponding security processing (such as verifying and decrypting the incoming signaling from the secure device, or signing and encrypting the outgoing signaling to the secure device). After the security processing is completed, the packet is returned to the original method flow for further execution (such as being handed over to the platform business logic processing or being sent to the network interface). The entire proxy processing process is transparent and non-perceptible to the upper-layer business logic of the signaling platform.

[0065] Through the above step S203, first, the security processing logic (such as signature, verification, encryption, decryption) required by GB 35114 is completely separated from the complex core business code of the platform, achieving decoupling of security function and business function, and the upper-layer business logic of the platform can obtain security capability without any modification; secondly, since the proxy service is implemented through bytecode enhancement within the platform process, it avoids the additional network hop and serialization overhead caused by the traditional way of adding an independent proxy server, thereby achieving extremely high processing performance and extremely low signaling delay; thirdly, by querying the security policy based on the device ID, fine-grained control at the device level is achieved, enabling a single signaling platform to efficiently and accurately handle mixed traffic of secure and non-secure devices, thereby ensuring backward compatibility and smooth upgrade path.

[0066] Through the above steps S201, S202, S203, the security signaling processing capability is encapsulated into a dynamically loadable service component (such as a Java Agent Jar package) by the bytecode enhancement tool, and the service component is loaded into the running environment of the video monitoring signaling platform, and the proxy service of the security signaling is realized inside the platform process. Specifically, first, the security signaling capability required by the GB 35114 standard is encapsulated into a standardized Java Agent service component (JAR package) by the bytecode enhancement tool. Based on the standard loading mechanism provided by the Java virtual machine (JVM), the service component can be seamlessly integrated into the signaling platform runtime environment. After the service component runs, the network communication method (such as DatagramSocket.send() / receive()) of the signaling platform underlying layer is enhanced through the embedded bytecode converter (ClassFileTransformer) of the service component, so as to intercept and process all SIP signaling data (i.e. target information) flowing between the platform and the device. After processing, the signaling is returned to the original business logic or network stack for further execution, and the whole process is transparent to the upper layer business.

[0067] The method fundamentally overcomes the core defects of the traditional upgrade scheme: first, without modifying any source code, configuration or database structure of the original SIP signaling platform, the system stability risk and the expensive testing and reconstruction cost introduced by direct modification are completely eliminated, realizing true zero-intrusion integration; second, by locating and enhancing the underlying network communication method common to all Java programs at the JVM level, the specificity of different signaling platforms in the implementation of the upper layer business logic is effectively shielded, so that the same solution can be universally adapted to various GB / T 28181 platforms developed based on Java, solving the problem of poor universality.

[0068] Therefore, the platform operator can quickly give the existing system the security capability conforming to the national mandatory standard (GB 35114) without touching the original code and affecting the business continuity, greatly reducing the technical threshold and implementation risk of compliance transformation. The scheme provides a reliable and highly operable technical path for the smooth, efficient and safe upgrade of the massive GB / T 28181 system in the country.

[0069] In some embodiments, encapsulating the security signaling processing capability based on the bytecode enhancement tool includes:

[0070] encoding the security logic of the security signaling processing capability as an independent functional module;

[0071] transforming the independent functional module into the service component by the bytecode enhancement tool.

[0072] Specifically, the abstract security protocol requirements are translated into a Java Agent service component that can be dynamically loaded and enhance the behavior of the target program through the following two stages:

[0073] First stage: modular coding of security logic;

[0074] This stage aims to implement the security capabilities specified in GB 35114 standard as reusable, well-defined interface software modules, including the following steps:

[0075] (1) Function decomposition and implementation:

[0076] The security requirements defined in GB 35114 standard are decomposed into multiple single-function, well-defined core modules, and implemented using Java language. These modules include but are not limited to:

[0077] CertificateValidator: responsible for verifying the device digital certificate, including verifying the certificate chain, CA signature, validity period, and revocation status;

[0078] SignatureHandler: responsible for SM3 hash calculation and SM2 digital signature or signature verification on SIP signaling messages;

[0079] CryptoModule: responsible for encrypting and decrypting sensitive data (such as session key VKEK) using SM4 algorithm;

[0080] KeyManager: responsible for the generation, distribution, storage, and life cycle management of session keys such as VKEK.

[0081] (2) Define clear interfaces:

[0082] Each module is encapsulated as a high cohesion, low coupling independent unit, and provides clear and stable application programming interfaces (APIs) to the outside. For example, the SignatureHandler module can provide the following methods:

[0083] boolean verifySignature(String message, String nonce).

[0084] Second stage: componentized encapsulation through bytecode enhancement.

[0085] The goal of this stage is to build a JavaAgent that can dynamically weave the above security modules into the runtime of the target program, including the following steps:

[0086] (1) Create Agent framework and bytecode converter:

[0087] Create a Java Agent project, define an Agent main class (e.g. SecurityAgent) containing a standard premain or agentmain method. Write a transformer implementing the ClassFileTransformer interface using a bytecode manipulation library such as ByteBuddy, in which explicitly:

[0088] Intercept targets: specify the classes and methods to be enhanced, for example, intercept the send(DatagramPacket p) and receive(DatagramPacket p) methods in the java.net.DatagramSocket class;

[0089] Enhancement logic: define the code inserted at a specific time (e.g. before or after calling, or when an exception is thrown) in the execution of the target method, which is responsible for calling the security module functions developed in the first phase. For example, insert logic at the beginning of the receive method to determine whether it is a SIP REGISTER message and call CertificateValidator.validate() for authentication.

[0090] (2) Register the transformer and package deployment:

[0091] In the premain or agentmain method of the Agent, register the above transformer in the Instrumentation instance provided by JVM. Finally, the Agent class, security function module, bytecode enhancement library dependency and manifest file (MANIFEST.MF, which must specify the Premain-Class or Agent-Class attribute) are built into a complete JAR package that meets the Java Agent specification.

[0092] Through the above two-stage process, the GB 35114 security requirements are converted from an abstract standard to a deployable and dynamically loadable security enhancement service component. This scheme, through modular design and bytecode enhancement technology, completely decouples the security capabilities from the platform business logic and develops and encapsulates them independently. Its beneficial effects are as follows: the componentization and standardization of security functions are realized: security modules can be developed, tested and released independently, significantly improving development efficiency and quality; when the cryptographic algorithm or security protocol needs to be updated, only the independent component needs to be replaced to achieve the upgrade of the entire system capability, greatly improving the maintainability, flexibility and iterative agility of the system, while ensuring zero-intrusion to the original signaling platform.

[0093] In some embodiments, the method further includes:

[0094] injecting the service component through a virtual machine parameter when the video monitoring signaling platform process is started;

[0095] Or, injecting the service component into the running process of the video monitoring signaling platform through a preset dynamic loading interface when the video monitoring signaling platform process is running.

[0096] Among them, when the video monitoring signaling platform process is started, the service component is injected through the Java virtual machine (JVM) startup parameter; when the video monitoring signaling platform process is running, the service component is injected into the running process of the video monitoring signaling platform through the dynamic loading interface (Attach API) provided by the Java platform.

[0097] The above two implementation manners are based on the standard mechanism of the Java virtual machine, and are designed to realize the deep integration of the security service component and the signaling platform runtime in a zero-invasive manner.

[0098] The specific implementation process is as follows:

[0099] Method one: static access at startup.

[0100] Static integration is achieved through the -javaagent startup parameter of JVM, and the specific steps are as follows:

[0101] (1) Component deployment: place the pre-encapsulated security agent service component JAR package (such as security-agent.jar) in the specified directory of the signaling platform server.

[0102] (2) Modify the startup command: modify the startup script (for example, startup.sh or start.bat) of the signaling platform, and add the -javaagent parameter pointing to the component in the original Java startup command. For example, change the original command:

[0103] java -jar platform.jar;

[0104] to:

[0105] java -javaagent: / path / to / security-agent.jar -jar platform.jar.

[0106] (3) Component loading and initialization: JVM recognizes the -javaagent parameter when starting, and loads and initializes the specified Premain-Class class in the MANIFEST.MF file in the JAR package first, and calls the premain method. In this method, the custom bytecode converter (ClassFileTransformer) is registered through the Instrumentation instance passed in.

[0107] (4) Platform startup and enhancement effect: After the JVM completes the Agent initialization, it continues to load and run the signaling platform main program. After that, the loading process of all target classes will be intercepted and enhanced by the registered converter.

[0108] Method two: runtime dynamic access.

[0109] Through the Attach API of Java, the runtime dynamic integration is realized, and the specific steps are as follows:

[0110] (1) Environment preparation: Ensure that the security agent service component JAR package (security-agent.jar) has been deployed in the target environment, and prepare the attachment tool program (Attacher Tool) based on the com.sun.tools.attach.VirtualMachine API.

[0111] (2) Execute attachment and loading: During the running of the signaling platform service, execute the above attachment tool. The tool performs the following operations:

[0112] (a) Locate the running signaling platform process through the process ID (PID) of the target JVM;

[0113] (b) Attach to the JVM;

[0114] (c) Call the loadAgent(" / path / to / security-agent.jar") method to pass the component JAR package path to the target JVM.

[0115] (3) Dynamic loading and redefinition: After the target JVM receives the instruction, it dynamically loads the Agent JAR package and calls the agentmain method. In this method, the bytecode converter is registered through the Instrumentation instance, and the loaded class (such as java.net.DatagramSocket) can be optionally redefined (Retransformation) to implant enhancement logic.

[0116] (4) Access completion: after the attachment process is completed, the security agent service takes effect immediately, and starts to intercept and process the signaling. During the whole process, the main business of the signaling platform is not aware and uninterrupted.

[0117] The scheme provides two access methods closely relying on the standard mechanism of the Java platform. The system administrator can flexibly select static integration or dynamic loading according to actual operation and maintenance constraints (such as business continuity requirements, maintenance window). Compared with the practice of stopping deployment or introducing external proxy components in the traditional scheme, the application effectively solves the core operation and maintenance problems of "integration timing inflexibility" and "influence on business continuity" in security function integration. The static access method is simple and reliable, and is suitable for service scenarios that can accept restart; the dynamic access method realizes real business non-sense hot deployment, meets the strict requirements of 7x24 hours high availability of core systems, and thus provides unprecedented operation and maintenance flexibility and system adaptability.

[0118] In some embodiments, the target information includes incoming information and outgoing information; the incoming information refers to information sent by the target device to the video monitoring signaling platform, and the outgoing information refers to information sent by the video monitoring signaling platform to the target device; and the proxy service of the target information by the service component includes:

[0119] The video monitoring signaling platform is monitored by using a bytecode operation tool, the underlying UDP communication method of the video monitoring signaling platform is intercepted, and the target information is obtained;

[0120] A target device ID is parsed from the target information, and a security level of the target device is obtained from a cache server, and based on the security level, a secure device and a non-secure device are determined from preset terminal devices;

[0121] The incoming information from the secure device is subjected to signature / decryption operation; and the incoming information from the non-secure device is directly sent to a lower level for processing;

[0122] The outgoing information to the secure device is subjected to signature / encryption operation, and the encrypted signature information is attached to the message header of the outgoing information; and the outgoing information to the non-secure device is directly sent to a lower level for processing.

[0123] The underlying UDP communication method includes DatagramSocket.send() and DatagramSocket.receive().

[0124] Specifically, the present scheme defines the core agent service workflow of the service component after accessing the platform. The scheme builds a differentiated data processing pipeline based on the security level of the device, and the technical features can be divided into the following three core links:

[0125] (1) Communication interception: Through the bytecode enhancement tool, the network communication core class (java.net.DatagramSocket) and its key methods (send(), receive()) of the video monitoring signaling platform are intercepted, so that all the original communication data packets (i.e. target information) between the platform and the device are captured.

[0126] (2) Analysis and classification: The SIP protocol message structure is restored and analyzed from the intercepted raw data packets, and the key business identifier-device ID is extracted. Taking this ID as the key, the security capability level of the device is obtained and determined in real time by querying the external distributed cache server (such as Redis), and it is classified as "safe device" or "non-safe device"; among them, the cache server is used to store and maintain the mapping relationship between the device identifier and its security level.

[0127] (3) Differentiated security processing: According to the security level of the device, different security policies are executed:

[0128] For safe devices, the communication information needs to be processed completely according to GB 35114 security: the incoming information (device→platform) is verified and decrypted; the outgoing information (platform→device) is signed and encrypted, and the security parameters are attached to the SIP message header.

[0129] For non-safe devices, their communication information is directly transmitted, bypassing all security processing logic, ensuring backward compatibility for traditional devices.

[0130] The above scheme can be implemented through the following technical process:

[0131] (1) Planting interception point:

[0132] Using ByteBuddy and other bytecode manipulation tools, when the JVM loads the java.net.DatagramSocket class, the bytecodes of the send() and receive() methods are dynamically modified, and the interception logic is planted at the entrance of the above-mentioned methods, ensuring that all operations of receiving and sending UDP data packets through the Socket first execute the custom proxy code.

[0133] (2) Build processing pipeline:

[0134] Packet capture and protocol analysis: The DatagramPacket object is obtained by the interception code, and the original byte data is extracted and restored to a structured SIP message.

[0135] Key information extraction: Analyze SIP message header fields (such as From, To, Call-ID, etc.), and accurately extract the device ID of the sender or receiver.

[0136] Security level decision: The proxy component uses the device ID as the key to initiate a query request to the distributed cache server to obtain the security level identifier corresponding to the device. The data in the cache is written and maintained by the device registration and authentication process.

[0137] (3) Execute policy routing:

[0138] According to the security level result returned by the cache, route the message to different processing channels:

[0139] Secure channel: Call the pre-installed security function module (such as using SM2 signature verification and SM4 decryption) to perform deep security processing on the message. After processing, return the message to the original logic for further execution.

[0140] Compatible channel: Do not process the message, and directly return the original message to continue executing the original logic.

[0141] (4) Transparent integration:

[0142] The entire proxy processing process is completely transparent to the signaling platform's upper-layer business logic. The platform still calls the socket.send() and socket.receive() methods in its original way, and the underlying communication has been enhanced, with all security processing automatically completed in the underlying.

[0143] Through the above mechanism, the scheme achieves three technical effects: First, it ensures that a single signaling platform can safely access new devices that meet the GB 35114 standard and seamlessly compatible with existing devices that only support the GB / T 28181 standard, solving the compatibility problem in mixed networking of new and old devices; second, through fine-grained management based on business-layer device ID (rather than network-layer IP address or port), it realizes precise security policy control at the device granularity, avoiding the misprocessing problem of traditional coarse-grained control strategies; finally, since it uses an in-process integration mode, it completely avoids the network delay overhead and single-point failure risk brought by independent proxy server solutions, providing strong security capabilities while ensuring high performance and high reliability of the system.

[0144] In some embodiments, the signature verification / decryption operation for the incoming information from the secure device includes:

[0145] If the incoming information is a REGISTER request, the security level of the target device is determined according to the Authorization header information in the REGISTER information request header;

[0146] The identity information carried in the authentication header of the video monitoring signaling platform request is verified by the security device;

[0147] If the verification is passed, the incoming information is sent to the lower level processing, and the security level of the security device is saved; if the verification is not passed, the target device identity verification fails is returned;

[0148] If the incoming information is a non-REGISTER request, the signature information in the non-REGISTER request header is verified; if the verification is successful, it is sent to the lower level processing, and if the verification fails, the target device verification is not passed is returned.

[0149] Specifically, when the service component receives the incoming information from the security device, it is differentially processed according to the SIP request method type:

[0150] (1) Handle the REGISTER request.

[0151] When it is identified that the incoming information is a REGISTER request, the service component first determines the security level claimed by the target device according to the Authorization authentication header information in the request header (for example, by analyzing a specific field in the device digital certificate to determine the GB 35114 security level it supports). Then, for the security device, the identity information (such as digital certificate) carried in the authentication header is verified, that is, a strong identity authentication based on public key infrastructure (PKI) is performed to verify its certificate chain, signature validity, validity period and revocation status. If the verification is passed, the incoming information is sent to the lower level processing (i.e. submitted to the core business logic of the signaling platform), and the security level of the device is saved to the distributed cache server; if the verification is not passed, the process is terminated, and the identity verification failure is directly returned to the target device (such as returning a 401 Unauthorized response).

[0152] (2) Handle non-REGISTER request.

[0153] When the ingress information is identified as non-REGISTER request such as INVITE, MESSAGE, INFO, etc., the service component verifies the signature information (such as the Nonce value extracted from the Note field) in the request header. That is, the integrity and source of the signaling are verified by using the pre-shared session key (VKEK) through the national cryptographic algorithm (such as SM3, SM2). If the verification is successful, the signaling is sent to the lower level for processing; if the verification fails, it is determined that the signaling is illegal or has been tampered with, and the signaling is discarded and a verification failure (such as returning an appropriate 4xx error response) is returned to the target device.

[0154] Through the above hierarchical processing mechanism, the present scheme realizes multiple security benefits: first, by judging the security level and performing strong identity authentication, a trusted identity cornerstone is established at the beginning of device access, completely solving the risk of device identity impersonation and misuse; second, by verifying each service signaling, the integrity and authenticity of the signaling in the transmission process are ensured, effectively preventing replay attacks, man-in-the-middle attacks, and command injection threats. The entire process is automatically completed within the transparent proxy framework of the present scheme, and there is no interference to the upper layer business logic of the signaling platform.

[0155] In some embodiments, the signing / encryption operation for the out-bound information sent to the secure device includes:

[0156] If the out-bound information is a REGISTER response message of the video monitoring signaling platform, a security signature and encryption key information are added to the REGISTER response message, the target operation information is generated, and the target operation information is sent to the target device;

[0157] If the out-bound information is a non-REGISTER response message, signature calculation is performed on the non-REGISTER response message header and message body, and the generated signature is spliced into the message header to generate the target operation information, and the target operation information is sent to the target device.

[0158] Specifically, when the service component processes the out-bound information sent to the secure device, two different types of security reinforcement operations are performed according to the message type:

[0159] (1) Secure connection establishment response (for REGISTER response message).

[0160] When it is identified that the outgoing information is a successful response message (200 OK) of the signaling platform to the device REGISTER request, the service component is security enhanced. Specifically, key security parameters are inserted in the original response message body generated by the platform, mainly including: (a) digital signature (Sign): SM2 signature is generated using the platform private key for the key content of the response message, which is used to prove the authenticity of the platform identity to the device, and completes the two-way identity authentication; (b) encrypted session key: the session key (VKEK) is SM2 encrypted using the public key of the target device, and is injected into the message body as a parameter such as cryptkey. Through this step, not only the self-authentication of the platform identity is realized, but also the key distribution is safely completed, which establishes the foundation for subsequent secure communication.

[0161] (2) Security service signaling delivery (for non-REGISTER response message).

[0162] When it is identified that the outgoing information is an INVITE, INFO or other non-REGISTER message (including request and response), the service component is integrity protected. Specifically, the header and message body of the outgoing message are jointly hashed (such as using SM3 algorithm to generate digest), and the platform private key is used to SM2 sign the digest, and the generated digital signature value is spliced into the extension header field (such as Note field) of the SIP message, and finally the complete security message is sent to the target device. This operation ensures that the business instruction cannot be tampered with during transmission, and the source is trusted.

[0163] The above outbound signaling security processing solves three core security problems systematically: first, it breaks through the limitation of traditional one-way authentication, and through the digital signature of the platform to the REGISTER response, the device can verify the platform identity, and a two-way trust relationship is established, effectively resisting server impersonation attacks; second, by using the device public key to encrypt VKEK, the confidentiality of the session key in the untrusted network is ensured, only the target device holding the corresponding private key can decrypt it, solving the key distribution problem; finally, by signing each service signaling and attaching it to the message header, the integrity and authenticity of the instruction are guaranteed, so that the receiving device can verify whether the instruction is tampered with, effectively preventing man-in-the-middle attacks and instruction injection attacks, thereby comprehensively improving the security, trustworthiness and reliability of the communication channel.

[0164] In some embodiments, the method further comprises: during the running of the video monitoring signaling platform, unloading the service component through a preset dynamic loading interface.

[0165] Specifically, during the continuous running of the video monitoring signaling platform, the previously injected service components can be safely removed from the platform process by calling the preset dynamic loading interface (such as the uninstall method provided by the JMX MBean). The uninstallation process covers the cleaning work of the enhanced bytecode, and through the reverse operation of the bytecode enhancement tool (such as the reset capability provided by the AgentBuilder of ByteBuddy), the class methods (such as DatagramSocket.receive() and.send()) that have been intercepted and enhanced are restored to their original state, so that the video monitoring signaling platform completely returns to the initial mode of processing only GB / T 28181 standard signaling, and the complete rollback of the function is realized.

[0166] The traditional basic software upgrade solution or deep integration solution is often irreversible once implemented due to its direct modification of the system underlying code; if the newly introduced security component has unpredictable compatibility defects, performance bottlenecks or conflicts with specific business logic, the operation and maintenance personnel will face a dilemma, and the entire system may be paralyzed. In contrast, the dynamic uninstallation capability provided by the present solution fundamentally solves the key operation and maintenance reliability problem of "how to quickly and safely remove a newly added function that may have risks without restarting the core service".

[0167] In addition, the present solution gives the system unprecedented strategic flexibility. In some specific business scenarios (for example, system deep debugging, forensic analysis or responding to temporary compliance policy adjustments), it may be necessary to temporarily turn off the GB 35114 security function. The present solution provides a fine-grained technical means for this purpose. The operation and maintenance personnel or automatic control system can dynamically and seamlessly turn on or off the advanced security signaling capability according to the real-time security situation, audit requirements or temporary policy needs through simple instruction operations, thereby achieving the optimal balance between security and business continuity.

[0168] The embodiment also provides a security signaling integration system, which is used for implementing the above-mentioned embodiments and preferred embodiments, and details are not repeated. As used below, the terms "module", "unit", "sub-unit" and the like can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, hardware or a combination of software and hardware is also possible and is contemplated.

[0169] Figure 3 is a structural block diagram of a security signaling integration system according to an embodiment of the present application, as shown in Figure 3 The device includes a video monitoring signaling platform 10 and a target device 20, wherein:

[0170] The video monitoring signaling platform 10 is used for accessing a service component; the service component is generated by encapsulating a security signaling processing capability based on a bytecode enhancement tool;

[0171] The video monitoring signaling platform 10 is also used for proxying service of target information by using the service component; wherein the target information refers to communication information between the video monitoring signaling platform 10 and the target device 20.

[0172] It should be noted that each of the above modules can be a functional module or a program module, and can be implemented by software or hardware. For the modules implemented by hardware, each of the above modules can be located in the same processor; or each of the above modules can also be located in different processors in any combination. In this embodiment, specific examples can refer to the examples described in the above embodiments and optional implementation manners, which will not be described herein.

[0173] The embodiment also provides an electronic device including a memory and a processor, the memory storing a computer program, and the processor being configured to execute the computer program to perform the steps in any of the above method embodiments.

[0174] Optionally, the electronic device can further include a transmission device and an input / output device, wherein the transmission device is connected with the processor, and the input / output device is connected with the processor.

[0175] Optionally, in the embodiment, the processor can be configured to execute the following steps by the computer program:

[0176] S1, encapsulating a security signaling processing capability based on a bytecode enhancement tool to generate a service component;

[0177] S2, accessing the service component to a video monitoring signaling platform;

[0178] S3, using the service component to proxy service of target information on the video monitoring signaling platform; wherein the target information refers to communication information between the video monitoring signaling platform and a target device.

[0179] It should be noted that specific examples in the embodiment can refer to the examples described in the above embodiments and optional implementation manners, which will not be described herein.

[0180] In addition, in combination with the security signaling integration method in the above embodiments, the embodiment can provide a storage medium for implementation. The storage medium stores a computer program; when the computer program is executed by a processor, any of the security signaling integration methods in the above embodiments is implemented.

[0181] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties.

[0182] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiments. Any reference to memory, database or other medium used in the embodiments provided by the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided by the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided by the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0183] Those skilled in the art should understand that any combination of the technical features of the above-mentioned embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above-mentioned embodiments are not described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0184] The above-described embodiments are merely illustrative of several embodiments of the present application, which are described in more detail and in a specific and detailed manner, but should not be construed as limiting the scope of the patent. It should be noted that for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present application, and these are all within the scope of the present application. Therefore, the scope of protection of the patent of the present application should be subject to the appended claims.

Claims

1. A secure signaling integration method, characterized in that, include: Based on bytecode enhancement tools, security signaling processing capabilities are encapsulated to generate service components; Connect the service components to the video surveillance signaling platform; On the video surveillance signaling platform, the service component is used to perform proxy services for target information, including: the service component uses a bytecode manipulation tool to listen to the video surveillance signaling platform, intercepts the underlying UDP communication method of the video surveillance signaling platform, obtains the target information, and performs proxy services for the target information; wherein, the target information refers to the communication information between the video surveillance signaling platform and the target device.

2. The secure signaling integration method according to claim 1, characterized in that, Based on bytecode enhancement tools, security signaling processing capabilities are encapsulated to generate service components including: The security logic of the security signaling processing capability is encoded into an independent functional module; The independent functional modules are transformed into the service components using bytecode enhancement tools.

3. The secure signaling integration method according to claim 1, characterized in that, The step of connecting the service component to the video surveillance signaling platform includes: When the video surveillance signaling platform process starts, the service component is injected through virtual machine parameters; Alternatively, during the execution of the video surveillance signaling platform process, the service components can be injected into the running process of the video surveillance signaling platform through a preset dynamic loading interface.

4. The secure signaling integration method according to claim 1, characterized in that, The target information includes inbound information and outbound information; wherein, the inbound information refers to information sent from the target device to the video surveillance signaling platform, and the outbound information refers to information sent from the video surveillance signaling platform to the target device; the service component uses a bytecode manipulation tool to monitor the video surveillance signaling platform, intercepts the underlying UDP communication method of the video surveillance signaling platform, obtains the target information, and performs proxy services for the target information, including: The target device ID is parsed from the target information, and the security level of the target device is obtained from the cache server. Based on the security level, secure devices and insecure devices are determined from the preset terminal devices. For incoming information from the security device, perform signature verification / decryption operations; for incoming information from the non-security device, directly send it to the next level for processing. For outbound information destined for the secure device, a signature / encryption operation is performed, and the encrypted signature information is appended to the message header of the outbound information; for outbound information destined for the non-secure device, it is directly sent to the next level for processing.

5. The security signaling integration method according to claim 4, characterized in that, The signature verification / decryption operation for incoming information from the security device includes: If the incoming information is a REGISTER request, the security level of the target device is determined based on the Authorization header information in the request header of the REGISTER request. The security device verifies the identity information carried in the authentication header of the video surveillance signaling platform request. If the verification passes, the incoming information is sent to the next level for processing, and the security level of the security device is saved; if the verification fails, the target device identity verification fails. If the incoming information is a non-REGISTER request, the signature information in the request header of the non-REGISTER request is verified; if the signature verification is successful, it is sent to the next level for processing; if the signature verification fails, the target device is replied that the signature verification failed.

6. The secure signaling integration method according to claim 4, characterized in that, The signing / encryption operation for the outgoing information destined for the security device includes: If the outgoing information is a REGISTER response message from the video surveillance signaling platform, then a security signature and encryption key information are added to the REGISTER response message to generate information after the target operation, and the information after the target operation is sent to the target device; If the outgoing information is a non-REGISTER response message, then the message header and message body of the non-REGISTER response message are signed, and the generated signature is appended to the message header to generate the target operation information, and the target operation information is sent to the target device.

7. The secure signaling integration method according to claim 1, characterized in that, The method further includes: during the operation of the video surveillance signaling platform, unloading the service component through a preset dynamic loading interface.

8. A security signaling integration system, comprising a video surveillance signaling platform and target devices, characterized in that: The video surveillance signaling platform is used to access service components; the service components are generated by encapsulating security signaling processing capabilities based on bytecode enhancement tools. The video surveillance signaling platform is also used to perform proxy services for target information using the service component, including: the service component listens to the video surveillance signaling platform by using a bytecode manipulation tool, intercepts the underlying UDP communication method of the video surveillance signaling platform, obtains the target information, and performs proxy services for the target information; wherein, the target information refers to the communication information between the video surveillance signaling platform and the target device.

9. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the security signaling integration method according to any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the security signaling integration method according to any one of claims 1 to 7 when it is run.

Images