Video monitoring protection method and device based on AI desensitization model and SM algorithm, equipment, medium and product

Abstract

This application discloses a video surveillance protection method, device, equipment, medium, and product based on an AI-based de-identification model and national cryptographic algorithms, relating to the field of video encryption and decryption protection. The method includes: acquiring a video stream; encrypting the video stream using a hardware encryption card; performing password authentication based on the acquired video stream viewing request to obtain an authentication result; if the authentication result is successful, decrypting the encrypted video stream using the hardware encryption card; determining whether to invoke the AI ​​de-identification model based on the monitoring permissions corresponding to the video stream viewing request; if yes, invoking the AI ​​de-identification model to de-identify the decrypted and restored video stream, and displaying the de-identified video data; if no, displaying and playing the decrypted and restored video stream. This application aims to improve the video security of video surveillance.

Description

Technical Field

[0001] This application relates to the field of video encryption and decryption protection, and in particular to a video surveillance protection method, device, equipment, medium and product based on an AI desensitization model and national cryptographic algorithms. Background Technology

[0002] Video files captured by cameras and stored on NVRs (Network Video Recorders) are in plaintext. When internal control processes fail or have vulnerabilities, internal personnel can copy and distribute these plaintext video files, or record and distribute sensitive information via the monitoring screen in the control room. The consequences of this extend beyond personal privacy breaches and financial losses to the company; they can also potentially impact public safety.

[0003] Therefore, ensuring the secure storage of video surveillance data without interfering with normal monitoring by personnel in the control room has become a key issue that current monitoring systems need to address. Thus, resolving the security issues of video surveillance data is of paramount importance. Summary of the Invention

[0004] The purpose of this application is to provide a video surveillance protection method, device, equipment, medium, and product based on an AI desensitization model and national cryptographic algorithms, which can improve the video security of video surveillance.

[0005] To achieve the above objectives, this application provides the following solution:

[0006] Firstly, this application provides a video surveillance protection method based on an AI desensitization model and a national cryptographic algorithm. This method is applied to a video surveillance protection system. The video surveillance protection system includes a video data leakage prevention system, which incorporates a hardware encryption card using a national cryptographic algorithm, and an AI desensitization model constructed using a target tracking algorithm based on deep learning and data transformation. The national cryptographic algorithm uses the SM4 algorithm in CTR mode. The AI ​​desensitization model is used to desensitize facial data in the video so that the initial facial features corresponding to the desensitized facial data cannot be reversed and restored.

[0007] The video surveillance protection method based on the AI ​​desensitization model and national cryptographic algorithms includes:

[0008] Acquire video stream;

[0009] The video stream is encrypted using a hardware encryption card;

[0010] Password authentication is performed based on the obtained video stream viewing request, and the authentication result is obtained;

[0011] After the authentication result is successful, the encrypted video stream is decrypted based on the hardware encryption card.

[0012] Based on the monitoring permissions corresponding to the video stream viewing request, determine whether to invoke the AI ​​de-identification model;

[0013] If so, the AI ​​desensitization model is invoked to desensitize the restored video stream obtained after decryption, and the desensitized video data is displayed and played.

[0014] If not, the decrypted and restored video stream will be displayed and played.

[0015] Secondly, this application provides a video surveillance protection device based on an AI desensitization model and national cryptographic algorithms, comprising:

[0016] The video stream acquisition module is used to acquire video streams;

[0017] An encryption processing module is used to encrypt the video stream based on a hardware encryption card;

[0018] The authentication module is used to perform password authentication based on the obtained video stream viewing request and obtain the authentication result;

[0019] The decryption processing module is used to decrypt the encrypted video stream based on the hardware encryption card after the authentication result is successful.

[0020] The judgment module is used to determine whether to invoke the AI ​​de-identification model based on the monitoring permissions corresponding to the video stream viewing request;

[0021] The desensitization processing and display module is used to call the AI ​​desensitization model to desensitize the restored video stream obtained after decryption when the result of the judgment module output is yes, and then display and play the desensitized video data.

[0022] The display module is used to display and play the restored video stream after decryption when the result of the judgment module output is negative.

[0023] Thirdly, this application provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the video surveillance protection method based on the AI ​​desensitization model and national cryptographic algorithm described above.

[0024] Fourthly, this application provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the video surveillance protection method based on the AI ​​desensitization model and national cryptographic algorithm described above.

[0025] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the video surveillance protection method based on the AI ​​desensitization model and national cryptographic algorithms described above.

[0026] According to the specific embodiments provided in this application, the following technical effects are disclosed:

[0027] This application provides a video surveillance protection method, device, equipment, medium, and product based on an AI-based de-identification model and national cryptographic algorithms. The encryption based on national cryptographic algorithms, specifically the SM4 algorithm CTR mode, significantly improves encryption performance and possesses parallel processing capabilities, enhancing encryption efficiency. Furthermore, this application uses an AI-based de-identification model to determine whether to de-identify facial data in the video based on monitoring permissions, protecting user facial privacy. Effective de-identification prevents unauthorized access and misuse of facial data during transmission, storage, and use, thereby improving video surveillance security. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 The flowchart shows a video surveillance protection method based on an AI desensitization model and national cryptographic algorithms.

[0030] Figure 2 This is a schematic diagram of the system architecture for a video surveillance protection system.

[0031] Figure 3 A schematic diagram of the AI ​​desensitization model;

[0032] Figure 4 This is a schematic diagram of the AI ​​desensitization model structure;

[0033] Figure 5 This is a schematic diagram of multi-target tracking;

[0034] Figure 6 This is a schematic diagram of the video capture and encryption process;

[0035] Figure 7 A flowchart illustrating the process for regular monitoring personnel to view surveillance videos;

[0036] Figure 8 A flowchart illustrating the process for system administrators to view surveillance videos;

[0037] Figure 9 This is a structural diagram of a video surveillance protection device based on an AI-based desensitization model and national cryptographic algorithms;

[0038] Figure 10 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0039] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0040] This application uses the SM4 algorithm, a national cryptographic algorithm, to encrypt video frames in a video stream, and employs the SM2 algorithm to sign the encrypted video frame data. This application details the architecture, encryption steps, key management, and distribution mechanism of the video surveillance protection system, and analyzes its security and feasibility. The video surveillance protection system effectively guarantees the confidentiality, integrity, availability, and privacy of video surveillance, providing a complete system upgrade solution for video surveillance systems.

[0041] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, this application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0042] In an exemplary embodiment, a video surveillance protection method based on an AI-based desensitization model and a national cryptographic algorithm is provided. This method is applied to a video surveillance protection system. The video surveillance protection system includes a video data leakage prevention system, which incorporates a hardware encryption card using a national cryptographic algorithm, and an AI desensitization model constructed using a target tracking algorithm based on deep learning and data transformation. The national cryptographic algorithm uses the SM4 algorithm in CTR mode. The AI ​​desensitization model is used to desensitize facial data in the video so that the original facial features corresponding to the desensitized facial data cannot be reversed and restored.

[0043] like Figure 1 As shown, the video surveillance protection method based on the AI ​​desensitization model and national cryptographic algorithms includes:

[0044] Step 100: Obtain the video stream.

[0045] Step 200: Encrypt the video stream using a hardware encryption card.

[0046] The encryption of the video stream based on a hardware encryption card specifically includes:

[0047] The video data in the video stream is encrypted using a hardware encryption card. An SM4 video encryption key Key1 and an SM4 video signature key Key2 are randomly generated. The CMAC value is then calculated on the encrypted video data to obtain the CMAC_R value.

[0048] Based on the key protection key KEK_Key stored in the hardware encryption card, the SM4 video encryption key Key1 and the SM4 video signature key Key2 are encrypted to generate encrypted KeyData. This determines the encrypted video stream.

[0049] Step 300: Perform password authentication based on the obtained video stream viewing request to obtain the authentication result.

[0050] The process involves password authentication based on the acquired video stream viewing request, resulting in the following authentication outcome:

[0051] Based on the video stream viewing request obtained by the hardware encryption card, a random number is generated; based on the random number, a signature is obtained by signing with the SM2 private key; based on the security U-shield, the random number, the device ID of the encryption card bound to the security U-shield, the signature value, and the security U-shield certificate issued by the root certificate are concatenated to form device authentication data.

[0052] Based on the hardware encryption card, the device is authenticated according to the device authentication data, and the certificate of the security U-shield is verified using the pre-set root certificate. The public key in the certificate of the security U-shield is used to verify the signature value in the authentication data. By comparing the random number and the encryption card device ID, the device authentication result is output, and the authentication result is obtained.

[0053] Step 400: After the authentication result is successful, the encrypted video stream is decrypted based on the hardware encryption card.

[0054] After successful authentication, the encrypted video stream is decrypted using a hardware encryption card, specifically including:

[0055] After authentication is successful, the encrypted KeyData data is decrypted based on the key protection key KEK_Key stored in the hardware encryption card, restoring the SM4 video encryption key Key1 and the SM4 video signature key Key2.

[0056] Using the SM4 video signature key Key2, calculate the CMAC_V value of the encrypted video data and compare it with the CMAC_R value to obtain the comparison result.

[0057] If the comparison results are the same, the encrypted video data is decrypted using the key protection key KEK_Key.

[0058] If the comparison results are different, the encrypted video data has been tampered with, and an alarm will be triggered.

[0059] Step 500: Based on the monitoring permissions corresponding to the video stream viewing request, determine whether to invoke the AI ​​de-identification model.

[0060] Step 600: If yes, then call the AI ​​desensitization model to desensitize the restored video stream obtained after decryption, and display and play the desensitized video data.

[0061] As an optional implementation method, the AI ​​desensitization model is a model built on the CNN framework and using an anchor-based structural design.

[0062] The AI ​​desensitization model is determined using a target tracking algorithm based on deep learning and data transformation; the target tracking algorithm uses the SORT algorithm; and the data transformation uses an irreversible hash algorithm.

[0063] Step 700: If not, display and play the restored video stream obtained after decryption.

[0064] In one embodiment, the video surveillance protection method based on the AI ​​desensitization model and national cryptographic algorithms further includes:

[0065] The encrypted KeyData data and CMAC_R value are inserted into the SEI; the SEI is a component of the MPEG-4 video stream.

[0066] In cities, video surveillance in public areas has achieved near-complete coverage. Taking the transportation sector as an example, major intersections and road sections in major cities are equipped with high-definition cameras to monitor traffic flow, capture violations, and assist traffic management departments in alleviating congestion and maintaining order. This not only ensures pedestrian safety but also, during peak travel periods like holidays, allows for early warnings of potential stampedes through crowd density analysis.

[0067] At the community level, video surveillance is a crucial security standard in both newly built and renovated communities. Newer communities often feature more sophisticated surveillance systems that not only record the entry and exit of people and vehicles but also integrate facial recognition access control systems. These systems work in conjunction with surveillance to automatically alert property security if suspicious individuals are detected loitering for an extended period. In renovation projects for older communities, the installation and upgrading of surveillance cameras are being vigorously promoted. After renovation, new high-definition cameras cover community entrances, corridors, and public activity areas, significantly improving residents' sense of security.

[0068] Commercial establishments also rely heavily on video surveillance. Inside shopping malls, surveillance cameras provide comprehensive coverage from shop corridors on each floor to parking lots, preventing theft, protecting customers' belongings, and providing data support for mall layout adjustments and store leasing by analyzing customer walking patterns and lingering areas. Chain supermarkets and convenience stores also widely install surveillance systems, not only for theft prevention but also to monitor employee work status and standardize checkout procedures.

[0069] Video encryption and key distribution in the car sentry mode can improve security and meet the requirements of independent control over information security.

[0070] SM4, a block symmetric encryption algorithm released by the State Cryptography Administration of China, holds an important position in the field of data encryption due to its 128-bit block length and key length, as well as its 32-round nonlinear iterative structure. CTR (Counter Mode), one of the working modes supported by SM4, has unique advantages and application characteristics.

[0071] Key elements: In CTR mode, a counter is introduced into the encryption process. The initial value of the counter is typically selected by the user or generated via a specific initialization vector (IV), and it increments sequentially during encryption (usually by 1 each time). Each counter value is encrypted using the SM4 encryption algorithm, generating a keystream block. This keystream block is then XORed with the corresponding plaintext block to obtain the ciphertext block. For example, suppose the plaintext is divided into... ...and multiple 128-bit blocks, the initial value of the counter is... The key stream block is obtained after SM4 encryption. Then the ciphertext block The counter increments to back, , And so on. The decryption process is the reverse operation: the same keystream block is generated using the same sequence of counter values, and then XORed with the ciphertext block to recover the plaintext.

[0072] Functional Framework: CTR mode transforms block cipher algorithms into stream cipher algorithms, enabling parallel processing of the encryption process. Since the encryption of each plaintext block independently depends on the encryption result of its corresponding counter value, multiple plaintext blocks can be encrypted simultaneously, significantly improving encryption efficiency, especially suitable for scenarios handling large amounts of data. Furthermore, this mode supports random access, meaning that specific ciphertext blocks can be decrypted directly without decrypting the entire ciphertext sequence. This is crucial in applications requiring fast access to portions of data, such as data fragmentation encryption and decryption in network transmission.

[0073] Compared to other modes, CTR mode significantly improves encryption performance while maintaining the high-strength encryption characteristics of the SM4 algorithm. Its parallel processing capability allows for optimized encryption speed in multi-core processor environments, meeting the demands of scenarios with extremely high encryption efficiency requirements, such as large data storage encryption and high-speed network communication encryption. Furthermore, CTR mode has limitations on error propagation; an error in the transmission of a ciphertext block only affects the recovery of the plaintext corresponding to that block, unlike some modes (such as CBC mode) which can lead to decryption errors in multiple subsequent blocks. This enhances the reliability of data transmission, making its advantages particularly evident in complex network environments.

[0074] AI-powered facial recognition anonymization models (i.e., AI-based anonymization models) are a key technology for ensuring the security and privacy of facial data. In today's digital age, with the widespread application of facial recognition technology in many fields such as security monitoring, financial payments, and access control systems, their importance is becoming increasingly prominent. Because facial data is highly sensitive personal biometric information, its leakage could lead to serious risks such as identity theft and privacy violations. Therefore, AI-based facial recognition anonymization models have emerged to address this need.

[0075] This AI-based face masking model is primarily built upon deep learning and data transformation technologies. In the feature extraction stage, advanced deep learning architectures such as Convolutional Neural Networks (CNNs) are used to accurately extract key features from the input facial image. These features effectively characterize the uniqueness of the face for subsequent recognition and comparison. Subsequently, the face masking stage employs various masking algorithms, including irreversible transformations. This ensures that the original facial features are virtually impossible to reconstruct from the masked hash value.

[0076] Functional System: From a functional perspective, the primary function of the AI ​​facial recognition desensitization model is to protect users' facial privacy by effectively desensitizing facial data to prevent it from being illegally obtained and misused during transmission, storage, and use.

[0077] SEI (Supplemental Enhancement Information) is a part of the video stream in the MPEG-4 standard. It carries additional, non-essential information that may be helpful for video processing or applications. Here are some key pieces of information about SEI:

[0078] NAL Unit Type: In H.264 / AVC (MPEG-4 Part 10), a NAL unit type value of 6 indicates SEI content. In H.265 / HEVC, NAL unit types of 39 and 40 represent SEI content.

[0079] SEI payload type: The SEI payload type specifies the specific purpose of the SEI information. The H.264 / AVC standard does not define a range for the SEI payload type; the number of bytes representing the payload type is variable. The SEI payload type is obtained by continuously reading 8 bits until a value other than 0xff is reached, and then summing the read values. When the SEI payload type value is 5, the specified processing method is called `user_data_unregistered()`, which is commonly used to store encoder encoding parameters, etc.

[0080] The structure of an SEI: An SEI typically includes the SEI payload type, SEI payload size, and the specific SEI payload content. For example, in the user_data_unregistered() type, the payload size might be followed by a 16-byte UUID (Universally Unique Identifier), and then the specific user data content.

[0081] The role of SEI: SEI information is not a necessary part of the decoding process, but it can be used for various purposes, such as transmitting encoder parameters, video copyright information, camera parameters, and editing events during the content generation process. It can also transmit information related to answering questions in live Q&A mode, and optimize the synchronization between question display and audience audio and video viewing.

[0082] like Figure 2 As shown, the video surveillance protection system mainly consists of three parts: video acquisition, video protection gateway (video data leakage prevention gateway), and video playback (user monitoring).

[0083] Video capture consists of a camera and a gateway.

[0084] Video protection (video data leakage prevention system):

[0085] The video stream captured by the camera is input to the video data leakage prevention system via a gateway. The system uses a built-in hardware encryption card to randomly generate an SM4 video encryption key (Key1) to encrypt the video data in the stream. It also randomly generates an SM4 video signature key (Key2) and calculates the CMAC value on the encrypted video data. The video protection gateway uses the key protection key (KEK_Key) stored in the hardware encryption card to encrypt the video encryption key (Key1) and the video signature key (Key2), generating encrypted KeyData data. The gateway then inserts the KeyData data and the CMAC_R value into the SEI (Search Engine Information Base) for subsequent video decryption and integrity verification.

[0086] The video stream data, encrypted and signed by the video protection gateway, will be saved to the NVR network video recorder according to the traditional process and protocol.

[0087] When users need to perform monitoring, they need to use a USB key for authentication and login. There are two types of USB keys: one is a security USB key with monitoring permissions, which can only view monitoring videos after facial recognition or other sensitive information has been anonymized. This type of USB key is used by ordinary monitoring personnel to view monitoring videos on a large monitoring screen. The other type is a restore USB key, which can view the original video without anonymization. This type of USB key is used by system administrators to view the original video after meeting security control procedures.

[0088] The process for regular monitoring personnel to view surveillance videos:

[0089] The monitoring program is activated; a security USB key is inserted and password authentication is performed; after successful authentication, the monitoring program reads the video file from the NVR through the video protection gateway; the video protection gateway reads the KeyData file from the SEI of the video file. The KeyData file is decrypted using the key protection key KEK_Key in the hardware encryption card. The video encryption key Key1 and video signature key Key2 are restored; the CMAC_V value is calculated on the encrypted video data using the video signature key Key2 and compared with the CMAC_R value stored in the SEI. If the two are different, an alarm is triggered indicating that the video has been tampered with. If the two CMACs are the same, the encrypted video data is decrypted using the key protection key KEK_Key, restoring the original video. The video protection gateway then calls the privacy protection model (i.e., the AI ​​de-identification model) to de-identify faces; the player displays the de-identified video on the large screen.

[0090] The process for system administrators to view surveillance videos:

[0091] Open the monitoring program; insert the recovery USB key and enter the password for authentication; after successful authentication, the monitoring program reads the video file from the NVR through the video protection gateway; the video protection gateway reads the KeyData file in the SEI of the video file. Using the key protection key KEK_Key in the hardware encryption card, it decrypts the KeyData file. It restores the video encryption key Key1 and the video signature key Key2. Using the video signature key Key2, it calculates the CMAC_V value for the encrypted video data and compares it with the CMAC_R value stored in the SEI; if the two are different, an alarm is triggered indicating that the video has been tampered with. If the two CMACs are the same, it decrypts the encrypted video data using the key protection key KEK_Key, restoring the original video; the player then plays the original video.

[0092] AI-powered facial recognition with de-identification of faces to protect personal privacy. Video encryption and signature are the core differences between this application and traditional systems. Key leakage is prevented through hardware encryption cards generating keys, KEK_Key protecting the keys, and SEI carrying critical information.

[0093] Clear access control: The authentication process for U-shields is independent for ordinary personnel and management personnel, and the decryption logic for anonymized / original videos is completed in the video data leakage prevention system, ensuring that access cannot be overstepped.

[0094] Integrity Guarantee: The entire process is verified through CMAC values ​​to ensure that the video stream is not tampered with during transmission / storage.

[0095] Key security: All core keys (Key1, Key2, KEK_Key) are generated / stored through hardware encryption cards to avoid the risk of key leakage at the software level.

[0096] Encrypting video files solves the problem of anyone being able to view videos stored on the NVR. File signing protects video integrity. Minimizes changes to existing business processes. Regular monitoring personnel can only view anonymized videos. Prevents regular monitoring personnel from leaking personal information from large-screen recordings. Protects individual privacy. Allows police or relevant regulatory departments to verify the original video. System administrators can open and view specific videos.

[0097] like Figure 3 and Figure 4 As shown, the framework and system structure of the AI ​​model are as follows:

[0098] Using a CNN framework and an anchor-based design, compared to anchor-free, anchor-based approaches can more accurately adapt to the size of the target and have a higher detection rate in desensitization applications.

[0099] The overall framework adopts the classic YOLO paradigm, namely Input, Backbone, Neck, and Head. The overall data flow is clear, making it easy to train and deploy. The training data can be easily processed in the Input stage, including common data augmentation strategies, which can greatly increase the expressive power of the training data.

[0100] During the Backbone design phase, the Conv+C3+SPPF module was mainly used. On the one hand, this improved the feature extraction capability of the CNN, and on the other hand, it did not require too much data, thus finding a balance between computational power consumption and accuracy improvement.

[0101] In the Neck design, using FPN can improve the generalization ability of CNN without increasing the computational cost, and has stronger fault tolerance. In addition, the bottom-up approach is adopted, the purpose of which is to fully integrate the semantic information of deep features and shallow features in feature maps of three scales, making it more conducive to object detection.

[0102] In the Head design, network outputs are specifically designed for faces and license plates, allowing for more targeted and efficient output of the target data.

[0103] Furthermore, the algorithm was customized for the RK3588 platform chip. The network model structure design is as follows: Figure 4 As shown, in order to make full use of computing power, the network model design selects operators that are friendly to GPU, CPU and DSP.

[0104] Improved multi-target tracking algorithm:

[0105] To improve the accuracy and reduce the false recognition rate of the algorithm, a target tracking algorithm was integrated. This target tracking algorithm is based on the SORT algorithm and has been improved to address its shortcomings. The main improvements include:

[0106] The SORT algorithm is migrated from single-class to multi-class tracking by binding each tracker to a class, and IOU target matching is only performed between trackers of the same class.

[0107] The ID counting method for each category has been modified. The original SORT algorithm counted all categories together and output the total number of targets that appeared (including successfully tracked targets and targets that appeared and disappeared without being tracked). The improved version only counts the IDs of targets that have been confirmed to have appeared, which makes the ID output more stable and continuous.

[0108] like Figure 5As shown, different colored target rectangles represent different object IDs. At time T1, one object has been successfully tracked. At time T2, in addition to detecting the target rectangle (purple) corresponding to the new position of the tracked object, the predicted target rectangle (black) for object tracking is also associated with the target rectangle to distinguish the correspondence of the target rectangles for object tracking, thus generating the object tracking target rectangle result at time T2 (including the newly added object tracker tracking the newly detected object in T2). If the tracked object is occluded at time T3, the object must continue to be found and tracked (to avoid IDSwitch).

[0109] Model input: Raw image data in RGB format; Model output: The coordinates of the top left and bottom right corners of the face in the image.

[0110] like Figure 6 As shown, the camera captures the raw video stream and sends it to the gateway: the IPC encapsulates the captured video data according to the RTP protocol and sends it to the gateway through the established TCP connection; the gateway forwards the raw video stream to the video data leakage prevention system: the gateway directly forwards TCP packets to the video data leakage prevention system; the video data leakage prevention system sends a request to the hardware encryption card to generate an encryption key; the hardware encryption card calls the hardware accelerator interface to generate a true random number. The hardware encryption card sets the generated random number into key slot Keyslot3 as the video encryption key Key1; the hardware encryption card caches Key1; the hardware encryption card returns a status indicating that the encryption key generation and setting were successful; the video data leakage prevention system sends a request to the hardware encryption card to generate a signature key; the hardware encryption card calls the hardware accelerator interface to generate a true random number again. The hardware encryption card sets the generated random number into key slot Keyslot4 as the signature key Key2; the hardware encryption card caches Key2; the hardware encryption card returns a status indicating that the signature key generation and setting were successful; the video data leakage prevention system sends a request to the hardware encryption card to encrypt the video data using the SM4 algorithm and key Key1. The hardware encryption card encrypts the incoming video data using Keyslot3; the hardware encryption card caches the encrypted video data; the hardware encryption card returns the encrypted video data to the video data leakage prevention system; the video data leakage prevention system caches the encrypted video data; the video data leakage prevention system requests the hardware encryption card to calculate the SM4 CMAC of the encrypted video data using the signature key Key2; the hardware encryption card calculates the SM4 CMAC of the cached encrypted video data using the key2 key in Keyslot4; the hardware encryption card returns the SM4 CMAC value of the encrypted video data; the video data leakage prevention system caches the CMAC of the encrypted video data; the video data leakage prevention system encrypts and protects Key1 / Key2 with the hardware encryption card using the SM4 algorithm and the KEK_Key key.

[0111] The hardware encryption card uses the SM4 algorithm and KEK_Key key to protect the encryption of Key1 / Key2; the hardware encryption card returns the encrypted key data KeyData; the video data leakage prevention system inserts KeyData and the cached CMAC value into the SEI field of the video stream; the video data leakage prevention system sends the processed encrypted video stream and SEI data to the network video recording NVR and requests saving.

[0112] The network video recording system stores the processed video stream; the network video recording system then returns the storage results to the video data leakage prevention system.

[0113] like Figure 7 As shown, the steps for a regular monitoring staff member to view surveillance video are as follows:

[0114] The user clicks to play the surveillance video; the video data leakage prevention system pops up an authentication window, requiring the user to insert a security USB key and enter a PIN code; the user inserts the USB key and enters their PIN code; the video data leakage prevention system sends the user's PIN code to the security USB key, requesting user authentication; the security USB key verifies the user's PIN code; the security USB key returns the user authentication result and user permissions to the video data leakage prevention system; the video data leakage prevention system requests a random number from the hardware encryption card; the hardware encryption card generates a random number; the hardware encryption card sends the random number to the video data leakage prevention system; the video data leakage prevention system sends the random number to the security USB key; the security USB key signs the received random number and the device ID of the encryption card bound to the security USB key using an SM2 private key; the security USB key combines the random number, the device ID of the encryption card bound to the security USB key, the signature value, and the root certificate issuance security... The U-shield certificate is concatenated to form device authentication data; the secure U-shield sends the device authentication data to the video data leakage prevention system; the video data leakage prevention system sends the device authentication data to the hardware encryption card to initiate device authentication; the hardware encryption card uses a pre-set root certificate to verify the secure U-shield's certificate; the hardware encryption card uses the public key in the secure U-shield's certificate to verify the signature value in the authentication data; the hardware encryption card compares the random number with the encryption card's device ID; the hardware encryption card returns the device authentication result to the video data leakage prevention system; the video data leakage prevention system obtains encrypted video data from the network video recording NVR; the NVR returns encrypted video data and SEI data; the video data leakage prevention system sends the encrypted video data and SEI data to the hardware encryption card to request decoding of the video data; the hardware encryption card uses a pre-set KEK_Key and SM4 algorithm to decrypt the SEI data.The video encryption key Key1 and signature key Key2 are recovered; the hardware encryption card sets the video encryption key Key1 into key slot 5 to decrypt the video; the hardware encryption card sets the signature key Key2 into key slot 6 to verify the signature; the hardware encryption card uses SM4. CMAC and Keyslot6 verify the signature of the encrypted video; the hardware encryption card uses SM4 and Keyslot to decrypt the encrypted video; the hardware encryption card sends the decrypted video data to the video data leakage prevention system; the video data leakage prevention system decodes the video data to restore the original YUV format data of the video frames; the video data leakage prevention system converts the original YUV format data of the video frames into RGB format; the RGB format video data of the video data leakage prevention system calls the AI ​​face recognition model; the AI ​​face recognition model automatically labels faces; the AI ​​face recognition model returns the coordinates of the top left and bottom right corners of all faces in the original data to the video data leakage prevention system; the video data leakage prevention system uses a color block filling algorithm to irreversibly gray-cover the original pixel YUV values ​​of the face areas given by the AI ​​face recognition model for desensitization processing; the video data leakage prevention system re-encodes the original video frame data after face desensitization processing into H.264; the video data leakage prevention system sends the desensitized video to a large screen; ordinary monitoring personnel view the desensitized monitoring video on the large screen.

[0115] like Figure 8 As shown, the steps for a system administrator to view surveillance videos are as follows:

[0116] The user clicks to play the surveillance video; the video data leakage prevention system pops up an authentication window, requiring the user to insert a recovery USB key and enter a PIN code; the user inserts the USB key and enters their PIN code; the video data leakage prevention system sends the user's PIN code to the recovery USB key, requesting user authentication; the recovery USB key verifies the user's PIN code; the recovery USB key returns the user authentication result and user permissions to the video data leakage prevention system; the video data leakage prevention system requests a random number from the hardware encryption card; the hardware encryption card generates a random number; the hardware encryption card sends the random number to the video data leakage prevention system; the video data leakage prevention system sends the random number to the recovery USB key; the recovery USB key signs the received random number and the device ID of the encryption card bound to the recovery USB key using the SM2 private key; the recovery USB key then returns the random number, the device ID of the encryption card bound to the recovery USB key, the signature value, and the root certificate issued by the recovery USB key. The U-Shield certificate is concatenated to form device authentication data; the restored U-Shield sends the device authentication data to the video data leakage prevention system; the video data leakage prevention system sends the device authentication data to the hardware encryption card to initiate device authentication; the hardware encryption card uses a pre-set root certificate to verify the restored U-Shield certificate; the hardware encryption card uses the public key in the restored U-Shield certificate to verify the signature value in the authentication data; the hardware encryption card compares the random number with the encryption card device ID; the hardware encryption card returns the device authentication result to the video data leakage prevention system; the video data leakage prevention system obtains encrypted video data from the network video recording (NVR); the NVR returns encrypted video data and SEI data; the video data leakage prevention system sends the encrypted video data (SEI data) to the hardware encryption card to request decoding of the video data; the hardware encryption card uses a pre-set KEK_Key and SM4 algorithm to decrypt the SEI data. The process involves: restoring the video encryption key Key1 and signature key Key2; the hardware encryption card setting the video encryption key Key1 into key slot 5 to decrypt the video; the hardware encryption card setting the signature key Key2 into key slot 6 to verify the signature; the hardware encryption card using SM4 CMAC and key slot 6 to verify the signature of the encrypted video; the hardware encryption card using SM4 and key slot 6 to decrypt the encrypted video; the hardware encryption card sending the decrypted video data to the video data leakage prevention system; the video data leakage prevention system sending the decrypted video to the large screen; and system administrators viewing the original, un-decrypted surveillance video on the large screen.

[0117] Video files are encrypted using the national standard SM4 CBC mode to protect their confidentiality.

[0118] To ensure the integrity of encrypted data files, the system introduces the CMAC digital signature mechanism. This mechanism allows monitoring personnel to definitively determine whether video data files were generated through legitimate encryption, effectively resisting security threats from attackers who forge or tamper with video data, and technically guaranteeing the integrity of the video data's origin.

[0119] Resistance to brute-force attacks: The SM4 algorithm uses a 128-bit key length, far exceeding the cracking capabilities of current mainstream attack methods. For example, with a brute-force attack, an attacker would need to attempt 2... 128 The SM4 algorithm has 200 possible key combinations, and even with the most advanced supercomputers, attempting all of them would take an enormous amount of time. From the perspective of computing resources and time costs, brute-force cracking is virtually an impossible task. Furthermore, the SM4 algorithm itself is highly complex; its round functions, permutation operations, and nonlinear transformations have undergone rigorous cryptographic analysis and verification, effectively resisting classic block cipher attacks such as differential analysis and linear analysis.

[0120] In summary, through multiple safeguards including high-strength encryption algorithms, digital signature verification, hardware encryption cards, and USB token authentication, the system forms a comprehensive security protection system in terms of confidentiality, integrity, and resistance to attacks, effectively resisting various common network attacks and security threats. Simultaneously, the use of AI models for automatic facial recognition and anonymization protects personal privacy information.

[0121] Based on national cryptographic algorithms, the system uses SM4 video encryption keys, signature keys, video protection gateways, and USB tokens to securely protect the security and integrity of surveillance videos. The video protection gateway reduces the workload of modifying traditional video surveillance systems while protecting personal privacy within the monitoring environment and enhancing the sense of security for the community. Furthermore, it can optimize algorithms for faster encryption and decryption, adapting to higher-resolution videos; make quantum algorithms more efficient and secure after key management and distribution are implemented; and combine with new technologies such as trusted execution environments to ensure greater security throughout the entire lifecycle of video data, further improving the security of video surveillance.

[0122] In one exemplary embodiment, such as Figure 9 As shown, a video surveillance protection device based on an AI desensitization model and national cryptographic algorithms is provided, including:

[0123] The video stream acquisition module is used to acquire video streams.

[0124] An encryption processing module is used to encrypt the video stream based on a hardware encryption card.

[0125] The authentication module is used to perform password authentication based on the obtained video stream viewing request and obtain the authentication result.

[0126] The decryption processing module is used to decrypt the encrypted video stream based on the hardware encryption card after the authentication result is successful.

[0127] The judgment module is used to determine whether to invoke the AI ​​de-identification model based on the monitoring permissions corresponding to the video stream viewing request.

[0128] The desensitization processing and display module is used to call the AI ​​desensitization model to desensitize the restored video stream obtained after decryption when the result of the judgment module output is yes, and then display and play the desensitized video data.

[0129] The display module is used to display and play the restored video stream after decryption when the result of the judgment module output is negative.

[0130] In one exemplary embodiment, a computer device is provided, which may be a server or a terminal, and its internal structure diagram may be as follows. Figure 10 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs in the non-volatile storage media to run. The database stores video surveillance protection data based on an AI-based de-identification model and national cryptographic algorithms. The I / O interfaces are used for information exchange between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a video surveillance protection method based on an AI-based de-identification model and national cryptographic algorithms.

[0131] Those skilled in the art will understand that Figure 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0132] In one exemplary embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0133] In one exemplary embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0134] In one exemplary embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0135] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0136] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0137] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0138] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0139] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A video surveillance protection method based on an AI desensitization model and national cryptographic algorithms, characterized in that, The video surveillance protection method based on the AI ​​desensitization model and national cryptographic algorithms is applied to the video surveillance protection system. The video surveillance protection system includes a video data leakage prevention system, which has a built-in hardware encryption card using national cryptographic algorithms, and an AI desensitization model built using a target tracking algorithm based on deep learning and data transformation. The national cryptographic algorithm adopts the SM4 algorithm CTR mode. The AI ​​desensitization model is used to desensitize facial data in the video so that the original facial features corresponding to the facial data cannot be reversed after desensitization. The video surveillance protection method based on the AI ​​desensitization model and national cryptographic algorithms includes: Acquire video stream; The video stream is encrypted using a hardware encryption card; Password authentication is performed based on the obtained video stream viewing request, and the authentication result is obtained; After the authentication result is successful, the encrypted video stream is decrypted based on the hardware encryption card. Based on the monitoring permissions corresponding to the video stream viewing request, determine whether to invoke the AI ​​de-identification model; If so, the AI ​​desensitization model is invoked to desensitize the restored video stream obtained after decryption, and the desensitized video data is displayed and played. If not, the decrypted and restored video stream will be displayed and played. Encrypting the video stream using a hardware encryption card specifically includes: The video data in the video stream is encrypted using a hardware encryption card. An SM4 video encryption key Key1 and an SM4 video signature key Key2 are randomly generated. The CMAC value is calculated on the encrypted video data to obtain the CMAC_R value. Based on the key protection key KEK_Key stored in the hardware encryption card, the SM4 video encryption key Key1 and the SM4 video signature key Key2 are encrypted to generate encrypted KeyData data.

2. The video surveillance protection method based on AI desensitization model and national cryptographic algorithm according to claim 1, characterized in that, After the authentication result is successful, the encrypted video stream is decrypted based on the hardware encryption card, specifically including: After the authentication result is successful, the encrypted KeyData data is decrypted based on the key protection key KEK_Key stored in the hardware encryption card to restore the SM4 video encryption key Key1 and SM4 video signature key Key2. Using the SM4 video signature key Key2, calculate the CMAC_V value of the encrypted video data and compare it with the CMAC_R value to obtain the comparison result. If the comparison results are the same, the encrypted video data is decrypted using the key protection key KEK_Key; If the comparison results are different, the encrypted video data has been tampered with, and an alarm will be triggered.

3. The video surveillance protection method based on AI desensitization model and national cryptographic algorithm according to claim 1, characterized in that, The video surveillance protection method based on the AI ​​desensitization model and national cryptographic algorithms also includes: The encrypted KeyData data and CMAC_R value are inserted into the SEI; the SEI is a component of the MPEG-4 video stream.

4. The video surveillance protection method based on AI desensitization model and national cryptographic algorithm according to claim 1, characterized in that, Password authentication is performed based on the obtained video stream viewing request, and the authentication result is obtained, specifically including: Based on the video stream viewing request, a random number is generated using a hardware encryption card; Based on the random number, a signature is obtained by signing using the SM2 private key; Based on the security USB key, the random number, the device ID of the encryption card bound to the security USB key, the signature value, and the security USB key certificate issued by the root certificate are concatenated to form device authentication data; Based on the hardware encryption card, device authentication is performed according to the device authentication data, and the certificate of the security U-shield is verified using the preset root certificate. The signature value in the authentication data is verified using the public key in the certificate of the security U-shield. The device authentication result is output by comparing the random number and the encryption card device ID, and the authentication result is obtained.

5. The video surveillance protection method based on AI desensitization model and national cryptographic algorithm according to claim 1, characterized in that, The AI ​​desensitization model is a model built on the CNN framework and using an anchor-based structural design. The AI ​​desensitization model is determined using a target tracking algorithm based on deep learning and data transformation; wherein the target tracking algorithm uses the SORT algorithm; and the data transformation uses an irreversible hash algorithm.

6. A video surveillance protection device based on an AI desensitization model and national cryptographic algorithms, characterized in that, include: The video stream acquisition module is used to acquire video streams; An encryption processing module is used to encrypt the video stream based on a hardware encryption card; The authentication module is used to perform password authentication based on the obtained video stream viewing request and obtain the authentication result; The decryption processing module is used to decrypt the encrypted video stream based on the hardware encryption card after the authentication result is successful. The judgment module is used to determine whether to invoke the AI ​​de-identification model based on the monitoring permissions corresponding to the video stream viewing request; The desensitization processing and display module is used to call the AI ​​desensitization model to desensitize the restored video stream obtained after decryption when the result of the judgment module output is yes, and then display and play the desensitized video data. The display module is used to display and play the restored video stream after decryption when the result of the module output is negative. Encrypting the video stream using a hardware encryption card specifically includes: The video data in the video stream is encrypted using a hardware encryption card. An SM4 video encryption key Key1 and an SM4 video signature key Key2 are randomly generated. The CMAC value is calculated on the encrypted video data to obtain the CMAC_R value. Based on the key protection key KEK_Key stored in the hardware encryption card, the SM4 video encryption key Key1 and the SM4 video signature key Key2 are encrypted to generate encrypted KeyData data.

7. A computer device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the video surveillance protection method based on the AI ​​desensitization model and national cryptographic algorithm as described in any one of claims 1-5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the video surveillance protection method based on the AI ​​desensitization model and national cryptographic algorithm as described in any one of claims 1-5.

9. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the video surveillance protection method based on the AI ​​desensitization model and national cryptographic algorithm as described in any one of claims 1-5.

Images