Quantum key-based terminal registration method and video monitoring system

Abstract

The invention relates to the technical field of information security and video monitoring, and particularly provides a terminal registration method based on a quantum key and a video monitoring system. According to the application, the quantum key synchronously distributed by the quantum key management server is utilized to directly drive the encryption and decryption operation in the registration authentication process, so that strong mutual trust identity authentication of the video monitoring terminal and the video management system is realized. According to the application, quantum key distribution and a terminal registration process are deeply fused, and identity authentication and use of a one-time pad key are combined into one, so that a brand-new strong-security registration mechanism without a static password can be provided. Through the mechanism, the credibility of the access behavior and the absolute security of the subsequent communication can be ensured from the registration source, so that the technical effect of improving the overall security level of the video monitoring system can be achieved.

Description

Technical Field

[0001] This application relates to the fields of information security and video surveillance technology, and in particular to a terminal registration method and video surveillance system based on quantum key distribution. Background Technology

[0002] Currently, the mainstream solution for video surveillance terminals to access video management systems is to use usernames and passwords for authentication. During production or deployment, video surveillance terminals typically have a fixed username and password set as authentication credentials in their local or network configuration files. During the registration process, the video surveillance terminal sends a connection request to the video management system, submitting the pre-set username and password. The video management system compares the received username and password with pre-stored credentials in its database. Only after successful verification is the video surveillance terminal allowed to complete registration, thereby gaining access to the video management system and uploading video streams.

[0003] However, during the interaction between video surveillance terminals and the video management system, usernames / passwords are extremely vulnerable to theft, brute-force attacks, or capture through network sniffing. This weakness in the static credential mechanism exacerbates the vulnerability of the entire authentication system. Once an attacker obtains legitimate credentials, they can easily impersonate a legitimate video surveillance terminal to illegally access the video management system. Subsequently, the attacker can inject forged video streams into the video management system or monitoring center to carry out a deception attack. This not only causes the video management system and monitoring center to lose their proper monitoring effectiveness but also leads to serious misjudgments by system administrators, potentially triggering major security incidents in critical areas such as security and transportation.

[0004] It is evident that the weak authentication mechanisms of existing technologies can lead to problems such as unauthorized access and video source forgery, significantly reducing the data credibility and information security of video streams. Summary of the Invention

[0005] The purpose of this application is to at least address one of the aforementioned technical deficiencies, particularly the problems of unauthorized access and video source forgery caused by weak authentication mechanisms in the prior art, which greatly reduce the data credibility and information security of video streams.

[0006] In a first aspect, embodiments of this application provide a terminal registration method based on quantum key distribution, applied to a video surveillance system, the video surveillance system including a video surveillance terminal, a quantum key management server, and a video management system; the method includes:

[0007] When terminal registration is required, the video surveillance terminal generates a session identifier for the registration session and generates a first key allocation request based on the session identifier.

[0008] The video surveillance terminal sends the first key allocation request to the quantum key management server;

[0009] In response to the first key allocation request, the quantum key management server determines the registered quantum key and generates a binding relationship between the registered quantum key and the session identifier carried in the first key allocation request; wherein, the registered quantum key and the session identifier correspond one-to-one.

[0010] The quantum key management server returns the registered quantum key to the video surveillance terminal;

[0011] The video surveillance terminal encrypts its own authentication information according to the registered quantum key to obtain terminal authentication information ciphertext, and generates a registration request according to the terminal authentication information ciphertext and the session identifier;

[0012] The video surveillance terminal sends the registration request to the video management system;

[0013] In response to the registration request, the video management system generates a first key acquisition request based on the session identifier carried in the registration request.

[0014] The video management system sends the first key acquisition request to the quantum key management server;

[0015] In response to the first key acquisition request, the quantum key management server queries each binding relationship based on the session identifier carried in the first key acquisition request to obtain the registered quantum key;

[0016] The quantum key management server returns the registered quantum key to the video management system;

[0017] The video management system decrypts the encrypted terminal authentication information carried in the registration request using the registration quantum key to obtain decrypted identity authentication information, and performs identity authentication on the video surveillance terminal based on the decrypted identity authentication information, and registers the terminal based on the terminal identity authentication result.

[0018] In some embodiments, the video management system authenticates the video surveillance terminal based on the decrypted identity authentication information, and registers the terminal according to the terminal identity authentication result, including:

[0019] The video management system compares and verifies the decrypted identity authentication information with the pre-stored legitimate terminal identity information;

[0020] If the comparison and verification pass, the video management system encrypts the platform authentication information of the system according to the registration quantum key to obtain the platform information ciphertext, and generates a registration response message based on the platform information ciphertext.

[0021] The video management system returns the registration response message to the video monitoring terminal;

[0022] The video surveillance terminal responds to the registration response message by decrypting the platform information ciphertext carried in the registration response message using the registration quantum key to obtain the decrypted platform authentication information. Based on the decrypted platform authentication information, it performs identity authentication on the video management system and accesses the video management system if the platform identity authentication is successful.

[0023] In some embodiments, the video surveillance terminal performs identity authentication on the video management system based on the authentication information from the decryption platform, including:

[0024] The video surveillance terminal compares and verifies the decryption platform authentication information with the pre-stored legitimate platform information. If the comparison and verification pass, the platform authentication is successful.

[0025] In some embodiments, after the video surveillance terminal is connected to the video management system, the system further includes:

[0026] The video surveillance terminal destroys the registered quantum key;

[0027] The quantum key management server destroys the registered quantum key;

[0028] The video management system destroys the registered quantum key.

[0029] In some embodiments, after the video surveillance terminal is connected to the video management system, the system further includes:

[0030] The video management system generates a second key allocation request based on the terminal identifier of the video surveillance terminal;

[0031] The video management system sends the second key allocation request to the quantum key management server;

[0032] The quantum key management server allocates a quantum key pool based on the terminal identifier carried in the second key allocation request;

[0033] The quantum key management server distributes the quantum key pool to the video surveillance terminal and the video management system respectively through the quantum key distribution network;

[0034] The video surveillance terminal determines the target quantum key in the locally maintained quantum key pool, and encrypts the collected raw video data according to the target quantum key to obtain video ciphertext information;

[0035] The video surveillance terminal sends the encrypted video information to the video management system;

[0036] The video management system determines the target quantum key from a locally maintained quantum key pool, and decrypts the video ciphertext information based on the target quantum key to obtain the original video data.

[0037] In some embodiments, after the video surveillance terminal encrypts the acquired raw video data according to the target quantum key to obtain ciphertext video information, it further includes:

[0038] The video surveillance terminal deletes the target quantum key from its locally maintained quantum key pool; or, the video surveillance terminal marks the target quantum key as obsolete in its locally maintained quantum key pool.

[0039] In some embodiments, after the video management system decrypts the video ciphertext information according to the target quantum key to obtain the original video data, it further includes:

[0040] The video management system deletes the target quantum key from its locally maintained quantum key pool; or, the video management system marks the target quantum key as obsolete in its locally maintained quantum key pool.

[0041] In some embodiments, the method further includes:

[0042] The video management system monitors the number of available keys in the locally maintained quantum key pool, and generates a third key allocation request based on the terminal identifier of the video monitoring terminal when the number of available keys is less than a preset threshold.

[0043] The video management system sends the third key allocation request to the quantum key management server;

[0044] In response to the third key allocation request, the quantum key management server reallocates the quantum key pool according to the terminal identifier carried in the third key allocation request;

[0045] The quantum key management server distributes the redistributed quantum key pool to the video surveillance terminal and the video management system respectively through the quantum key distribution network.

[0046] In some embodiments, the method further includes:

[0047] When the video management system detects that the video monitoring terminal is offline or disconnected, it generates a first key abandonment request based on the terminal identifier of the video monitoring terminal.

[0048] The video management system sends the first key discard request to the quantum key management server;

[0049] The quantum key management server determines the target quantum key pool based on the terminal identifier carried in the first key discard request, and discards the unused quantum keys in the target quantum key pool.

[0050] Secondly, embodiments of this application provide a video surveillance system based on the quantum key-based terminal registration method of any of the above embodiments, comprising: a video surveillance terminal, a quantum key management server, and a video management system; wherein:

[0051] The video surveillance terminal is used to generate a session identifier for a registration session when terminal registration is required, and to generate a first key allocation request based on the session identifier.

[0052] The video surveillance terminal is used to send the first key allocation request to the quantum key management server;

[0053] The quantum key management server is used to respond to the first key allocation request, determine the registered quantum key, and generate a binding relationship between the registered quantum key and the session identifier carried in the first key allocation request; wherein, the registered quantum key and the session identifier correspond one-to-one.

[0054] The quantum key management server is used to return the registered quantum key to the video surveillance terminal;

[0055] The video surveillance terminal is used to encrypt its own authentication information according to the registered quantum key to obtain terminal authentication information ciphertext, and generate a registration request according to the terminal authentication information ciphertext and the session identifier;

[0056] The video surveillance terminal is used to send the registration request to the video management system;

[0057] The video management system is used to respond to the registration request by generating a first key acquisition request based on the session identifier carried in the registration request;

[0058] The video management system is used to send the first key acquisition request to the quantum key management server;

[0059] The quantum key management server is used to respond to the first key acquisition request, query each binding relationship according to the session identifier carried in the first key acquisition request, and obtain the registered quantum key;

[0060] The quantum key management server is used to return the registered quantum key to the video management system;

[0061] The video management system is used to decrypt the encrypted terminal authentication information carried in the registration request according to the registration quantum key to obtain decrypted identity authentication information, and to authenticate the video surveillance terminal based on the decrypted identity authentication information, and to register the terminal according to the terminal identity authentication result.

[0062] In some embodiments of this application, a quantum key-based terminal registration method and video surveillance system are provided. The quantum keys synchronously distributed by a quantum key management server directly drive encryption and decryption operations during the registration and authentication process, achieving strong mutual trust and identity verification between the video surveillance terminal and the video management system. This application deeply integrates quantum key distribution with the terminal registration process and combines identity authentication with the use of a one-time key, thus providing a novel, password-free, and highly secure registration mechanism. This mechanism ensures the trustworthiness of access behavior and the absolute security of subsequent communication from the registration source, thereby achieving the technical effect of improving the overall security level of the video surveillance system. Attached Figure Description

[0063] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0064] Figure 1 This is one of the flowcharts of a quantum key-based terminal registration method in some embodiments;

[0065] Figure 2 This is a second schematic diagram of a quantum key-based terminal registration method in some embodiments. Detailed Implementation

[0066] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0067] The technical terms used in this application are explained below:

[0068] Video surveillance terminal: Devices responsible for collecting and encoding video data, such as cameras and network video recorders.

[0069] Video Management System (VMS) is a centralized video surveillance management platform responsible for receiving, storing, and managing video streams.

[0070] Quantum Key Management Server (Q-KMS) is a dedicated server for managing truly random keys generated by a quantum key distribution network. Q-KMS is responsible for receiving, storing, and processing quantum random numbers, and synchronously distributing keys to designated video surveillance terminals and video management platforms based on business logic (such as terminal registration and authentication). It serves as a bridge connecting the underlying security resources of the quantum key distribution network with upper-layer video application services.

[0071] Secure registration refers to the process by which video surveillance terminals and video management systems conduct two-way identity authentication and establish a secure association based on quantum keys. This process is a prerequisite for accessing the network and using services.

[0072] One-Time Pad (OTP) is a cryptographic algorithm that is theoretically proven to be absolutely secure. This algorithm requires that the key be truly random, the same length as the plaintext, and used only once.

[0073] The quantum key-based terminal registration method involved in this application is described below.

[0074] In some embodiments, this application provides a terminal registration method based on quantum key distribution, which can be applied to a video surveillance system. Specifically, the video surveillance system may include a video surveillance terminal, a quantum key management server (Q-KMS), and a video management system (VMS), all connected to each other to achieve data transmission and interaction. In some examples, the video surveillance terminal and the Q-KMS can transmit data via a quantum key distribution (QKD) link, and the video surveillance terminal and the VMS can transmit data via an IP (Internet Protocol) network. A secure management interface may be provided between the Q-KMS and the VMS, through which they can transmit data.

[0075] like Figure 1 As shown, the method provided in this application may include the following steps:

[0076] S102: When the video surveillance terminal needs to register, it generates a session identifier for the registration session and generates a first key allocation request based on the session identifier.

[0077] In this step, the video surveillance terminal first determines whether terminal registration is required. Terminal registration refers to the process by which a video surveillance terminal establishes a legitimate communication identity when it first connects to or reconnects to the video management system. It can be understood that the video surveillance terminal can determine whether the terminal registration process is necessary based on the actual situation; for example, the video surveillance terminal can determine that terminal registration is required when it detects that it has been powered on.

[0078] When a terminal registration request is detected, the video surveillance terminal can automatically perform a session initialization operation to generate a session ID for this registration session. The session ID uniquely identifies the registration session; that is, different registration sessions correspond to different session IDs. It can be understood that the video surveillance terminal can generate the session ID for this registration session in any way. For example, it can use a combination of a timestamp and a random number, or it can select from a set of pre-defined session IDs according to preset selection rules.

[0079] When a session identifier is generated, the video surveillance terminal can use it to generate a first key allocation request, in order to apply to Q-KMS for a quantum key specific to this registration session using the session identifier of this registration session. It can be understood that the first key allocation request carries the session identifier of this registration session.

[0080] S104: The video surveillance terminal sends a first key allocation request to the quantum key management server.

[0081] In this step, the video surveillance terminal can send the first key allocation request in any way, and this application does not impose any specific restrictions on this.

[0082] S106: In response to the first key allocation request, the quantum key management server determines the registered quantum key and generates a binding relationship between the registered quantum key and the session identifier carried in the first key allocation request; wherein, the registered quantum key and the session identifier correspond one-to-one.

[0083] In this step, after receiving the first key allocation request from the video surveillance terminal, Q-KMS can allocate a quantum key for this registration session from the quantum key pool managed by Q-KMS. This quantum key is the registration quantum key described in this application, used for identity authentication between the video surveillance terminal and VMS during this registration session. Furthermore, Q-KMS can bind the registration quantum key to the session identifier of this registration session; for example, it can store the registration quantum key and the session identifier in a corresponding manner, or generate an association between the registration quantum key and the session identifier.

[0084] It's important to note that Q-KMS uses a one-time pad mechanism for key allocation. This means that Q-KMS assigns different registration quantum keys for different registration sessions on the same video surveillance terminal; similarly, it assigns different registration quantum keys for different registration sessions on different video surveillance terminals. This ensures that each registration uses a completely new and unused key, thus guaranteeing the security of the registration process.

[0085] S108: The quantum key management server returns the registered quantum key to the video surveillance terminal.

[0086] In this step, after determining the registration quantum key for this registration session, Q-KMS can return it to the video surveillance terminal. At this point, the video surveillance terminal obtains the password for this registration authentication.

[0087] S110: The video surveillance terminal encrypts its own authentication information using the registered quantum key to obtain the terminal authentication information ciphertext, and generates a registration request based on the terminal authentication information ciphertext and the session identifier.

[0088] In this step, the video surveillance terminal receives the registration quantum key returned by Q-KMS and uses this key to perform encrypted calculations on its own identity authentication information (such as a unique device identifier, feature code, etc.) to generate ciphertext of terminal authentication information. The video surveillance terminal can then generate a registration request based on the ciphertext of terminal authentication information and the session identifier, ensuring that the registration request carries the ciphertext of terminal authentication information and the session identifier, facilitating key lookup by VMS.

[0089] S112: The video surveillance terminal sends a registration request to the video management system.

[0090] In this step, the video surveillance terminal can send a registration request to the VMS in any way. For example, it can be sent via an IP network.

[0091] S114: In response to the registration request, the video management system generates a first key acquisition request based on the session identifier carried in the registration request.

[0092] In this step, after receiving the registration request from the video surveillance terminal, the VMS can apply to the Q-KMS for the quantum key corresponding to the registration session based on the session identifier carried in the registration request. Therefore, the VMS can generate a first key acquisition request based on the session identifier in the registration request, and then apply to the Q-KMS for the corresponding quantum key through the first key request.

[0093] S116: The video management system sends a first key acquisition request to the quantum key management server.

[0094] In this step, the video management system can send the first key acquisition request to Q-KMS in any way, such as via a QKD link or an IP network.

[0095] S118: The quantum key management server responds to the first key acquisition request by querying each binding relationship based on the session identifier carried in the first key acquisition request, and obtains the registered quantum key.

[0096] In this step, after receiving the first key acquisition request, Q-KMS can authenticate VMS. If authentication is successful, Q-KMS can return the quantum key that has been assigned to the video surveillance terminal and is bound to the session identifier carried in the first key acquisition request as the registration quantum key to VMS, thereby ensuring that the video surveillance terminal and VMS have the same quantum key.

[0097] S120: The quantum key management server returns the registered quantum key to the video management system.

[0098] In this step, Q-KMS can return the registered quantum key corresponding to the session identifier to VMS in any way.

[0099] S122: The video management system decrypts the encrypted terminal authentication information carried in the registration request based on the registered quantum key to obtain the decrypted identity authentication information, and performs identity authentication on the video surveillance terminal based on the decrypted identity authentication information, and registers the terminal based on the terminal identity authentication result.

[0100] In this step, VMS can verify the terminal using the acquired registration quantum key. Specifically, VMS can use the registration quantum key returned by Q-KMS to decrypt the ciphertext of the terminal authentication information carried in the registration request, obtaining plaintext data (i.e., decrypted identity authentication information). Subsequently, VMS can authenticate the legitimate identity of the video surveillance terminal based on the plaintext data to determine whether the video surveillance terminal is a legitimate terminal, and register the terminal based on the terminal identity authentication result.

[0101] In some examples, if the terminal authentication result fails, VMS can prohibit the video surveillance terminal from accessing VMS to avoid problems such as unauthorized access and video source forgery.

[0102] This application utilizes quantum keys synchronously distributed by a quantum key management server to directly drive encryption and decryption operations during the registration and authentication process, achieving strong mutual trust and identity verification between video surveillance terminals and the video management system. This application deeply integrates quantum key distribution with the terminal registration process and combines identity authentication with the use of a one-time key, thus providing a novel, password-free, and highly secure registration mechanism. Through this mechanism, the trustworthiness of access behavior and the absolute security of subsequent communication can be ensured from the registration source, thereby achieving the technical effect of improving the overall security level of the video surveillance system.

[0103] In some embodiments, the video management system authenticates the video surveillance terminal based on decrypted identity authentication information, and registers the terminal according to the authentication result, including:

[0104] Step A1: The video management system will compare and verify the decrypted identity authentication information with the pre-stored legitimate terminal identity information;

[0105] Step A3: If the comparison and verification pass, the video management system encrypts the platform authentication information of this system according to the registered quantum key to obtain the platform information ciphertext, and generates a registration response message based on the platform information ciphertext;

[0106] Step A5: The video management system returns a registration response message to the video surveillance terminal;

[0107] Step A7: The video surveillance terminal responds to the registration response message, decrypts the platform information ciphertext carried in the registration response message according to the registration quantum key, obtains the decrypted platform authentication information, and performs identity authentication on the video management system based on the decrypted platform authentication information. If the platform identity authentication is successful, the terminal accesses the video management system.

[0108] In this embodiment, during terminal verification, the VMS can compare the decrypted identity authentication information with the legitimate terminal identity information pre-stored in the database. If the decrypted identity authentication information is recorded in the database, it indicates that the video surveillance terminal is a legitimate terminal, and the comparison verification passes. If the decrypted identity authentication information is not recorded in the database, further judgment can be made or the comparison verification can be directly determined to have failed.

[0109] If the verification passes, to further ensure communication security, the VMS can send its platform authentication information to the video surveillance terminal for verification, achieving two-way authentication and further improving information security. During this process, the VMS can encrypt its platform authentication information using the registered quantum key, generating ciphertext platform information, and then generate a registration response message based on this ciphertext. It can be understood that the registration response message can carry data indicating successful terminal authentication and the ciphertext platform information.

[0110] Subsequently, VMS sends a registration response message to the video surveillance terminal. Upon receiving the registration response message, the video surveillance terminal responds by using the registration quantum key to decrypt the encrypted platform information carried in the registration response message, obtaining the decrypted platform authentication information. Next, the video surveillance terminal authenticates its identity with the video management system based on the decrypted platform authentication information, confirming the legitimacy of the video management system. Only when the platform identity authentication is successful will the video surveillance terminal connect to the video management system, thus completing the entire process of one-key secure registration and authentication, ensuring the security and trustworthiness of the entire access process.

[0111] In some embodiments, the video surveillance terminal authenticates the video management system based on the decryption platform authentication information, including: the video surveillance terminal compares and verifies the decryption platform authentication information with pre-stored legitimate platform information; if the comparison and verification pass, the platform authentication is successful.

[0112] In this embodiment, the video surveillance terminal can compare the plaintext data of the platform authentication information (i.e., decrypted platform authentication information) with the legitimate platform information pre-stored in the terminal. If the decrypted authentication information is recorded in the legitimate platform information, and the decrypted authentication information matches the information recorded in the legitimate platform information, it indicates that the video management system is a legitimate system, the platform authentication is successful, and the two-way authentication based on quantum keys is successful. If the decrypted authentication information is not recorded in the legitimate platform information, the platform authentication fails. If the platform authentication is successful, the video surveillance terminal can confirm the legitimacy of the video management system and securely access the video management system to complete the entire registration and authentication process. This two-way authentication mechanism greatly enhances the security of the video surveillance system, effectively preventing security threats such as unauthorized access and forged video sources, and providing a solid guarantee for the stable operation of the video surveillance system.

[0113] In some embodiments, after the video surveillance terminal is connected to the video management system, the system further includes:

[0114] The video surveillance terminal destroys the registered quantum key;

[0115] The quantum key management server destroys registered quantum keys;

[0116] The video management system destroys the registered quantum keys.

[0117] In this embodiment, after completing security authentication, the video surveillance terminal can establish secure communication with the VMS to access the VMS and complete the registration process. After successful registration, this application can destroy the quantum key used in this registration session to ensure one-time password protection, further improving information security. Subsequently, the video surveillance terminal can push video streams to the VMS.

[0118] In some embodiments, such as Figure 2 As shown, after the video surveillance terminal is connected to the video management system, the following steps are also included:

[0119] S202: The video management system generates a second key distribution request based on the terminal identifier of the video surveillance terminal;

[0120] S204: The video management system sends a second key allocation request to the quantum key management server;

[0121] S206: The quantum key management server allocates a quantum key pool based on the terminal identifier carried in the second key allocation request;

[0122] S208: The quantum key management server distributes the quantum key pool to the video surveillance terminal and the video management system respectively through the quantum key distribution network;

[0123] S210: The video surveillance terminal determines the target quantum key in the locally maintained quantum key pool, and encrypts the collected raw video data according to the target quantum key to obtain the video ciphertext information;

[0124] S212: The video surveillance terminal sends encrypted video information to the video management system;

[0125] S214: The video management system determines the target quantum key in the locally maintained quantum key pool, and decrypts the video ciphertext information according to the target quantum key to obtain the original video data.

[0126] Specifically, after a video surveillance terminal is connected to a VMS, it can push video streams to the VMS. To further ensure the security of video data and prevent data leakage, the video surveillance terminal can use a quantum key pool to encrypt the raw video data it acquires. The VMS can then decrypt the received encrypted video information using the same quantum key pool.

[0127] In this embodiment, after successful registration, the VMS, on behalf of the video surveillance terminal, can apply to the Q-KMS for a large-capacity quantum key pool dedicated to subsequent video stream encryption. During the application process, the VMS can generate a second key allocation request, which carries information such as the terminal identifier of the video surveillance terminal, so that the Q-KMS can identify the ownership of the quantum key pool. After receiving the second key allocation request, the Q-KMS can allocate a brand-new quantum key pool from the quantum resource pool, independent of the registration session, and securely and synchronously distribute the quantum key pool to the video surveillance terminal and the VMS via the QKD link. It should be noted that this quantum key pool is dedicated to this video surveillance terminal-VMS pair, and this quantum key pool may include multiple quantum keys.

[0128] After receiving the quantum key pool distributed by Q-KMS, the video surveillance terminal can store the quantum key pool locally and maintain the usage status of each quantum key in the quantum key pool locally. Similarly, after receiving the quantum key pool distributed by Q-KMS, VMS can store the quantum key pool locally and maintain the usage status of each quantum key in the quantum key pool locally.

[0129] During the encryption process, the video surveillance terminal can determine the target quantum key from its locally stored dedicated key pool according to a preset key selection rule (such as a first-in, first-out rule), and use the target quantum key to encrypt the original video data to obtain the encrypted video information. For example, the video surveillance terminal can use frames as encryption units for data encryption.

[0130] In some examples, the target quantum key can have a key length equal to or slightly longer than the original video data. In other examples, the video surveillance terminal can perform a bitwise XOR operation between the target quantum key and the original video data to obtain the encrypted video information.

[0131] After generating encrypted video information, the video surveillance terminal can send the encrypted video stream data packets to the VMS via, for example, an IP network. During this transmission, the video surveillance terminal and the VMS can use any streaming media protocol for data transmission, including but not limited to RTP (Real-time Transport Protocol) or RTSP (Real-Time Streaming Protocol).

[0132] After receiving encrypted video stream data packets, VMS can select a target quantum key from a dedicated key pool stored locally in VMS and synchronized with the video surveillance terminal, according to the same key selection rules. The target quantum key is then used to decrypt the received encrypted video information, thereby restoring the original video data.

[0133] In some embodiments, after the video surveillance terminal encrypts the acquired raw video data according to the target quantum key to obtain the ciphertext video information, it further includes:

[0134] The video surveillance terminal deletes the target quantum key from the locally maintained quantum key pool; or, the video surveillance terminal marks the target quantum key as obsolete in the locally maintained quantum key pool.

[0135] Specifically, the video surveillance terminal can locally destroy and manage the keys in the quantum key pool. After each use of a quantum key, the video surveillance terminal can securely delete the quantum key from the local key pool or mark it as obsolete, ensuring the absolute one-time use of the quantum key to further improve data security.

[0136] In some embodiments, after the video management system decrypts the video ciphertext information according to the target quantum key to obtain the original video data, it further includes:

[0137] The video management system deletes the target quantum key from the locally maintained quantum key pool; or, the video management system marks the target quantum key as obsolete in the locally maintained quantum key pool.

[0138] Specifically, VMS can destroy and manage keys in the quantum key pool locally within the system. After each use of a quantum key, VMS can securely delete the quantum key from the local key pool or mark it as obsolete, ensuring the absolute one-time use of the quantum key to further improve data security.

[0139] In some embodiments, the method provided in this application may further include the following steps:

[0140] Step B1: The video management system monitors the number of available keys in the locally maintained quantum key pool, and generates a third key allocation request based on the terminal identifier of the video monitoring terminal when the number of available keys is less than a preset threshold.

[0141] Step B3: The video management system sends a third key allocation request to the quantum key management server;

[0142] Step B5: In response to the third key allocation request, the quantum key management server reallocates the quantum key pool according to the terminal identifier carried in the third key allocation request;

[0143] Step B7: The quantum key management server distributes the redistributed quantum key pool to the video surveillance terminal and the video management system through the quantum key distribution network.

[0144] In this embodiment, VMS can monitor the number of available keys remaining in the local key pool and, before the available keys are exhausted, initiate a request to Q-KMS to redistribute the key pool in order to dynamically replenish new quantum keys and ensure continuous encrypted communication capabilities.

[0145] It is understood that the specific value of the preset threshold can be determined according to the actual situation, and this application does not impose specific restrictions on it. The specific process of steps B1 to B7 can be referred to the above description of steps S202 to S208, and will not be repeated here.

[0146] In some embodiments, the method provided in this application may further include the following steps:

[0147] When the video management system detects that a video monitoring terminal is offline or disconnected, it generates a first key abandonment request based on the terminal identifier of the video monitoring terminal.

[0148] The video management system sends a first key revocation request to the quantum key management server;

[0149] The quantum key management server determines the target quantum key pool based on the terminal identifier carried in the first key discard request, and discards the unused quantum keys in the target quantum key pool.

[0150] In this embodiment, when a video surveillance terminal goes offline or disconnects, the VMS can notify the Q-KMS, causing the Q-KMS to discard all unused keys in the terminal's dedicated key pool and release related resources. When the video surveillance terminal re-registers, the Q-KMS will reallocate a completely new key pool for the video surveillance terminal-VMS pair. This achieves secure communication termination and further enhances data security.

[0151] The video surveillance system provided in the embodiments of this application is described below. The method steps performed by the video surveillance system described below can be referred to and corresponded to the terminal registration method based on quantum key described above.

[0152] In some embodiments, this application provides a video surveillance system based on the quantum key-based terminal registration method described in any of the above embodiments. The video surveillance system includes: a video surveillance terminal, a quantum key management server, and a video management system. Wherein:

[0153] The video surveillance terminal is used to generate a session identifier for a registration session when terminal registration is required, and to generate a first key allocation request based on the session identifier.

[0154] The video surveillance terminal is used to send the first key allocation request to the quantum key management server;

[0155] The quantum key management server is used to respond to the first key allocation request, determine the registered quantum key, and generate a binding relationship between the registered quantum key and the session identifier carried in the first key allocation request; wherein, the registered quantum key and the session identifier correspond one-to-one.

[0156] The quantum key management server is used to return the registered quantum key to the video surveillance terminal;

[0157] The video surveillance terminal is used to encrypt its own authentication information according to the registered quantum key to obtain terminal authentication information ciphertext, and generate a registration request according to the terminal authentication information ciphertext and the session identifier;

[0158] The video surveillance terminal is used to send the registration request to the video management system;

[0159] The video management system is used to respond to the registration request by generating a first key acquisition request based on the session identifier carried in the registration request;

[0160] The video management system is used to send the first key acquisition request to the quantum key management server;

[0161] The quantum key management server is used to respond to the first key acquisition request, query each binding relationship according to the session identifier carried in the first key acquisition request, and obtain the registered quantum key;

[0162] The quantum key management server is used to return the registered quantum key to the video management system;

[0163] The video management system is used to decrypt the encrypted terminal authentication information carried in the registration request according to the registration quantum key to obtain decrypted identity authentication information, and to authenticate the video surveillance terminal based on the decrypted identity authentication information, and to register the terminal according to the terminal identity authentication result.

[0164] The aforementioned video surveillance system utilizes quantum keys synchronously distributed by a quantum key management server to directly drive encryption and decryption operations during the registration and authentication process, achieving strong mutual trust and identity verification between the video surveillance terminal and the video management system. This application deeply integrates quantum key distribution with the terminal registration process and combines identity authentication with the use of a one-time key, thus providing a novel, password-free, and highly secure registration mechanism. This mechanism ensures the trustworthiness of access behavior and the absolute security of subsequent communication from the registration source, thereby achieving the technical effect of improving the overall security level of the video surveillance system.

[0165] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. In this document, "a," "an," "the," "the," and "its" may also include plural forms unless the context clearly indicates otherwise. "Multiple" refers to at least two, such as 2, 3, 5, or 8, etc. "And / or" includes any and all combinations of the related listed items.

[0166] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can be referred to each other.

[0167] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A terminal registration method based on quantum key distribution, characterized in that, The method is applied to a video surveillance system, which includes a video surveillance terminal, a quantum key management server, and a video management system; the method includes: When terminal registration is required, the video surveillance terminal generates a session identifier for the registration session and generates a first key allocation request based on the session identifier. The video surveillance terminal sends the first key allocation request to the quantum key management server; In response to the first key allocation request, the quantum key management server determines the registered quantum key and generates a binding relationship between the registered quantum key and the session identifier carried in the first key allocation request; wherein, the registered quantum key and the session identifier correspond one-to-one. The quantum key management server returns the registered quantum key to the video surveillance terminal; The video surveillance terminal encrypts its own authentication information according to the registered quantum key to obtain terminal authentication information ciphertext, and generates a registration request according to the terminal authentication information ciphertext and the session identifier; The video surveillance terminal sends the registration request to the video management system; In response to the registration request, the video management system generates a first key acquisition request based on the session identifier carried in the registration request. The video management system sends the first key acquisition request to the quantum key management server; In response to the first key acquisition request, the quantum key management server queries each binding relationship based on the session identifier carried in the first key acquisition request to obtain the registered quantum key; The quantum key management server returns the registered quantum key to the video management system; The video management system decrypts the encrypted terminal authentication information carried in the registration request using the registration quantum key to obtain decrypted identity authentication information, and performs identity authentication on the video surveillance terminal based on the decrypted identity authentication information, and registers the terminal based on the terminal identity authentication result.

2. The method according to claim 1, characterized in that, The video management system authenticates the video surveillance terminal based on the decrypted identity authentication information, and registers the terminal according to the authentication result, including: The video management system compares and verifies the decrypted identity authentication information with the pre-stored legitimate terminal identity information; If the comparison and verification pass, the video management system encrypts the platform authentication information of the system according to the registration quantum key to obtain the platform information ciphertext, and generates a registration response message based on the platform information ciphertext. The video management system returns the registration response message to the video monitoring terminal; The video surveillance terminal responds to the registration response message by decrypting the platform information ciphertext carried in the registration response message using the registration quantum key to obtain the decrypted platform authentication information. Based on the decrypted platform authentication information, it performs identity authentication on the video management system and accesses the video management system if the platform identity authentication is successful.

3. The method according to claim 2, characterized in that, The video surveillance terminal performs identity authentication on the video management system based on the authentication information from the decryption platform, including: The video surveillance terminal compares and verifies the decryption platform authentication information with the pre-stored legitimate platform information. If the comparison and verification pass, the platform authentication is successful.

4. The method according to claim 2, characterized in that, After the video surveillance terminal is connected to the video management system, the system further includes: The video surveillance terminal destroys the registered quantum key; The quantum key management server destroys the registered quantum key; The video management system destroys the registered quantum key.

5. The method according to any one of claims 2 to 4, characterized in that, After the video surveillance terminal is connected to the video management system, the system further includes: The video management system generates a second key allocation request based on the terminal identifier of the video surveillance terminal; The video management system sends the second key allocation request to the quantum key management server; The quantum key management server allocates a quantum key pool based on the terminal identifier carried in the second key allocation request; The quantum key management server distributes the quantum key pool to the video surveillance terminal and the video management system respectively through the quantum key distribution network; The video surveillance terminal determines the target quantum key in the locally maintained quantum key pool, and encrypts the collected raw video data according to the target quantum key to obtain video ciphertext information; The video surveillance terminal sends the encrypted video information to the video management system; The video management system determines the target quantum key from a locally maintained quantum key pool, and decrypts the video ciphertext information based on the target quantum key to obtain the original video data.

6. The method according to claim 5, characterized in that, After the video surveillance terminal encrypts the acquired raw video data according to the target quantum key to obtain the ciphertext video information, it also includes: The video surveillance terminal deletes the target quantum key from its locally maintained quantum key pool; or, the video surveillance terminal marks the target quantum key as obsolete in its locally maintained quantum key pool.

7. The method according to claim 5, characterized in that, After the video management system decrypts the video ciphertext information according to the target quantum key to obtain the original video data, it further includes: The video management system deletes the target quantum key from its locally maintained quantum key pool; or, the video management system marks the target quantum key as obsolete in its locally maintained quantum key pool.

8. The method according to claim 7, characterized in that, The method further includes: The video management system monitors the number of available keys in the locally maintained quantum key pool, and generates a third key allocation request based on the terminal identifier of the video monitoring terminal when the number of available keys is less than a preset threshold. The video management system sends the third key allocation request to the quantum key management server; In response to the third key allocation request, the quantum key management server reallocates the quantum key pool according to the terminal identifier carried in the third key allocation request; The quantum key management server distributes the redistributed quantum key pool to the video surveillance terminal and the video management system respectively through the quantum key distribution network.

9. The method according to claim 5, characterized in that, The method further includes: When the video management system detects that the video monitoring terminal is offline or disconnected, it generates a first key abandonment request based on the terminal identifier of the video monitoring terminal. The video management system sends the first key discard request to the quantum key management server; The quantum key management server determines the target quantum key pool based on the terminal identifier carried in the first key discard request, and discards the unused quantum keys in the target quantum key pool.

10. A video surveillance system based on the quantum key-based terminal registration method according to any one of claims 1 to 9, characterized in that, include: Video surveillance terminals, quantum key management servers, and video management systems; among which: The video surveillance terminal is used to generate a session identifier for a registration session when terminal registration is required, and to generate a first key allocation request based on the session identifier. The video surveillance terminal is used to send the first key allocation request to the quantum key management server; The quantum key management server is used to respond to the first key allocation request, determine the registered quantum key, and generate a binding relationship between the registered quantum key and the session identifier carried in the first key allocation request; wherein, the registered quantum key and the session identifier correspond one-to-one. The quantum key management server is used to return the registered quantum key to the video surveillance terminal; The video surveillance terminal is used to encrypt its own authentication information according to the registered quantum key to obtain terminal authentication information ciphertext, and generate a registration request according to the terminal authentication information ciphertext and the session identifier; The video surveillance terminal is used to send the registration request to the video management system; The video management system is used to respond to the registration request by generating a first key acquisition request based on the session identifier carried in the registration request; The video management system is used to send the first key acquisition request to the quantum key management server; The quantum key management server is used to respond to the first key acquisition request, query each binding relationship according to the session identifier carried in the first key acquisition request, and obtain the registered quantum key; The quantum key management server is used to return the registered quantum key to the video management system; The video management system is used to decrypt the encrypted terminal authentication information carried in the registration request according to the registration quantum key to obtain decrypted identity authentication information, and to authenticate the video surveillance terminal based on the decrypted identity authentication information, and to register the terminal according to the terminal identity authentication result.

Images