Video encryption method, electronic device, storage medium and program product
By generating random root keys and regional master keys, the video encryption method solves the problem of encryption keys being vulnerable to attack and unrecoverable in existing technologies, and achieves highly secure video encryption and decryption process management.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-25
- Publication Date
- 2026-03-24
AI Technical Summary
In existing video encryption methods, the encryption key is easily obtained by attackers, posing a security risk. Furthermore, the encryption key is strongly coupled with the video file, making it irreparable once leaked.
Multiple regional master keys and service encryption keys are generated using a random number root key. The corresponding key is obtained through the video region address for encryption. The key is updated periodically on the server side and stored in the hardware security module. The service encryption key becomes invalid after successful decryption.
It enables full-process management of key generation, transmission, and destruction, decoupling the key generation and encryption processes, improving the security of video encryption, and preventing the spread of video files after key leakage.
Smart Images
Figure CN121728286A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of computer, in particular to a video encryption method, an electronic device, a storage medium and a program product. BACKGROUND
[0002] In the process of encrypting a video, the existing video encryption method such as the video standard encryption and playing in m3u8 format generates an encryption key when generating an m3u8 file, writes the encryption key in the m3u8 file, uses an EXT-X-KEY label to realize the encryption of the video, or stores the encryption key in a server, changes the EXT-X-KEY in the m3u8 file into a link, and obtains the encryption key stored in the server by accessing the link. However, no matter which of the above methods, there are defects.
[0003] Firstly, in the first method, the encryption key written in the file can be easily obtained, the transmission of the encryption key using the network link is also easy to be obtained by attackers, and there is a great security risk.
[0004] Secondly, the encryption method has strong coupling between the encryption key of the video and the video file itself, the leakage of the encryption key is equivalent to the leakage of the video file, and the encryption key is a static key. Once the key is leaked, there is no way to remedy. SUMMARY
[0005] The purpose of the embodiments of the present application is to provide a video encryption method, an electronic device, a storage medium and a program product to solve the above problems.
[0006] In order to achieve the above purpose, the first aspect of the present application provides a video encryption method, comprising: generating a random number root key in response to a video encryption instruction; generating a plurality of region master keys and a plurality of service encryption keys corresponding to each region master key based on the random number root key; obtaining the corresponding region master key and the corresponding service encryption key through the region address of the video to be encrypted; encrypting the video to be encrypted through the service encryption key corresponding to the region address of the video to be encrypted, and generating a corresponding video encryption key after the video to be encrypted is encrypted, wherein the video encryption key is used to decrypt the encrypted video.
[0007] In the embodiments of the present application, the step of generating a plurality of region master keys and a plurality of service encryption keys corresponding to each region master key based on the random number root key comprises: obtaining an encryption string of each region address; generating region master keys corresponding to a plurality of region addresses based on the random number root key and the encryption string; generating a plurality of corresponding service encryption keys and a corresponding key pool based on the region master key, and storing the plurality of service encryption keys in the key pool.
[0008] In the embodiments of the present application, the step of obtaining the corresponding regional master key and the corresponding service encryption key through the regional address of the video to be encrypted comprises: obtaining the regional address of the video to be encrypted; obtaining the regional master key corresponding to the regional address based on the regional address of the video to be encrypted; and obtaining the service encryption key in the key pool corresponding to the regional master key.
[0009] In the embodiments of the present application, after the step of encrypting the video to be encrypted through the service encryption key corresponding to the regional address of the video to be encrypted and generating the corresponding video encryption key after the video to be encrypted is encrypted, the method further comprises: generating a buffer pool corresponding to the key pool of the regional master key; and transferring the service encryption key corresponding to the video encryption key from the key pool to the buffer pool.
[0010] In the embodiments of the present application, the video encryption method further comprises: storing the video encryption key and the encrypted video on the server side; and updating the random number root key, the regional master key and the service encryption key on the server side once every preset update time length.
[0011] In the embodiments of the present application, the video encryption method further comprises: in response to the number of access requests of any regional address received in a preset request time length being greater than or equal to a preset security threshold, updating the random number root key, the regional master key and the service encryption key of the regional address.
[0012] In the embodiments of the present application, the random number root key, the regional master key and the service encryption key are stored in a hardware security module.
[0013] The second aspect of the present application provides a video decryption method, comprising: obtaining a video file to be decrypted and a video encryption key corresponding to the video file to be decrypted; decrypting the video file to be decrypted by using the video encryption key to obtain a corresponding service encryption key; obtaining a regional master key corresponding to the regional address of the video file to be decrypted based on the service encryption key; when the corresponding service encryption key can be matched in the buffer pool of the regional master key, using the service encryption key to decrypt the decrypted video file to be decrypted again to obtain a playable video file, and deleting the corresponding service encryption key in the buffer pool.
[0014] The third aspect of the present application provides an electronic device, comprising: a processor and a memory, the memory storing instructions; the processor calling the instructions in the memory to enable the electronic device to implement the video encryption method of any embodiment of the first aspect and the video decryption method of the second aspect.
[0015] The fourth aspect of this application provides a machine-readable storage medium storing instructions that, when executed by a processor, cause the processor to perform the video encryption method of any embodiment of the first aspect and the video decryption method of the second aspect.
[0016] The fifth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the video encryption method of any embodiment of the first aspect and the video decryption method of the second aspect.
[0017] The encrypted video obtained through the above technical solution achieves full-process management of key generation, transmission, and destruction. The root key and regional master key are only used for the generation of lower-level keys and do not participate in the specific encryption process. This decouples key generation from video encryption. Furthermore, the service encryption key becomes invalid after one successful decryption. If an attacker obtains the service encryption key through illegal means, it can also prevent the video file from being further disseminated, forming an effective remedial measure and greatly improving its security.
[0018] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description
[0019] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings: Figure 1 This illustration schematically shows an application environment diagram of the video encryption method according to an embodiment of this application; Figure 2 The schematic diagram illustrates a flow chart of a video encryption method according to an embodiment of this application; Figure 3 The illustration shows a flowchart of step S120 of the video encryption method according to an embodiment of the present application; Figure 4 The illustration shows a flowchart of step S130 of the video encryption method according to an embodiment of this application; Figure 5 This schematically illustrates a block diagram showing the structural relationship between the root key, the regional master key, and the service encryption key in a video encryption method according to an embodiment of this application. Figure 6 This schematic diagram illustrates the structure of the buffer pool and key pool of the video encryption method according to an embodiment of this application; Figure 7 The schematic diagram illustrates a flow chart of a video decryption method according to an embodiment of this application; Figure 8 This illustration schematically shows a flowchart illustrating the specific steps of the video decryption method according to an embodiment of this application when decrypting a video; Figure 9 The diagram illustrates the internal structure of a computer device according to an embodiment of this application. Detailed Implementation
[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.
[0021] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.
[0022] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.
[0023] The acquisition, transmission, storage, use, and processing of data in this application comply with relevant laws and regulations. Furthermore, it should be noted that certain software, components, models, and other existing industry solutions may be mentioned in the embodiments of this application. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.
[0024] The video encryption method provided in this application can be applied to, for example... Figure 1In the application environment shown, terminal 110 communicates with server 120 via a network. When terminal 110 requests encrypted video, server 120 responds to the video encryption command sent by terminal 110 and encrypts the video. Terminal 110 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices. Server 120 can be a standalone server or a server cluster consisting of multiple servers.
[0025] like Figure 2 As shown, in one embodiment of this application, a video encryption method is provided. This embodiment mainly applies this method to the above-mentioned... Figure 1 Taking server 120 as an example, the video encryption method in this embodiment includes the following steps: Step S110: In response to the video encryption command, a random root key is generated.
[0026] In this embodiment, when encrypting the received video to be encrypted according to the video encryption instruction, a random number generated by a random number generator is used as the root key for encrypting the video, so as to ensure the high confidentiality of the root key.
[0027] Step S120: Based on the random root key, generate multiple regional master keys and multiple service encryption keys corresponding to each regional master key.
[0028] like Figure 3 As shown, in some embodiments, step S120 includes steps S121 to S123.
[0029] In step S121, the encrypted string for each area address is obtained.
[0030] In step S122, a zone master key corresponding to multiple zone addresses is generated based on the random root key and the encryption string. The encryption string can be the encryption salt value of that zone address.
[0031] In step S123, based on the regional master key, multiple corresponding service encryption keys and corresponding key pools are generated, and the multiple service encryption keys are stored in the key pools.
[0032] In this embodiment, after obtaining the root key, the region address (e.g., a network address IP address) of the video to be encrypted is obtained according to the video encryption instructions. Based on this region address, the region master key is generated by combining the encryption salt value of the region address with the AES-256 encryption algorithm. That is, each region has an independent region master key, making the generated key regional and accessible only to users in specific regions or network segments, thereby improving key security.
[0033] Then, based on the regional master key for each region, multiple corresponding service encryption keys are generated and stored in a key pool. Simultaneously, each regional master key also generates a buffer pool corresponding to the key pool, used to load the service encryption key when decrypting the video. This decouples the regional master key from the service encryption key, thereby improving encryption security.
[0034] Step S130: Obtain the corresponding area master key and the corresponding service encryption key through the area address of the video to be encrypted.
[0035] like Figure 4 As shown, in some embodiments, step S130 includes steps S131 to S133.
[0036] In step S131, the region address of the video to be encrypted is obtained.
[0037] In step S132, the area master key of the corresponding area address is obtained based on the area address of the video to be encrypted.
[0038] In step S133, the service encryption key is obtained from the key pool corresponding to the regional master key.
[0039] Furthermore, prior to the video decryption in step S140, the video encryption method further includes steps S134 to S135.
[0040] In step S134, a buffer pool corresponding to the key pool of the regional master key is generated.
[0041] In step S135, the service encryption key corresponding to the video encryption key is transferred from the key pool to the buffer pool.
[0042] like Figure 5 and Figure 6 As shown, in this embodiment, the regional master keys corresponding to different regions of the root key RK are RMK1, RMK2, ..., RMKn, and each regional master key corresponds to multiple service encryption keys SEK1, SEK2, ..., SEKn.
[0043] When encrypting a video, first find the region master key of the area where the video encryption instruction is located, find the corresponding key pool based on the region master key, obtain the service encryption key at the top of the key pool, and then perform bidirectional encryption with the video file using the service encryption key.
[0044] Step S140: Encrypt the video to be encrypted using the service encryption key corresponding to the region address of the video to be encrypted, and generate a corresponding video encryption key after the video to be encrypted is encrypted. The video encryption key is used to decrypt the encrypted video. In this embodiment, after encryption is completed, a corresponding video encryption key (VEK) is generated based on the service encryption key, and the video encryption key is stored in the server. The service encryption key used for encryption is moved to the buffer pool, and the encrypted video file is stored in the server.
[0045] Furthermore, in the video encryption method of this application embodiment, the video encryption key and the encrypted video are stored on the server. After the corresponding video encryption key is generated after encrypting the video to be encrypted, the server updates the random root key, the regional master key and the service encryption key every time a preset update time is elapsed. Even if the key is leaked, there is no need to worry about the leakage of the video file.
[0046] In this embodiment, the preset update duration can be set to 10 minutes, 20 minutes, 30 minutes, or 60 minutes, etc. The key is updated once after each preset update duration to ensure the security of the key.
[0047] Furthermore, when multiple access requests for decrypted videos are received within a short period of time, in response to the fact that the number of access requests received from any area address within a preset request duration is greater than or equal to a preset security threshold, the random root key, area master key, and service encryption key of that area address are updated.
[0048] For example, if dozens or hundreds of access requests are received within 1 minute for a certain area master key or service encryption key in the key pool, they are identified as abnormal traffic, and the random root key, area master key, and service encryption key of that area address are updated to avoid the risk of key leakage.
[0049] Specifically, in this application embodiment, the random number root key, the area master key, and the service encryption key are stored in a hardware security module. This hardware security module can be a server or similar device used to store key data. By storing the keys in the hardware security module, and transmitting the keys directly through physical hardware, physical protection is achieved. Compared to network transmission protocols such as HTTP and UDP, hardware transmission offers better security and reduces the possibility of key leakage.
[0050] The encrypted video obtained by the video encryption method of the above embodiments of this application realizes full-process management of key generation, transmission and destruction. The root key and regional master key are only used for the generation of lower-level keys and do not participate in the specific encryption process. This decouples key generation and video encryption. Furthermore, the service encryption key becomes invalid after one successful decryption. If an attacker obtains the service encryption key by illegal means, it can also prevent the video file from being further disseminated, forming an effective remedial measure and greatly improving its security.
[0051] It should be understood that, although Figure 2 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.
[0052] like Figure 7 As shown, this application also provides a video decryption method, which includes the following steps: Step S210: Obtain the video file to be decrypted and the video encryption key corresponding to the video file to be decrypted.
[0053] Step S220: Decrypt the video file to be decrypted using the video encryption key to obtain the corresponding service encryption key.
[0054] Step S230: Based on the service encryption key, obtain the region master key that corresponds to the region address of the video file to be decrypted.
[0055] Step S210: When a corresponding service encryption key can be matched in the buffer pool of the regional master key, the decrypted video file to be decrypted is decrypted again using the service encryption key to obtain a playable video file, and the corresponding service encryption key is deleted from the buffer pool.
[0056] like Figure 8 As shown in this embodiment, when it is necessary to play an encrypted video, the encrypted video is first decrypted.
[0057] First, the encrypted video file is retrieved from the server. Then, the video encryption key is requested and used to decrypt the video file, yielding the corresponding service encryption key. Next, the regional master key for the user's location is obtained. The system then checks the buffer pool corresponding to the regional master key to see if the obtained service encryption key exists in the buffer pool. If it exists, the video decryption is considered successful, and normal video playback begins. The service encryption key is then removed from the buffer pool. If it does not exist, the video decryption fails, and the process stops.
[0058] In this embodiment of the application, the service encryption key and the video encryption key are removed after decryption, meaning that the service encryption key and the video encryption key are one-time keys. This way, even if the keys are leaked or obtained by others through illegal means, there is no need to worry about the leakage of video files, which can prevent the video files from being further disseminated and forms an effective remedial measure.
[0059] The decoupling of the regional master key and the service encryption key in the video decryption method of this application can prevent the key from being illegally obtained. Furthermore, the service encryption key becomes invalid after one successful decryption. If an attacker obtains the service encryption key through illegal means, it can also prevent the video file from being further disseminated, forming an effective remedial measure and greatly improving its security.
[0060] This application also provides an electronic device, which includes a processor and a memory. The memory stores instructions, and the processor can call the instructions in the memory to enable the electronic device to implement the video encryption method and video decryption method of the above embodiments of this application.
[0061] The steps of the video encryption method include: Step S110: In response to the video encryption command, a random root key is generated.
[0062] Step S120: Based on the random root key, generate multiple regional master keys and multiple service encryption keys corresponding to each regional master key.
[0063] Step S130: Obtain the corresponding area master key and the corresponding service encryption key through the area address of the video to be encrypted.
[0064] Step S140: Encrypt the video to be encrypted using the service encryption key corresponding to the area address of the video to be encrypted, and generate the corresponding video encryption key after the video to be encrypted is encrypted.
[0065] The steps of the video decryption method include: Step S210: Obtain the video file to be decrypted and the video encryption key corresponding to the video file to be decrypted.
[0066] Step S220: Decrypt the video file to be decrypted using the video encryption key to obtain the corresponding service encryption key.
[0067] Step S230: Based on the service encryption key, obtain the region master key that corresponds to the region address of the video file to be decrypted.
[0068] In step S240, when a corresponding service encryption key can be matched in the buffer pool of the regional master key, the decrypted video file to be decrypted is decrypted again using the service encryption key to obtain a playable video file, and the corresponding service encryption key is deleted from the buffer pool.
[0069] The electronic device provided in this application embodiment can manage the entire process of key generation, transmission, and destruction. The root key and regional master key are only used for the generation of lower-level keys and do not participate in the specific encryption process. This decouples key generation from video encryption. Furthermore, the service encryption key becomes invalid after one successful decryption. If an attacker obtains the service encryption key through illegal means, it can also prevent the video file from being further disseminated, forming an effective remedial measure and greatly improving its security.
[0070] The processor of this electronic device contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and the video encryption and decryption methods of the embodiments described above can be implemented by adjusting the kernel parameters.
[0071] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.
[0072] This application also provides a machine-readable storage medium storing a program thereon, which, when executed by a processor, implements the video encryption method and video decryption method of the above embodiments of this application.
[0073] In one embodiment, the electronic device of this application can be a computer device, which can be a server, and its internal structure diagram can be as follows. Figure 9As shown, the computer device includes a processor A01, a network interface A02, a memory (not shown), and a database (not shown) connected via a system bus. The processor A01 provides computing and control capabilities. The memory includes internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02, and a database (not shown). The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A04. The database stores data for executing the video encryption and video decryption methods of the embodiments described above. The network interface A02 communicates with external terminals via a network connection. When the computer program B02 is executed by the processor A01, it implements the video encryption and video decryption methods of the embodiments described above.
[0074] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0075] In one embodiment, the above embodiments of this application can also be implemented as a computer program, which can be implemented as follows: Figure 9 The computer device shown operates on this device. The computer device's memory may store various program modules that execute the video encryption and video decryption methods of the above embodiments of this application. When executed by a processor, the computer program comprised of these program modules can implement the steps of the video encryption and video decryption methods of the various embodiments of this application described in this specification.
[0076] This application also provides a computer program product, which, when executed on a data processing device, is adapted to perform the steps of initializing the video encryption method and video decryption method of the above embodiments of this application, wherein the steps of the video encryption method include: Step S110: In response to the video encryption command, a random root key is generated.
[0077] Step S120: Based on the random root key, generate multiple regional master keys and multiple service encryption keys corresponding to each regional master key.
[0078] Step S130: Obtain the corresponding area master key and the corresponding service encryption key through the area address of the video to be encrypted.
[0079] Step S140: Encrypt the video to be encrypted using the service encryption key corresponding to the area address of the video to be encrypted, and generate the corresponding video encryption key after the video to be encrypted is encrypted.
[0080] The steps of the video decryption method include: Step S210: Obtain the video file to be decrypted and the video encryption key corresponding to the video file to be decrypted.
[0081] Step S220: Decrypt the video file to be decrypted using the video encryption key to obtain the corresponding service encryption key.
[0082] Step S230: Based on the service encryption key, obtain the region master key that corresponds to the region address of the video file to be decrypted.
[0083] In step S240, when a corresponding service encryption key can be matched in the buffer pool of the regional master key, the decrypted video file to be decrypted is decrypted again using the service encryption key to obtain a playable video file, and the corresponding service encryption key is deleted from the buffer pool.
[0084] The computer program product of this application embodiment, by implementing the above-described video encryption and decryption methods, can achieve full-process management of key generation, transmission, and destruction. The root key and regional master key are only used for the generation of lower-level keys and do not participate in the specific encryption process, thus decoupling key generation from video encryption. Furthermore, the service encryption key becomes invalid after one successful decryption. If an attacker obtains the service encryption key through illegal means, it can also prevent the video file from being further disseminated, forming an effective remedial measure and greatly improving its security.
[0085] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0086] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0087] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0088] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0089] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0090] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0091] Computer-readable media include both permanent and non-permanent, removable and non-removable media, which can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.
[0092] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
[0093] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.
Claims
1. A video encryption method, characterized in that, include: In response to video encryption commands, a random root key is generated; Based on the random number root key, multiple regional master keys and multiple service encryption keys corresponding to each regional master key are generated. The corresponding region master key and the corresponding service encryption key are obtained by using the region address of the video to be encrypted. The video to be encrypted is encrypted using the service encryption key corresponding to the region address of the video to be encrypted, and a corresponding video encryption key is generated after the video to be encrypted is encrypted. The video encryption key is used to decrypt the encrypted video.
2. The video encryption method according to claim 1, characterized in that, The step of generating multiple regional master keys and multiple service encryption keys corresponding to each regional master key based on the random number root key includes: Retrieve the encrypted string for each region address; Based on the random number root key and the encryption string, generate the area master key corresponding to multiple area addresses; Based on the regional master key, multiple corresponding service encryption keys and corresponding key pools are generated, and the multiple service encryption keys are stored in the key pools.
3. The video encryption method according to claim 2, characterized in that, The step of obtaining the corresponding region master key and the corresponding service encryption key through the region address of the video to be encrypted includes: Obtain the region address of the video to be encrypted; Based on the region address of the video to be encrypted, obtain the region master key corresponding to the region address; Obtain the service encryption key from the key pool corresponding to the regional master key.
4. The video encryption method according to claim 2, characterized in that, After the steps of encrypting the video to be encrypted using the service encryption key corresponding to the region address of the video to be encrypted, and generating a corresponding video encryption key after encrypting the video to be encrypted, the method further includes: Generate a buffer pool corresponding to the key pool of the master key for the region; The service encryption key corresponding to the video encryption key is transferred from the key pool to the buffer pool.
5. The video encryption method according to claim 1, characterized in that, The method further includes: The video encryption key and the encrypted video are stored on the server. After each preset update interval, the server updates the random number root key, the regional master key, and the service encryption key.
6. The video encryption method according to claim 5, characterized in that, The method further includes: In response to a situation where the number of access requests received for any area address within a preset request duration is greater than or equal to a preset security threshold, the random number root key, the area master key, and the service encryption key for that area address are updated.
7. The video encryption method according to claim 1, characterized in that, The random number root key, the area master key, and the service encryption key are stored in the hardware security module.
8. A video decryption method, characterized in that, include: Obtain the video file to be decrypted, and the video encryption key corresponding to the video file to be decrypted; The video file to be decrypted is decrypted using the video encryption key to obtain the corresponding service encryption key; Based on the service encryption key, obtain the region master key that corresponds to the region address of the video file to be decrypted; When a corresponding service encryption key can be matched in the buffer pool of the regional master key, the decrypted video file to be decrypted is decrypted again using the service encryption key to obtain a playable video file, and the corresponding service encryption key is deleted from the buffer pool.
9. An electronic device, characterized in that, include: A processor and a memory, wherein the memory stores instructions; The processor invokes the instructions in the memory to cause the electronic device to implement the video encryption method as described in any one of claims 1 to 7 and the video decryption method as described in claim 8.
10. A machine-readable storage medium storing instructions thereon, characterized in that, When executed by a processor, this instruction causes the processor to be configured to perform the video encryption method as described in any one of claims 1 to 7 and the video decryption method as described in claim 8.
11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the video encryption method as described in any one of claims 1 to 7 and the video decryption method as described in claim 8.