Hierarchical real-time video stream transmission link architecture and transmission method

Abstract

The invention provides a hierarchical real-time video stream transmission link architecture and a transmission method. The hierarchical real-time video stream transmission link architecture comprises a data acquisition layer, an intelligent decision-making layer, a management control layer and an authentication service layer, when a user initiates a request, the authentication service issues a Token containing an administrative region code, and the data acquisition layer verifies the identity of the user based on the Token by adopting a network layer and application layer dual verification mechanism. The intelligent decision-making layer plans a video stream data transmission path according to the administrative region corresponding to the Token, the request content and the health degree index of the regional routing node according to an intelligent routing strategy; the data acquisition layer acquires / forwards corresponding video stream data according to the path; the management control layer determines the state of each routing node based on the health degree index and performs visual display; and meanwhile, audit logs generated by the data acquisition layer and the intelligent decision-making layer are stored. The invention aims to support safe, efficient and intelligent cross-provincial key business collaboration while avoiding unauthorized access to video data of other provinces through systematic reconstruction authority, routing and auditing mechanisms.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of video security transmission, in particular to a hierarchical real-time video stream transmission link architecture and a transmission method. BACKGROUND

[0002] The existing power grid video monitoring system mainly adopts three types of technical solutions to solve the problems of permission management, route optimization and security audit, but all have significant limitations: 1. The implementation mode of the traditional permission verification scheme is generally based on role-based access control (RBAC) or attribute-based access control (ABAC) model, and the TOKEN only contains basic user identity information (such as user ID, role), and the permission verification is centralized in the application layer, which is insufficient in permission control, resulting in that the users of a province may access the video data of other provinces beyond their authority, or the users of the headquarters cannot efficiently access the cross-province key resources, causing data confusion and the risk of misoperation.

[0003] 2. The traditional routing scheme generally adopts static routing, which only performs simple load balancing to distribute traffic through preset fixed transmission paths (such as preferentially selecting backbone network nodes), resulting in insufficient permission control, which is manifested in that the cross-province transmission delay is too high (average > 500ms), especially under the bandwidth fluctuation in peak period, affecting the real-time monitoring effect.

[0004] 3. The traditional audit scheme generally adopts decentralized log storage in local servers, relying on manual periodic analysis of abnormal access records, although there is also a traditional TOKEN mechanism, but it lacks regional binding and dynamic verification, and is easy to be forged or tampered with, increasing the threat of data leakage.

[0005] Therefore, it is urgent to improve the existing technology to improve the speed and security of power grid video transmission. SUMMARY

[0006] In order to solve the problems existing in the prior art, the present application provides a hierarchical real-time video stream transmission link architecture, comprising: a data acquisition layer, an intelligent decision layer, a management control layer and an authentication service connected in communication; The authentication service is used for issuing a Token by the authentication service when a user initiates a request, and the Token includes an administrative region code. The data acquisition layer is used for verifying the user identity based on the Token using a network layer + application layer dual verification mechanism, and is also used for reporting the request to the intelligent decision layer after verification, and is also used for obtaining / forwarding the corresponding infrastructure-related video stream data based on the video stream data transmission path of the intelligent decision layer. The intelligent decision layer is configured to receive a request from the data collection layer, and plan a video stream data transmission path according to a preset intelligent routing strategy based on a health degree index of each routing node in an administrative region corresponding to a Token of a user and a request content; the intelligent decision layer is further configured to publish the planned video stream data transmission path to the data collection layer, and report the health degree index to the management control layer. The management control layer includes a visual management and control platform configured to determine and display a state of each routing node based on the health degree index of the intelligent decision layer, and collect and store an audit log generated by the data collection layer and the intelligent decision layer, and store the log based on a blockchain technology.

[0007] Preferably, the data collection layer, the intelligent decision layer and the management control layer are arranged in a smart routing gateway device, and the smart routing gateway device is deployed in different administrative regions. The authentication service is arranged in the intelligent decision layer or in a permission authentication service device, and the permission authentication service device is in communication connection with the smart routing gateway device.

[0008] Preferably, the routing node is provided with a Token verification module configured to verify the legality of a Token carried in a user access request, discard the user request when the verification is not legal, and report to the management control layer when the verification is legal, and report the request to the intelligent decision layer when the verification is legal. The legality verification includes verifying whether the user permission and a region of a requested related video match based on an administrative region carried by the user Token. Preferably, verifying whether the user permission and the region of the requested related video match based on the administrative region carried by the user Token includes that the administrative region carried by the user Token is different from region information of the routing node, and the user permission information does not contain a permission to access data in another province. Preferably, whether the user permission and the region of the requested related video match includes: Whether the administrative region carried by the user Token is consistent with the region of the related video; or Whether the user permission contains the region information of the related video.

[0009] Preferably, the intelligent routing strategy includes: Calculating a link health degree based on a heartbeat packet of a regional routing node; Real-time statistics of available bandwidth of each path, combination of historical data to predict bandwidth fluctuation in peak period to determine residual bandwidth; Storing the health degree and residual bandwidth information in a routing table; Calculate a comprehensive score based on the link health, the residual bandwidth ratio, and in combination with the regional matching condition; Determine the optimal path based on a preset threshold and the comprehensive score.

[0010] Preferably, the routing table includes: path ID, source node, target node, health, residual bandwidth, and regional matching flag.

[0011] Preferably, the link health is calculated as follows: Health = (1 - packet loss rate) x 100 - RTT / 10 In the formula, RTT is the response time. The calculation formula of the comprehensive score is as follows: Comprehensive score = health x 0.6 + residual bandwidth ratio x 0.4 Wherein: residual bandwidth ratio = residual bandwidth / request bandwidth.

[0012] Preferably, the visual management and control platform includes a display module, an anomaly detection module, a degradation processing module, and an instruction issuing module. The anomaly detection module is used to record the anomaly event by the blockchain event when receiving the anomaly reported by the data collection layer. The anomaly event of the same IP is counted, and the IP blacklist and alarm are triggered when the count reaches a certain number. The record includes: the gateway encrypts the IP, timestamp, failure reason, and event of abnormal access; The degradation processing module is used to trigger the degradation mechanism when the health is lower than the trigger threshold, and the degradation mechanism includes taking the routing node with low health as a backup node and taking the backup node as a selectable routing node. The display module is used to visually display the routing node state and all operations stored by the dashboard; the state includes: backup, selectable, and whether abnormal; The instruction issuing module is used to issue instructions to the data collection layer and the intelligent decision layer; the instructions include: setting the routing node as a backup node, converting the backup node to a selectable node, and adjusting the priority of the network routing node.

[0013] Preferably, the visual management and control platform further includes: The user initiates a cross-regional request for video information, and the superior user assigns the target province access permission to the user based on the permission authentication service device.

[0014] Based on the same invention concept, the application also provides a hierarchical real-time video streaming method, which includes: When the user initiates a request, the authentication service issues a Token, and the Token includes the administrative region code. The data collection layer verifies the user identity by using the network layer + application layer double verification mechanism based on Token, and reports the request to the intelligent decision layer after verification; The intelligent decision layer plans a video stream data transmission path according to a Token corresponding administrative region, request content and health degree indexes of each routing node in the administrative region according to a preset intelligent routing strategy, and reports the health degree indexes to the management control layer; Based on the video stream data transmission path of the intelligent decision layer, the corresponding routing node is used to obtain / forward the corresponding infrastructure-related video stream data; The management control layer is used to calculate and display the state of each routing node, and the audit logs generated by the data collection layer and the intelligent decision layer are collected and stored by the management control layer, and the logs are stored based on the blockchain technology.

[0015] Compared with the prior art, the beneficial effects of the present application are: 1. The present application provides a hierarchical real-time video stream transmission link architecture and transmission method, which comprises a data collection layer, an intelligent decision layer, a management control layer and an authentication service; when a user initiates a request, the authentication service issues a Token containing an administrative region code, the data collection layer verifies the user identity by using the network layer + application layer double verification mechanism based on Token, and the intelligent decision layer plans a video stream data transmission path according to the Token corresponding administrative region, request content and health degree indexes of each routing node in the region according to an intelligent routing strategy; the data collection layer obtains / forwards the corresponding video stream data according to the path; the management control layer determines the state of each routing node based on the health degree indexes and performs visual display; at the same time, the audit logs generated by the data collection layer and the intelligent decision layer are stored. The present application aims to realize safe, efficient and intelligent inter-provincial business collaboration by systematically reconstructing the permission, routing and audit mechanism. The design defect of TOKEN without region attribute is eliminated, and the permission verification automatically triggers the provincial routing.

[0016] 2. The dynamic routing switching realized based on the health state can adapt to network fluctuations and improve transmission stability.

[0017] 3. The security audit provided by the management control layer adopts the blockchain technology to add a tamper-proof mechanism, and at the same time improves the abnormal processing speed of the blacklist. DETAILED DESCRIPTION

[0018] Figure 1 The figure is a hierarchical real-time video stream transmission link architecture diagram of the present application; Figure 2 The figure is a hierarchical real-time video stream transmission method flow diagram of the present application. DETAILED DESCRIPTION

[0019] To better understand this invention, the following description, in conjunction with the accompanying drawings and examples, will further illustrate the invention.

[0020] Example 1: This method, based on the original hierarchical architecture (headquarters-provincial company), strengthens the strong correlation between permissions and routing, and adopts a three-tier collaborative architecture, such as... Figure 1 As shown, the three-layer collaborative architecture provided by this invention, comprising a bottom-layer data acquisition layer, a middle-layer intelligent decision-making layer, and an upper-layer management and control layer, jointly solves systemic problems such as permission generalization, low transmission efficiency, and high security risks in power grid video stream transmission. The layers are closely interconnected, working together to ensure the efficient operation and security of the entire system.

[0021] Data Acquisition Layer: Real-time data acquisition is achieved through distributed regional routing nodes, and token verification ensures the trustworthiness of device identities.

[0022] Intelligent decision-making layer: Generates the optimal transmission path based on dynamic programming and uses a multi-objective optimization algorithm to achieve load balancing.

[0023] Management and control layer: Build an integrated management and control platform to achieve visualized monitoring, and introduce blockchain technology (such as Hyperledger Fabric) as a core component to ensure evidence storage throughout the entire operation chain, so as to achieve the immutability of the entire operation chain.

[0024] The implementation of this architecture has significantly improved operational efficiency: it upgrades from traditional manual log analysis to real-time anomaly blocking, reducing response time from hours to seconds. In terms of security, based on a blockchain security audit system integrated into the management control layer, reliable evidence of all unauthorized access attempts is achieved, and security policies are automatically executed through smart contracts (such as setting "automatically triggering an IP blacklist and alarm after 3 abnormal access attempts").

[0025] Specifically: (a) Data Acquisition Layer The data acquisition layer is the executor of data transmission, receiving user requests and decision-making instructions, and completing the implementation of "identity verification + data acquisition + data forwarding". It is the system's "data entry point and transmission channel," only executing predetermined instructions, not actively planning paths, and only responsible for basic identity verification and data sending and receiving.

[0026] The data acquisition layer addresses issues including: real-time collection and monitoring of network status data to ensure accuracy and timeliness; ensuring the reliability of transmission signaling and preventing data tampering or forgery during transmission; and the gateway layer directly intercepting cross-regional requests, resolving the deficiency in traditional solutions where tokens are not bound to administrative region attributes.

[0027] The data acquisition layer includes the following: The system employs authentication methods such as distributed area routing nodes, intelligent detection technology, and token authentication. Distributed area routing nodes are responsible for data collection and transmission. Intelligent detection technology is used to collect network status data in real time. Token authentication and other authentication methods ensure the credibility of transmitted signaling. Specifically, a regionalized token is used: the user's administrative region (e.g., province code) is embedded during access key authentication to ensure the token is only valid within the gateway of that province. A dual verification mechanism is employed: an immutable region code (e.g., RSA-PSS signature) is embedded in the token, implementing dual verification at the network layer and application layer, making the success rate of token forgery approach zero.

[0028] Network layer verification: Legality verification based on physical network attributes; IP address region verification (e.g., if the token shows the user is registered in "Beijing" but the source IP is registered in "Shanghai", it will be directly blocked); MAC address binding verification (verifies if the source MAC address of the user request is in the list of valid MAC addresses for that region, and rejects the request if they do not match). Application layer verification: Token validity verification (verifies the token's signature integrity (using a preset key to prevent tampering), validity period (whether it is within the range of issuance time + expiration time), and format validity (whether it conforms to the token structure specified by the system). Administrative region permission matching verification (routing nodes read their pre-configured administrative region code; if the token's administrative region code does not match the routing node's region code, the permission is deemed mismatched).

[0029] Token generation (issuance) is flexible: it may be completed by an independent authentication service: the generation of tokens is not necessarily handled by the underlying system, but may be issued by an independent, dedicated authentication service (such as an independent identity authentication server); in some system architectures, the authority to issue tokens may also be the responsibility of the authentication service of the middle layer (such as the business logic layer) or the upper layer (such as the identity management system).

[0030] The token verification mechanism is fixed (executed by the underlying server): It is deployed on the underlying video server, which receives requests from clients (such as cameras and monitoring equipment) and verifies the token's validity to complete identity authentication. For example, in a power grid video surveillance scenario, distributed regional routing nodes use token authentication to ensure the device's identity is trustworthy and verify its access permissions. This invention enables dynamic authentication, verifying whether the user's permissions match the video's region for each video stream request. The gateway layer directly intercepts cross-regional requests, addressing the deficiency in traditional solutions where the token is not bound to administrative region attributes.

[0031] The relationship between the data acquisition layer and the layers above and below: The data acquisition layer provides accurate network status data to the middle layer, supporting intelligent routing decisions. It receives management and control commands from the upper layer and executes corresponding operations.

[0032] (II) Intelligent Decision-Making Layer The intelligent decision-making layer is the decision-maker in path planning. Based on multi-dimensional information (region, request, node status), it dynamically formulates the optimal data transmission scheme and is the "brain" of the system. It does not directly collect or transmit data, but focuses on "decision analysis" to provide the data collection layer with the basis for action.

[0033] The problems that intelligent decision-making layers need to solve include: Based on network status data and transmission strategies, transmission paths are dynamically planned. Load balancing and node evaluation are implemented to optimize traffic allocation strategies.

[0034] The intelligent decision-making layer includes the following: The intelligent routing decision engine is responsible for the dynamic planning of transmission paths, such as... Figure 2 As shown.

[0035] Requests from provincial company users are automatically routed to the video service node within their province, and cross-provincial access is prohibited. Headquarters users can specify access to video services in a particular province, but additional token approval is required.

[0036] The specific process for approving a token is as follows: The user requesting video information initiates a cross-regional request. The superior user, on the authentication service device (authentication service), grants the user access permissions to the target requested region, generating specific cross-regional permissions to obtain cross-regional access credentials. The user then accesses the authentication service through the data acquisition layer after authentication. This authentication is supplemented if the "network layer verification" fails, ensuring that the user's permissions include information about the region to which the relevant video belongs.

[0037] Take, for example, the scenario where user A (belonging to "Beijing") requests access to video data from "Hebei Province" for business collaboration purposes.

[0038] During permission request and token generation: A superior user with approval authority temporarily grants user A's account access to "Hebei Province" in the authentication service. Based on this, the authentication service generates a special token, which, in addition to containing the user's home region code "Beijing", also contains a list of authorized target access regions (such as "Hebei Province").

[0039] During cross-regional permission verification: User A, carrying the aforementioned special token, requests access to a video stream in "Hebei Province". This request is routed to a routing node within "Hebei Province"; this node performs an "administrative region permission matching verification" in the application layer. The node reads its pre-configured administrative region code ("Hebei Province") and compares it with the "target access region list" in the token. Since the token explicitly authorizes "Hebei Province," it matches the node's region code, and the verification passes. The request is allowed and forwarded. If the token does not authorize that region, the permission is deemed mismatched, and the request is rejected.

[0040] Furthermore, if the token is tampered with, expired, or incorrectly formatted, the request will be rejected regardless of whether the user has cross-regional permissions.

[0041] Multi-objective optimization algorithms are used to optimize transmission paths and traffic allocation.

[0042] The node evaluation module, based on load balancing, evaluates the performance and load of nodes.

[0043] Specifically, the intelligent routing strategy includes: 1. Heartbeat Detection Mechanism: Regional routing nodes send heartbeat packets to neighboring nodes every 5 seconds. Link health (0-100 points) is calculated based on response time (RTT) and packet loss rate. Calculation formula: Health score = (1 - packet loss rate) × 100 - RTT (ms) / 10 Health index system: The score is dynamically calculated based on parameters such as network latency and packet loss rate. For example, when the packet loss rate is 5% and RTT=80ms, the health score is 87.

[0044] 2. Bandwidth recording module: Real-time statistics of available bandwidth for each path, combined with historical data to predict bandwidth fluctuations during peak periods (such as a surge in video streams during midday inspections).

[0045] 3. The routing table is dynamically maintained and adopts a multi-dimensional scoring mechanism: it stores the real-time status of each path, including: path ID, source node, destination node, health status, remaining bandwidth, and region matching flag.

[0046] 4. Dynamic update rules A weighted decision model combined with a nearest-path routing algorithm is used to determine the route.

[0047] Weighted decision model: Prioritize paths that match the region and have a health score > 80. Then, calculate the overall score using the formula: Overall Score = Health Score × 0.6 + Remaining Bandwidth Percentage × 0.4, where Remaining Bandwidth Percentage = Remaining Bandwidth / Request Bandwidth. The health score and remaining bandwidth are derived from the routing table.

[0048] The system prioritizes nodes with a score >80 to ensure high reliability.

[0049] Health scores can be used to optimize the selection decision for users within the province to access different nodes in the province. When a user initiates an access request, the routing engine compares the comprehensive scores of available nodes in the province in real time and automatically routes to the node with the highest score, avoiding congestion or failure points.

[0050] When the health score is below 60 or the remaining bandwidth is less than 120% of the requested traffic, the priority of this path will be automatically downgraded.

[0051] Practical data shows that this strategy can reduce video buffering time by up to 67%, making it particularly suitable for low-latency requirements in high-concurrency scenarios.

[0052] The relationship between the intelligent decision-making layer and its upper and lower layers: It receives network status data from the underlying layer and makes intelligent routing decisions. The decision results are then fed back to the upper layer, supporting visualized monitoring and intelligent operation and maintenance of the entire network status.

[0053] (III) Management and Control Layer: The management and control layer is the overall controller of the system's status, monitoring system operation, storing audit logs, and ensuring data traceability. It acts as the system's "monitoring center and evidence storage center," not participating in front-end request processing or path planning, but solely responsible for overall visual control and secure log storage.

[0054] The problems that the management control layer needs to solve: Enables visualized monitoring of the entire network status, allowing administrators to understand network conditions in real time. Provides intelligent operation and maintenance functions, supporting real-time blocking of abnormal access and security auditing. Ensures the integrity and security of operations by using blockchain technology to achieve end-to-end evidence storage of operations.

[0055] The management control layer includes: An integrated visual management platform provides visualized monitoring and intelligent operation and maintenance functions. Real-time blocking and security audit modules are used for detecting and handling abnormal access. Blockchain technology is used to achieve end-to-end operation evidence storage, ensuring data integrity and security. A degradation mechanism (such as switching to a backup node) is automatically triggered when the node health score falls below 60, and the node status is visualized through a dashboard, allowing users to quickly identify anomalies (such as high latency or packet loss).

[0056] The smart contract automatically triggers an IP blacklist and sends an alert after three abnormal access attempts, as detailed below: An access request is considered abnormal if it meets both of the following conditions: regional unauthorized access: a provincial company user accesses resources outside the province (e.g., a Zhejiang account requests Jiangsu video); illegal cross-province access: a headquarters user accesses data from another province without an approval token; high-frequency attack: more than 5 cross-regional requests are initiated within 1 second.

[0057] When an anomaly occurs, the blockchain event log records the anomaly. This includes: the gateway encrypting the IP address of the abnormal access, the timestamp, and the reason for the failure into an event, writing it to the blockchain, and counting the anomaly events of the same IP address. When the cumulative anomaly count of an IP address reaches 3 times (IP:xxxx has been blocked due to 3 cross-province unauthorized accesses, such as Zhejiang → Jiangsu), the IP blacklist and alarm are automatically triggered.

[0058] IP Blacklist: When the count reaches a certain number, the IP blacklist and alarm will be triggered; The IP blacklist triggering mechanism includes: recording abnormal situations; triggering the IP blacklist and issuing an alarm when the number of recorded instances reaches a certain threshold. Recording abnormal situations includes: the gateway encrypting the IP address, timestamp, and failure reason of the abnormal access as an event; a blacklist mechanism; and abandoning access requests from specific blacklisted users, including identifiers such as specified users, IP addresses, and MAC addresses. Intelligent routing will not consider such access. If the same IP generates multiple abnormal events exceeding a specified threshold, the blacklist mechanism will be triggered and a warning will be issued.

[0059] Real-time alerts: Alerts are pushed to the operations and maintenance platform via message queue. The relationship between the management control layer and the upper and lower layers: It receives network-wide status information from the middle layer for visualized monitoring and intelligent operation and maintenance. It sends management and control commands to the lower and middle layers to adjust network status and transmission strategies.

[0060] This invention reduces invalid bandwidth usage by approximately 30% through real-time health-based dynamic routing control. Automated operation and maintenance lowers labor costs by approximately 40%, making it particularly suitable for large-scale power grid video surveillance scenarios. Its anti-tampering mechanism meets the compliance audit requirements of the power industry, avoiding potential penalties for violations.

[0061] Example 2: Based on the same inventive concept, this invention also provides a hierarchical real-time video stream transmission method, such as... Figure 2 As shown, it includes: S1. When a user initiates a request, the authentication service issues a Token, which includes an administrative region code; S2. The data collection layer uses a dual verification mechanism of network layer + application layer based on Token to verify the user's identity. After the verification is successful, the request is reported to the intelligent decision layer. S3. Based on the intelligent decision-making layer, the video stream data transmission path is planned according to the administrative region corresponding to the user's token, the request content, and the health index of each routing node in the administrative region according to the preset intelligent routing strategy, and the health index is reported to the management control layer. S4. Based on the intelligent decision-making layer, the video stream data transmission path uses the corresponding routing nodes to obtain / forward the corresponding infrastructure-related video stream data. S5. Calculate and display the status of each routing node using the management and control layer; and collect and store the audit logs generated by the data acquisition layer and the intelligent decision-making layer using the management and control layer, and preserve the logs based on blockchain technology.

[0062] Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0063] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0064] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0065] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0066] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0067] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of the claims of the present invention pending approval.

Claims

1. A hierarchical real-time video stream transmission link architecture, characterized in that, include: The communication connection includes a data acquisition layer, an intelligent decision-making layer, a management and control layer, and authentication services. The authentication service is used to: issue a token when a user initiates a request, the token including an administrative region code; The data acquisition layer is used to verify user identity based on a dual verification mechanism of network layer + application layer using a token. It is also used to report the request to the intelligent decision-making layer after verification; and to acquire / forward the corresponding infrastructure-related video stream data based on the video stream data transmission path of the intelligent decision-making layer. The intelligent decision-making layer is used to receive requests from the data acquisition layer. It is also used to plan video stream data transmission paths according to a preset intelligent routing strategy based on the administrative region corresponding to the user's token, the request content, and the health index of each routing node in the administrative region. It is also used to publish the planned video stream data transmission path to the data acquisition layer; It is also used to report the health indicators to the management and control layer; The management and control layer includes a visual management and control platform, which is used to determine and display the status of each routing node based on the health indicators of the intelligent decision-making layer; It is also used to collect and store audit logs generated by the data acquisition layer and the intelligent decision-making layer, and to preserve the logs based on blockchain technology.

2. The architecture as described in claim 1, characterized in that, The data acquisition layer, intelligent decision-making layer, and management control layer are located in the intelligent routing gateway device; the intelligent routing gateway device is deployed in different administrative regions. The authentication service is set up at the intelligent decision-making layer or at the authorization authentication service device; the authorization authentication service device is communicatively connected to the intelligent routing gateway device.

3. The architecture as described in claim 1, characterized in that, The routing node is equipped with a Token verification module, which is used to verify the legality of the Token carried in the user access request. When the verification is invalid, the user request is discarded and reported to the management control layer. When the verification is valid, the request is reported to the intelligent decision layer. The legality verification includes: verifying whether the user's permissions match the region of the requested video based on the administrative region carried by the user's token; Preferably, verifying whether the user's permissions match the region of the requested video based on the administrative region carried by the user token includes: the administrative region carried by the user token is different from the region information of the routing node and the user's permission information does not include permission to access data from other provinces.

4. The architecture as described in claim 3, characterized in that, Whether the user's permissions match the region of the requested video includes: Whether the administrative region carried by the user token is consistent with the region to which the relevant video belongs; or Does the user permission include information about the region to which the relevant video belongs? 5. The architecture as described in claim 1, characterized in that, The intelligent routing strategy includes: Calculate link health based on the heartbeat packets of the regional routing nodes; Real-time statistics of available bandwidth for each path, combined with historical data to predict bandwidth fluctuations during peak hours and determine remaining bandwidth; The health status and remaining bandwidth information are stored in the routing table; A comprehensive score is calculated based on the link health, remaining bandwidth percentage, and regional matching. The optimal path is determined based on a preset threshold and the overall score.

6. The architecture as described in claim 5, characterized in that, The routing table includes: path ID, source node, destination node, health status, remaining bandwidth, and region matching flag.

7. The architecture as described in claim 5, characterized in that, The link health status is calculated using the following formula: Health score = (1 - packet loss rate) × 100 - RTT / 10 In the formula: RTT is the response time; The formula for calculating the overall score is as follows: Overall Score = Health Score × 0.6 + Remaining Bandwidth Percentage × 0.4 Where: Remaining bandwidth percentage = Remaining bandwidth / Requested bandwidth.

8. The architecture as described in claim 1, characterized in that, The visualization management platform includes a display module, an anomaly detection module, a degradation processing module, and an instruction issuance module; The anomaly detection module is used to record the anomaly event in the blockchain event log when it receives an anomaly reported by the data acquisition layer. It also counts abnormal events from the same IP address, and triggers an IP blacklist and alarm when the count reaches a certain number; the record includes: the gateway encrypting the abnormal access IP address, timestamp, failure reason, and other information into an event; The degradation processing module is used to trigger a degradation mechanism when the health level is lower than the trigger threshold. The degradation mechanism includes using the routing node with low health level as a backup node and using the backup node as an selectable routing node. The display module is used to visually display the status of routing nodes and all operations related to evidence storage using a dashboard; the status includes: standby, selectable, and whether it is abnormal. The instruction issuing module is used to issue instructions to the data acquisition layer and the intelligent decision-making layer; the instructions include: setting a routing node as a backup node, converting a backup node into a selectable node, and adjusting the priority of network routing nodes.

9. The architecture as described in claim 2, characterized in that, The visualization and control platform also includes: When a user requests video information and initiates a cross-regional request, the superior user grants the user access permissions to the target province based on the authorization service device.

10. A hierarchical real-time video stream transmission method, characterized in that, include: When a user initiates a request, the authentication service issues a token, which includes an administrative region code; The data acquisition layer uses a dual verification mechanism of network layer + application layer based on Token to verify the user's identity. Once the verification is successful, the request is reported to the intelligent decision layer. Based on the intelligent decision-making layer, the video stream data transmission path is planned according to the administrative region corresponding to the user's token, the request content, and the health indicators of each routing node in the administrative region, and the health indicators are reported to the management and control layer. Based on the intelligent decision-making layer, the video stream data transmission path utilizes corresponding routing nodes to acquire / forward relevant infrastructure-related video stream data. The status of each routing node is calculated and displayed using the management control layer; The system also utilizes the management and control layer to collect and store audit logs generated by the data acquisition layer and the intelligent decision-making layer, and uses blockchain technology to preserve evidence of these logs.

Images