Video encryption transmission method, video decryption output method and device

Abstract

The application provides a video encryption transmission method and device and a video decryption output method. The video encryption transmission method comprises the following steps: constructing a security parameter set according to an encrypted video encryption key and an initialization vector of a group of images; performing an exclusive or operation on the first L-1 bytes of an original data byte stream by using a stream key to obtain encrypted byte stream data; setting a network abstraction layer header for each processed network abstraction layer unit of the group of images, wherein the network abstraction layer header at least comprises original encoding standard information and encryption state information; performing a hash signature processing on the encrypted byte stream data of the group of images to generate signature data, and encapsulating the signature data into an authentication network abstraction layer unit; encapsulating the security parameter set, the network abstraction layer unit provided with the network abstraction layer header, the authentication network abstraction layer unit and the original parameter set of the group of images in the transmission order of the original code stream of the group of images to obtain an encrypted video code stream; and sending the encrypted video code stream to a receiver.

Description

Technical Field

[0001] This application relates to the field of video encryption and decryption technology, and in particular to a video encryption transmission method, a video decryption output method, and an apparatus. Background Technology

[0002] In video surveillance scenarios, video data is captured by cameras, compressed by encoders into a bitstream conforming to standard video encoding formats, and then transmitted over the network to the receiving end for decoding and playback. The raw bitstream generated by mainstream video encoding standards (such as H.264 and H.265) consists of a series of NALUs (Network Abstraction Layer Units). Each NALU comprises a NAL header and an RBSP (Raw Byte Sequence Payload) from the VCL (Video Coding Layer). Different video encoding standards define their own distinct NAL header syntax and RBSP structures. The video stream is separated by start codes (such as 0x000001) to form a continuous bitstream for transmission or storage.

[0003] Current video transmission technologies lack a unified video data encapsulation format, forcing video streams with different encoding standards to employ different encryption and encapsulation methods for secure transmission. This results in low system compatibility, high complexity, and high maintenance costs. Key security parameters such as keys and algorithm identifiers are transmitted outside the video stream, posing risks of interception, tampering, or desynchronization, thus weakening security. Furthermore, the separation of the video stream from security parameters increases the complexity of system synchronization and management. Simultaneously, existing solutions typically perform coarse-grained encryption on the entire RBSP payload, failing to differentiate encryption ranges within the bitstream (e.g., encrypting only I-frames or only a portion of macroblocks within a slice), lacking flexibility and adaptability. Summary of the Invention

[0004] The technical problem to be solved by the embodiments of this application is to provide a video encryption transmission method, a video decryption output method and apparatus, so as to achieve secure transmission of video streams supporting multiple encoding standards under a single encapsulation format, and to embed all key security parameters inside the video bitstream, thereby achieving the purpose of improving compatibility, enhancing security and increasing flexibility.

[0005] In a first aspect, embodiments of this application provide a video encryption transmission method, applied to a sender, the method comprising:

[0006] For each image group in the original video stream, a security parameter set for the image group is constructed based on the generated encrypted video encryption key and initialization vector of the image group.

[0007] The first L-1 bytes of the original data byte stream are XORed using a stream key to obtain encrypted byte stream data; the stream key is determined based on the initialization vector and the video encryption key; the original data byte stream is the byte stream of the network abstraction layer unit that needs to be encrypted within the image group; and L is the total number of bytes in the original data byte stream.

[0008] A network abstraction layer header is set for each network abstraction layer unit after the processing of the image group. The network abstraction layer header includes at least: original coding standard information and encryption state information.

[0009] The encrypted byte stream data of the image group is hash-signed to generate signature data for the image group, and the signature data is encapsulated into the authentication network abstraction layer unit;

[0010] According to the transmission order of the original bitstream of the image group, the security parameter set, the network abstraction layer unit with the network abstraction layer header, the authentication network abstraction layer unit, and the original parameter set of the image group are encapsulated to obtain an encrypted video bitstream; wherein, the original parameter set includes: an encrypted sequence parameter set, an encrypted image parameter set, and image and video data;

[0011] The encrypted video stream is sent to the recipient.

[0012] Secondly, embodiments of this application provide a video decryption output method, applied to a receiver, the method comprising:

[0013] Receive the encrypted video stream sent by the sender, parse the encrypted video stream, and obtain each network abstraction layer unit;

[0014] Extract the security parameter set corresponding to each image group in the encrypted video stream, and parse the encrypted video encryption key and initialization vector of the image group from the security parameter set;

[0015] The encrypted video encryption key is decrypted using the corresponding video key encryption key stored locally to obtain the video encryption key for the image group, and the stream key is determined based on the video encryption key and the initialization vector.

[0016] Identify the network abstraction layer units that have a network abstraction layer header in each network abstraction layer unit, and determine whether the network abstraction layer unit is an encryption unit by the encryption status information of the network abstraction layer header. If it is an encryption unit, extract its encrypted byte stream data.

[0017] The authentication network abstraction layer unit corresponding to the image group is parsed to obtain the signature data of the image group, and the encrypted byte stream data is hashed and verified based on the signature data.

[0018] After the signature verification is successful, the first L-1 bytes of the encrypted byte stream data are XORed using the stream key to obtain the original data byte stream, where L is the total number of bytes in the original data byte stream; the header of the network abstraction layer unit is restored to its original network abstraction layer header conforming to the original video encoding standard before encryption by using the original encoding standard information of the network abstraction layer header.

[0019] According to the original bitstream transmission order of the image group, the recovered network abstraction layer unit and the original parameter set of the image group are assembled and sent to the video decoder for decoding to output the video frame sequence of the image group.

[0020] Thirdly, embodiments of this application provide a video encryption transmission device, applied to a sender, the device comprising:

[0021] The parameter set construction module is used to construct a security parameter set for each image group in the original video bitstream, based on the generated encrypted video encryption key and initialization vector of the image group.

[0022] The encrypted data acquisition module is used to perform an XOR operation on the first L-1 bytes of the original data byte stream using a stream key to obtain encrypted byte stream data; the stream key is determined based on the initialization vector and the video encryption key, the original data byte stream is the byte stream of the network abstraction layer unit that needs to be encrypted within the image group, and L is the total number of bytes in the original data byte stream;

[0023] A header setting module is used to set a network abstraction layer header for each network abstraction layer unit after the processing of the image group. The network abstraction layer header includes at least: original encoding standard information and encryption state information.

[0024] The signature data generation module is used to perform hash signature processing on the encrypted byte stream data of the image group, generate the signature data of the image group, and encapsulate the signature data into the authentication network abstraction layer unit;

[0025] The encrypted stream acquisition module is used to encapsulate the security parameter set, the network abstraction layer unit with the network abstraction layer header, the authentication network abstraction layer unit, and the original parameter set of the image group according to the transmission order of the original bitstream of the image group to obtain an encrypted video bitstream; wherein, the original parameter set includes: an encrypted sequence parameter set, an encrypted image parameter set, and image and video data;

[0026] An encrypted stream sending module is used to send the encrypted video stream to the receiver.

[0027] Fourthly, embodiments of this application provide a video decryption output device, applied to a receiver, the device comprising:

[0028] The abstract layer acquisition module is used to receive the encrypted video stream sent by the sender, parse the encrypted video stream, and obtain each network abstract layer unit.

[0029] The information extraction module is used to extract the security parameter set corresponding to each image group in the encrypted video stream, and to parse the encrypted video encryption key and initialization vector of the image group from the security parameter set;

[0030] The stream key determination module is used to decrypt the encrypted video encryption key using the corresponding video key encryption key stored locally to obtain the video encryption key of the image group, and to determine the stream key based on the video encryption key and the initialization vector.

[0031] The data extraction module is used to identify the network abstraction layer units that have a network abstraction layer header in each network abstraction layer unit, and to determine whether the network abstraction layer unit is an encryption unit by the encryption status information of the network abstraction layer header. If it is an encryption unit, its encrypted byte stream data is extracted.

[0032] The signature verification processing module is used to parse the authentication network abstraction layer unit corresponding to the image group to obtain the signature data of the image group, and perform hash signature verification processing on the encrypted byte stream data based on the signature data;

[0033] The header recovery module is used to perform an XOR operation on the first L-1 bytes of the encrypted byte stream data using the stream key after the signature verification is passed, to obtain the original data byte stream, where L is the total number of bytes in the original data byte stream; and to restore the header of the network abstraction layer unit to its original network abstraction layer header that conforms to the original video encoding standard before encryption by using the original encoding standard information of the network abstraction layer header.

[0034] The video frame sequence output module is used to assemble the recovered network abstraction layer unit and the original parameter set of the image group according to the original bitstream transmission order of the image group, and send them to the video decoder for decoding to output the video frame sequence of the image group.

[0035] Fifthly, embodiments of this application provide an electronic device, including:

[0036] The processor, the memory, and the computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the video encryption transmission method described in the first aspect above, or the video decryption output method described in the second aspect above.

[0037] In a sixth aspect, embodiments of this application provide a computer-readable storage medium that, when the instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to perform the video encryption transmission method described in the first aspect or the video decryption output method described in the second aspect.

[0038] Compared with the prior art, the embodiments of this application have the following advantages:

[0039] In this embodiment, a security parameter set containing key security parameters such as encryption keys and initialization vectors is constructed for each image group and encapsulated together with the video stream. This solves the problems of interception and tampering risks and complex synchronization management caused by the separation of security parameters and video streams in the prior art. By setting a network abstraction layer header containing the original encoding standard information for each network abstraction layer unit, unified encryption encapsulation of video streams with different encoding standards is achieved, solving the problems of low system compatibility, high complexity, and high maintenance costs. Furthermore, XOR encryption is performed on the first L-1 bytes of the original data byte stream to achieve precise control of the encryption range, solving the problem of lack of flexibility and adaptability in existing coarse-grained encryption, ultimately achieving highly compatible, highly secure, and highly flexible secure video transmission.

[0040] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0041] Figure 1 A flowchart illustrating the steps of a video encryption transmission method provided in this application embodiment;

[0042] Figure 2 A schematic diagram of a bitstream structure provided in an embodiment of this application;

[0043] Figure 3 A flowchart illustrating the steps of a video decryption and output method provided in this application embodiment;

[0044] Figure 4 This is a schematic diagram of the structure of a video encryption transmission device provided in an embodiment of this application;

[0045] Figure 5 This is a schematic diagram of the structure of a video decryption output device provided in an embodiment of this application;

[0046] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0047] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0048] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. The singular forms “a,” “the,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0049] Reference Figure 1 This diagram illustrates a flowchart of a video encryption transmission method provided in an embodiment of this application. This video encryption transmission method can be applied to the sender. Figure 1 As shown, the video encryption transmission method may include steps 101 to 106.

[0050] Step 101: For each image group in the original video stream, construct the security parameter set of the image group based on the generated encrypted video encryption key and initialization vector of the image group.

[0051] The embodiments of this application can be applied to the sender (video sender), that is, the executing entity is the sender.

[0052] In this embodiment, a group of pictures (GOP) is a group of consecutive image frames in video coding, typically containing one I-frame and several P-frames and B-frames.

[0053] A video encryption key (VEK) is a key used to directly encrypt and decrypt video data; it is the actual key used to encrypt video content.

[0054] VKEK (Video Key Encryption Key) is a key used to encrypt VEK and can be used to protect the security of VEK itself.

[0055] Encrypted video encryption key (Encrypted VEK, EVEK) is the ciphertext form of VEK encrypted with VKEK.

[0056] An initialization vector (IV) is an initial value used in the stream cipher mode of a block cipher to randomize the encryption process.

[0057] The Security Parameter Set (SPS) is a network abstraction layer unit defined in this application that carries global security configuration information and is used to carry security parameters such as keys, algorithm identifiers, and initialization vectors.

[0058] Raw Byte Sequence Payload (RBSP) is raw data encoded by VCL (Video Coding Layer) but not encapsulated by NAL (Network Abstraction Layer).

[0059] In scenarios such as video surveillance, continuous video frames can be captured using camera equipment (such as surveillance cameras). Video encoders can perform compression encoding processes on the captured video frames, including inter-frame prediction, transformation, quantization, and entropy coding, outputting a raw bitstream conforming to video coding standards such as H.264 and H.265. This raw bitstream is composed of a series of standard NAL units. Then, it can be structured and organized into GOPs (Group of Pictures). A GOP is a continuous set of coded frames in video coding, typically starting with an Instantaneous Decoding Refresh (IDR) frame or a keyframe (I-frame), followed by several P-frames and B-frames to form an independently decodeable video unit.

[0060] At the beginning of each GOP (i.e., the start of the encoder outputting a new IDR frame or I frame, i.e., the start position of the current video sequence entering a new, independently decodeable group of images), an encrypted video encryption key (EVEK) and an initialization vector (IV) for that group of images can be generated, and a security parameter set for that group of images can be constructed based on the EVEK and IV. This implementation process can be described in detail below with reference to the specific implementation method.

[0061] In one implementation of this application, step 101 may include sub-steps A1 to A3.

[0062] Sub-step A1: Randomly generate a video encryption key and the initialization vector.

[0063] In this embodiment, at the beginning of a Group of Pictures (GOP), the video encoder randomly generates a video encryption key (VEK) suitable for the current group of images using a random number algorithm, and also randomly generates an initialization vector for subsequent video data encryption. The video encryption key and the initialization vector have the same number of bytes, such as 128 bits each.

[0064] Sub-step A2: Using a preset encryption algorithm, encrypt the video encryption key with a preset video key encryption key to obtain the encrypted video encryption key.

[0065] The preset encryption algorithm refers to the symmetric encryption algorithm used to encrypt the encryption key of the video.

[0066] After obtaining the video encryption key and initialization vector, the video encryption key can be encrypted using a preset encryption algorithm to obtain an encrypted video encryption key. Specifically, both the video sender and receiver can pre-configure the video encryption key, and the video encoder uses the preset encryption algorithm to encrypt the video encryption key using this preset encryption algorithm to obtain an encrypted video encryption key in ciphertext form, thereby achieving secure key transmission.

[0067] Sub-step A3: Construct the security parameter set based on the initialization vector and the encrypted video encryption key.

[0068] After obtaining the encrypted video encryption key, a security parameter set can be constructed based on the initialization vector and the encrypted video encryption key. That is, the initialization vector and the encrypted video encryption key are used as core security parameters, combined with information such as the encryption algorithm identifier and authentication identifier, to construct the security parameter set corresponding to the current image group, and then encapsulated as an independent network abstraction layer unit.

[0069] In this embodiment, the security parameter set may include: whether encryption fields are supported, whether authentication fields are supported, encryption algorithm identifier, key vector carrying indicator field, source device identifier, encryption algorithm field of video encryption key, signature algorithm type, camera certificate identifier, hash algorithm type, and number of image frames for hash calculation.

[0070] The security parameter set is described below:

[0071] (1) Type: Define a special nal_unit_type (e.g., 63) to identify SPS.

[0072] (2) Header: In its security extension NAL header, encryption_idc and authentication_idc are both set to 0 to ensure that its payload can be directly parsed.

[0073] (3) Load Balancer (RBSP) semantics: The SPS RBSP contains a series of fields used to transmit global security control information, mainly including:

[0074] encryption_flag: Whether encryption is supported.

[0075] authentication_flag: Whether authentication is supported.

[0076] encryption_type: Encryption algorithm identifier (e.g., 0: SM1, 1: SM4).

[0077] The key vector carries the indicator fields vek_flag / iv_flag: indicating whether EVEK and IV are carried.

[0078] evek: The encryption key for the encrypted video (EVEK).

[0079] iv: Initialization vector.

[0080] Source device identifier camera_id: Source device identifier.

[0081] The encryption algorithm field vek_encryption_type for the video encryption key: the algorithm used to encrypt VEK.

[0082] signature_type: Signature algorithm type (e.g., SM2).

[0083] camera_idc: Camera certificate identifier, used for verification.

[0084] hash_type: Hash algorithm type (e.g., SM3).

[0085] The hash calculation of image frames successive_hash_pictures_minus1 specifies how many consecutive frames of image data participate in a single hash calculation, used to balance performance and security granularity.

[0086] This application embodiment regenerates and encrypts the video encryption key at the beginning of each image group, and constructs a unified security parameter set in conjunction with the initialization vector to achieve hierarchical key protection and secure embedded transmission. This not only improves the security of video transmission, but also ensures the synchronization of encryption and decryption, and supports key updates by image group, thereby enhancing the overall security protection capability.

[0087] Step 102: Perform an XOR operation on the first L-1 bytes of the original data byte stream using the stream key to obtain encrypted byte stream data; the stream key is determined based on the initialization vector and the video encryption key, the original data byte stream is the byte stream of the network abstraction layer unit that needs to be encrypted within the image group, and L is the total number of bytes in the original data byte stream.

[0088] A stream key is a key stream generated by an encryption algorithm based on a video encryption key and an initialization vector, used to encrypt video data byte by byte.

[0089] Exclusive OR (XOR) is a mathematical operator commonly used in logical operations and bitwise operations in computers. The XOR operation outputs true (1) if and only if the two input values ​​are different, otherwise it outputs false (0), that is, "0 if they are the same, 1 if they are different".

[0090] The Network Abstraction Layer Unit (NALU) is the basic data encapsulation unit in video coding standards, consisting of a NAL header and an RBSP.

[0091] Encrypted byte stream data (i.e., encrypted RBSP) is ciphertext data obtained by XORing the original data byte stream with the stream key.

[0092] After constructing the security parameter set, the original data byte stream corresponding to the network abstraction layer units that need to be encrypted within the image group can be obtained, and the total number of bytes in the original data byte stream is determined to be L. The stream key is determined based on the initialization vector, and the first L-1 bytes of the original data byte stream are XORed using the stream key to obtain the encrypted byte stream data. The last byte is left unencrypted to ensure bitstream compatibility. The original data byte stream can be the byte stream of the network abstraction layer units that need to be encrypted within the image group. The implementation process of obtaining the encrypted byte stream data through the XOR operation can be described in detail below.

[0093] In one implementation of this application, step 102 may include sub-step B1 and sub-step B2.

[0094] Sub-step B1: Process the video encryption key and the initialization vector based on the preset encryption algorithm to obtain the stream key.

[0095] In this embodiment, encryption_type (encryption algorithm identifier) ​​is defined in the security parameter set. The preset encryption algorithm used can be determined through encryption_type.

[0096] After obtaining the video encryption key and initialization vector, a preset encryption algorithm can be used to process the video encryption key and initialization vector to obtain the corresponding stream key. Specifically, the video encryption key (VEK) and initialization vector (IV) corresponding to the current group of images (GOP) generated earlier are obtained, ensuring that both are valid and synchronized parameters. Subsequently, the preset encryption algorithm (preferably a symmetric encryption algorithm, such as the Output Feedback (OFB) mode of the SM4 algorithm) is called, using the video encryption key (VEK) as the core key of the algorithm and the initialization vector (IV) as the initial randomization parameter of the algorithm, and input into the preset encryption algorithm for operation; the algorithm generates a continuous key sequence adapted to the length of the original data byte stream, i.e., the stream key, through iterative processing of VEK and IV. This stream key corresponds one-to-one with the first L-1 bytes of the original data byte stream, providing key support for subsequent byte-by-byte XOR encryption.

[0097] Sub-step B2: Using the stream key, perform a byte-by-byte XOR operation on the first L-1 bytes of the original data byte stream to obtain the encrypted byte stream data.

[0098] After obtaining the stream key, the raw data byte stream (RBSP) corresponding to the Network Abstraction Layer Unit (NALU) to be encrypted within the current Group of Pictures (GOP) can be extracted. The total number of bytes in the raw data byte stream is determined by byte counting, denoted as L. Then, according to the generated stream key, following the principle of "byte-by-byte correspondence," each byte of the stream key is XORed with the first L-1 bytes of the raw data byte stream (i.e., the original byte is XORed with the corresponding stream key byte to obtain the encrypted byte). Simultaneously, the last byte of the raw data byte stream is left unencrypted to ensure bitstream compatibility and avoid format anomalies during subsequent decoding. Finally, the first L-1 bytes after XOR encryption are combined with the unencrypted last byte to form complete ciphertext data, i.e., encrypted byte stream data, completing the encryption process of the original video data.

[0099] This application embodiment generates a stream key by combining a preset encryption algorithm with VEK and IV, achieving dynamic adaptation of the encryption key and improving key security. The design of using the stream key to XOR the first L-1 bytes of the original data byte stream byte by byte, while retaining the last byte, achieves secure encryption of video data, ensures bitstream compatibility, precisely controls the encryption range, improves encryption flexibility, and effectively avoids the risk of original data leakage.

[0100] Step 103: Set a network abstraction layer header for each network abstraction layer unit after processing of the image group. The network abstraction layer header includes at least: original encoding standard information and encryption state information.

[0101] The Network Abstraction Layer (NAL) header is an extended header set in this application, which contains at least the original encoding standard information and encryption status information to identify the bitstream type and encryption status.

[0102] After encrypting the raw byte stream data of the current image group, a uniformly formatted network abstraction layer header can be configured for each network abstraction layer unit (NETB) within the current image group, whether it has been encrypted or not. The NETB header carries at least the original encoding standard information and encryption status information. The original encoding standard information identifies the video encoding standard followed by the NETB before encryption, while the encryption status information indicates whether the NETB has undergone encryption processing, enabling the receiving end to quickly identify the stream type and encryption attributes.

[0103] In practical applications, the information contained in the Network Abstraction Layer header (i.e., the Security Extensions (NAL) header) may include:

[0104] 1. Set codec_flag (i.e., original encoding standard information) to identify the original encoding standard.

[0105] 2. Set encryption_idc (i.e., encryption status information, 1 for encryption, 0 for no encryption).

[0106] 3. Store the importance information (temporal_id in H.265 or nal_ref_idc in H.264) from the original NAL header into the temporal_id field (carrying the original importance information).

[0107] 3. Retain the original nal_unit_type (indicating the NAL unit type).

[0108] In specific implementations, in order to be compatible with different encoding standards, this application defines a unified 2-byte security extension NAL header, the syntax of which is shown in the table below.

[0109]

[0110] This header can retain the original NAL unit type and importance information while adding encoding standard identifiers and security status identifiers, serving as a bridge connecting the original bitstream and the securely encapsulated bitstream.

[0111] Step 104: Perform hash signature processing on the encrypted byte stream data of the image group to generate signature data of the image group, and encapsulate the signature data into the authentication network abstraction layer unit.

[0112] The authentication network abstraction layer unit is a dedicated network abstraction layer unit that carries signature data and is used by the recipient to verify the signature.

[0113] After obtaining the encrypted byte stream data of the image group, hash signing processing can be performed on the encrypted byte stream data of the image group to generate signature data for the image group. This signature data is then encapsulated into an authentication network abstraction layer unit. Specifically, hash signing processing can be performed on the encrypted byte stream data obtained from the current image group after encryption processing. A data digest is calculated based on a preset hash algorithm, and signature data used to verify data integrity and legality is generated through a signature algorithm. Subsequently, the signature data can be encapsulated into a separately configured authentication network abstraction layer unit, enabling the authentication information to be carried integrally with the video stream, facilitating synchronous signature verification at the receiving end.

[0114] The process of obtaining signature data can be described in detail below with reference to the specific implementation method.

[0115] In one implementation of this application, step 104 may include sub-step C1 and sub-step C2.

[0116] Sub-step C1: Calculate the hash value corresponding to the encrypted byte stream data.

[0117] In this embodiment, after obtaining the encrypted byte stream data, a hash value can be calculated on the encrypted RBSP data (i.e., the encrypted byte stream data) or on a set of RBSPs containing multiple consecutive NALUs specified by `successive_hash_pictures_minus1`. All encrypted byte stream data that has undergone encryption processing within the current image group (GOP) is extracted. A complete hash operation is performed on the encrypted byte stream data according to a preset hash algorithm type (such as SM3, SHA-256, etc., which can be pre-configured and written into the security parameter set): All bytes of the encrypted byte stream are traversed, and the variable-length encrypted byte stream data is converted into a fixed-length hash value (data digest) through the iterative compression logic of the hash algorithm. During the operation, it is ensured that the first L-1 encrypted bytes and the last unencrypted byte of the encrypted byte stream are covered, guaranteeing that the hash value can completely represent the uniqueness of the encrypted byte stream data. If any data tampering occurs, the hash value will change significantly.

[0118] Sub-step C2: Sign the hash value using the sender's private key to obtain the signature data.

[0119] After obtaining the hash value, the sender's private key can be used to sign the hash value to obtain signed data, ensuring the integrity of the video stream transmission. In the specific implementation, the sender's pre-stored asymmetric encryption private key (paired with the receiver's public key) can be obtained. A preset signature algorithm (such as SM2, with the algorithm type synchronously written into the security parameter set) is used, and the obtained hash value is used as the signature object for signature calculation: first, the hash value is standardized, and then the standardized hash value is encrypted using the private key to generate signature data with unforgeable and non-repudiable characteristics. After signing, the signature data is encapsulated to conform to the data encapsulation specifications of the Network Abstraction Unit (NALU), preparing for subsequent encapsulation into the authentication NALU.

[0120] This application's embodiments calculate a hash value for the encrypted byte stream data and sign it with the sender's private key. The uniqueness of the hash value enables data integrity verification, while the unforgeability of the private key signature ensures the data source's trustworthiness, effectively preventing the encrypted video data from being tampered with or forged during transmission. Simultaneously, the lightweight hash + signature processing method significantly improves the security level of video transmission without substantially increasing the bitstream size. Furthermore, the signature data can be directly encapsulated into the authentication NALU for integrated transmission with the video stream, reducing the complexity of system signature verification.

[0121] Step 105: According to the transmission order of the original bitstream of the image group, encapsulate the security parameter set, the network abstraction layer unit with the network abstraction layer header, the authentication network abstraction layer unit, and the original parameter set of the image group to obtain an encrypted video bitstream; wherein, the original parameter set includes: an encrypted sequence parameter set, an encrypted image parameter set, and image and video data.

[0122] The raw parameter set refers to the set of parameters defined by the video coding standard, including the encrypted sequence parameter set, the encrypted image parameter set, and the image and video data.

[0123] An encrypted video stream is a secure video stream that can be directly transmitted, formed by sequentially encapsulating a security parameter set, an encrypted network abstraction layer unit, an authentication network abstraction layer unit, and the original parameter set.

[0124] After hash signature processing, the security parameter set, the Network Abstraction Layer (NET) unit with the NET header, the authentication NET unit, and the original parameter set of the current image group can be sequentially concatenated and encapsulated according to the transmission sequence of the original video stream of the current image group, forming an encrypted video stream that can be directly transmitted or stored. The original parameter set can include the encrypted sequence parameter set, the encrypted image parameter set, and the image and video data, ensuring the integrity of the video stream structure and decoding compatibility. Simultaneously, standard start codes can be used to separate and connect the units, resulting in a complete byte stream that is a unified secure video stream embedding security parameters, encrypted content, and a digital signature.

[0125] As can be seen from the above scheme, this application defines a unified Security Extended NAL unit structure and a Security Parameter Set (SPS), which is placed at the beginning of the encrypted video data. By modifying the NAL header of encoding methods such as H.265 and H.264, a flag indicating whether the bitstream is encrypted is added. The specific structure is as follows: Figure 2 As shown, it includes:

[0126] 1. Start code: The separator for NAL units.

[0127] 2. Security Parameter Set (SPS): A special NAL unit added in this application.

[0128] 3. Encrypted Sequence Parameter Set: A standard video sequence parameter set containing global encoding information for the video sequence, such as resolution and frame rate.

[0129] 4. Encrypted Picture Parameter Set (PPS): A standard video picture parameter set that contains decoding parameters for picture slices, such as entropy coding mode and number of reference frames.

[0130] 5. Encrypted IDR (Instantaneous Decoding Refresh) image and video data: Encrypted data from instantaneous decoding refresh frames. An IDR frame is a special type of I-frame that contains the encoded information of a complete image.

[0131] 6. Encrypted non-IDR image and video data: Encrypted non-IDR frame data, typically including P-frames and B-frames.

[0132] Step 106: Send the encrypted video stream to the recipient.

[0133] After obtaining the encrypted video stream, the encrypted video stream can be sent to the recipient. The specific sending method can be such as remote communication or local physical connection communication, etc. This embodiment does not limit this.

[0134] The video encryption transmission method provided in this application solves the problems of interception and tampering risks and complex synchronization management caused by the separation of security parameters and video streams in existing technologies by constructing a security parameter set containing key security parameters such as encryption keys and initialization vectors for each image group and encapsulating it together with the video bitstream. By setting a network abstraction layer header containing original encoding standard information for each network abstraction layer unit, unified encryption encapsulation of video streams with different encoding standards is achieved, solving the problems of low system compatibility, high complexity, and high maintenance costs. Furthermore, XOR encryption is performed on the first L-1 bytes of the original data byte stream to achieve precise control of the encryption range, solving the problem of lack of flexibility and adaptability in existing coarse-grained encryption, ultimately achieving highly compatible, highly secure, and highly flexible secure video transmission.

[0135] Reference Figure 3 The diagram illustrates a flowchart of a video decryption and output method provided in an embodiment of this application. This video decryption and output method can be applied to a receiver. Figure 3 As shown, the video decryption output method may include steps 301 to 307.

[0136] Step 301: Receive the encrypted video stream sent by the sender, parse the encrypted video stream, and obtain each network abstraction layer unit.

[0137] The embodiments of this application can be applied to the receiver (i.e., the video receiving device), that is, the executing entity is the receiver.

[0138] The receiver can receive the encrypted video stream sent by the sender and parse it to obtain the Network Abstraction Layer (NALUs). In the specific implementation, the receiver receives the encrypted video stream transmitted by the sender over the network. First, it performs frame synchronization processing on the received stream, identifies and extracts the start code (such as 0x000001 or 0x00000001) from the stream, and uses the start code as the dividing line to segment the encrypted video stream unit by unit, separating all Network Abstraction Layer (NALUs) in the stream, including NALUs corresponding to the security parameter set, video NALUs with Network Abstraction Layer headers, authentication Network Abstraction Layer (NALUs), and NALUs corresponding to the original parameter set. At the same time, it records the receiving order of each NALU to ensure that the subsequent assembly is consistent with the original stream transmission order.

[0139] Step 302: Extract the security parameter set corresponding to each image group in the encrypted video stream, and parse the encrypted video encryption key and initialization vector of the image group from the security parameter set.

[0140] After parsing the network abstraction layer units, the security parameter set corresponding to each image group in the encrypted video stream can be extracted from the parsing results. The encrypted video encryption key and initialization vector for each image group can then be parsed from the security parameter set. Specifically, all network abstraction layer units obtained in step 301 can be type-identified. By identifying the unit type identifier (nal_unit_type) of the NALU, the NALU corresponding to the security parameter set (SPS) for each image group (GOP) can be selected. The payload data (RBSP) of this SPS NALU can then be extracted. The payload data is parsed to extract the encrypted video encryption key (EVEK) and initialization vector (IV) corresponding to the current image group. Simultaneously, auxiliary security parameters such as the encryption algorithm identifier and hash type can be extracted, providing a foundation for subsequent key decryption and stream key generation.

[0141] Step 303: Decrypt the encrypted video encryption key using the corresponding video key encryption key stored locally to obtain the video encryption key for the image group, and determine the stream key based on the video encryption key and the initialization vector.

[0142] After obtaining the encrypted video encryption key and initialization vector, the encrypted video encryption key can be decrypted using the corresponding locally stored video encryption key to obtain the video encryption key for the image group. The stream key is then determined based on this video encryption key and initialization vector. In the specific implementation, the receiver calls the locally pre-stored video encryption key (VKEK) that is consistent with the sender's preset encryption key. Using the same preset encryption algorithm (symmetric encryption algorithm) as the sender when encrypting EVEK, the receiver performs a decryption operation on the encrypted video encryption key (EVEK) obtained in step 302 to restore the video encryption key (VEK) corresponding to the current image group. Subsequently, using the same preset encryption algorithm (such as SM4-OFB mode) used by the sender to generate the stream key, the decrypted VEK is used as the core key, and the IV obtained in step 302 is used as the initial randomization parameter. These are input into the algorithm for iterative processing to generate a stream key that is completely consistent with the encryption key, ensuring that the key used for decryption matches synchronously with the key used for encryption.

[0143] The process of determining the stream key can be described in detail below in conjunction with the implementation method.

[0144] In one implementation of this application, step 303 may include sub-step D1 and sub-step D2.

[0145] Sub-step D1: Determine the preset encryption algorithm based on the encryption algorithm identifier in the security parameter set.

[0146] In this embodiment, the Security Parameter Set (SPS) corresponding to the parsed current Group of Pictures (GOP) can be obtained. The data in the SPS is then precisely parsed to extract the encryption algorithm identifier. This encryption algorithm identifier is a pre-defined standardized identifier (e.g., identifier "01" for the SM4 algorithm and identifier "02" for the AES algorithm), used to clearly identify the encryption algorithm type used by the sender when generating the stream key. The receiver (or the sender when generating the stream key) matches the extracted encryption algorithm identifier with a pre-configured local algorithm mapping table to determine the pre-defined encryption algorithm used for generating the stream key. This ensures that the algorithm is completely consistent with the algorithms used in subsequent encryption and decryption processes, avoiding stream key failure and data encryption / decryption failure due to algorithm mismatch.

[0147] Sub-step D2: Based on the preset encryption algorithm, encrypt the video encryption key and the initialization vector to obtain the stream key.

[0148] The algorithm acquires the core parameters corresponding to the current image group: the video encryption key (VEK) and the initialization vector (IV). VEK is either the original key obtained after decryption (for the receiver) or a randomly generated original key (for the sender). IV is the initial randomized parameter parsed from the security parameter set. Both parameters are ensured to conform to the requirements of the preset encryption algorithm in terms of format and length. Subsequently, the algorithm is activated (preferably in Output Feedback (OFB) mode, such as SM4-OFB). The video encryption key (VEK) is used as the core key input, and the initialization vector (IV) is used as the initial iteration parameter input. The algorithm generates a continuous key sequence, i.e., the stream key, by performing iterative operations and byte expansion on VEK and IV. The generated stream key corresponds one-to-one with the first L-1 bytes of the original data byte stream, ensuring that each byte has a corresponding key byte for subsequent byte-by-byte XOR encryption and decryption, guaranteeing the accuracy and security of encryption and decryption.

[0149] This application embodiment determines the preset encryption algorithm through the encryption algorithm identifier in the security parameter set, realizing dynamic matching and unified management of the algorithm, avoiding the problem of stream key failure caused by inconsistency between the encryption and decryption algorithms, and improving the compatibility and versatility of the scheme. Based on the preset encryption algorithm, a stream key is generated by combining VEK and IV, realizing dynamic generation and adaptation of the key. This not only improves the security of the stream key (avoiding the leakage risk caused by single key reuse), but also ensures that the stream key and the encryption / decryption data are accurately matched, providing reliable support for subsequent byte-by-byte XOR encryption and decryption, while simplifying the key management process, balancing security and practicality.

[0150] Step 304: Identify the network abstraction layer units that have network abstraction layer headers in each network abstraction layer unit, and determine whether the network abstraction layer unit is an encryption unit by the encryption status information of the network abstraction layer header. If it is an encryption unit, extract its encrypted byte stream data.

[0151] After obtaining each Network Abstraction Layer (NALU), the NALUs with NALU headers can be identified. The encryption status information in the NALU header is used to determine if the NALU is an encrypted unit. If it is, its encrypted byte stream data is extracted. Specifically, all the segmented NALUs are identified one by one, and NALUs with the aforementioned NALU headers are selected. Then, the encryption status information in the NALU header is read. The identifier in the encryption status information (e.g., a preset identifier "1" indicates encryption, and "0" indicates no encryption) is used to determine if the NALU is an encrypted unit. If it is determined to be an encrypted unit, the core payload data of the NALU, i.e., the encrypted byte stream data, is extracted. Simultaneously, the NALU identifier corresponding to the encrypted byte stream data is recorded for subsequent association with signature data for verification.

[0152] Step 305: Parse the authentication network abstraction layer unit corresponding to the image group to obtain the signature data of the image group, and perform hash verification processing on the encrypted byte stream data according to the signature data.

[0153] After obtaining the authentication network abstraction unit (ANB) of the image group, the corresponding ARB can be parsed to obtain the signature data of the image group. Then, hash verification processing is performed on the encrypted byte stream data based on the signature data. Specifically, based on the identifier of the current image group, the corresponding ARB can be selected from the NALUs obtained in step 301. The payload data of the authentication NALU is parsed to extract the encapsulated signature data. Subsequently, according to the hash type (such as SM3, SHA-256) parsed from the security parameter set, the extracted signature data is verified to complete the data integrity and source legitimacy verification. The hash verification process can be described in detail below.

[0154] In one implementation of this application, step 305 may include sub-steps E1 to E3.

[0155] Sub-step E1: Calculate the hash value of the encrypted byte stream data based on the hash algorithm type parsed from the security parameter set.

[0156] In this embodiment, the Security Parameter Set (SPS) corresponding to the parsed current image group (GOP) is retrieved, and the payload data (RBSP) of the SPS is precisely parsed to extract the hash algorithm type identifier carried within. This identifier is a preset standardized identifier (such as identifier "01" corresponding to the SM3 algorithm and identifier "02" corresponding to the SHA-256 algorithm), used to clearly identify the algorithm type used by the sender when performing hash signature.

[0157] Subsequently, extract all encrypted byte stream data that need to be verified within the current image group (i.e., the ciphertext data corresponding to the encrypted units selected in the previous steps) to ensure that the data completely covers the first L-1 encrypted bytes and the last unencrypted byte of the encrypted byte stream, so as to avoid deviations in hash value calculation due to missing data.

[0158] Finally, based on the hash algorithm type obtained from the parsing, the corresponding hash algorithm is called to perform a complete hash operation on the extracted encrypted byte stream data. Through the iterative compression logic of the algorithm, the variable-length encrypted byte stream data is converted into a fixed-length hash value (data digest). This hash value uniquely corresponds to the current encrypted byte stream data. If the data is tampered with in any way, the hash value will be significantly different, providing a basis for comparison for subsequent signature verification.

[0159] Sub-step E2: Determine the corresponding sender public key based on the camera certificate identifier obtained from the security parameter set.

[0160] Continue parsing the payload data of the Security Parameter Set (SPS) and extract the camera certificate identifier (camera_idc) carried within it. This identifier is the unique identity of the sending camera and corresponds one-to-one with the sending digital certificate. It is used to verify the legitimacy of the sending identity.

[0161] Subsequently, the receiver invokes a pre-stored certificate mapping table (which pre-stores the association between camera certificate identifiers and corresponding public keys of all trusted senders). It precisely matches the parsed camera certificate identifiers with the identifiers in the mapping table, filtering out the sender's digital certificate corresponding to that identifier and extracting the sender's public key from the digital certificate. This public key exists in pairs with the private key used by the sender for signing. It can only be used for signature verification and cannot be used for data encryption or signing, ensuring the security and exclusivity of the public key. Simultaneously, it guarantees that the extracted public key perfectly matches the private key used by the sender for signing, ensuring the accuracy of subsequent signature verification.

[0162] Sub-step E3: Perform signature verification processing on the encrypted byte stream data based on the sender's public key.

[0163] Extract the signature data corresponding to the current image group that has been parsed (i.e., the sender's signature result extracted from the authentication network abstraction layer unit), perform format standardization processing on the signature data, restore it to the original format that can be used for signature verification calculation, and ensure that it is consistent with the output format when the sender signs.

[0164] Subsequently, the same signature algorithm used by the sender (such as SM2, RSA, etc., the algorithm type can be synchronously parsed from the security parameter set) is invoked. The local hash value calculated in sub-step E1, the sender's public key determined in sub-step E2, and the standardized signature data are input into the verification algorithm. During the verification process, the algorithm decrypts the signature data using the sender's public key to restore the original hash value calculated by the sender during signing. This original hash value is then compared byte-by-byte with the hash value calculated locally in sub-step E1.

[0165] If the two are completely consistent, the signature verification is deemed successful, confirming that the encrypted byte stream data is complete, has not been tampered with, and originates from a trusted sender. If the two are inconsistent, the signature verification is deemed unsuccessful, the subsequent decryption process is immediately terminated, a security alarm is triggered, and the relevant data is discarded.

[0166] The hash algorithm type in the security parameter set of this application determines the hash algorithm used for signature verification, ensuring consistency with the sender's hash operation logic and avoiding verification failure due to algorithm differences, thus improving verification accuracy. By associating the camera certificate identifier with the sender's public key, accurate verification of the sender's identity is achieved, preventing data injection by unauthorized senders. Signature verification is performed based on the sender's public key and the signature data. Utilizing the pairing characteristics of public and private keys, dual verification of the integrity and legitimacy of the encrypted data's source is achieved, effectively preventing data from being tampered with or forged during transmission. Simultaneously, the signature verification process is simplified, balancing security and efficiency, and providing a secure prerequisite for subsequent decryption.

[0167] Step 306: After the signature verification is successful, the first L-1 bytes of the encrypted byte stream data are XORed using the stream key to obtain the original data byte stream, where L is the total number of bytes in the original data byte stream; the header of the network abstraction layer unit is restored to its original network abstraction layer header conforming to the original video encoding standard before encryption by using the original encoding standard information of the network abstraction layer header.

[0168] After successful signature verification, the first L-1 bytes of the encrypted byte stream data can be XORed using the stream key to obtain the original data byte stream, where L is the total number of bytes in the original data byte stream. Then, using the original encoding standard information in the Network Abstraction Layer (RBSP) header, the header of the RBSP unit is restored to its original RBSP header conforming to the original video encoding standard before encryption. In specific implementation, if the signature verification result in step 305 is successful (i.e., the hash value obtained from the signature verification is consistent with the locally calculated hash digest), the decryption process is initiated: First, determine the total number of bytes L of the original data byte stream corresponding to the current encrypted byte stream data (consistent with the L used by the sender during encryption). Using the stream key generated in step 303, perform an XOR operation byte-by-byte on the first L-1 bytes of the encrypted byte stream data (the reverse of the XOR operation used by the sender during encryption) to obtain the first L-1 decrypted original bytes. Combine the first L-1 decrypted bytes with the last unencrypted byte in the encrypted byte stream data to restore the complete original data byte stream (RBSP). Simultaneously, the original encoding standard information (such as H.264 and H.265 identifiers) in the Network Abstraction Layer (NALU) header is read. Based on this information, the security extension header of the current NALU is restored to the original NALU header that conforms to the corresponding original video encoding standard before encryption, ensuring that the NALU meets the recognition requirements of the standard decoder.

[0169] The process of processing encrypted byte stream data to obtain the original data byte stream can be described in detail in conjunction with the following implementation method.

[0170] In one implementation of this application, step 306 may include sub-step F1 and sub-step F2.

[0171] Sub-step F1: Perform an XOR operation on the first L-1 bytes of the encrypted byte stream data using the stream key to obtain the initial byte stream.

[0172] In this embodiment, the generated stream key can be retrieved (this stream key is completely consistent with the stream key generated by the sender during encryption, and is generated based on the video encryption key (VEK) and initialization vector (IV) according to a preset encryption algorithm), and the encrypted byte stream data to be decrypted can be extracted at the same time. The total number of bytes L of the original data byte stream corresponding to the encrypted byte stream data can be determined (consistent with the L determined by the sender during encryption, which can be obtained by parsing the network abstraction layer unit payload length).

[0173] Subsequently, the first L-1 bytes of the encrypted byte stream data are selected (this part is the ciphertext part encrypted by the sender using the stream key XOR). According to the principle of "byte-by-byte correspondence", each byte of the stream key is XORed with the first L-1 bytes of the encrypted byte stream in turn. This operation is completely reversed from the XOR operation when the sender encrypts, that is, when encrypting, "original byte ⊕ stream key byte = encrypted byte", and when decrypting, "encrypted byte ⊕ stream key byte = original byte".

[0174] After the operation is completed, a sequence consisting of the first L-1 original bytes is obtained, which is the initial byte stream. It is ensured that the initial byte stream is completely consistent with the first L-1 bytes of the original data byte stream before encryption by the sender.

[0175] Sub-step F2: Combine the initial byte stream with the unencrypted last byte stream data to obtain the original data byte stream.

[0176] Extract the last unencrypted byte from the current encrypted byte stream data (this byte is the unencrypted part that the sender deliberately kept during encryption to ensure bit stream compatibility and avoid decoding anomalies), and confirm that this byte has not been tampered with (data integrity has been verified through the hash signature verification step mentioned above).

[0177] Subsequently, following the original order of the original data byte stream, the initial byte stream (the first L-1 original bytes) obtained in sub-step F1 is concatenated with the last unencrypted byte in an ordered manner. The concatenated result forms a complete byte sequence, which is the original data byte stream (RBSP). During the concatenation process, it is ensured that the byte order is completely consistent with the original data byte stream before encryption by the sender, without any misalignment or missing bytes, thus guaranteeing the accuracy of subsequent reconstruction of the network abstraction layer unit and video decoding.

[0178] This application employs an XOR operation reversed with the sender's input, combined with a synchronously generated stream key, to decrypt the first L-1 bytes of the encrypted byte stream. This ensures that the decrypted data is completely identical to the original data, guaranteeing decryption accuracy. By concatenating the last unencrypted byte, it avoids the bitstream compatibility issues caused by full encryption, simplifies the decryption process, and relies on the aforementioned signature verification to ensure the integrity of the unencrypted bytes. Ultimately, it achieves accurate reconstruction of the original data byte stream, providing reliable raw data support for subsequent network abstraction layer header reconstruction and video decoding, thus balancing decryption security, compatibility, and efficiency.

[0179] Step 307: According to the original bitstream transmission order of the image group, assemble the recovered network abstraction layer unit and the original parameter set of the image group, and send them to the video decoder for decoding to output the video frame sequence of the image group.

[0180] After completing the above operations, the NALU recovered in step 306 with the original network abstraction layer header can be sequentially assembled with the original parameter set of the image group (including the encrypted sequence parameter set, encrypted image parameter set, and image / video data) extracted in step 301, according to the transmission order of the original bitstream of the current image group. This ensures that the assembled bitstream structure is consistent with the timing and structure of the original bitstream sent by the sender. The assembled standard video bitstream is then sent to the video decoder. The video decoder decodes the bitstream according to the decoding process of the corresponding video encoding standard, and finally outputs the video frame sequence of the current image group for subsequent playback, storage, or analysis. When the security parameter set corresponding to the next image group is parsed, steps 301-307 are repeated to achieve the decryption and playback of continuous video frames.

[0181] The video decryption output method provided in this application obtains a security parameter set by parsing the encrypted video stream and decrypts it to obtain the video encryption key and stream key. Combined with the network abstraction layer header, it achieves encryption status identification and original header restoration, enabling compatibility with video stream decryption and decoding of different encoding standards. By performing hash verification on the encrypted byte stream data, the integrity and trustworthiness of data transmission are ensured. Accurate decryption is achieved by performing an XOR operation on the first L-1 bytes of the encrypted byte stream data to restore the original data byte stream, adapting to fine-grained encryption strategies. After decryption, the data can be directly sent to a standard decoder to output video frames, thereby improving system compatibility, security, and decryption flexibility while reducing decoding complexity.

[0182] The technical solution of this embodiment will be described in detail below, taking a video surveillance system as an example.

[0183] Suppose a city's video surveillance system uses smart cameras that support H.265 encoding at the front end, and a storage and playback system that supports H.264 decoding at the back end. The system needs to implement end-to-end content encryption during video transmission and ensure that video streams with different encoding standards can be uniformly encapsulated and securely transmitted.

[0184] After the camera captures video, it encodes it according to GOP (e.g., 30 frames per GOP) and initiates the secure encapsulation process.

[0185] I. Initialization.

[0186] 1. At the start of the first GOP, the encoder randomly generates a 128-bit VEK and a 128-bit IV. The VEK is encrypted using the preset VKEK through the SM4_ECB algorithm to obtain EVEK.

[0187] 2. Construct a security parameter set SPS, whose RBSP encapsulates parameters such as encryption_type, EVEK, IV, camera_id, hash_type, signature_type, and authentication_flag.

[0188] 2. Video data encryption.

[0189] 1. RBSP data of all VCL NAL units (such as coded slices of I-frames and P-frames) within the GOP ( Encrypt:

[0190] (1) Generate stream keys using VEK and IV in SM4_OFB mode. .

[0191] (2) Perform XOR encryption on all bytes of the RBSP except the last byte. encrypt the data As a new RBSP.

[0192] 2. Assemble a unified security extension NAL header for each encrypted VCL NAL unit:

[0193] codec_flag=0 (indicates H.265)

[0194] encryption_idc=1 (indicates encryption is enabled)

[0195] The temporal_id field should be filled with the nuh_temporal_id_plus1 value from the original H.265 header.

[0196] III. Digital Signatures.

[0197] 1. Calculate the hash value for the encrypted RBSP data or the RBSP set of multiple consecutive NALUs specified by successive_hash_pictures_minus1. .

[0198] 2. Sign the hash value using the sender's private key SK to ensure the integrity of the video stream transmission. .

[0199] 3. The signature data is encapsulated as additional authentication data in a separate authentication NAL unit.

[0200] IV. Stream encapsulation.

[0201] 1. Arrange all NAL units (including SPS, encrypted VCL NALU, certified NAL units and other parameter set NALUs, etc.) in the encoding order of the original bitstream, and use standard start codes for separation and connection.

[0202] 2. The resulting complete byte stream is a unified secure video stream with embedded security parameters, encrypted content, and digital signature.

[0203] V. Decryption and playback at the receiving end.

[0204] 1. The receiver identifies the SPS NAL unit and extracts the RBSP ciphertext data, EVEK, and IV.

[0205] 2. Read and parse the associated authentication NAL unit to obtain the signature data: (1) For the received ciphertext data Calculate the hash value. (2) Based on camera_idc, obtain the corresponding sender's public key and perform signature verification: (3) Verification passed: This proves that the currently received encrypted data packet is complete and comes from a trusted sender, and decryption is allowed.

[0206] 3. Use the local VKEK to decrypt EVEK to obtain VEK.

[0207] 4. Perform the following operations on each subsequent VCL NAL unit:

[0208] (1) Check encryption_idc. If it is 1, use VEK and IV to generate the same stream key through SM4_OFB. Decrypting RBSP .

[0209] (2) Restore the original H.265 or H.264 NAL header based on codec_flag and temporal_id.

[0210] 5. The restored standard NAL units are sent to the decoder for decoding in the original bitstream encoding order to play the complete video stream.

[0211] Reference Figure 4 The diagram illustrates a structural schematic of a video encryption transmission device provided in an embodiment of this application. This video encryption transmission device can be applied to the sender. Figure 4 As shown, the video encryption transmission device 400 may include the following modules:

[0212] The parameter set construction module 410 is used to construct a secure parameter set for each image group in the original video bitstream based on the generated encrypted video encryption key and initialization vector of the image group.

[0213] The encrypted data acquisition module 420 is used to perform an XOR operation on the first L-1 bytes of the original data byte stream using a stream key to obtain encrypted byte stream data; the stream key is determined based on the initialization vector and the video encryption key, the original data byte stream is the byte stream of the network abstraction layer unit that needs to be encrypted within the image group, and L is the total number of bytes in the original data byte stream;

[0214] The header setting module 430 is used to set a network abstraction layer header for each network abstraction layer unit after the processing of the image group. The network abstraction layer header includes at least: original encoding standard information and encryption status information.

[0215] The signature data generation module 440 is used to perform hash signature processing on the encrypted byte stream data of the image group, generate signature data of the image group, and encapsulate the signature data into the authentication network abstraction layer unit;

[0216] The encrypted stream acquisition module 450 is used to encapsulate the security parameter set, the network abstraction layer unit with the network abstraction layer header, the authentication network abstraction layer unit, and the original parameter set of the image group according to the transmission order of the original bitstream of the image group to obtain an encrypted video bitstream; wherein, the original parameter set includes: an encrypted sequence parameter set, an encrypted image parameter set, and image and video data;

[0217] The encrypted stream sending module 460 is used to send the encrypted video stream to the receiver.

[0218] Optionally, the parameter set construction module includes:

[0219] A generation unit is used to randomly generate a video encryption key and an initialization vector;

[0220] An encryption unit is used to encrypt the video encryption key using a preset video key encryption key through a preset encryption algorithm to obtain the encrypted video encryption key;

[0221] A construction unit is configured to construct the security parameter set based on the initialization vector and the encrypted video encryption key;

[0222] The security parameter set also includes: whether encryption fields are supported, whether authentication fields are supported, encryption algorithm identifier, key vector carrying indicator field, source device identifier, encryption algorithm field of video encryption key, signature algorithm type, camera certificate identifier, hash algorithm type, and number of image frames for hash calculation.

[0223] Optionally, the encrypted data acquisition module includes:

[0224] A key acquisition unit is used to process the video encryption key and the initialization vector based on the preset encryption algorithm to obtain the stream key;

[0225] The data acquisition unit is used to perform a byte-by-byte XOR operation on the first L-1 bytes of the original data byte stream using the stream key to obtain the encrypted byte stream data.

[0226] Optionally, the signature data generation module includes:

[0227] A hash value calculation unit is used to calculate the hash value corresponding to the encrypted byte stream data;

[0228] The signature data acquisition unit is used to sign the hash value using the sender's private key to obtain the signature data.

[0229] The video encryption transmission device provided in this application solves the problems of interception and tampering risks and complex synchronization management caused by the separation of security parameters and video streams in the prior art by constructing a security parameter set containing key security parameters such as encryption keys and initialization vectors for each image group and encapsulating it together with the video bitstream. By setting a network abstraction layer header containing the original encoding standard information for each network abstraction layer unit, unified encryption encapsulation of video streams with different encoding standards is achieved, solving the problems of low system compatibility, high complexity, and high maintenance costs. Furthermore, by performing XOR encryption on the first L-1 bytes of the original data byte stream, precise control of the encryption range is achieved, solving the problem of lack of flexibility and adaptability of existing coarse-grained encryption, ultimately realizing highly compatible, highly secure, and highly flexible secure video transmission.

[0230] Reference Figure 5 The diagram illustrates a structural schematic of a video decryption output device provided in an embodiment of this application. This video decryption output device can be applied to a receiving method. Figure 5 As shown, the video decryption output device 500 may include the following modules:

[0231] Abstraction layer acquisition module 510 is used to receive the encrypted video stream sent by the sender, parse the encrypted video stream, and obtain each network abstraction layer unit;

[0232] Information extraction module 520 is used to extract the security parameter set corresponding to each image group in the encrypted video stream, and parse the encrypted video encryption key and initialization vector of the image group from the security parameter set;

[0233] The stream key determination module 530 is used to decrypt the encrypted video encryption key using the corresponding video key encryption key stored locally to obtain the video encryption key of the image group, and to determine the stream key based on the video encryption key and the initialization vector.

[0234] The data extraction module 540 is used to identify the network abstraction layer units that have a network abstraction layer header in each network abstraction layer unit, and to determine whether the network abstraction layer unit is an encryption unit by the encryption status information of the network abstraction layer header. If it is an encryption unit, its encrypted byte stream data is extracted.

[0235] The signature verification processing module 550 is used to parse the authentication network abstraction layer unit corresponding to the image group to obtain the signature data of the image group, and perform hash signature verification processing on the encrypted byte stream data according to the signature data.

[0236] The header recovery module 560 is used to perform an XOR operation on the first L-1 bytes of the encrypted byte stream data using the stream key after the signature verification is passed, to obtain the original data byte stream, where L is the total number of bytes in the original data byte stream; and to restore the header of the network abstraction layer unit to its original network abstraction layer header that conforms to the original video encoding standard before encryption by using the original encoding standard information of the network abstraction layer header.

[0237] The video frame sequence output module 570 is used to assemble the recovered network abstraction layer unit and the original parameter set of the image group according to the original bitstream transmission order of the image group, and send them to the video decoder for decoding, so as to output the video frame sequence of the image group.

[0238] Optionally, the signature verification processing module includes:

[0239] The hash value calculation unit is used to calculate the hash value of the encrypted byte stream data according to the hash algorithm type parsed from the security parameter set;

[0240] The public key determination unit is used to determine the corresponding sender's public key based on the camera certificate identifier obtained from the security parameter set;

[0241] The signature verification processing unit is used to perform signature verification processing on the encrypted byte stream data based on the sender's public key.

[0242] Optionally, the stream key determination module includes:

[0243] An encryption algorithm determination unit is used to determine a preset encryption algorithm based on the encryption algorithm identifiers in the security parameter set;

[0244] The stream key acquisition unit is used to encrypt the video encryption key and the initialization vector based on the preset encryption algorithm to obtain the stream key.

[0245] Optionally, the head recovery module includes:

[0246] The byte stream acquisition unit is used to perform an XOR operation on the first L-1 bytes of the encrypted byte stream data using the stream key to obtain an initial byte stream.

[0247] The raw stream acquisition unit is used to combine the initial byte stream with the unencrypted last byte stream data to obtain the raw data byte stream.

[0248] The video decryption output device and method provided in this application embodiment obtain a security parameter set by parsing the encrypted video stream and decrypting it to obtain the video encryption key and stream key. Combined with the network abstraction layer header, they achieve encryption status identification and original header restoration, enabling compatibility with video stream decryption and decoding of different encoding standards. By performing hash verification on the encrypted byte stream data, the integrity and trustworthiness of data transmission are ensured. By performing an XOR operation on the first L-1 bytes of the encrypted byte stream data to restore the original data byte stream, accurate decryption is achieved, adapting to fine-grained encryption strategies. After decryption, the data can be directly sent to a standard decoder to output video frames, thereby improving system compatibility, security, and decryption flexibility while reducing decoding complexity.

[0249] This application also provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the above-described video encryption transmission method or the above-described video decryption output method.

[0250] Figure 6 A schematic diagram of the structure of an electronic device 600 according to an embodiment of the present invention is shown. Figure 6 As shown, the electronic device 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to computer program instructions stored in read-only memory (ROM) 602 or loaded from storage unit 608 into random access memory (RAM) 603. The RAM 603 may also store various programs and data required for the operation of the electronic device 600. The CPU 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0251] Multiple components in electronic device 600 are connected to I / O interface 605, including: input unit 606, such as keyboard, mouse, microphone, etc.; output unit 607, such as various types of displays, speakers, etc.; storage unit 608, such as disk, optical disk, etc.; and communication unit 609, such as network card, modem, wireless transceiver, etc. Communication unit 609 allows electronic device 600 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0252] The various processes and handling described above can be executed by processing unit 601. For example, the methods of any of the above embodiments can be implemented as computer software programs tangibly contained in a computer-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by CPU 601, one or more actions of the methods described above can be performed.

[0253] Additionally, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned video encryption transmission method or the aforementioned video decryption output method.

[0254] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal that includes said element.

Claims

1. A method for encrypted video transmission, characterized in that, Applied to the sender, the method includes: For each group of images in the original video stream, a video encryption key and an initialization vector are randomly generated; By using a preset encryption algorithm, the video encryption key is encrypted with a preset video key encryption key to obtain an encrypted video encryption key; Based on the initialization vector and the encrypted video encryption key, a security parameter set is constructed; wherein, the security parameter set further includes: whether encryption fields are supported, whether authentication fields are supported, encryption algorithm identifier, key vector carrying indicator field, source device identifier, encryption algorithm field of video encryption key, signature algorithm type, camera certificate identifier, hash algorithm type, and hash calculation image frame number; The first L-1 bytes of the original data byte stream are XORed using a stream key to obtain encrypted byte stream data; the stream key is determined based on the initialization vector and the video encryption key; the original data byte stream is the byte stream of the network abstraction layer unit that needs to be encrypted within the image group; and L is the total number of bytes in the original data byte stream. A network abstraction layer header is set for each network abstraction layer unit after the processing of the image group. The network abstraction layer header includes at least: original coding standard information and encryption state information. The encrypted byte stream data of the image group is hash-signed to generate signature data for the image group, and the signature data is encapsulated into the authentication network abstraction layer unit; According to the transmission order of the original bitstream of the image group, the security parameter set, the network abstraction layer unit with the network abstraction layer header, the authentication network abstraction layer unit, and the original parameter set of the image group are encapsulated to obtain an encrypted video bitstream; wherein, the original parameter set includes: an encrypted sequence parameter set, an encrypted image parameter set, and image and video data; The encrypted video stream is sent to the recipient.

2. The method according to claim 1, characterized in that, The method of XORing the first L-1 bytes of the original data byte stream using a stream key to obtain encrypted byte stream data includes: The video encryption key and the initialization vector are processed based on the preset encryption algorithm to obtain the stream key; Using the stream key, the first L-1 bytes of the original data byte stream are XORed byte by byte to obtain the encrypted byte stream data.

3. The method according to claim 1, characterized in that, The step of performing hash signature processing on the encrypted byte stream data of the image group to generate signature data for the image group includes: The hash value corresponding to the encrypted byte stream data is calculated; The hash value is signed using the sender's private key to obtain the signature data.

4. A video decryption and output method, characterized in that, Applied to the receiver, the method includes: Receive the encrypted video stream sent by the sender, parse the encrypted video stream, and obtain each network abstraction layer unit; Extract the security parameter set corresponding to each image group in the encrypted video stream, and parse the encrypted video encryption key and initialization vector of the image group from the security parameter set; The encrypted video encryption key is decrypted using the corresponding video key encryption key stored locally to obtain the video encryption key for the image group, and the stream key is determined based on the video encryption key and the initialization vector. Identify the network abstraction layer units that have a network abstraction layer header in each network abstraction layer unit, and determine whether the network abstraction layer unit is an encryption unit by the encryption status information of the network abstraction layer header. If it is an encryption unit, extract its encrypted byte stream data. The authentication network abstraction layer unit corresponding to the image group is parsed to obtain the signature data of the image group, and the encrypted byte stream data is hashed and verified based on the signature data. After the signature verification is successful, the first L-1 bytes of the encrypted byte stream data are XORed using the stream key to obtain the original data byte stream, where L is the total number of bytes in the original data byte stream; the header of the network abstraction layer unit is restored to its original network abstraction layer header conforming to the original video encoding standard before encryption by using the original encoding standard information of the network abstraction layer header. According to the original bitstream transmission order of the image group, the recovered network abstraction layer unit and the original parameter set of the image group are assembled and sent to the video decoder for decoding to output the video frame sequence of the image group.

5. The method according to claim 4, characterized in that, The step of performing hash verification processing on the encrypted byte stream data based on the signature data includes: The hash value of the encrypted byte stream data is calculated based on the hash algorithm type parsed from the security parameter set; The corresponding sender's public key is determined based on the camera certificate identifier parsed from the security parameter set; The encrypted byte stream data is verified using the sender's public key.

6. The method according to claim 4, characterized in that, The step of determining the stream key based on the video encryption key and the initialization vector includes: The preset encryption algorithm is determined based on the encryption algorithm identifier in the security parameter set; Based on the preset encryption algorithm, the video encryption key and the initialization vector are encrypted to obtain the stream key.

7. The method according to claim 4, characterized in that, The step of performing an XOR operation on the first L-1 bytes of the encrypted byte stream data using the stream key to obtain the original data byte stream includes: The first L-1 bytes of the encrypted byte stream data are XORed using the stream key to obtain the initial byte stream; The initial byte stream is combined with the unencrypted last byte stream data to obtain the original data byte stream.

8. A video encryption transmission device, characterized in that, Applied to the sender, the device includes: The parameter set construction module is used to randomly generate a video encryption key and an initialization vector for each image group in the original video stream; encrypt the video encryption key using a preset encryption algorithm and a preset video key encryption key to obtain the encrypted video encryption key; and construct a security parameter set based on the initialization vector and the encrypted video encryption key; wherein the security parameter set further includes: whether encryption fields are supported, whether authentication fields are supported, encryption algorithm identifier, key vector carrying indicator field, source device identifier, encryption algorithm field of video encryption key, signature algorithm type, camera certificate identifier, hash algorithm type, and hash calculation image frame number; The encrypted data acquisition module is used to perform an XOR operation on the first L-1 bytes of the original data byte stream using a stream key to obtain encrypted byte stream data; the stream key is determined based on the initialization vector and the video encryption key, the original data byte stream is the byte stream of the network abstraction layer unit that needs to be encrypted within the image group, and L is the total number of bytes in the original data byte stream; A header setting module is used to set a network abstraction layer header for each network abstraction layer unit after the processing of the image group. The network abstraction layer header includes at least: original encoding standard information and encryption state information. The signature data generation module is used to perform hash signature processing on the encrypted byte stream data of the image group, generate the signature data of the image group, and encapsulate the signature data into the authentication network abstraction layer unit; The encrypted stream acquisition module is used to encapsulate the security parameter set, the network abstraction layer unit with the network abstraction layer header, the authentication network abstraction layer unit, and the original parameter set of the image group according to the transmission order of the original bitstream of the image group to obtain an encrypted video bitstream; wherein, the original parameter set includes: an encrypted sequence parameter set, an encrypted image parameter set, and image and video data; An encrypted stream sending module is used to send the encrypted video stream to the receiver.

9. A video decryption output device, characterized in that, Applied to the receiver, the device includes: The abstract layer acquisition module is used to receive the encrypted video stream sent by the sender, parse the encrypted video stream, and obtain each network abstract layer unit. The information extraction module is used to extract the security parameter set corresponding to each image group in the encrypted video stream, and to parse the encrypted video encryption key and initialization vector of the image group from the security parameter set; The stream key determination module is used to decrypt the encrypted video encryption key using the corresponding video key encryption key stored locally to obtain the video encryption key of the image group, and to determine the stream key based on the video encryption key and the initialization vector. The data extraction module is used to identify the network abstraction layer units that have a network abstraction layer header in each network abstraction layer unit, and to determine whether the network abstraction layer unit is an encryption unit by the encryption status information of the network abstraction layer header. If it is an encryption unit, its encrypted byte stream data is extracted. The signature verification processing module is used to parse the authentication network abstraction layer unit corresponding to the image group to obtain the signature data of the image group, and perform hash signature verification processing on the encrypted byte stream data based on the signature data; The header recovery module is used to perform an XOR operation on the first L-1 bytes of the encrypted byte stream data using the stream key after the signature verification is passed, to obtain the original data byte stream, where L is the total number of bytes in the original data byte stream; and to restore the header of the network abstraction layer unit to its original network abstraction layer header that conforms to the original video encoding standard before encryption by using the original encoding standard information of the network abstraction layer header. The video frame sequence output module is used to assemble the recovered network abstraction layer unit and the original parameter set of the image group according to the original bitstream transmission order of the image group, and send them to the video decoder for decoding to output the video frame sequence of the image group.

Images