Data transmission protection method and device of hardware cryptographic algorithm based on SRTP protocol

Abstract

The invention relates to a data transmission protection method and device for a hardware state cryptographic algorithm based on an SRTP protocol, belongs to the technical field of communication, and solves the problems that an open source soft algorithm used by the SRTP protocol in the prior art is relatively low in security, consumes too much CPU and is low in cryptographic operation efficiency. The method comprises the following specific steps: a video conference terminal A processes an input image by using a media processing module to obtain a plurality of original RTP data packets, and sends the original RTP data packets to an SRTP processing module of the video conference terminal A through asynchronous communication; the SRTP processing module encapsulates each original RTP data packet into an RTP data packet with a customized data structure, and sends the RTP data packet to the cryptographic device Ta; the cryptographic device Ta performs encryption authentication calculation based on an SM4 cryptographic algorithm and an SM3 authentication algorithm, and transmits an encrypted RTP data packet back to the SRTP processing module; and the SRTP processing module encapsulates the returned data into an SRTP data packet, returns the SRTP data packet to the media processing module again through asynchronous communication, and then transmits the SRTP data packet to the video conference terminal B, so that the security and integrity of video data transmission are realized.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a data transmission protection method and apparatus based on a hardware-based national cryptographic algorithm of the SRTP protocol. Background Technology

[0002] In video conferencing systems, the Secure Real-time Transport Protocol (SRTP) is often used to protect audio and video data packets during transmission. SRTP uses a symmetric encryption algorithm to encrypt the payload of Real-time Transport Protocol (RTP) data packets and a key-based hash authentication code (HMAC) algorithm to provide integrity protection and message authentication.

[0003] First, the current SRTP protocol's RFC3711 specification uses AES_ICM and AES_GCM encryption algorithms and HMAC-SHA1 authentication algorithm. Both encryption and authentication algorithms are internationally open-source software algorithms, and the SHA1 algorithm has been announced to have been cracked by hacker groups, significantly compromising its security. Second, with the rapid increase in demand for higher image quality in video conferencing (such as 4K and 8K resolution), the frequency of cryptographic operations called during SRTP packet processing is higher. Using software algorithms leads to significant CPU consumption, affecting the normal operation of other system modules. Finally, the SRTP protocol currently uses a synchronous interface, meaning that processing each RTP packet requires waiting for the previous RTP packet to complete, resulting in packet blocking. Therefore, the open-source software algorithms currently used in the SRTP protocol have drawbacks such as low security, excessive CPU consumption, and low cryptographic operation efficiency. Summary of the Invention

[0004] Based on the above analysis, the embodiments of the present invention aim to provide a data transmission protection method and apparatus based on the SRTP protocol and a hardware-based national cryptographic algorithm, in order to solve the problems of low security, excessive CPU consumption, and low cryptographic operation efficiency in existing video conferencing systems.

[0005] The objective of this invention is mainly achieved through the following technical solutions:

[0006] On one hand, embodiments of the present invention provide a data transmission protection method based on the SRTP protocol and a hardware-based national cryptographic algorithm, comprising the following steps:

[0007] Video conferencing terminal A uses its media processing module to process the input image into several original RTP data packets, and then sends them to its own SRTP processing module via asynchronous communication.

[0008] The SRTP processing module encapsulates the data to be encrypted extracted from each original RTP data packet into RTP data packets with a customized data structure and sends them to the cryptographic device Ta.

[0009] The cryptographic device Ta encrypts the payload of each customized RTP data packet based on the SM4 cryptographic algorithm to obtain ciphertext, and uses the SM3 authentication algorithm based on the ciphertext to obtain the message authentication code. The encrypted RTP data packet carrying the ciphertext and the message authentication code is then sent back to the SRTP processing module.

[0010] The SRTP processing module encapsulates the returned encrypted RTP data packets into SRTP data packets, and then sends them back to the media processing module via asynchronous communication. The media processing module then transmits the data to the video conferencing terminal B.

[0011] Furthermore, the asynchronous communication is implemented using the SRTP processing module based on the customized data structure and two-layer callback functions, including:

[0012] The media processing module of video conferencing terminal A uses the SRTP processing module to initialize the asynchronous interface;

[0013] The media processing module registers a first-level callback function, and the SRTP processing module registers a second-level callback function.

[0014] The cryptographic device returns the corresponding data packet to the SRTP processing module based on the second-level callback function;

[0015] The SRTP processing module triggers a first-level callback function based on the returned data, and sends the corresponding data packet back to the media processing module.

[0016] Furthermore, the customized data structure adds encryption / decryption offset, encryption / decryption length, authentication calculation offset, authentication calculation length, transmission mode, and message authentication code to the payload portion of the RTP / SRTP data packet.

[0017] Furthermore, the initialization of the asynchronous interface includes:

[0018] Initialize the asynchronous interface session context;

[0019] Import the symmetric encryption / decryption key of SM4 ECB and the authentication key of HMAC-SM3; wherein, the encryption / decryption key and the authentication key are generated by combining the SRTP master key obtained through key negotiation with the key derivation algorithm;

[0020] Initialize the cryptographic device session association SRTP processing module context, which is used to distinguish the asynchronous communication channels between the SRTP processing module and the cryptographic device based on the transmission mode in the customized data structure; the transmission mode includes a receive mode and a send mode.

[0021] Furthermore, the payload of each customized RTP packet is encrypted using ECB mode based on the SM4 cryptographic algorithm, including:

[0022] The payload data to be encrypted is extracted from the customized RTP data packet based on the encryption / decryption offset and encryption / decryption length.

[0023] The payload data is encrypted using the encryption / decryption key to obtain ciphertext.

[0024] Furthermore, the message authentication code obtained based on the ciphertext using the SM3 authentication algorithm includes:

[0025] Based on the authentication calculation offset and authentication calculation length, the corresponding data to be authenticated is extracted from the customized RTP data packet containing the ciphertext;

[0026] The authentication key is used to perform HMAC-SM3 operation on the data to be processed to generate a message authentication code.

[0027] Furthermore, the video conferencing terminal B utilizes its own SRTP processing module and cryptographic device Tb to perform authentication, verification, and decryption processing on the received SRTP data packets based on the asynchronous communication, thereby obtaining parsed RTP data packets, which are then processed to produce an output image.

[0028] Furthermore, the authentication, verification, and decryption processing of the received SRTP data packets includes:

[0029] The authentication data is extracted from the customized SRTP data packet based on the authentication calculation offset and authentication calculation length.

[0030] Perform HMAC-SM3 authentication on the data to be authenticated to obtain message authentication code F';

[0031] If the message authentication code F' matches the message authentication code contained in the SRTP data packet, the verification passes; otherwise, the verification fails.

[0032] After verification, the data to be decrypted is extracted from the payload of the SRTP data packet according to the encryption / decryption offset and encryption / decryption length, and then decrypted using the symmetric algorithm SM4 ECB mode.

[0033] On the other hand, embodiments of the present invention provide a data transmission protection device based on the SRTP protocol and a hardware-based national cryptographic algorithm, comprising:

[0034] An encoder is used to compress captured video input images into standard video frames when transmitting video conferences;

[0035] The media processing module is used to encapsulate the standard video frames into several original RTP data packets during video conference transmission, and send the several original RTP data packets to the SRTP processing module through asynchronous communication; it is also used to transmit each SRTP data packet returned by the SRTP processing module to the video conference receiving terminal.

[0036] The SRTP processing module is used to encapsulate the data to be encrypted extracted from each original RTP data packet into RTP data packets with a customized data structure and send them to the cryptographic device during video conferencing; it is also used to encapsulate the encrypted RTP data packets returned by the cryptographic device into SRTP data packets and send them back to the media processing module again via asynchronous communication.

[0037] A cryptographic device is used to perform symmetric algorithm encryption, decryption, and authentication calculations on data packets sent by the SRTP processing module based on an asynchronous interface, and then send the data back to the SRTP processing module.

[0038] A decoder is used to decode standard video frames during video conferencing reception.

[0039] A display device used to display the output image obtained after decoding.

[0040] Furthermore, during video conference reception, the SRTP processing module is also used to send the received SRTP data to the cryptographic device; to send the SRTP data packets returned by the cryptographic device back to the media processing module via asynchronous communication; the media processing module is also used to send the received SRTP data packets to the SRTP processing module; and to assemble several RTP data packets returned by the SRTP processing module into standard video frames.

[0041] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0042] 1. This invention proposes an asynchronous call process based on the SRTP protocol framework. It completes hardware encryption with cryptographic devices through asynchronous interfaces. It leverages the high security, low CPU consumption, and fast operation speed of cryptographic devices, combined with asynchronous calls, to improve the efficiency of cryptographic operations and ensure the security and integrity of data transmission.

[0043] 2. It encapsulates the hardware algorithm interface for SM4 ECB mode encryption and HMAC-SM3 authentication of cryptographic devices, and extends the implementation of the SM4-ECB-128-HMAC-SM3-80 algorithm. By utilizing the characteristics of SM4 ECB mode block independence and parallel operation, it improves data transmission security while ensuring real-time performance.

[0044] 3. When the data transmission protection device based on the SRTP protocol hardware cryptographic algorithm is applied to application scenarios with high real-time requirements such as video conferencing, the confidentiality and real-time performance of the system can be improved.

[0045] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0046] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0047] Figure 1 This is a flowchart of a data transmission protection method based on a hardware-based national cryptographic algorithm using the SRTP protocol, according to an embodiment of the present invention.

[0048] Figure 2 This is a flowchart illustrating the video stream transmission from terminal A to terminal B according to an embodiment of the present invention.

[0049] Figure 3 This is a schematic diagram of the SM4 ECB encryption algorithm in an embodiment of the present invention;

[0050] Figure 4 This is a schematic diagram of the HMAC-SM3 authentication algorithm according to an embodiment of the present invention;

[0051] Figure 5 This is a flowchart of the open-source soft algorithm synchronous call processing based on the SRTP protocol according to an embodiment of the present invention;

[0052] Figure 6 This is a flowchart illustrating the asynchronous call processing of cryptographic devices based on the SRTP protocol according to an embodiment of the present invention.

[0053] Figure 7 This is a flowchart illustrating the asynchronous call process for encryption and authentication implemented by the SRTP processing module in this embodiment of the invention.

[0054] Figure 8 This is a flowchart illustrating the asynchronous call process for authentication verification and decryption implemented by the SRTP processing module in this embodiment of the invention. Detailed Implementation

[0055] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0056] Example 1

[0057] A specific embodiment of the present invention discloses a data transmission protection method based on a hardware-based national cryptographic algorithm of the SRTP protocol, such as... Figure 1 As shown, it includes the following steps:

[0058] Step S1: Video conferencing terminal A uses the media processing module to process the input image to obtain several original RTP data packets, and sends them to its own SRTP processing module through asynchronous communication.

[0059] Step S2: The SRTP processing module encapsulates the data to be encrypted extracted from each original RTP data packet into an RTP data packet with a customized data structure and sends it to the cryptographic device Ta.

[0060] Step S3: The cryptographic device Ta encrypts the payload of each customized RTP data packet based on the SM4 cryptographic algorithm to obtain ciphertext, and obtains the message authentication code based on the ciphertext using the SM3 authentication algorithm, and sends the encrypted RTP data packet carrying the ciphertext and message authentication code back to the SRTP processing module.

[0061] Step S4: The SRTP processing module sends the encrypted RTP data packet back to the media processing module via asynchronous communication, and the media processing module transmits it to the video conferencing terminal B via the network in the form of SRTP data packets.

[0062] The above method, based on the SRTP protocol, provides a hardware-based national cryptographic algorithm for data transmission protection in video conferencing systems. By using asynchronous communication between the SRTP processing module and the cryptographic device, hardware encryption of the data is achieved. This fully utilizes the characteristics of the cryptographic device and the asynchronous calling method, improving the security of data transmission in the video conferencing system while consuming less CPU resources and increasing the efficiency of cryptographic operations.

[0063] It should be noted that in video conferencing system applications, audio data traffic is much smaller than video data traffic; the main pressure for data encryption protection lies in video data transmission. The flowchart for the encrypted video stream transmission from video conferencing terminal A to terminal B is as follows: Figure 2Hardware-based national cryptographic algorithms are implemented using cryptographic devices to improve the efficiency of cryptographic operations. These cryptographic devices, such as server cryptographic machines and cryptographic cards, can be externally mounted on the terminal or embedded within it.

[0064] Specifically, in step S1, the media processing module of video conferencing terminal A compresses the original video input image into H.264 / H.265 video frames using an encoder; and based on the size of the H.264 / H.265 encoded image frames, the media processing module splits the H.264 / H.265 video frames into several RTP data packets; then, the data packets are sent to the SRTP processing module via asynchronous communication. H.264 and H.265 are two video encoding standards used for compressing and transmitting video data, widely used in video conferencing, video streaming media, and other fields. At the same video quality, H.265 can reduce the video file size by 50% compared to H.264, and the higher compression efficiency is beneficial for transmitting ultra-high-definition videos such as 4K and 8K.

[0065] It should be noted that data protection methods based on the SRTP protocol are mostly open-source software algorithms based on synchronization interfaces, and the calling logic diagram is as follows: Figure 5 During terminal media processing, the received RTP / SRTP data packets are sent to the SRTP processing module. The SRTP processing module requires CPU resources to perform two open-source software algorithm cryptographic operations, including AES encryption / decryption and HMAC-SHA1 authentication / verification. If the SDF / SKF synchronous interface is used based on the cryptographic device, two I / O calls are required: SM4 ECB + HMAC-SM3. Table 1 shows the performance comparison data of 10,000 cryptographic operations performed on the Hi 3531d embedded platform of the terminal, using the open-source software algorithm, the cryptographic machine's SDF synchronous interface, and the cryptographic machine's Async asynchronous interface, when the RTP packet length is 1024 bytes. It can be seen that the first two methods have lower computational efficiency.

[0066] Table 1

[0067]

[0068] The cryptographic machine Async asynchronous interface mentioned in the algorithm category is the asynchronous communication call based on cryptographic devices in this embodiment of the invention, and the logic block diagram is as follows: Figure 6 The cryptographic operations are completed through two callback layers, eliminating the use of the standard SDF / SKF synchronous interface of cryptographic devices. A custom data structure for interaction between the SRTP processing module and the cryptographic device is redesigned, enabling encryption / decryption and authentication to be completed on the cryptographic device in a single call. This asynchronous communication specifically includes:

[0069] The media processing module of video conferencing terminal A uses the SRTP processing module to initialize the asynchronous interface;

[0070] The media processing module registers a first-level callback function, and the SRTP processing module registers a second-level callback function.

[0071] The cryptographic device returns the corresponding data packet to the SRTP processing module based on the second-level callback function;

[0072] The SRTP processing module triggers the first-level callback function based on the returned data, and sends the corresponding data packet back to the media processing module.

[0073] This asynchronous call does not block the SRTP processing module's processing of RTP / SRTP, reduces the I / O frequency of calling the cryptographic device by half, fully utilizes the advantage of the cryptographic device's ability to perform parallel computation, and effectively improves the cryptographic operation efficiency of the SRTP processing module.

[0074] Specifically, the customized data structure in step S2 involves adding information such as encryption / decryption offset, encryption / decryption length, authentication calculation offset, authentication calculation length, transmission mode, and message authentication code to the payload of the RTP / SRTP data packet.

[0075] Specifically, in step S3, unlike the open-source software algorithms AES encryption and decryption and HMAC-SHA1 authentication and verification algorithms, this embodiment uses the SM4-ECB-128-HMAC-SM3-80 algorithm, which is an extension of the hardware national cryptographic algorithm, as the encryption algorithm. It uses SM4 (ECB mode) as the encryption algorithm and HMAC-SM3 as the authentication algorithm.

[0076] Among them, SM4, as a symmetric encryption algorithm, can use modes such as ECB, CBC, CFB, OFB, MAC, and CTR. Selecting the ECB (Electronic Codebook) mode, the SM4 encryption algorithm is designed in ECB mode, such as... Figure 3 As shown, the payload for encrypting each custom RTP packet specifically includes:

[0077] Extract the payload data to be encrypted from the customized RTP data packet based on the encryption / decryption offset and encryption / decryption length;

[0078] The payload data is encrypted using the encryption / decryption key using ECB encryption to obtain the ciphertext.

[0079] On the one hand, ECB mode is a mode supported by all cryptographic devices, making it highly practical. On the other hand, ECB mode generates the same ciphertext from the same plaintext without changing the key, and the encryption and decryption operations do not depend on the context of the packets. In the event of packet loss or out-of-order delivery, it does not affect the normal operation of the network adaptability modules of the video conferencing terminal. In addition, using ECB mode allows for parallel computation, effectively reducing the latency of data encryption and ensuring the real-time performance of video conferencing.

[0080] The message authentication code is obtained based on the ciphertext using the HMAC-SM3 authentication algorithm, such as... Figure 4 As shown, it specifically includes:

[0081] Based on the authentication calculation offset and authentication calculation length, the corresponding data to be authenticated is extracted from the customized RTP data packet containing the ciphertext;

[0082] The authentication key is used to perform HMAC-SM3 operation on the data to be processed to generate a message authentication code.

[0083] The HMAC-SM3 operation uses SM3 as its cryptographic hash function to generate a 10-byte (80-bit) message authentication code tag based on the authentication key and the HMAC calculation formula. The message authentication code tag is used to verify the identity and integrity of the SRTP data packet.

[0084] Based on the results of the above encryption and authentication calculations, the encrypted RTP data packets with a customized data structure are reconstructed and sent back to the SRTP processing module. To achieve SM4 ECB encryption / decryption and HMAC-SM3 authentication in a single call, the asynchronous interface of the SRTP processing module's open-source library libsrtp and the SDF standard interface for cryptographic devices need to be modified.

[0085] For example, the SRTP processing module adds the following three interfaces to the SRTP open-source library libsrtp:

[0086] srtp_async_register() is used to register the first-level callback function of the media processing module;

[0087] srtp_async_protect() is used by the media module to call the SRTP processing module to perform SM4ECB encryption calculation and HMAC-SM3 authentication calculation on RTP packets;

[0088] srtp_async_unprotect() is used by the media processing module to call the SRTP processing module to perform HMAC-SM3 authentication verification and SM4 ECB decryption processing on SRTP data packets.

[0089] Cryptographic operation interfaces of cryptographic devices typically communicate with the cryptographic device server via client-side libraries. Asynchronous interface calls to cryptographic devices, however, are implemented through custom data structures and asynchronous call interfaces. These asynchronous interfaces include:

[0090] Async_OpenSession() is used to initialize the session context;

[0091] Async_ImportKey() is used to import the symmetric encryption / decryption key and HMAC-SM3 authentication key of SM4 ECB; the encryption / decryption key and authentication key are generated by combining the SRTP master key obtained by key negotiation of protocols such as H.323 / H.235, SIP / SDP, and DTLS with the key derivation algorithm.

[0092] `Async_SetObj()` is used to associate the cryptographic device session context with the SRTP processing module context. It distinguishes the asynchronous communication channels between the SRTP processing module and the cryptographic device using a custom data structure with transmission modes, including receive and send modes. During the function call, data and states related to the current session and module can be accessed and manipulated.

[0093] Async_Register_Func() is used to register the second-level callback function of the SRTP processing module;

[0094] Async_sm4_hmac_sm3() is used for SM4 ECB encryption / decryption and HMAC-SM3 authentication calculations;

[0095] Async_CloseKey() is used to release handles to the symmetric key and authentication key;

[0096] Async_CloseSession() is used to release the session handle and resources.

[0097] For example, the video conferencing terminal utilizes the SRTP processing module and asynchronous interface calls to implement the encryption and authentication process, such as... Figure 7 The specific steps are as follows:

[0098] Step S41: The media processing module of the video conferencing terminal A calls the session initialization interface of the SRTP processing module. The initialization interface of the SRTP processing module will complete the asynchronous call initialization of the cryptographic device internally, including the calls to interfaces such as Async_OpenSession(), Async_ImportKey(), and Async_SetObj().

[0099] Step S42: The media processing module registers the first-level callback function using the srtp_async_register() interface, and the SRTP processing module registers the second-level callback function using the Async_Register_Func() interface.

[0100] Step S43: The media processing module sends several original RTP data packets to the SRTP processing module using the asynchronous interface srtp_async_protect();

[0101] Step S44: The SRTP processing module encapsulates the received RTP data into RTP data packets with a custom data structure and calls the cryptographic device asynchronous interface Async_sm4_hmac_sm3() to pass the data to the cryptographic device.

[0102] Step S45: The cryptographic device extracts the data to be encrypted from the customized RTP data packet according to the encryption / decryption offset and encryption / decryption calculation length. It then encrypts the specified data using the symmetric algorithm SM4 ECB mode to obtain ciphertext. Next, it extracts the data to be authenticated from the customized RTP data packet according to the authentication calculation offset and authentication calculation length. Finally, it performs an HMAC-SM3 operation on the specified data to obtain the message authentication code. Finally, it uses a second callback function to return the encrypted and authenticated RTP data packet to the SRTP processing module. For example, an HMAC-SM3 operation is performed from the header to the payload end of the customized RTP data packet to obtain the message authentication code.

[0103] Step S46: The SRTP processing module encapsulates the encrypted RTP data based on the callback from the cryptographic device into an SRTP data packet, and then returns it to the media processing module using the first callback function.

[0104] Similarly, video conferencing terminal B uses its own SRTP processing module and cryptographic device to perform authentication, verification, and decryption processing on the received SRTP data packets based on asynchronous communication, obtaining the parsed RTP data packets, which are then processed to produce the output image. The process of transmitting the encrypted video stream from terminal B to terminal A is as follows: Figure 2 The reverse process.

[0105] For example, the video conferencing terminal uses the SRTP processing module and asynchronous interface calls to implement the authentication verification and decryption process, as follows: Figure 8 The specific steps are as follows:

[0106] The media processing module of video conferencing terminal B calls the session initialization interface of the SRTP processing module;

[0107] The media processing module uses the srtp_async_register() interface to register the first-level callback function, and the SRTP processing module uses the Async_Register_Func() interface to register the second-level callback function.

[0108] The media processing module sends SRTP packets received from the network to the SRTP processing module using the asynchronous interface srtp_async_unprotect();

[0109] The SRTP processing module calls the cryptographic device's asynchronous interface Async_sm4_hmac_sm3() to pass the received SRTP data packet to the cryptographic device;

[0110] The cryptographic device extracts the data to be authenticated from the customized SRTP data packet according to the authentication calculation offset and authentication calculation length, performs HMAC-SM3 authentication operation on the specified data, and obtains the message authentication code; for example, HMAC-SM3 operation is performed on the header to payload end of the customized SRTP data packet (excluding the message authentication code in the SRTP data packet) to generate the message authentication code.

[0111] If the calculated message authentication code matches the message authentication code contained in the SRTP data packet, the verification passes; otherwise, the verification fails.

[0112] After verification, the data to be decrypted is extracted from the payload of the SRTP data packet according to the encryption / decryption offset and encryption / decryption length, and decrypted using the symmetric algorithm SM4 ECB mode; for example, the payload of the SRTP data packet (excluding the message authentication code in the SRTP packet) is decrypted using the symmetric algorithm SM4 ECB mode.

[0113] The cryptographic device uses a second-level callback function to return the authenticated and decrypted data to the SRTP processing module;

[0114] The SRTP processing module encapsulates the data from the cryptographic device callback into an RTP data packet, and then returns it to the terminal media processing module using the first-level callback function.

[0115] Compared with existing technologies, this embodiment provides a data transmission protection method for hardware-based national cryptographic algorithms using the SRTP protocol. Based on the SRTP protocol framework, an asynchronous call process is designed. Through interaction with cryptographic devices, the SM4-ECB-128-HMAC-SM3-80 algorithm is extended to complete the data transmission protection of the hardware-based national cryptographic algorithm. Ultimately, this achieves real-time performance, confidentiality, and integrity of data transmission based on the SRTP protocol. On one hand, the method improves cryptographic efficiency through cryptographic devices and asynchronous calls, offering high security and low CPU consumption. On the other hand, leveraging the advantages of independent and parallel processing of SM4 ECB mode blocks, it effectively reduces data encryption latency, ensuring the real-time performance of video conferencing.

[0116] Example 2

[0117] Another specific embodiment of the present invention discloses a data transmission protection device based on the SRTP protocol and a national cryptographic algorithm, which is installed in various video conferencing terminals. It includes:

[0118] An encoder is used to compress captured video input images into standard video frames when transmitting video conferences;

[0119] The media processing module is used to encapsulate the standard video frame into several original RTP data packets when sending video conferences, and to send the several original RTP data packets to the SRTP processing module through asynchronous communication, and to transmit the SRTP data packets returned by the SRTP processing module to the video conference receiving terminal.

[0120] The SRTP processing module is used to encapsulate the data to be encrypted extracted from each original RTP data packet into RTP data packets with a customized data structure and send them to the cryptographic device during video conferencing; and to encapsulate the encrypted RTP data packets returned by the cryptographic device into SRTP data packets and send them back to the media processing module through asynchronous communication.

[0121] A cryptographic device is used to perform symmetric algorithm encryption, decryption, and authentication calculations on data packets sent by the SRTP processing module based on an asynchronous interface, and then send the data back to the SRTP processing module.

[0122] A decoder is used to decode standard video frames during video conferencing reception.

[0123] A display device used to display the output image obtained after decoding.

[0124] Similarly, during video conference reception, the SRTP processing module is also used to send the received SRTP data to the cryptographic device; to send the SRTP data packets returned by the cryptographic device back to the media processing module via asynchronous communication; the media processing module is also used to send the received SRTP data packets to the SRTP processing module; and to assemble several RTP data packets returned by the SRTP processing module into standard video frames.

[0125] The system can perform hardware-encrypted data transmission of the SRTP protocol according to the data transmission protection method based on the hardware national cryptographic algorithm of the SRTP protocol as described in any of the schemes in Embodiment 1. Related aspects can be referenced from each other, and are not repeated in this embodiment.

[0126] Compared with existing technologies, this embodiment provides a data transmission protection device based on the SRTP protocol and a hardware-based national cryptographic algorithm. The SRTP processing module interacts with the cryptographic device through asynchronous communication to complete the encryption, decryption, and authentication process of the transmitted data. When the device is applied to application scenarios with high real-time requirements, such as video conferencing, it can improve the confidentiality and real-time performance of the system.

[0127] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0128] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A data transmission protection method based on a hardware-based national cryptographic algorithm using the SRTP protocol, characterized in that, Includes the following steps: Video conferencing terminal A uses its media processing module to process the input image into several raw RTP data packets, and then sends them to its own SRTP processing module via asynchronous communication. The SRTP processing module encapsulates the data to be encrypted extracted from each original RTP data packet into RTP data packets with a customized data structure and sends them to the cryptographic device Ta. The cryptographic device Ta encrypts the payload of each customized RTP data packet based on the SM4 cryptographic algorithm to obtain ciphertext, and uses the SM3 authentication algorithm based on the ciphertext to obtain the message authentication code. The encrypted RTP data packet carrying the ciphertext and the message authentication code is then sent back to the SRTP processing module. The SRTP processing module encapsulates the returned encrypted RTP data packets into SRTP data packets, and then sends them back to the media processing module via asynchronous communication. The media processing module then transmits the data to the video conferencing terminal B.

2. The data transmission protection method based on the SRTP protocol and a hardware-based national cryptographic algorithm according to claim 1, characterized in that, The asynchronous communication is implemented using the SRTP processing module based on the customized data structure and two-layer callback functions, including: The media processing module of video conferencing terminal A uses the SRTP processing module to initialize the asynchronous interface; The media processing module registers a first-level callback function, and the SRTP processing module registers a second-level callback function. The cryptographic device returns the corresponding data packet to the SRTP processing module based on the second-level callback function; The SRTP processing module triggers a first-level callback function based on the returned data, and sends the corresponding data packet back to the media processing module.

3. The data transmission protection method based on the SRTP protocol and a hardware-based national cryptographic algorithm according to claim 2, characterized in that, The customized data structure adds encryption / decryption offset, encryption / decryption length, authentication calculation offset, authentication calculation length, transmission mode, and message authentication code to the payload portion of the RTP / SRTP data packet.

4. The data transmission protection method based on the SRTP protocol and a hardware-based national cryptographic algorithm according to claim 3, characterized in that, The initialization of the asynchronous interface includes: Initialize the asynchronous interface session context; Import the symmetric encryption / decryption key of SM4 ECB and the authentication key of HMAC-SM3; wherein, the encryption / decryption key and the authentication key are generated by combining the SRTP master key obtained through key negotiation with the key derivation algorithm; Initialize the cryptographic device session association SRTP processing module context, which is used to distinguish the asynchronous communication channels between the SRTP processing module and the cryptographic device based on the transmission mode in the customized data structure; the transmission mode includes a receive mode and a send mode.

5. A data transmission protection method based on a hardware-based national cryptographic algorithm according to claim 4, characterized in that, The payload of each customized RTP packet is encrypted in ECB mode based on the SM4 cryptographic algorithm, including: The payload data to be encrypted is extracted from the customized RTP data packet based on the encryption / decryption offset and encryption / decryption length. The payload data is encrypted using the encryption / decryption key to obtain ciphertext.

6. The data transmission protection method based on the SRTP protocol and a hardware-based national cryptographic algorithm according to claim 5, characterized in that, The message authentication code obtained using the SM3 authentication algorithm based on the ciphertext includes: Based on the authentication calculation offset and authentication calculation length, the corresponding data to be authenticated is extracted from the customized RTP data packet containing the ciphertext; The authentication key is used to perform HMAC-SM3 operation on the data to be processed to generate a message authentication code.

7. A data transmission protection method based on a hardware-based national cryptographic algorithm according to any one of claims 1-6, characterized in that, Also includes: Video conferencing terminal B uses its own SRTP processing module and cryptographic device Tb to perform authentication, verification and decryption processing on the received SRTP data packets based on the asynchronous communication, and obtains parsed RTP data packets, which are then processed to obtain the output image.

8. A data transmission protection method based on a hardware-based national cryptographic algorithm according to claim 7, characterized in that, The authentication, verification, and decryption processing of the received SRTP data packets includes: The authentication data is extracted from the customized SRTP data packet based on the authentication calculation offset and authentication calculation length. Perform HMAC-SM3 authentication on the data to be authenticated to obtain message authentication code F'; If the message authentication code F' matches the message authentication code contained in the SRTP data packet, the verification passes; otherwise, the verification fails. After verification, the data to be decrypted is extracted from the payload of the SRTP data packet according to the encryption / decryption offset and encryption / decryption length, and then decrypted using the symmetric algorithm SM4 ECB mode.

9. A data transmission protection device based on the SRTP protocol and a national cryptographic algorithm, characterized in that, include: An encoder is used to compress captured video input images into standard video frames when transmitting video conferences; The media processing module is used to encapsulate the standard video frames into several original RTP data packets during video conference transmission, and send the several original RTP data packets to the SRTP processing module through asynchronous communication; it is also used to transmit each SRTP data packet returned by the SRTP processing module to the video conference receiving terminal. The SRTP processing module is used to encapsulate the data to be encrypted extracted from each original RTP data packet into a customized RTP data packet and send it to the cryptographic device during video conferencing. It is also used to encapsulate the encrypted RTP data packets returned by the cryptographic device into SRTP data packets and send them back to the media processing module again via asynchronous communication; A cryptographic device is used to perform symmetric algorithm encryption, decryption, and authentication calculations on data packets sent by the SRTP processing module based on an asynchronous interface, and then send the data back to the SRTP processing module. A decoder is used to decode standard video frames during video conferencing reception. A display device used to display the output image obtained after decoding.

10. A data transmission protection device based on a hardware national cryptographic algorithm of the SRTP protocol according to claim 9, characterized in that, During video conference reception, the SRTP processing module is also used to send the received SRTP data to the cryptographic device; send the SRTP data packets returned by the cryptographic device back to the media processing module through asynchronous communication; the media processing module is also used to send the received SRTP data packets to the SRTP processing module; and assemble several RTP data packets returned by the SRTP processing module into a standard video frame.

Images