An access type video security ruggedization module

Abstract

The application belongs to the technical field of video security, and discloses an access type video security reinforcement module, which adopts a zero-copy forwarding module of a dual-architecture of a kernel state DMA memory mapping and an eBPF dynamic program, optimizes a processing flow from a data transmission bottom layer, and reduces system overhead and transmission delay in a video stream transmission process; bidirectional transparent proxy is realized through virtual network card technology, without any configuration modification of an existing network topology, a front-end collection device and a back-end management platform, so that full-flow non-perception access and stable forwarding can be completed; in combination with a multi-dimensional flow isolation strategy and a special scheduling mechanism, physical isolation and priority dynamic allocation of flow of different security levels and different manufacturer devices are realized; a special hardware acceleration chip with a built-in integrated national secret algorithm adopts a double-engine parallel operation architecture to improve the password processing efficiency, and generates and binds public and private keys through device identification and hardware fingerprint double factors, so as to avoid security risks such as key forgery, leakage and tampering.

Description

Technical Field

[0001] This invention belongs to the field of video security technology, specifically an access-type video security hardening module. Background Technology

[0002] Video surveillance systems are widely deployed in key industries such as transportation, finance, energy, education, and healthcare. While the scale of video surveillance equipment deployment continues to expand, the security capabilities of these systems lag far behind their deployment scale. In recent years, cyberattacks targeting video surveillance systems have been frequent, causing serious security risks and economic losses. Existing video surveillance systems generally suffer from the following security vulnerabilities: Devices from different manufacturers use a large number of proprietary protocols, making it difficult to uniformly harden security. At the same time, a large number of devices transmit signaling and control data in plaintext, which is extremely easy to be eavesdropped, tampered with and forged. Attackers can obtain sensitive information such as device login credentials and control commands by intercepting signaling.

[0003] Traditional video surveillance equipment mostly uses simple authentication methods based on usernames and passwords, and some devices even have default passwords that have not been changed; the few systems that use certificate authentication face complex operation and maintenance issues such as certificate issuance, renewal, and revocation, making them difficult to adapt to large-scale equipment deployment scenarios.

[0004] Video streams have distinct temporal and frame size characteristics. Attackers can use traffic analysis techniques to identify video surveillance traffic and then carry out targeted denial-of-service attacks, traffic hijacking, or content theft.

[0005] Existing security solutions mostly employ software encryption or gateway proxy methods, which introduce significant transmission delays and performance losses. At the same time, existing security solutions are prone to service interruptions due to failures, and cannot meet the protection requirements of critical industries for 24 / 7 uninterrupted operation. Summary of the Invention

[0006] The purpose of this invention is to provide an access-based video security hardening module to solve one or more of the problems mentioned in the background art.

[0007] To achieve the above objectives, the present invention provides the following technical solution: an access-type video security hardening module, comprising the following modules: Furthermore, the zero-copy forwarding module adopts a dual architecture design of kernel-mode DMA memory mapping and eBPF dynamic program. In kernel mode, it directly obtains the video data packets received by the network card through the DMA controller, and maps the data packets directly from the kernel buffer to the user-mode security processing buffer through memory mapping. Embed eBPF dynamic program to monitor video stream transmission status in real time and adaptively adjust memory mapping granularity according to video frame rate and resolution. Based on virtual network interface card (NIC) technology, a two-way proxy is implemented, which is completely transparent to the front-end camera and the back-end platform, enabling seamless access and forwarding of all traffic. It adopts a dedicated traffic scheduling mechanism for video streams, combined with a three-dimensional traffic isolation strategy of port, IP, and MAC address, to physically isolate video surveillance traffic of different security levels and different manufacturers, and supports dynamic allocation of traffic priorities.

[0008] The dedicated video stream traffic scheduling mechanism is designed based on the real-time and continuous transmission requirements of video streams. Combined with the three-dimensional traffic isolation results, it performs time-sharing scheduling, bandwidth allocation on demand, and priority preemption scheduling on traffic in different queues. High-priority traffic can preempt some transmission resources of low-priority traffic when resources are scarce, thus avoiding long-term starvation of low-priority traffic.

[0009] Furthermore, the protocol parsing module has a built-in protocol feature library, which includes common video surveillance protocols such as ONVIF and RTSP, as well as proprietary protocol features from mainstream manufacturers. It has a protocol feature self-evolution mechanism and uses a CNN-LSTM fusion deep learning model to learn, extract features, and automatically adapt to unknown protocols in real time, thereby generating parsing rules for unknown protocols. It adopts a one-stop protocol conversion mechanism of lightweight parsing, standardized conversion, and secure encryption. For the proprietary protocols of different manufacturers, it converts them into standard protocol formats while simultaneously completing the national cryptographic SM4 encryption preprocessing of signaling data. The signaling national cryptographic encryption preprocessing and protocol standardization conversion are executed synchronously in the same processing pipeline. The signaling data after protocol conversion is not stored on the ground or generated in the intermediate cache, but directly enters the national cryptographic encryption engine to complete the encryption process. The encryption process performs encryption processing on the field structure of the signaling data, and only performs encryption operations on sensitive signaling fields, while non-sensitive fields are kept transparently transmitted.

[0010] It has a protocol anomaly detection function, which uses AI models to identify malformed protocol packets and abnormal commands, and promptly blocks malicious protocol attacks.

[0011] Furthermore, the decoupling and desensitization module divides video surveillance data into three layers: signaling layer, metadata layer, and media stream layer. It adopts a dual independent physical channel transmission design, achieving physical isolation between the two through a dedicated signaling channel and a dedicated media stream channel. An asynchronous metadata pretransmission mechanism is adopted, combined with an AI prediction model, to dynamically adjust the timing and rate of metadata pretransmission based on the bandwidth, latency and other status of the video stream transmission. The metadata uses SM3 hash verification. Before data encapsulation, the metadata sender uses the SM3 algorithm to calculate the hash value of the metadata as a whole, and encapsulates the hash value and metadata into the same data packet for transmission. After receiving the data packet, the receiver first separates the metadata and hash value, and then uses the same SM3 algorithm to recalculate the hash value of the received metadata. The calculation result is compared with the transmitted hash value. If the comparison is consistent, the data is determined to be complete and usable. If the comparison is inconsistent, the data is determined to have been tampered with or the transmission has failed, and a metadata retransmission request is immediately triggered.

[0012] It features an AI-powered dynamic desensitization mechanism that uses a fusion model of computer vision and natural language processing to automatically identify sensitive fields in signaling, including usernames, passwords, device serial numbers, and monitoring point information. It dynamically selects the corresponding desensitization strategy based on the sensitivity level. For highly sensitive devices, the login password is desensitized using SM4 encryption; for moderately sensitive monitoring point information, fuzzy replacement is used; and for low-sensitive device models, partial concealment is used. Custom configuration of desensitization strategies is supported.

[0013] National Cryptographic SM3 Data Integrity Verification Formula: It represents the hash verification result calculated by the national cryptographic SM3 algorithm, which is used to verify the integrity of metadata data transmission and accurately determine whether the data has been illegally tampered with or has experienced transmission anomalies. This indicates that the hash algorithm specified in the Chinese commercial cryptography standard has high security and collision resistance, and can perform irreversible hash operations on the input data; Metadata in a video surveillance system includes core non-media stream data such as device operating status, monitoring point information, and device configuration parameters.

[0014] Furthermore, the national cryptographic key module has a built-in dedicated hardware acceleration chip for the national cryptographic algorithm and adopts a dual-engine parallel computing design. It improves the cryptographic computing speed by working together with the SM9 authentication engine and the SM4 encryption engine. The device identifier and hardware fingerprint are used to generate a public and private key, and the public and private key are bound to the device identifier and hardware fingerprint. It adopts a lightweight dynamic key management mechanism to achieve automated management of the entire lifecycle of key generation, distribution, update, and revocation. It has a dynamic key update trigger mechanism that automatically triggers updates based on device operating status, network environment, and attack detection results. The key update process adopts a breakpoint resume method, which is completely transparent to the business. It supports batch registration and hierarchical authentication of devices, and assigns keys with different permissions to devices with different security levels. It has a key anomaly detection function to monitor the risk of key leakage and tampering in real time and trigger key revocation and regeneration in a timely manner.

[0015] Two-factor hardware binding public / private key generation formula: This represents the public key of the access-based video security reinforcement module, which is mainly used for external identity authentication and data encryption operations and can be used publicly in secure scenarios. This represents the private key of the access-type video security reinforcement module. It is deeply bound to the module hardware and used for data decryption and digital signature. It is core confidential information and must not be disclosed to external parties. This represents a public-private key pair generation function based on Chinese cryptographic algorithms, which generates asymmetric key pairs that meet security standards based on a unique key seed; This indicates a unique device identifier preset by the factory for the module, which is the core exclusive serial number that distinguishes different hardware modules; The hardware fingerprint representing the module is generated by combining the unique identification codes of the encryption chip, the main control chip, and the network interface chip; This represents a bitwise XOR operation, used to fuse the device identifier with the hardware fingerprint to generate a unique and unforgeable key seed.

[0016] Furthermore, the RTP protection module employs RTP packet timing reconstruction technology. Through random timing adjustment and intelligent generation of fake data packets, it randomizes the sending interval and length of RTP data packets, generates fake data packets with the same structure as real video frames by combining video frame features, and adaptively adjusts the insertion frequency of fake data packets according to network bandwidth. The version number, sequence number, timestamp, and other fields in the RTP protocol header are dynamically and randomly modified, and a new protocol header feature obfuscation process is added to eliminate the inherent fingerprint of the RTP protocol. It has an AI attack detection model that monitors abnormal behavior in video traffic in real time, including traffic analysis, denial-of-service attacks, and traffic hijacking. When an attack is detected, it automatically adjusts the timing reconstruction and protocol header feature obfuscation strategies, and triggers other security protection mechanisms such as traffic isolation and encryption upgrades in conjunction with other modules.

[0017] The RTP data packet timing reconstruction and protocol header feature obfuscation processing described in this module are implemented using character substitution transformation and data reordering as reinforcement logic. This process converts a single character in the data into several other characters, and scrambles and rearranges the entire RTP data packet, regenerating the sequence number and timestamp. The processed data cannot be recovered from its original content without a corresponding restoration algorithm, further enhancing the anti-cracking and anti-restoration capabilities of RTP video stream transmission.

[0018] RTP Protocol Header Dynamic Feature Obfuscation Formula: This indicates that the RTP protocol header has undergone dynamic obfuscation, eliminating the inherent characteristic fingerprints of the original protocol and effectively resisting external traffic analysis attacks. This represents a randomization function that dynamically adapts over time, continuously updating obfuscation rules based on the time dimension to ensure the stability of the protocol header spoofing effect; The original RTP protocol header represents the video stream transmission and contains core protocol fields such as version number, sequence number, and timestamp. This represents a random seed for network status, generated from real-time network parameters such as bandwidth, transmission delay, and link packet loss rate. Only authorized peer devices can obtain it synchronously.

[0019] Furthermore, the anti-packet loss module adopts an AI prediction model based on LSTM neural network to monitor network packet loss rate, latency, bandwidth and other parameters in real time, predict network status changes in advance, adjust transmission strategies in advance, and dynamically adapt the key length, encryption granularity and data packet retransmission strategy of the encryption algorithm according to the network status. When the network conditions are good, high-strength SM4 encryption and large-granularity encryption are used. When the network experiences packet loss or high latency, it automatically switches to lightweight SM4 encryption and small-granularity encryption. At the same time, forward error correction and selective retransmission mechanisms are activated, and key frames are retransmitted first based on video frame priority. It adopts a multi-path transmission mechanism and uses AI intelligent routing algorithm to dynamically allocate video traffic according to the bandwidth, latency and security of each path, and transmits key frames and ordinary frames separately. It has a path fault self-healing function, and automatically switches to the backup path when a path fails, with the switching latency controlled within 50ms. It also has a transmission status feedback mechanism, which feeds back transmission parameters to other modules in real time and adjusts strategies such as zero-copy forwarding and traffic obfuscation in conjunction with each other.

[0020] The transmission status feedback mechanism is as follows: Real-time collection and integration of all-dimensional transmission parameters such as network packet loss rate, transmission delay, available bandwidth, link status, and path quality are synchronously pushed to core functional modules such as the zero-copy forwarding module, RTP protection module, and anti-packet loss module at fixed intervals; Each module synchronously and adaptively adjusts operating parameters such as memory mapping granularity, data packet timing obfuscation strength, encryption algorithm granularity, and retransmission strategy based on the real-time transmission parameters fed back.

[0021] Furthermore, the fault self-healing module adopts a hardware bypass design. When the module experiences a power failure, hardware failure, or software crash, the hardware bypass switch automatically closes, directly connecting the front-end camera to the back-end platform, and the video traffic bypasses the module for direct transmission. It has a three-level fault detection mechanism to monitor key components of the module such as power supply, CPU, memory, network interface, and encryption engine in real time. It is divided into three levels: minor fault, moderate fault, and severe fault. Different self-healing strategies are adopted for different levels of fault. In the case of minor fault, the software will be restarted and the configuration will be restored automatically. In the case of moderate fault, the backup software module will be started. In the case of severe fault, the hardware will be automatically switched to the hardware bypass mode. Minor faults are primarily repaired at the software level, automatically performing process restarts, parameter resets, and cache clearing operations without interrupting traffic processing and transmission. Moderate faults are primarily repaired at the module level, automatically activating backup software modules or backup hardware subunits, with the backup unit taking over all functions of the faulty module to maintain the overall operational status of the module. Severe faults directly trigger hardware bypass protection, with all traffic being forwarded directly, while stopping power supply to unnecessary hardware of the module, and restarting the module only after the fault has been cleared.

[0022] The AI-powered intelligent early warning model predicts the development trend of faults in advance and sends alarm information to the management platform, including the fault type, location, and self-healing suggestions. After the module recovers from the fault, it automatically switches back to normal working mode and automatically analyzes the cause of the fault and generates a fault report.

[0023] The beneficial effects of this invention are as follows: 1. This invention employs a zero-copy forwarding module with a dual architecture of kernel-mode DMA memory mapping and eBPF dynamic programming. This optimizes the data transmission process from the underlying layer, reducing system overhead and transmission latency during video stream transmission. It achieves bidirectional transparent proxying through virtual network interface card (NIC) technology, enabling seamless full-traffic access and stable forwarding without requiring any configuration modifications to the existing network topology, front-end acquisition devices, or back-end management platform. Combined with multi-dimensional traffic isolation strategies and a dedicated scheduling mechanism, it achieves physical isolation and dynamic priority allocation of traffic from devices of different security levels and vendors. The eBPF dynamic program can adaptively adjust memory mapping parameters based on the video stream transmission status, preventing system anomalies caused by traffic fluctuations.

[0024] 2. This invention incorporates a dedicated hardware acceleration chip with integrated national cryptographic algorithms, employing a dual-engine parallel computing architecture to improve cryptographic processing efficiency. It generates and binds public and private keys using a dual-factor approach of device identification and hardware fingerprint, constructing a hardware-level security foundation to avoid security risks such as key forgery, leakage, and tampering. A lightweight dynamic key management mechanism enables automated management of the entire key lifecycle, supporting batch device registration and tiered authentication, simplifying the operational complexity of large-scale device deployment. The protocol parsing module is equipped with a deep learning model, capable of autonomously learning and adapting to unknown protocols, completing standardized conversions of various private protocols, and simultaneously performing secure encryption preprocessing of signaling data. Furthermore, it uses an AI model to accurately identify abnormal protocol data and malicious commands, blocking attacks at the protocol layer.

[0025] 3. This invention eliminates the inherent fingerprint characteristics of video stream transmission through RTP packet timing reconstruction, protocol header feature obfuscation, and intelligent generation of fake data packets, resisting various network attacks such as traffic analysis, traffic hijacking, and denial-of-service. The neural network-based anti-packet loss module can monitor network status in real time and intelligently predict transmission trends, dynamically adjusting encryption strategies and data transmission mechanisms. The multi-path transmission architecture combined with intelligent routing logic achieves self-healing of transmission path faults. The hardware bypass design, coupled with a multi-level fault self-healing mechanism, automatically switches to a backup link when the module malfunctions, ensuring uninterrupted video surveillance services. The AI ​​fault warning and analysis mechanism can predict potential faults in advance, push alarm information, and generate analysis reports, ensuring business continuity across the entire link. Attached Figure Description

[0026] Figure 1 This is a flowchart illustrating the overall workflow of the access-type video security hardening module of the present invention. Figure 2 This is a flowchart of the core security hardening process of the present invention; Figure 3 This is a flowchart of the fault self-healing and hardware bypass protection sub-process of the present invention. Detailed Implementation

[0027] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] like Figures 1 to 3 As shown, this embodiment of the invention provides an access-based video security hardening module, comprising the following modules: In this embodiment of the invention, the zero-copy forwarding module adopts a dual architecture design of kernel-mode DMA memory mapping and eBPF dynamic program. In kernel mode, it directly obtains the video data packets received by the network card through the DMA controller, and maps the data packets directly from the kernel buffer to the user-mode security processing buffer through memory mapping, eliminating the two data copies between the traditional kernel mode and user mode. The DMA controller is directly connected to the network card hardware. After the video data packets arrive at the network card hardware, the DMA controller directly handles the transfer and storage of the data packets without CPU processing. In kernel mode, the module establishes a linear mapping relationship between physical and virtual addresses to map the network card receive buffer, kernel data buffer, and user-mode security processing buffer to consecutive addresses, eliminating data copying between kernel mode and user mode. The eBPF dynamic program is mounted on the network card receive hook point and memory mapping management hook point to read the video stream frame rate, resolution, and data packet length parameters in real time, and dynamically adjust the size and allocation strategy of the memory mapping block according to the traffic load.

[0029] Embedded eBPF dynamic program, real-time monitoring of video stream transmission status, adaptive adjustment of memory mapping granularity according to video frame rate and resolution, avoiding buffer overflow problems in video stream burst scenarios. eBPF dynamic program collects video stream data packet length, transmission rate, and frame rate parameters in real time. When the traffic is stable, it uses a larger memory mapping block to improve processing efficiency, and when the traffic fluctuates or bursts, it uses a smaller memory mapping block to avoid buffer overflow. The mapping granularity adjustment process takes effect in real time without restarting the module.

[0030] Based on virtual network interface card (NIC) technology, a two-way proxy is implemented, which is completely transparent to the front-end camera and the back-end platform. No modification to the original network topology and device configuration is required. It achieves seamless access and forwarding of all traffic. It adopts a dedicated traffic scheduling mechanism for video streams and combines a three-dimensional traffic isolation strategy of port, IP and MAC address to physically isolate video surveillance traffic of different security levels and different manufacturers. It supports dynamic allocation of traffic priority to prevent cross-regional security penetration.

[0031] The virtual network interface card (NIC) is implemented using kernel-mode virtual network devices. After creation, it binds to the physical network port and takes over all uplink and downlink traffic of the physical network port. Uplink traffic sent by the front-end device enters through the physical network port, is fully captured by the virtual NIC, and forwarded to the security processing module. After processing, it is sent to the back-end platform by the virtual NIC through the physical network port. Downlink control traffic issued by the back-end platform enters through the physical network port, is captured by the virtual NIC, undergoes security processing, and is then forwarded to the front-end device. The entire traffic takeover and forwarding process does not modify the source / destination IP address, MAC address, or port number.

[0032] A unique identifier for traffic is constructed using three-dimensional features: port, IP address, and MAC address. Traffic isolation is achieved through hardware-level flow tables and independent transmission queues. Traffic with different identifiers is assigned to dedicated hardware queues for transmission, and the queues are independent of each other without overlap. Traffic priority weights are configured according to the device's security level and manufacturer affiliation. High-priority traffic occupies transmission resources and processing power first, while low-priority traffic is transmitted and processed when resources are idle. Priority weights can be dynamically adjusted according to scenario requirements.

[0033] In this embodiment of the invention, the protocol parsing module has a built-in protocol feature library, which includes common video surveillance protocols such as ONVIF and RTSP, as well as private protocol features of mainstream manufacturers such as Hikvision, Dahua, and Uniview. It has a protocol feature self-evolution mechanism and uses a CNN-LSTM fusion deep learning model to learn, extract features, and automatically adapt to unknown protocols in real time, thereby generating parsing rules for unknown protocols. The CNN-LSTM fusion deep learning model is built by cascading convolutional neural networks and long short-term memory networks. The overall model includes, in sequence, a convolutional feature extraction layer, a temporal feature encoding layer, a fully connected fusion layer, a protocol classification layer, and a parsing rule generation layer. Convolutional layers are used to extract local binary features and message structure features of video surveillance protocol messages. Long Short-Term Memory (LSTM) layers are used to capture the temporal dependencies and interaction logic features of protocol messages. Fully connected fusion layers integrate and weight multi-dimensional features. Protocol classification layers complete the protocol type determination. Parsing rule generation layers output standardized parsing rules that adapt to unknown protocols. The model takes as input the raw protocol message data stream, protocol header feature vector, and message length temporal features from a video surveillance scenario. The output is the protocol type identification result and directly callable parsing rules. The model is trained on a dedicated dataset of video surveillance protocols. First, it collects, labels, and preprocesses samples of general protocols and vendor-specific protocols to build a protocol sample set covering multiple scenarios. Then, it completes the model network structure construction and parameter initialization. The model is trained using supervised learning and continuously iterates to optimize the model weights to adapt to video surveillance protocol parsing scenarios. It also supports incremental training mode.

[0034] The protocol feature self-evolution adopts an incremental learning and real-time update mode. After the model completes feature extraction and adaptation for unknown protocols, the newly generated protocol features and parsing rules are imported into the protocol feature library in real time. At the same time, combined with the malicious attack features reported by the anomaly detection module, the model feature vector is automatically optimized and the recognition rules are iteratively updated. It can autonomously adapt to new video surveillance protocols and unknown attack methods.

[0035] It adopts a one-stop protocol conversion mechanism of lightweight parsing, standardized conversion, and secure encryption. For the proprietary protocols of different manufacturers, it converts them into standard protocol formats while simultaneously completing the national cryptographic SM4 encryption preprocessing of signaling data. The protocol parsing module first identifies the vendor's proprietary protocol and completes the format parsing. Simultaneously, it maps the proprietary protocol fields to the corresponding fields of the standard protocol, completing the format conversion. After the conversion is completed, it immediately performs national cryptographic encryption preprocessing on the signaling data. The conversion and encryption are completed in the same process, without any intermediate data storage.

[0036] It has a protocol anomaly detection function, which uses AI models to identify malformed protocol packets and abnormal commands, and promptly blocks malicious protocol attacks.

[0037] Protocol anomaly detection uses an AI model to perform comprehensive and in-depth verification of protocol messages. It checks the legality of protocol fields, compliance of command formats, rationality of interaction timing, and data length suitability in turn. It identifies malformed messages and malicious commands with disordered formats, out-of-bounds fields, illegal commands, reversed timing, and abnormal data. Once an anomaly is detected, it immediately intercepts and discards the abnormal traffic to prevent the further spread of attacks. At the same time, it synchronizes the characteristics of abnormal messages and attack types to the protocol feature database in real time.

[0038] In this embodiment of the invention, the decoupling and desensitization module divides video surveillance data into three layers: signaling layer, metadata layer, and media stream layer. It adopts a dual independent physical channel transmission design, and achieves physical isolation between the two through a dedicated signaling channel and a dedicated media stream channel. The dedicated signaling channel and the dedicated media stream channel are independent hardware transmission paths within the module, each corresponding to an independent physical interface and transmission link. The module performs layered identification on the received video data, diverting the signaling layer data to the dedicated signaling channel for transmission and the media stream layer data to the dedicated media stream channel for transmission. The two channels employ independent clock synchronization, data verification, and transmission control mechanisms, ensuring no data crosstalk or resource contention between the channels.

[0039] An asynchronous metadata pretransmission mechanism is adopted, combined with an AI prediction model, to dynamically adjust the timing and rate of metadata pretransmission based on the bandwidth, latency and other status of the video stream transmission, so as to avoid occupying the media stream bandwidth. The metadata uses SM3 hash verification to prevent tampering. The AI ​​prediction model is a lightweight long short-term memory network model optimized for video streaming transmission, which consists of an input layer, a single hidden layer LSTM temporal coding unit, a feature transformation layer, and an output layer connected in sequence. The input layer receives network transmission time-series data in video surveillance scenarios, the LSTM time-series coding unit mines the changing patterns of network states, the feature transformation layer performs normalization processing on the predicted features, and the output layer generates metadata data transmission control parameters. The model input consists of real-time collected continuous time-series status data such as network bandwidth, transmission delay, and link packet loss rate. The model input is time-series features captured by a fixed window. The output consists of metadata pre-transmission start timing, transmission rate ratio, and transmission start / stop threshold. Model training is based on multi-scenario transmission data of video streams. First, transmission time-series data under different network environments and different video bitrates are collected and labeled and normalized preprocessed. Then, the model structure is constructed and parameters are initialized. The model is trained through the time-series prediction learning paradigm.

[0040] Asynchronous metadata pretransmission is performed during the idle period of media streaming, and is staggered from the media streaming time sequence. Before the metadata is sent, a hash value is calculated using the SM3 algorithm and transmitted synchronously with the data. The receiving end performs data integrity verification by comparing the hash value. If a mismatch is found, metadata retransmission is triggered.

[0041] It features an AI-powered dynamic desensitization mechanism that uses a fusion model of computer vision and natural language processing to automatically identify sensitive fields in signaling, including usernames, passwords, device serial numbers, and monitoring point information. It dynamically selects the corresponding desensitization strategy based on the sensitivity level. For highly sensitive devices, the login password is desensitized using SM4 encryption; for moderately sensitive monitoring point information, fuzzy replacement is used; and for low-sensitive device models, partial concealment is used. Custom configuration of desensitization strategies is supported.

[0042] The fusion model adopts a parallel architecture of natural language processing (NLP) and computer vision (CVR) branches. The outputs of the two branches are integrated by the feature fusion layer and then connected to the sensitive information determination layer and the desensitization strategy matching layer in sequence. The NLP branch uses a pre-trained language model to extract semantic features of signaling text to complete the identification and localization of text-based sensitive fields. The CVR branch uses an object detection model to extract visual sensitive features from video frames and device interfaces to complete the identification of image-based sensitive information. The feature fusion layer performs weighted fusion of text features and visual features to eliminate the bias of single feature recognition. The sensitive information determination layer completes the hierarchical determination of sensitive fields. The desensitization strategy matching layer outputs a desensitization execution scheme that is adapted to the sensitivity level. The model input consists of video surveillance signaling text data, device screen visual data, and signaling interaction context information. The output consists of the location of sensitive fields, the sensitivity level classification results, and the appropriate desensitization strategy. The model training is carried out based on the joint dataset of sensitive information in video surveillance signaling. First, the joint annotation of textual and visual sensitive information is completed. Then, a multi-task learning paradigm is used to complete the joint training of the dual-branch model to optimize the model's recognition accuracy and adaptability.

[0043] High-sensitivity fields are directly encrypted and desensitized using national cryptographic algorithms, making the data irreversible after desensitization. Medium-sensitivity fields are processed using feature fuzzy replacement, preserving the field format but hiding the true content. Low-sensitivity fields are partially hidden using key character concealment, retaining only non-sensitive fragments. Desensitization strategies can be modified as needed through the management platform.

[0044] In this embodiment of the invention, the national cryptographic key module has a built-in dedicated hardware acceleration chip that integrates national cryptographic algorithms such as SM2, SM3, SM4, and SM9. It adopts a dual-engine parallel computing design, and improves the speed of cryptographic operations such as encryption and decryption, signature verification, and hash calculation by working together through the SM9 authentication engine and the SM4 encryption engine. The SM9 authentication engine and the SM4 encryption engine are independent computing units built into the hardware acceleration chip. The two engines run simultaneously and process cryptographic tasks in parallel. The SM9 authentication engine is dedicated to device authentication, signature verification, and key negotiation, while the SM4 encryption engine is dedicated to encryption and decryption of video data and signaling data. The two engines achieve data interaction and instruction synchronization through the chip's internal bus, and authentication and encryption operations can be executed synchronously.

[0045] The device identifier and hardware fingerprint are used to generate public and private keys, and the device identifier and hardware fingerprint are bound together to prevent identifier forgery. The device identifier is the module's unique factory serial number, and the hardware fingerprint is the module's unique hardware identification code for the encryption chip, main control chip, and network interface chip. The two-factor data is XORed to generate a unique key seed, and a public-private key pair is generated based on the key seed. After the public and private keys are generated, they are hardware-level fixed and bound to the two-factor data. The public and private keys cannot be used independently without the module's hardware environment. Replacing the hardware or tampering with the two-factor data will cause the public and private keys to become invalid.

[0046] It adopts a lightweight dynamic key management mechanism to achieve automated management of the entire lifecycle of key generation, distribution, update and revocation. It has a dynamic key update trigger mechanism that automatically triggers updates based on device operating status, network environment and attack detection results. The key update process adopts a breakpoint resume method, which is completely transparent to the business and does not affect the normal operation of the video surveillance system. Key generation is performed independently by the hardware acceleration chip. After generation, the key is automatically encrypted and distributed to the corresponding device. Key updates are initiated according to a preset cycle or abnormal trigger conditions. The update process adopts a segmented transmission and breakpoint resume mechanism. If the transmission is interrupted, the update can be resumed from the breakpoint without interrupting the operation of the business. Key revocation is carried out by issuing instructions through the management platform. After receiving the instructions, the module immediately invalidates the corresponding key and synchronizes it with the associated device.

[0047] It supports batch registration and tiered authentication of devices, assigns keys with different permissions to devices of different security levels, has a key anomaly detection function, monitors the risk of key leakage and tampering in real time, and triggers key revocation and regeneration in a timely manner.

[0048] Security levels are categorized based on the deployment scenario and importance of the devices, and keys with corresponding permissions are assigned to devices of different levels. Keys for high-security-level devices have full-function authentication and encryption permissions, while keys for low-security-level devices only have basic communication permissions. The hierarchical authentication information is stored in a secure hardware area and cannot be illegally modified.

[0049] The key anomaly detection module continuously verifies the integrity, legality of key calls, and compliance of usage scenarios in real time, and monitors the key's call frequency, access source, usage permissions, and other status information. When it detects risks such as illegal key calls, compromised integrity, unauthorized use, or abnormal distribution, it immediately performs a hardware-level locking operation on the abnormal key, blocking all its usage permissions. At the same time, it automatically triggers the key revocation process and starts the hardware generation, encrypted distribution, and batch synchronization process of the new key.

[0050] In this embodiment of the invention, the RTP protection module adopts RTP data packet timing reconstruction technology. Through random timing adjustment and intelligent generation strategy of fake data packets, the sending interval and length of RTP data packets are randomized. Combined with video frame features, fake data packets with the same structure as real video frames are generated to avoid bandwidth waste caused by invalid padding. The insertion frequency of fake data packets is adaptively adjusted according to network bandwidth. The fake data packets are generated according to the length, format, and payload structure of the real video frames, maintaining consistency with the appearance of the real data packets; the insertion frequency is dynamically adjusted according to the real-time bandwidth utilization rate. When bandwidth is sufficient, the insertion frequency is increased to enhance the obfuscation effect, and when bandwidth is tight, the insertion frequency is decreased to avoid occupying too much transmission resources.

[0051] The version number, sequence number, timestamp, and other fields in the RTP protocol header are dynamically and randomly modified, and a new protocol header feature obfuscation process is added to eliminate the inherent fingerprint of the RTP protocol and prevent attackers from identifying video surveillance traffic through the protocol header. RTP packet timing reconstruction is achieved by randomly adjusting the packet sending interval and shuffling the continuous transmission order of packets. The obfuscation process follows the video frame decoding timing requirements and does not affect the normal decoding and playback of the terminal. Protocol header feature obfuscation uses a dynamic random algorithm to periodically modify the version number, sequence number, and timestamp fields. The modification rules are only synchronized between the module and the authorized peer, and external devices cannot obtain the modification logic. Fake packets are generated based on the structural characteristics of real video frames and are mixed with real packets for transmission, further masking the real traffic characteristics and resisting external traffic analysis and identification.

[0052] It has an AI attack detection model that monitors abnormal behavior in video traffic in real time, including traffic analysis, denial-of-service attacks, and traffic hijacking. When an attack is detected, it automatically adjusts the timing reconstruction and protocol header feature obfuscation strategies to improve obfuscation strength. At the same time, it links with other modules to trigger security protection mechanisms such as traffic isolation and encryption upgrades.

[0053] The AI ​​attack detection model adopts an anomaly detection architecture that integrates isolated forest and long short-term memory network. The overall structure consists of a traffic feature extraction layer, a temporal feature encoding layer, an anomaly determination layer, and an attack type identification layer. The traffic feature extraction layer extracts the sending time interval, packet length distribution features, and protocol header field features of RTP data packets; the time sequence feature encoding layer captures the time sequence changes and fluctuation patterns of traffic; the anomaly judgment layer identifies abnormal traffic states; and the attack type identification layer locates the specific attack behavior type. The model input consists of the data packet timing features, traffic rate change features, and protocol header anomaly feature vectors of the video surveillance RTP stream. The output consists of the traffic anomaly judgment result, attack type identifier, and protection mechanism trigger signal. The model training is based on a dedicated dataset constructed from normal and attack samples of video surveillance RTP traffic. First, the features of the samples are extracted, cleaned, and labeled. Then, a combination of semi-supervised and supervised learning is used to complete the model training, continuously optimizing the model's anomaly recognition capability.

[0054] After the AI ​​attack detection model determines the attack behavior, it immediately issues an upgrade command to the RTP protection module to enhance the execution of timing obfuscation and fake data packet insertion. At the same time, it sends a traffic isolation command to the zero-copy forwarding module to isolate the attack source traffic in a dedicated queue and limit its transmission resource consumption. Simultaneously, it issues an encryption upgrade command to the national cryptographic key module to improve the granularity of the encryption algorithm and the frequency of key updates. Multiple modules work together to build a multi-level attack protection system.

[0055] In this embodiment of the invention, the anti-packet loss module adopts an AI prediction model based on LSTM neural network to monitor network packet loss rate, latency, bandwidth and other parameters in real time, predict network status changes in advance, adjust transmission strategies in advance, avoid video stuttering caused by passive adjustment, and dynamically adapt the key length, encryption granularity and data packet retransmission strategy of the encryption algorithm according to the network status. The AI ​​prediction model is a multi-layer long short-term memory temporal prediction network, which consists of an input layer, a multi-layer LSTM hidden layer, a multi-feature fusion layer, and a transmission strategy output layer connected in sequence. Multi-layer LSTM hidden layers are used to deeply mine the temporal change patterns and correlation features of network state. Multi-feature fusion layer integrates network parameter features of multiple dimensions such as packet loss rate, latency, and bandwidth. Transmission strategy output layer generates transmission control instructions adapted to the current network state. The model input consists of multi-dimensional time-series feature data such as packet loss rate, transmission delay, and available bandwidth of the video surveillance transmission link. The output consists of network state prediction results, encryption strategy adjustment instructions, and retransmission mechanism trigger instructions. Model training is carried out based on network state data of multiple video transmission scenarios. First, network state time-series samples under different link environments and different transmission loads are collected and preprocessed by noise reduction and normalization. Then, a multi-layer LSTM network structure is constructed and parameters are initialized. The model is iteratively optimized through the time-series prediction training paradigm to ensure that the model accurately predicts changes in network state.

[0056] When the network conditions are good, high-strength SM4 encryption and large-granularity encryption are used. When the network experiences packet loss or high latency, it automatically switches to lightweight SM4 encryption and small-granularity encryption. At the same time, forward error correction and selective retransmission mechanisms are activated, and key frames are retransmitted first based on video frame priority. Forward error correction adds error correction codes when sending data packets, allowing the receiver to directly correct and repair minor packet loss; selective retransmission only retransmits lost or erroneous data packets, without retransmitting normal data packets; video frames are divided according to decoding priority, with key frames having higher retransmission priority than ordinary frames.

[0057] It adopts a multi-path transmission mechanism and uses AI intelligent routing algorithm to dynamically allocate video traffic according to the bandwidth, latency and security of each path, and transmits key frames and ordinary frames separately. It has a path fault self-healing function, and automatically switches to the backup path when a path fails, with the switching latency controlled within 50ms. It also has a transmission status feedback mechanism, which feeds back transmission parameters to other modules in real time and adjusts strategies such as zero-copy forwarding and traffic obfuscation in conjunction with each other.

[0058] Multi-path transmission is achieved by establishing multiple independent transmission links based on the module, with each link corresponding to a different network route and transmission channel; the AI ​​intelligent routing algorithm collects the bandwidth usage, transmission delay, and link stability parameters of each path in real time to comprehensively evaluate the path transmission quality; video traffic is split according to frame priority, with key frames assigned to the path with the best transmission quality and ordinary frames assigned to backup paths; when a transmission anomaly occurs on a single path, the traffic on that path is immediately switched to other normal paths, and the switching process is seamless.

[0059] The multi-path fault self-healing mechanism monitors the connectivity, data transmission integrity, and transmission stability of each transmission link in real time. Once a fault such as link interruption, excessive packet loss, or abnormal latency is detected, the smooth traffic migration process is immediately initiated to seamlessly switch all video traffic carried by the faulty path to the preset backup path. The migration process follows the video frame decoding timing requirements and preserves the original transmission order of key frames and ordinary frames.

[0060] In this embodiment of the invention, the fault self-healing module adopts a hardware bypass design. When the module experiences a power failure, hardware failure, or software crash, the hardware bypass switch automatically closes, directly connecting the front-end camera to the back-end platform. Video traffic bypasses the module and is transmitted directly, with the switching delay controlled within 50ms. The hardware bypass switch is a pure hardware circuit independent of the module's main control system. Its triggering and closing are driven entirely by hardware level signals and do not depend on CPU calculations, software programs, or configuration parameters. When the module experiences extreme abnormal situations such as power outages, main control failures, or encryption engine crashes, the hardware bypass circuit automatically triggers a closing action through level changes, directly opening the physical transmission path between the front-end device and the back-end platform.

[0061] It has a three-level fault detection mechanism to monitor key components of the module such as power supply, CPU, memory, network interface, and encryption engine in real time. It is divided into three levels: minor fault, medium fault, and severe fault. Different self-healing strategies are adopted for different levels of fault. In the case of minor faults such as excessive memory usage, the software will be restarted and the configuration will be restored automatically without affecting business operation. In the case of medium faults such as software abnormality, the backup software module will be started. In the case of severe faults such as hardware damage, the hardware will be automatically switched to hardware bypass mode. The hardware bypass switch is a built-in hardware pass-through circuit in the module, which is normally in the open state. The traffic is transmitted after being processed by the safety module. The three-level fault judgment is based on the component's operating status parameters. Minor faults are software operation abnormalities or parameter configuration deviations. Moderate faults are module function failures or insufficient computing power. Severe faults are hardware damage or power outages. Minor faults trigger software restart and configuration reset operations. Moderate faults activate the backup module takeover function. Severe faults trigger the hardware bypass switch to close, and the traffic is directly bypassed by the module for pass-through transmission. After the fault is repaired, the bypass is automatically disconnected and the safety hardened mode is restored.

[0062] By using AI-powered intelligent early warning models to predict fault development trends in advance, such as hardware aging warnings, alarm information is sent to the management platform, including fault type, location, and self-healing suggestions. After the module recovers from the fault, it automatically switches back to normal working mode, and at the same time, it automatically analyzes the cause of the fault and generates a fault report.

[0063] The AI ​​intelligent early warning model adopts a gradient boosting tree classification prediction architecture, which consists of a running feature acquisition layer, a core feature screening layer, a fault trend prediction layer, and a hierarchical early warning output layer in sequence. The operation feature acquisition layer extracts real-time operation parameters and load data of the module power supply, CPU, memory, network interface, and encryption engine; the core feature screening layer removes redundant features and retains core features that are strongly correlated with faults; the fault trend prediction layer predicts the probability of fault occurrence and development trend; and the hierarchical early warning output layer generates fault level signals and standardized early warning information. The model input consists of runtime sequence data, load status data, and operating environment parameter data of each key component of the module. The output consists of fault warning level, fault type prediction result, and warning trigger signal. The model training is based on the construction of a training dataset using module operation fault samples and normal operation samples. First, sample feature annotation, data cleaning and outlier handling are completed, and then supervised learning is used to complete the model training.

[0064] The fault report is generated autonomously by the module and includes comprehensive information such as the precise time of the fault occurrence, the component to which the fault belongs, the fault level determination, the entire process of the self-healing strategy execution, in-depth analysis of the fault causes, and subsequent prevention suggestions. After the report is generated, it is automatically uploaded to the management platform through a dedicated channel and is also encrypted and stored locally on the module.

[0065] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0066] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An access-type video security hardening module, characterized in that, It includes a zero-copy forwarding module, a protocol parsing module, a decoupling and desensitization module, a national cryptographic key module, an RTP protection module, a packet loss prevention module, and a fault self-healing module; The zero-copy forwarding module adopts a dual architecture of kernel-mode DMA memory mapping and eBPF dynamic program; The decoupling and desensitization module divides video surveillance data into three layers: signaling layer, metadata layer, and media stream layer. It achieves physical-level isolation between signaling and media stream through dedicated signaling channels and dedicated media stream channels. It uses a time-series prediction model based on LSTM neural network to adjust the metadata data transmission parameters and achieves dynamic desensitization through a fusion model of computer vision and natural language processing. The national cryptographic key module has a built-in dedicated hardware acceleration chip that integrates the national cryptographic algorithm. It uses a two-factor generation and binds public and private keys, and has the functions of key lifecycle management and hierarchical authentication. The RTP protection module employs RTP packet timing reconstruction technology to obfuscate the features of the RTP protocol header fields. It uses an anomaly detection model based on the fusion of isolated forest and long short-term memory network to monitor traffic anomalies and trigger protection measures. Through random timing adjustment and intelligent generation of fake data packets, it randomizes the sending interval and length of RTP data packets and generates fake data packets with the same structure as real video frames by combining video frame features. The version number, sequence number, and timestamp fields in the RTP protocol header are dynamically and randomly modified, and the modification rules are only synchronized on the authorized end. The anomaly detection model based on the fusion of isolated forest and long short-term memory network monitors abnormal behaviors in real time, including traffic analysis, denial-of-service attacks, and traffic hijacking. When an attack is detected, the protection strategy is automatically adjusted and other modules are linked to trigger traffic isolation and encryption upgrade security mechanisms.

2. The access-type video security hardening module according to claim 1, characterized in that, The zero-copy forwarding module implements bidirectional transparent proxy based on virtual network interface card technology, and adopts a dedicated traffic scheduling mechanism for video streams and a three-dimensional traffic isolation strategy. The zero-copy forwarding module acquires video data packets received by the network card through the DMA controller in kernel mode, maps the data packets directly from the kernel buffer to the user-mode security processing buffer through memory mapping, embeds an eBPF dynamic program to monitor the video stream transmission status in real time, and adaptively adjusts the memory mapping granularity according to the video frame rate and resolution.

3. The access-type video security hardening module according to claim 2, characterized in that, The zero-copy forwarding module's three-dimensional traffic isolation strategy is implemented using port, IP address, and MAC address as three isolation dimensions. It physically isolates video surveillance traffic of different security levels and different manufacturers, and supports dynamic allocation of traffic priorities.

4. The access-type video security hardening module according to claim 3, characterized in that, The protocol parsing module has a built-in protocol feature library, adapts to unknown protocols through a deep learning model, completes protocol conversion and signaling encryption preprocessing, and has a protocol anomaly detection function. The protocol parsing module's protocol feature library includes features of general video surveillance protocols and proprietary protocols from mainstream manufacturers. It has a protocol feature self-evolution mechanism and uses a CNN-LSTM fusion deep learning model to learn, extract features, and automatically adapt to unknown protocols in real time, generating corresponding parsing rules.

5. The access-type video security hardening module according to claim 4, characterized in that, The protocol parsing module adopts a one-stop protocol conversion mechanism, which converts private protocols into standard protocol formats while simultaneously performing national cryptographic encryption preprocessing of signaling data; the protocol anomaly detection function identifies malformed protocol packets and abnormal commands, blocking malicious protocol attacks.

6. The access-type video security hardening module according to claim 5, characterized in that, The decoupling and desensitization module adopts an asynchronous pre-transmission mechanism for metadata. Combined with a time-series prediction model based on LSTM neural network, it dynamically adjusts the timing and rate of metadata pre-transmission according to the video stream transmission status. The metadata is verified using the national cryptographic SM3 hash.

7. The access-type video security hardening module according to claim 6, characterized in that, The dynamic desensitization mechanism of the decoupled desensitization module automatically identifies sensitive fields in the signaling, including usernames, passwords, device serial numbers, and monitoring points, through a fusion model of computer vision and natural language processing. It dynamically selects desensitization strategies, including encryption desensitization, fuzzy replacement, and partial concealment, based on the sensitivity level, and supports custom configuration of desensitization strategies.

8. The access-type video security hardening module according to claim 7, characterized in that, The national cryptographic key module adopts a dual-engine parallel computing design, with the SM9 authentication engine and the SM4 encryption engine working together; it uses a dual-factor method of device identification and hardware fingerprint to generate public and private keys, and the public and private keys are bound to the device identification and hardware fingerprint. It adopts a lightweight dynamic key management mechanism to achieve automated management of the entire lifecycle of key generation, distribution, update and revocation, supports batch registration and hierarchical authentication of devices, and has key anomaly detection and dynamic update functions.

9. The access-type video security hardening module according to claim 1, characterized in that, The anti-packet loss module adopts a time-series prediction model based on LSTM neural network to monitor network packet loss rate, latency, and bandwidth parameters in real time. It dynamically adapts encryption and retransmission strategies according to network status and prioritizes the retransmission of key frames based on video frame priority. The anti-packet loss module has a built-in multi-path transmission mechanism. This mechanism dynamically allocates video traffic according to the status of each path through an intelligent routing algorithm based on comprehensive evaluation of multi-path status. It has the functions of path fault self-healing and transmission status feedback.

10. The access-type video security hardening module according to claim 1, characterized in that, The fault self-healing module adopts a hardware bypass switch design, monitors key components of the module in real time, adopts differentiated self-healing strategies according to fault level, and automatically switches back to working mode after the fault is recovered. The fault self-healing module's three-level fault detection mechanism monitors the module's key components in real time, classifying faults into three levels: minor, moderate, and severe. Differentiated self-healing strategies are adopted for different levels, and the module has functions for fault warning, alarm sending, and cause analysis. After the module recovers from the fault, it automatically switches back to normal working mode.

Images