Embedded video security reinforcement module

Abstract

The application belongs to the technical field of embedded terminal security and video data security processing, and discloses an embedded video security reinforcement module, method and system. The module comprises a module substrate, an on-board bypass connection part, a video segmentation processing circuit, a password security circuit, an isolated access circuit, a reinforcement output circuit, a state acquisition circuit and a strategy control circuit arranged on the module substrate, the on-board bypass connection part is connected between a video encoding output side and a video transmission output side of an embedded video device, the video segmentation processing circuit forms video segmentation data, a video segmentation serial number, a frame type and a current video segmentation digest value according to a frame boundary, a code stream unit boundary and a variable length segmentation control parameter, the password security circuit saves a root key which is not output to the video segmentation processing circuit and provides encrypted payload or integrity check value through a key handle, and the isolated access circuit limits reading of a key storage area from a video processing side.

Description

Technical Field

[0001] This invention belongs to the field of embedded terminal security and video data security processing technology, specifically an embedded video security hardening module. Background Technology

[0002] Embedded video devices typically include a video acquisition unit, an encoding unit, a main control unit, and a transmission unit. After video data is acquired and encoded, it forms an encoded video stream, which is then transmitted externally via a network interface, storage interface, or local bus. To improve video data security, existing solutions often set up encryption modules, security chips, identity authentication modules, or log modules on the camera, video gateway, or platform side to encrypt, sign, authenticate access, or record the operation of the video stream.

[0003] Existing solutions that meet video networking security requirements can provide some protection for transmission links and terminal access. However, there are still exploitable side-channel features in the video output stage after encoding. For H.264 or H.265 variable bitrate streams, different motion amplitudes and texture complexities will be reflected in packet size, packet intervals, and keyframe distribution. Even if the video payload is encrypted, attackers may still infer image changes by statistically analyzing the size and time interval of encrypted packets. For embedded terminals, unintentional electromagnetic radiation from high-speed image links and fluctuations in power indicator brightness may also expose image outlines or cryptographic operation rhythms, making it difficult for solutions that rely solely on channel encryption and access authentication to cover all output risks.

[0004] In onboard ruggedized scenarios, the encoded video stream is already formed, and the original acquisition and encoding links of the device are usually not easy to modify significantly. If the whole-channel encryption, single-frame verification, or gateway-side authentication methods are still used, the video data processing path, key retrieval path, and access status judgment are prone to disconnection: the video processing side may access key-related data when performing encryption or verification; there is a lack of correlation between different video segments for pre- and post-verification, and it is not easy to locate the segment level after the segment is deleted, reordered, or replaced; security policies are also prone to be executed based on fixed encryption rules or single authentication results, which are difficult to simultaneously reflect the frame type of the video segment, the module's own trust status, and the access status of the access object. Therefore, without changing the original video encoding link, the encoded video output link still has problems such as insufficient segment-level integrity verification, insufficient key isolation, inaccurate control of abnormal access output, and a fixed correlation between the output packet characteristics and changes in the original picture. Summary of the Invention

[0005] The purpose of this invention is to provide an embedded video security hardening module, method, and system to solve the problem that it is difficult to coordinate the implementation of segment-level verification, key isolation, abnormal access handling, and weakening of output-side traffic-side channel characteristics in the video output stage without changing the original video encoding link of the embedded video device.

[0006] To achieve the above objectives, the present invention provides the following technical solution: an embedded video security hardening module, which is connected between the video encoding output side and the video transmission output side of an embedded video device. This module is used to perform segmentation, key isolation, security processing, status determination, and hardening output on the encoded video stream before outputting the encoded video stream. It primarily addresses the problems in existing embedded video devices where the video data processing path may directly access key data, there is a lack of continuity verification between video segments, and video data may continue to be output even when the module's status or access status is abnormal.

[0007] The embedded video security hardening module includes a module substrate, an onboard bypass connection, a video segmentation processing circuit, a cryptographic security circuit, an isolation access circuit, a status acquisition circuit, a policy control circuit, and a hardening output circuit. The onboard bypass connection, video segmentation processing circuit, cryptographic security circuit, isolation access circuit, status acquisition circuit, policy control circuit, and hardening output circuit are all mounted on the module substrate. The onboard bypass connection is connected between the video encoding output side and the video transmission output side of the embedded video device. It is used to access the encoded video stream and the access request information corresponding to the encoded video stream. By arranging the module between the video encoding output side and the video transmission output side, the encoded video stream can be hardened without changing the original video acquisition and encoding structure of the embedded video device.

[0008] The onboard bypass connection unit includes a video channel interface, a control channel interface, and a bypass control unit. The video channel interface includes a first video port and a second video port. The first video port is connected to the video encoding output side, and the second video port is connected to the video transmission output side. The control channel interface is used to access access request information, which includes the access object identifier, access command type, and identity authentication data. The bypass control unit establishes a bypass processing path between the first video port and the second video port, passing through the video segmentation processing circuit. This allows the encoded video stream to enter the module for segmentation and security processing before being sent back to the video transmission output side. In this way, the processing of the video stream is based not only on the frame structure of the stream itself but also on the access request information, which can prevent all video data from being processed in the same fixed way.

[0009] The video segmentation processing circuit generates video segment data, video segment numbers, frame types of video segment data, and current video segment summary values ​​based on the encoded video bitstream. The video segmentation processing circuit includes a bitstream parsing unit, a segmentation management unit, a summary calculation unit, and an output processing unit. The bitstream parsing unit extracts frame type information, frame boundary information, and bitstream unit boundary information from the encoded video bitstream. The segmentation management unit generates consecutive video segment numbers based on the frame boundary information, bitstream unit boundary information, and video output order, and forms corresponding video segment data. The summary calculation unit generates the current video segment summary value based on the video segment data. The output processing unit writes the video segment data associated with the segment security mark into the video output buffer.

[0010] In one specific implementation, when the bitstream parsing unit identifies the encoded video bitstream as conforming to the Advanced Video Coding Standard (ADPS) or High Efficiency Video Coding Standard (HEAD), it identifies key frames and non-key frames based on the Network Abstraction Layer (NAL) unit type and uses the NAL unit boundary as the bitstream unit boundary. When the bitstream parsing unit identifies the encoded video bitstream as an encapsulated data packet, it determines the bitstream unit boundary based on the header length field and payload length field. Through this processing method, video segments are formed based on frame boundaries and bitstream unit boundaries, rather than being segmented only according to a fixed byte length, so that the subsequent encryption range, verification range, and output order can correspond to the video bitstream structure.

[0011] The cryptographic security circuit is connected to the video segmentation processing circuit through an isolated access circuit. The cryptographic security circuit has a key storage area and a key control buffer area. The key storage area is used to store the root key that is not output to the video segmentation processing circuit, and the key control buffer area is used to store the control data during the key invocation process. The cryptographic security circuit generates an encrypted payload or integrity verification value based on the key invocation instruction, policy version information, and video segment sequence number. When encryption processing and integrity verification processing are performed simultaneously on the same video segment data, the cryptographic security circuit generates an encrypted payload and an integrity verification value.

[0012] The cryptographic security circuit includes a root key storage unit, a segmented key derivation unit, a key handle table, and a handle output unit. The root key storage unit forms a key storage area. The segmented key derivation unit derives segmented keys for corresponding video segment data based on module identity information, policy version information, video segment sequence number, and random numbers. The key handle table records the correspondence between video segment sequence number, policy version information, and key handles. The handle output unit reads the corresponding key handle when it exists in the key handle table, and generates the corresponding key handle when it does not exist. The cryptographic security circuit determines the corresponding segmented key based on the key handle and generates an encrypted payload or integrity check value based on the segmented key. The segmented key is invoked through the key handle, instead of handing the plaintext segmented key to the video segment processing circuit, thus keeping the video data processing path isolated from the key control path.

[0013] The isolated access circuit restricts the video segmentation processing circuit from reading the key storage area. The isolated access circuit includes a video-side address restriction table, a key-side address restriction table, and an access arbitration unit. The video-side address restriction table limits the range of video buffer addresses that the video segmentation processing circuit can access, and the key-side address restriction table limits the range of key control addresses that the cryptographic security circuit can access. When the video segmentation processing circuit initiates an access request, the access arbitration unit compares the target address with the video-side address restriction table. If the target address points to the key storage area or the key control buffer, the access arbitration unit blocks the access request. Through address restriction and access arbitration, the video segmentation processing circuit can only submit video segment data or the current video segment digest value to the cryptographic security circuit, and cannot directly read the root key, segment key, or key control buffer content.

[0014] The status acquisition circuit generates a module trusted status and an access object access status based on the module startup verification result and access request information generated by the cryptographic security circuit. The module trusted status includes an allowed status and a restricted status, and the access object access status also includes an allowed status and a restricted status. The status acquisition circuit includes a trusted status acquisition unit and an access status acquisition unit. The trusted status acquisition unit acquires the verification result after the cryptographic security circuit performs integrity verification on the module startup data, interface configuration data, and policy version information, and generates the module trusted status based on the verification result. The access status acquisition unit generates an identity authentication result and a video call request record based on the access request information, and compares the identity authentication result and the video call request record with the access judgment parameters to generate the access object access status. Through this setting, the policy control circuit can simultaneously receive the module's own status and the access object status, avoiding the output of video data in a normal state when the module startup data, interface configuration data, policy version information, or access behavior are abnormal.

[0015] The policy control circuit provides the currently used policy version information and generates security processing control parameters based on the frame type, module trust status, and access object access status of the video segment data. The policy control circuit includes a policy register and a condition determination unit. The policy register forms a policy storage area, which stores policy version information, key frame processing parameters, non-key frame processing parameters, and abnormal state processing parameters. The condition determination unit calls the key frame processing parameters when the video segment data contains key frames and both the module trust status and access object access status are allowed; it calls the non-key frame processing parameters when the video segment data contains non-key frames and both the module trust status and access object access status are allowed; when the same video segment data contains both key frames and non-key frames, the condition determination unit calls the key frame processing parameters; and it calls the abnormal state processing parameters when the module trust status or access object access status is restricted. The policy control circuit generates security processing control parameters based on the called processing parameters.

[0016] Keyframe processing parameters include the keyframe payload encryption start position, keyframe payload encryption length, and keyframe verification method. Non-keyframe processing parameters include the non-keyframe payload encryption start position, non-keyframe payload encryption length, and non-keyframe verification method. Abnormal state processing parameters include the full payload encryption flag and the stop output flag. When the video segmentation processing circuit calls the keyframe processing parameters, it determines the range of keyframe payloads submitted to the cryptographic security circuit based on the keyframe payload encryption start position and keyframe payload encryption length. When calling the non-keyframe processing parameters, it determines the range of non-keyframe payloads submitted to the cryptographic security circuit based on the non-keyframe payload encryption start position and non-keyframe payload encryption length.

[0017] When the module's trusted state is restricted and the access object's access state is allowed, the video segmentation processing circuit submits the current video segment data to the cryptographic security circuit for full payload encryption processing based on the full payload encryption flag. When the access object's access state is restricted, the hardened output circuit stops outputting the current video segment data based on the stop output flag. Through the above processing, different frame types, different module states, and different access states can correspond to different processing parameters, avoiding the use of the same processing method for key frames, non-key frames, abnormal access, and module abnormalities.

[0018] The video segmentation processing circuit also forms segment security tags based on security processing control parameters and encrypted payloads or integrity verification values ​​generated by the cryptographic security circuit. After associating the segment security tags with the corresponding video segment data, the circuit sends them to the hardened output circuit. The segment security tags include video segment sequence number, frame type identifier, policy version information, current video segment digest value, and previous video segment verification value. The first video segment data uses the initial chain value generated by the aforementioned cryptographic security circuit as the previous video segment verification value. The initial chain value is generated by the cryptographic security circuit based on module identity information, module startup verification results, and random numbers. By simultaneously incorporating the current video segment digest value, the previous video segment verification value, and policy version information into the segment security tags, a sequential association is formed between adjacent video segments, which is used to identify cases where video segments are deleted, reordered, or replaced.

[0019] The hardened output circuit outputs the video segment data associated with the segment security tag to the video transmission output side according to the video output order corresponding to the video segment number. The video segment data processed by the module still enters the video transmission output side in the original video output order, and each video segment data is associated with the corresponding segment security tag, which facilitates the subsequent verification of the integrity, order and policy version of the video segments.

[0020] In a further implementation, the embedded video security hardening module also includes a security log circuit. The security log circuit is connected to the status acquisition circuit, the cryptographic security circuit, the policy control circuit, and the hardening output circuit. The security log circuit records events such as changes in the module's trusted state, key handle invocation events, policy version information changes, security processing control parameter generation events, video segmentation output events, and events where the access object's access state is restricted. The security log circuit generates a current log verification flag based on the previous log digest value, the current log content, and the log verification key handle provided by the cryptographic security circuit. By associating the previous log digest value with the current log content, the module's state changes, key invocations, and video segmentation output processes can have continuous verification basis.

[0021] With the above structure, the encoded video stream enters the module through the onboard bypass connection. The video segmentation processing circuit forms video segment data and video segment sequence numbers according to the stream structure. The cryptographic security circuit provides encrypted payload or integrity verification value without outputting root key and segment key to the video segmentation processing circuit. The isolation access circuit restricts the video processing side from accessing the key area. The status acquisition circuit introduces the module's trusted status and the access status of the access object into the policy judgment. The policy control circuit switches the security processing control parameters according to the frame type and status information. The hardened output circuit outputs the hardened video segment data in the video output order. Thus, the video data stream, key call stream, and status control stream cooperate with each other within the module, enabling the embedded video device to form segment-level security hardening processing capability on the basis of the original video encoding link.

[0022] The present invention also provides an embedded video data security hardening method, the steps of which include accessing the encoded video bitstream and access request information, performing variable-length segmentation based on frame boundaries and bitstream unit boundaries, generating security operation results under key isolation state, generating security processing control parameters according to frame type and status information, forming segmented security tags, and performing hardened output according to the video output order.

[0023] The present invention also provides an embedded video security hardening system, including an embedded video device and the aforementioned embedded video security hardening module. The embedded video device includes a video acquisition unit, an encoding unit, a main control unit, and a transmission unit. An onboard bypass connection is connected between the video encoding output side of the encoding unit and the video transmission output side of the transmission unit.

[0024] The beneficial effects of this invention are as follows: 1. This invention connects the onboard bypass connection unit between the video encoding output side and the video transmission output side of the embedded video device, so that the encoded video stream is processed by the video segmentation processing circuit before entering the original transmission link. The video segmentation processing circuit then forms video segment data, video segment sequence number, frame type and current video segment summary value based on frame boundaries, bitstream unit boundaries and variable length segmentation control parameters. This achieves the effect of establishing a segment-level security processing foundation without changing the original acquisition and encoding link. Compared with the method of processing according to fixed byte length or whole bitstream, this scheme can make the security processing range correspond to the actual bitstream structure, and weaken the fixed correspondence between packet size, packet interval and original image changes through variable length segmentation and output disturbance identification, thereby reducing the effectiveness of output side traffic side channel analysis.

[0025] 2. This invention separates the video segmentation processing path from the key control path by setting up a cryptographic security circuit and an isolated access circuit. The cryptographic security circuit stores the root key and derives segment keys based on module identity information, policy version information, video segment sequence number, and random number. The video segmentation processing circuit only submits key call instructions, video segment data, or the current video segment digest value, and then receives the encrypted payload or integrity verification value returned by the cryptographic security circuit. The isolated access circuit blocks the video segmentation processing circuit from reading the key storage area and key control buffer area through the video-side address restriction table, the key-side address restriction table, and the access arbitration unit. This achieves the effect of using secure computation results during video data processing without accessing the root key and plaintext segment keys. This hardware isolation relationship can reduce the risk of key leakage when the video processing side is accessed abnormally, and provides clear handle records for key calls of different video segments.

[0026] 3. This invention uses a state acquisition circuit and a strategy control circuit to generate security processing control parameters based on the module's trusted state, the access object's access state, and the frame type of the video segment data. The strategy control circuit calls different processing parameters according to key frames, non-key frames, abnormal module trusted state, and abnormal access object access state, and writes the strategy version information into the segment security tag. The segment security tag also includes the current video segment summary value and the previous video segment verification value, achieving the effect that the processing method, processing basis, and relationship between previous and subsequent segments of each video segment can be traced. When a video segment is deleted, reordered, or replaced, the chain relationship between the current video segment summary value, the previous video segment verification value, and the video segment sequence number is broken, which facilitates the subsequent location of abnormal segments. When the access object access state is abnormal, the hardened output circuit can stop outputting the current video segment data to prevent abnormal access from continuing to obtain video content. Attached Figure Description

[0027] Figure 1 This is an overall flowchart of the embedded video security hardening module of the present invention; Figure 2 This is a flowchart of the video segmentation process of the present invention; Figure 3 This is a flowchart of the key isolation security processing of the present invention. Detailed Implementation

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] like Figures 1 to 3 As shown, this embodiment provides an embedded food safety hardening module. The module includes a module substrate, an onboard bypass connection, a video segmentation processing circuit, a password security circuit, an isolation access circuit, a hardening output circuit, a status acquisition circuit, and a strategy control circuit. The module substrate is a printed circuit board, and the onboard bypass connection, video segmentation processing circuit, password security circuit, isolation access circuit, hardening output circuit, status acquisition circuit, and strategy control circuit are all arranged on the module substrate.

[0030] The video segmentation processing circuit is implemented by a programmable logic circuit or a dedicated processing circuit with the capabilities of bitstream parsing, buffer management, and digest calculation. It is used to receive the encoded video bitstream and form video segment data. The cryptographic security circuit is implemented by a security chip or security coprocessor with the capabilities of key protection, key derivation, and cryptographic operation. It is used to store the root key, derive segment keys, and generate encrypted payloads or integrity verification values. The isolation access circuit is implemented by bus access control logic, address restriction logic, and access arbitration logic. It is used to restrict the video segmentation processing circuit from accessing the key storage area and key control buffer area in the cryptographic security circuit.

[0031] The onboard bypass connection is connected between the video encoding output side and the video transmission output side of the embedded video device. The video encoding output side is where the video acquisition and encoding module in the embedded video device outputs the encoded video stream; the video transmission output side is where the embedded video device sends the video stream into the network transmission link, storage transmission link, or local transmission link. After the encoded video stream enters this module through the onboard bypass connection, it is first segmented and digested by the video segmentation processing circuit. Then, according to the security processing control parameters output by the strategy control circuit, it is encrypted, integrity checked, or output controlled. After processing, it is sent back to the video transmission output side by the hardened output circuit.

[0032] The onboard bypass connection unit includes a video channel interface, a control channel interface, and a bypass control unit. The video channel interface includes a first video port and a second video port. The first video port is connected to the video encoding output side, and the second video port is connected to the video transmission output side. The bypass control unit establishes a bypass processing path through the video segmentation processing circuit between the first video port and the second video port, so that the encoded video stream accessed by the first video port is sent to the video segmentation processing circuit. The control channel interface is used to access access request information, which includes access object identifier, access instruction type, and identity authentication data.

[0033] The access object identifier comes from the user identifier, device identifier, or session identifier recorded by the main control board of the embedded video device. The access command type includes real-time preview request, video playback request, video export request, or parameter access request. The identity authentication data includes authentication token, certificate verification data, session verification data, or identity verification result data forwarded by the main control board. The control channel interface does not replace the original user authentication module of the embedded video device, but instead accesses the access request information related to the output of the encoded video stream, so that the status acquisition circuit can form the access status of the access object based on the access request information.

[0034] The video segmentation processing circuit includes a stream parsing unit, a segmentation management unit, a digest calculation unit, and an output processing unit. The stream parsing unit receives the encoded video stream input from the first video port and extracts frame type information, frame boundary information, and stream unit boundary information from the encoded video stream. The segmentation management unit forms video segment data based on the frame boundary information, stream unit boundary information, video output order, and variable-length segmentation control parameters, and generates consecutive video segment numbers for each video segment data. The video segment numbers are generated according to the order in which the encoded video streams enter the module and are used for key handle table recording, segment security tag generation, and sequential output by the hardened output circuit.

[0035] When the encoded video stream is an H.264 or H.265 encoded stream, the stream parsing unit identifies keyframes and non-keyframes based on the network abstraction layer unit type, and uses the network abstraction layer unit boundary as the stream unit boundary. For H.264 streams, the network abstraction layer units corresponding to keyframes can be segmented separately, while the network abstraction layer units corresponding to non-keyframes can be merged into segments according to the output order within the same image group. When a single network abstraction layer unit exceeds the segmentation load limit allowed by the policy, the segmentation management unit still uses the identifiable slice boundary inside the network abstraction layer unit as an auxiliary boundary for segmentation. The above processing makes the segmentation boundary match the stream structure, rather than segmenting only according to a fixed byte length.

[0036] The variable-length segmentation control parameters are provided by the strategy control circuit, including at least the upper limit of segment load, the lower limit of segment load, the priority of key frame segmentation, the merging rules of non-key frames, the padding length generation rules, and the output perturbation level. Without destroying the bitstream boundary required for decoding, the segmentation management unit selects whether to merge adjacent bitstream units into segments according to the frame type and the output perturbation level, and generates an output perturbation identifier. Since the payload length of the video segment data is no longer determined solely by the length of the original video frame, it is difficult for attackers to directly infer the motion or texture changes of the original image from the size of the encrypted packet.

[0037] The summary calculation unit calculates the summary value of the current video segment based on the current video segment data. The inputs to the summary calculation include the payload content of the current video segment data, the video segment number, the frame type identifier, and the policy version information. The output processing unit receives the video segment data that has undergone security processing, associates the video segment data with the corresponding segment security tag, and writes it into the video output buffer.

[0038] The cryptographic security circuit is connected to the video segmentation processing circuit through an isolation access circuit. The cryptographic security circuit has a key storage area and a key control buffer area. The key storage area is used to store the root key. The root key is not output to the video segmentation processing circuit, nor is it output through the module's external interface. The key control buffer area is used to store key call instructions, policy version information, video segment sequence number, key handle, and encrypted payload or integrity verification value generated by the cryptographic security circuit.

[0039] When the video segmentation processing circuit needs to encrypt or verify the integrity of video segment data, it submits a key retrieval command, policy version information, video segment number, and video segment data or current video segment digest value to the cryptographic security circuit. The cryptographic security circuit determines the corresponding key handle based on the key retrieval command, policy version information, and video segment number, then determines the corresponding segment key based on the key handle, and uses the segment key to generate an encrypted payload or integrity verification value. If the same video segment data needs to be encrypted and verified simultaneously, the cryptographic security circuit generates the encrypted payload and integrity verification value respectively.

[0040] The cryptographic security circuit includes a root key storage unit, a segment key derivation unit, a key handle table, and a handle output unit. The root key storage unit forms a key storage area and stores the root key. The segment key derivation unit derives the segment key corresponding to the video segment data based on the module identity information, policy version information, video segment sequence number, and random number. The module identity information is the device unique identifier written at the factory, the hardware security identifier, or the module identifier protected by the cryptographic security circuit. The random number is generated by a random number generator or a secure random source within the cryptographic security circuit.

[0041] The key handle table records the correspondence between video segment sequence number, policy version information, and key handle. When the key handle output unit finds a key handle in the key handle table that corresponds to the current video segment sequence number and the current policy version information, it reads the key handle. When the key handle table does not contain a corresponding key handle, it generates a corresponding key handle and writes it into the key handle table. The cryptographic security circuit locates the corresponding segment key through the key handle and completes the security operation. The plaintext segment key is not written into the video receiving buffer, video segment buffer, or video output buffer that the video segmentation processing circuit can access.

[0042] The isolated access circuit includes a video-side address restriction table, a key-side address restriction table, and an access arbitration unit. The video-side address restriction table limits the range of video buffer addresses that the video segmentation processing circuit can access, including the video receiving buffer, the video segmentation buffer, and the video output buffer. The key-side address restriction table limits the range of key control addresses that the cryptographic security circuit can access, including the key storage area and the key control buffer.

[0043] When the video segmentation processing circuit initiates an access request, the access arbitration department compares the target address of the access request with the video-side address limitation table. If the target address falls within the video cache address range, the access arbitration department allows the access request to pass. If the target address points to the key storage area or the key control cache area, the access arbitration department blocks the access request. Through the above access arbitration process, the video segmentation processing circuit can submit video segment data or the current video segment digest value to the cryptographic security circuit, but it cannot directly read the root key, segment key, or key control cache content.

[0044] The status acquisition circuit includes a trusted status acquisition unit and an access status acquisition unit. The trusted status acquisition unit acquires the verification results of the cryptographic security circuit after performing integrity verification on the module startup data, interface configuration data, and policy version information, and generates the module trusted status based on the verification results. The module startup data includes a module startup code digest, a configuration table digest, or a load file digest. The interface configuration data includes video channel interface configuration, control channel interface configuration, or address mapping configuration. When all the above verification results pass, the module trusted status is an allowed status; when any verification result fails, the module trusted status is a restricted status.

[0045] The access status acquisition unit has access determination parameters. Based on the access request information input from the control channel interface, the access status acquisition unit generates an identity authentication result and a video call request record. It then compares the identity authentication result and the video call request record with the access determination parameters to generate the access status of the access object. The access determination parameters are written by the factory security policy, the device administrator configuration policy, or the policy issued by the superior management platform. The access determination parameters include the threshold for the number of identity authentication failures, the threshold for the frequency of video call requests, the threshold for the number of video export requests, and the threshold for the number of unauthorized register accesses. When the identity authentication result is successful and the video call request record does not meet the abnormal conditions limited by the access determination parameters, the access status of the access object is allowed. When the identity authentication fails or the video call request record meets the abnormal conditions limited by the access determination parameters, the access status of the access object is restricted.

[0046] The policy control circuit includes a policy register, a condition determination unit, and a policy update verification unit. The policy register forms a policy register area, which stores policy version information, key frame processing parameters, non-key frame processing parameters, abnormal state processing parameters, and traffic disturbance parameters. Key frame processing parameters include key frame payload encryption range rules and key frame verification methods; non-key frame processing parameters include non-key frame payload encryption range rules and non-key frame verification methods; abnormal state processing parameters include full payload encryption flags and stop output flags; and traffic disturbance parameters include padding length range, accompanying metadata length range, and output packet interval disturbance range.

[0047] The condition determination unit reads the frame type, module trust status, and access object access status of the video segment data. When the video segment data contains keyframes and both the module trust status and the access object access status are allowed, the condition determination unit calls the keyframe processing parameters. When the video segment data contains non-keyframes and both the module trust status and the access object access status are allowed, the condition determination unit calls the non-keyframe processing parameters. When the same video segment data contains both keyframes and non-keyframes, the condition determination unit calls the keyframe processing parameters.

[0048] When the module's trusted state is restricted or the access object's access state is restricted, the condition determination does not call the abnormal state handling parameters. When the module's trusted state is restricted but the access object's access state is allowed, the video segmentation processing circuit submits the current video segment data to the cryptographic security circuit for full payload encryption processing based on the full payload encryption flag. When the access object's access state is restricted, the hardened output circuit stops outputting the current video segment data based on the stop output flag.

[0049] The policy update verification unit receives policy data to be updated, which includes policy version information, processing parameters, traffic disturbance parameters, signature value, and policy publishing object identifier. The policy update verification unit first verifies the signature value through a cryptographic security circuit or independent signature verification logic, then compares whether the policy version information in the policy data to be updated is higher than the policy version information currently stored in the policy register, and confirms that the module's trusted state is in an allowed state. Only after the signature verification, version increment verification, and module trusted state verification all pass, will the policy update verification unit allow the policy data to be updated to be written to the policy register. If any verification fails, the policy update verification unit refuses to write and generates a policy update failure event.

[0050] The video segmentation processing circuit forms segment security tags based on the security processing control parameters and the encrypted payload or integrity verification value generated by the cryptographic security circuit. The segment security tags include the video segment sequence number, frame type identifier, policy version information, current video segment digest value, previous video segment verification value, and output perturbation identifier. For non-first video segment data, the previous video segment verification value is the integrity verification value corresponding to the previous video segment data. For the first video segment data, the previous video segment verification value adopts the initial chain value, which is generated by the cryptographic security circuit based on the module identity information, module startup verification result, and random number.

[0051] The segment security markers and video segment data are associated through the video segment sequence numbers. The segment security markers are stored in the extended header, accompanying metadata area, or index record area in the video output buffer. They can also be sent to the hardened output circuit as security marker records that correspond one-to-one with the video segment data. The encoded payload of the video segment data itself does not need to be rewritten. When the security processing control parameters require encryption, the encrypted payload part is replaced by the encrypted payload generated by the cryptographic security circuit, replacing the corresponding original payload.

[0052] The hardened output circuit outputs the video segment data associated with the segment security tag to the video transmission output side according to the video output order corresponding to the video segment number. When reading the video output buffer, the hardened output circuit first confirms the output order according to the video segment number, and then determines whether to output the corresponding video segment data according to the output processing flag. For video segment data where the access object access status is allowed and the stop output flag has not been triggered, the hardened output circuit outputs the video segment data and its associated segment security tag; for video segment data where the access object access status is restricted, the hardened output circuit stops outputting the current video segment data.

[0053] The flow disturbance unit of the reinforced output circuit configures the padding length, accompanying metadata length, or output packet interval according to the output disturbance identifier. The padding data is stored in the security mark record, transmission protocol extension field, or accompanying metadata area agreed upon within the module, and is not written into the necessary fields for decoding the original encoded payload. The output packet interval disturbance is performed within the real-time range allowed by the video transmission output side, so that the packet size and packet interval of the encrypted video segment data no longer maintain a unique correspondence with the original video frame payload length.

[0054] In one engineering implementation, for encoded video streams of 1080P, 25 frames per second, and 8Mbps to 16Mbps, the single-segment buffer processing latency of the video segmentation processing circuit is configured to be 0.6 milliseconds to 2.5 milliseconds, the integrity verification throughput is configured to be 80Mbps to 200Mbps, the single-processing time for key handle lookup and segment key derivation is configured to be 0.05 milliseconds to 0.3 milliseconds, and the total capacity of the video receiving buffer, video segment buffer, and video output buffer is configured to be 4MB to 32MB. The above parameters are used to describe the engineering configuration that the module can adopt, and the specific values ​​can be adjusted according to the processing chip, bitrate, and security level requirements.

[0055] In a further embodiment, the embedded video security hardening module also includes a security log circuit. The security log circuit is connected to the status acquisition circuit, the cryptographic security circuit, the policy control circuit, and the hardening output circuit. The security log circuit records events such as changes in the module's trusted state, key handle invocation events, policy version information changes, security processing control parameter generation events, video segmentation output events, and events where the access object's access state is restricted. The security log circuit generates a current log verification flag based on the previous log digest value, the current log content, and the log verification key handle provided by the cryptographic security circuit.

[0056] In this embodiment, the video data stream, key invocation stream, and state control stream are distinguished from each other and work together. The video data stream enters the video segmentation processing circuit through the onboard bypass connection and then returns to the video transmission output side through the hardened output circuit. The key invocation stream is initiated by the video segmentation processing circuit with a key invocation command. The cryptographic security circuit determines the segment key through the key handle and returns the encrypted payload or integrity verification value. The state control stream is formed by the state acquisition circuit to establish the module trusted state and access object access state, and then converted into security processing control parameters by the policy control circuit. Through the above process, the security processing of the encoded video segment data is correlated with the frame type, policy version information, current video segment digest value, previous video segment verification value, module trusted state, access object access state, and output disturbance identifier.

[0057] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0058] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An embedded video security hardening module, characterized in that, The device includes a module substrate, an onboard bypass connection, a video segmentation processing circuit, a cryptographic security circuit, an isolation access circuit, and a hardened output circuit. The onboard bypass connection, video segmentation processing circuit, cryptographic security circuit, isolation access circuit, and hardened output circuit are all disposed on the module substrate. The onboard bypass connection is connected between the video encoding output side and the video transmission output side of the embedded video device, and is used to access the encoded video stream and the access request information corresponding to the encoded video stream. The video segmentation processing circuit is used to generate video segment data, video segment sequence number, frame type, and current video segment summary value based on frame boundaries, stream unit boundaries, and variable-length segmentation control parameters. The cryptographic security circuit has a key storage area, which is used to store the root key that is not output to the video segmentation processing circuit. The cryptographic security circuit is used to generate a secure operation result based on the key call instruction, policy version information and video segment sequence number. The isolation access circuit is used to restrict the video segmentation processing circuit from reading the key storage area; the video segmentation processing circuit is also used to form a segment security tag according to the security operation result, and send the segment security tag to the hardened output circuit after associating it with the corresponding video segment data. The reinforced output circuit is used to output the video segment data associated with the segment security mark to the video transmission output side according to the video output order corresponding to the video segment number.

2. The embedded video security hardening module according to claim 1, characterized in that: The onboard bypass connection includes a video channel interface, a control channel interface, and a bypass control unit; the video channel interface includes a first video port and a second video port, the first video port being connected to the video encoding output side, and the second video port being connected to the video transmission output side; The control channel interface is used to access the access request information, which includes the access object identifier, access instruction type, and identity authentication data; the bypass control unit is used to establish a bypass processing path via the video segmentation processing circuit between the first video port and the second video port.

3. An embedded video security hardening module according to claim 2, characterized in that: The video segmentation processing circuit includes a stream parsing unit, a segmentation management unit, a digest calculation unit, and an output processing unit. The stream parsing unit extracts frame type information, frame boundary information, and stream unit boundary information from the encoded video stream. The segmentation management unit generates consecutive video segment numbers based on the frame boundary information, stream unit boundary information, video output order, and the variable-length segmentation control parameters, and forms corresponding video segment data. The digest calculation unit generates the current video segment digest value based on the video segment data, video segment number, and frame type identifier. The output processing unit writes the video segment data associated with the segmentation security tag into the video output buffer.

4. An embedded video security hardening module according to claim 3, characterized in that: The cryptographic security circuit also includes a key control buffer. The isolated access circuit includes a video-side address restriction table, a key-side address restriction table, and an access arbitration unit. The video-side address restriction table is used to limit the range of video buffer addresses that the video segmentation processing circuit can access. The key-side address restriction table is used to limit the range of key control addresses that the cryptographic security circuit can access. The access arbitration unit is used to compare the target address with the video-side address restriction table when the video segmentation processing circuit initiates an access request, and to block the access request when the target address points to the key storage area or the key control buffer.

5. An embedded video security hardening module according to claim 4, characterized in that: The cryptographic security circuit includes a root key storage unit, a segmented key derivation unit, a key handle table, and a handle output unit. The root key storage unit is used to form the key storage area. The segmented key derivation unit is used to derive segmented keys corresponding to video segment data based on module identity information, policy version information, video segment sequence number, and random number. The key handle table is used to record the correspondence between video segment sequence number, policy version information, and key handle. The handle output unit is used to read the key handle when a corresponding key handle exists in the key handle table, and to generate a corresponding key handle when a corresponding key handle does not exist in the key handle table. The cryptographic security circuit determines the corresponding segment key based on the key handle, and generates an encrypted payload or integrity verification value based on the segment key.

6. An embedded video security hardening module according to claim 5, characterized in that: The segmented security marker includes video segment number, frame type identifier, policy version information, current video segment summary value, previous video segment verification value, and output perturbation identifier; the first video segment data uses the initial chain value generated by the aforementioned cryptographic security circuit based on module identity information, module startup verification result, and random number as the previous video segment verification value; the hardened output circuit has a flow perturbation unit, which is used to configure the padding length, accompanying metadata length, or output packet interval according to the output perturbation identifier, so that the output packet characteristics of the video segment data are not uniquely determined by the original video frame payload length.

7. An embedded video security hardening module according to claim 6, characterized in that: It also includes a status acquisition circuit, which is disposed on the module substrate and is used to form the module trusted status and the access object access status according to the module startup verification result generated by the cryptographic security circuit and the access request information, respectively. The module's trusted state includes an allowed state and a restricted state, and the access object's access state includes an allowed state and a restricted state.

8. An embedded video security hardening module according to claim 7, characterized in that: It also includes a policy control circuit, which is disposed on the module substrate and includes a policy register, a condition determination unit, and a policy update verification unit. The policy register is used to store policy version information, key frame processing parameters, non-key frame processing parameters, abnormal state processing parameters, and traffic disturbance parameters. The condition determination unit is used to generate security processing control parameters based on the frame type of the video segment data, the module's trust status, and the access status of the access object, and write the currently used policy version information into the segment security tag. The policy update verification unit is used to perform signature verification, version increment verification, and module trust status verification on the policy data to be updated, and writes the policy data to be updated into the policy register when all verifications pass.

9. A method for hardening embedded video data security, characterized in that: An embedded video security hardening module according to any one of claims 1 to 8 includes the following steps: connecting the encoded video stream and corresponding access request information output from the video encoding output side of the embedded video device via an onboard bypass connection; using a video segmentation processing circuit to form multiple video segment data from the encoded video stream based on frame boundaries, stream unit boundaries, and variable-length segmentation control parameters, and generating a video segment sequence number, frame type, and current video segment digest value for each video segment data; restricting the video segmentation processing circuit from reading the key storage area in the cryptographic security circuit via an isolation access circuit, and having the cryptographic security circuit generate a security operation result based on the key call instruction, policy version information, and video segment sequence number without outputting the root key; generating security processing control parameters based on the frame type, module trust status, and access object access status of the video segment data; forming a segment security mark based on the security operation result, security processing control parameters, current video segment digest value, and previous video segment verification value; and outputting the video segment data associated with the segment security mark to the video transmission output side via a hardening output circuit according to the video output order corresponding to the video segment sequence number.

10. An embedded video security hardening system, characterized in that, The invention includes an embedded video device and the embedded video security hardening module as described in any one of claims 1 to 8; the embedded video device includes a video acquisition unit, an encoding unit, a main control unit, and a transmission unit; the encoding unit generates an encoded video stream, and the main control unit generates access request information corresponding to the encoded video stream; the video encoding output side of the encoding unit is the video encoding output side of the embedded video device, and the video transmission output side of the transmission unit is the video transmission output side of the embedded video device.

Images