Edge side water video encryption detection and tracing method

Abstract

The application discloses an edge side water conservancy video encryption detection and tracing method, and relates to the field of water conservancy edge video security. The application models the unified identity of a camera, an edge device, a user and the like, and generates a full-link security strategy; fuses post-quantum and quantum key generation to generate a session key, and transmits an encrypted video stream through an SRT / TLS channel; the video is decrypted only to an isolated ring memory, and is read by a frame-level token control algorithm, and the plaintext is not landed; various types of business data are object-encrypted and chain digest anti-tampering is generated; a multi-dimensional visible and invisible dynamic watermark is superimposed on an output picture; after the picture is leaked, multi-frame watermark matching audit account positioning is used to locate a leakage subject, and closed-loop disposal such as automatic key rotation and permission control is triggered. The application does not need to modify the existing video and AI process, solves the defects of plaintext leakage and untraceable leakage in the traditional scheme, and is suitable for reservoir and gate station water conservancy edge intelligent monitoring scenes.

Description

Technical Field

[0001] This invention relates to the fields of video security for water conservancy projects, edge intelligent detection, encrypted transmission of video streams, encrypted storage of data, dynamic digital watermarking, leakage tracing, and closed-loop auditing. Specifically, it relates to an edge-side water conservancy video encryption detection and tracing method applicable to reservoirs, dams, sluice gates, pumping stations, rivers, irrigation areas, equipment rooms, dam perimeters, and water conservancy dispatch centers. Background Technology

[0002] Video surveillance of water conservancy projects typically involves capturing video streams via cameras or video platforms, then transmitting them through dedicated networks, the internet, VPNs, or streaming media gateways to edge devices, algorithm servers, or scheduling platforms for real-time viewing, AI detection, alarm analysis, and historical data retention. In actual operations, video footage not only includes the operational status of the water surface, gates, reservoir areas, dams, machine rooms, and personnel and vehicles, but may also contain sensitive information such as the location of critical facilities, inspection activities, scheduling operations, on-duty personnel, and safety protection arrangements. Therefore, water conservancy video is vulnerable to eavesdropping, interception, copying, screenshotting, screen recording, or secondary dissemination at every stage, including transmission, edge processing, local caching, manual display, and subsequent external distribution.

[0003] Existing video security solutions mostly focus on the network transport layer, such as using TLS, VPN, or leased line encryption to prevent eavesdropping. These solutions can protect the transmission process between the camera and the platform or between the platform and the client. However, once the encrypted video stream enters the edge device, the system still needs to generate plaintext video frames in memory or a temporary directory to complete decoding, screenshotting, target identification, and alarm analysis. If the edge device is illegally logged into, its cache directory is copied, its hard drive is removed, or logs are analyzed offline, plaintext frames, detection results, device configurations, and access records may still be leaked.

[0004] On the other hand, AI detection systems typically need to display real-time footage to on-duty personnel, reviewers, or maintenance staff. Even if the transmission link and local disk are encrypted, the displayed footage can still be screenshotted, recorded, photographed, or leaked through secondary forwarding. Traditional static watermarks can only label the organization name or system name, and cannot accurately associate specific devices, cameras, users, sessions, frame times, or detection tasks. Furthermore, they lack the ability to trace responsibility after cropping, compression, obscuring, or multiple forwardings.

[0005] Furthermore, simply encrypting each frame of the original video independently before decrypting it would increase real-time detection latency and edge computing power burden, and could potentially compromise the compatibility of existing video access links such as SRT, RTSP, HTTP-FLV, HLS, and WebRTC. Therefore, there is an urgent need for a water conservancy video security solution that balances real-time performance, compatibility, and security. This solution should ensure the video stream is securely carried during upload, used only briefly in plaintext within edge devices with minimal overhead, remains encrypted when locally stored on disk, possesses dynamic traceability capabilities during manual review, and forms a verifiable and closed-loop chain of evidence in the event of a leak. Summary of the Invention

[0006] To address the aforementioned issues, this invention aims to propose an edge-side water conservancy video encryption detection and tracing method. While maintaining compatibility with existing video protocols and AI detection processes, it achieves integrated protection of transmission security, edge plaintext minimization, local encrypted storage, video leakage tracing, and closed-loop auditing.

[0007] To achieve the above objectives, the technical solution of the present invention is implemented as follows: An edge-side water conservancy video encryption detection and tracing method includes the following steps: Step S1: Register the identities of cameras or video platforms, edge detection devices, algorithm services, display terminals, access users and video streams, and establish a security policy that includes transmission protection, edge memory usage, local encrypted storage and image watermark tracing. Step S2: Before the camera or video platform sends the video stream to the edge detection device, a video session key is generated based on the post-quantum key negotiation key material, the quantum key distribution key material, or a hybrid key material of the two, and the encrypted video stream is sent through the protected transmission channel; Step S3: After receiving the encrypted video stream, the edge detection device verifies the channel identity, session key version, and data integrity, and decrypts and decodes the video stream into a protected memory frame buffer during runtime. Step S4: Generate a frame-level usage token for the plaintext video frame entering the memory frame buffer. The authorization algorithm service uses the frame-level usage token to call the plaintext video frame for target detection, event recognition, or alarm analysis. Step S5: After the algorithm analysis is completed, the system configuration, access authorization, cached frames, detection results, alarm records and running logs are encrypted and written to disk locally according to object type, and a chain-like integrity digest is established for the encrypted objects; Step S6: When the detection screen is output to the display terminal or manual viewing interface, a dynamic watermark traceability code is generated based on the device identifier, camera identifier, user identifier, session identifier, frame sequence number, timestamp, and detection result identifier, and then superimposed on the real-time screen. Step S7: When a screenshot, screen recording, or secondary dissemination of the leaked content occurs, extract the dynamic watermark traceability code from the leaked image and match it with the session records and display records in the local encrypted audit ledger to determine the source of the leak. Step S8: Update the risk level based on the matching results, trigger key rotation, restrict display authorization, solidify leakage evidence, and generate a security closed-loop record.

[0008] Furthermore, the specific steps for generating the video session key in step S2 are as follows: The edge detection device and the camera or video platform each generate random numbers, obtain the shared secret and quantum key distribution key fragments for quantum key negotiation, and generate the video session key through the following key derivation formula:

[0009] In the formula, Let F be the video session key, and F be the key derivation function. The shared secret obtained after quantum key negotiation. This represents a key fragment obtained from quantum key distribution, where D is the identifier for the edge detection device and V is the identifier for the video stream. Random numbers generated for cameras or video platforms. A random number generated for the edge detection device, where P is the security policy version. For concatenation operators; when quantum key fragments are unavailable, the system uses a post-quantum shared secret and random number to derive a temporary session key and increases the key rotation frequency.

[0010] Furthermore, the protected transmission channel in step S2 includes SRT, TLS, VPN, leased encrypted tunnel or a combination thereof. The protected transmission channel carries the video stream with session-level encryption without requiring independent re-encryption of each video frame. The system maintains session key versions according to the number of camera channels and carries sequence numbers, timestamps and message authentication tags in the transmitted data to prevent eavesdropping, tampering, replay and unauthorized access.

[0011] Furthermore, the protected memory frame buffer in step S3 is a non-persistent circular buffer. The non-persistent circular buffer includes at least a buffer identifier, frame sequence number, frame timestamp, reference count, authorized algorithm identifier, lifespan, and erase status. Plaintext video frames exist only in the circular buffer, and when the algorithm finishes reading, the reference count reaches zero, the lifespan expires, or the session is abnormal, the corresponding memory area is overwritten and erased.

[0012] Furthermore, the frame-level token used in step S4 is calculated from the frame token key, and the expression is:

[0013] In the formula, Use a token at the frame level for the i-th frame. For message authentication functions, Here, C is the frame token key, C is the camera identifier, V is the video stream identifier, and i is the frame sequence number. Let B be the timestamp of the i-th frame, A be the identifier of the memory buffer, P be the identifier of the algorithm task, and P be the security policy version. The algorithm service can only read the corresponding plaintext video frame from the memory frame buffer when the token verification is successful and the authorized scope is consistent with the current detection task. Each read operation is written to the audit log.

[0014] Furthermore, in step S5, local encryption to disk employs object-level envelope encryption. Object data keys are generated for configuration files, authorization files, cache frames, detection results, alarm records, and runtime logs according to the following key derivation formula:

[0015] In the formula, Let F be the data key for the j-th object, and let F be the key derivation function. The master key is stored locally, and E is the identifier for the edge detection device. Let j be the object type of the j-th object. For the storage segmentation of the j-th object, For the time window to which the j-th object belongs, The security level of the j-th object; The corresponding object content is then encrypted with the object data key, and the object data key is encrypted and saved with the device master key or key management service key; the encrypted object is stored in the form of an .edgeenc file, an encrypted directory, or an encrypted database record.

[0016] Furthermore, the chain integrity summary in step S5 is generated as follows:

[0017] In the formula, Let H be the necklace-style integrity digest for the j-th node, and H be the hash function. This is a summary of the previous necklace-style integrity. For the j-th encrypted disk object, For the metadata of the j-th object, Let j be the time of the j-th operation. The subject of the j-th operation; When the local hard drive is removed, the directory is copied, or the system is analyzed offline, the external entity can only obtain the encrypted object and cannot directly restore the system configuration, authorization information, cache frames, detection results, and business logs.

[0018] Furthermore, the dynamic watermark traceability code in step S6 is generated from the watermark key in the following manner:

[0019] In the formula, Let R be the dynamic watermark traceability code of the i-th frame, and R be the truncation function. For message authentication functions, Here, E is the watermark key, C is the edge detection device identifier, U is the viewing user identifier, S is the access session identifier, X is the display terminal identifier, and i is the frame sequence number. Let i be the timestamp of the i-th frame. Let L be the identifier of the detection result corresponding to the i-th frame, and L be the length of the traceability code. The watermark position, transparency, font perturbation, display frequency, and implicit embedding area are determined based on a pseudo-random position function; the dynamic watermark traceability code includes an explicit identifier that can be seen by humans and an implicit identifier that can be extracted by the system.

[0020] Furthermore, step S7, which involves tracing the source of the leak, specifically includes: Extract one or more watermark traceability codes from leaked screenshots, screen recording frames, or secondary dissemination video frames; verify the message authentication value of the traceability codes; and retrieve candidate devices, cameras, users, sessions, time windows, and display terminals from the encrypted audit log. When leaked footage is cropped, obscured, compressed, or distorted by re-photographing, the system performs a fusion scoring based on multi-frame watermarks, image time features, camera image features, and audit records to obtain source matching results.

[0021] Furthermore, the specific method for generating the safety closed-loop record in step S8 is as follows: The security incident risk level is updated based on source matching score, user history risk, device operation risk, leakage impact level, and audit evidence completeness. When the risk level reaches the handling threshold, it triggers session revocation, key rotation, display of authorization restrictions, freezing of relevant audit objects, solidification of leaked evidence, and security alarm push. When the risk level is in the "pending review" range, a review task is generated, and the security administrator conducts manual verification by combining watermark, access time, screen content, key version, and chain digest.

[0022] Beneficial effects: First, by using session-level secure bearer and quantum-secure enhanced key derivation, the video stream upload process is enhanced to resist eavesdropping, replay attacks, and future quantum attacks. Second, through protected memory frame buffers and frame-level usage tokens, AI detection algorithms can analyze video footage in real time, while preventing plaintext video frames from being stored as ordinary files on edge devices. Third, through object-level envelope encryption and chain digests, configurations, authorizations, caches, detection results, and logs on edge devices remain encrypted even if copied or analyzed offline, and have the ability to detect tampering. Fourth, through dynamic watermark traceability codes, screenshots, screen recordings, re-photographs, or secondary dissemination can be linked to specific users, sessions, devices, cameras, and time windows. Fifth, through key rotation, authorization restrictions, evidence solidification, and audit reports, video security incidents are expanded from single-point protection to operable closed-loop management. Attached Figure Description

[0023] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a flowchart of the main steps of the edge-side water conservancy video encryption detection and tracing method described in this embodiment of the invention; Figure 2 This is a schematic diagram of the quantum-secure enhanced key negotiation and video secure transmission process of the present invention; Figure 3 This is a schematic diagram of the edge device memory plaintext minimization and local encryption disk writing process of the present invention; Figure 4 This is a schematic diagram of the process for dynamic watermark overlay, leakage image extraction, and traceability matching of the present invention. Detailed Implementation

[0024] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0025] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0026] Example 1 See Figure 1-4 The edge-side water conservancy video encryption detection and tracing method of this embodiment includes the following operation process in its specific implementation: Step S1: Establish video security identity and unified security policy This step is executed by the Identity and Policy Management module, completing the end-to-end entity identity registration and security policy distribution. The specific process is as follows: S11. Read the registration information of all entities in the system and generate a globally unique identity: generate a camera identifier for each front-end camera, a video stream identifier for each video stream, a device identifier for the edge detection gateway, an algorithm task identifier for each type of AI detection task, a terminal identifier for each display terminal, and a user identifier for each accessing user.

[0027] S12. Define video streams, algorithm tasks, detection results, display sessions, and audit logs as security objects and assign them unified numbers. Establish the binding relationship between each security object and the five major security domains: transmission domain, memory domain, disk storage domain, display domain, and traceability domain. Clarify the protection boundaries and access rules of each security domain.

[0028] S13. Based on the water conservancy video security level (e.g., the core location of the reservoir is high security level, and the ordinary perimeter is ordinary security level), the location of the location, the user role, the terminal type and the leakage risk level, generate a corresponding version of the security policy. The policy content includes key rotation cycle, maximum plaintext frame survival time, watermark visibility level, leakage handling threshold, audit retention period, etc., which are used for subsequent key derivation, permission verification and security control throughout the entire process.

[0029] Step S2: Quantum-secure enhanced video transmission key negotiation and encrypted transmission Combination Figure 2 As shown, this step is executed collaboratively by the hybrid key negotiation module and the transmission encryption module, fully covering the entire process from two-way authentication and hybrid key derivation to secure transmission verification. The specific process is as follows: S21. The front-end camera / video aggregation platform and the edge detection gateway first perform two-way identity authentication. After successful authentication, both parties generate random numbers (camera side and edge side). At the same time, they obtain the shared secret generated by the subsequent quantum key negotiation, as well as the quantum key fragment output by the QKD device.

[0030] S22. Based on the aforementioned key materials and identity and policy information, a video session key is generated using a key derivation function. The calculation formula is as follows: (1) In this embodiment, the key derivation function F adopts HKDF-SHA256; Let F be the video session key, and F be the key derivation function. The shared secret obtained after quantum key negotiation. This represents a key fragment obtained from quantum key distribution, where D is the identifier for the edge detection device and V is the identifier for the video stream. Random numbers generated for cameras or video platforms. A random number generated for the edge detection device, where P is the security policy version. This is the concatenation operator.

[0031] When no QKD device is deployed on site or the quantum key fragment is unavailable, the system automatically downgrades to pure post-quantum key mode, using only the post-quantum shared secret and the temporary session key derived from random numbers of both parties, and automatically shortens the key rotation interval to improve transmission security.

[0032] S23. Establish an SRT encrypted transmission channel using the generated video session key to carry out session-level encryption on the video stream. This eliminates the need for independent re-encryption of each video frame and ensures compatibility with existing video transmission protocols. The transmitted data packets carry sequence numbers, timestamps, and HMAC message authentication tags to guarantee data integrity and anti-replay capability.

[0033] S24. The edge detection gateway continuously verifies the channel identity, session key version, message authentication tag and serial number continuity; when an abnormality occurs such as authentication failure, serial number change, key version expiration, etc., it immediately refuses to receive the corresponding video stream and writes the abnormal event into the encrypted audit record.

[0034] Step S3: Edge-side controlled decryption and memory decoding Combination Figure 3 As shown, after the encrypted video stream enters the edge detection device, controlled decryption and memory decoding are first performed to build a protected plaintext frame operating environment. The specific process is as follows: S31. After receiving the encrypted video stream, the edge detection gateway first completes the channel identity verification, session key version verification, message authentication tag verification, timestamp validity verification, and sequence number continuity verification. Only after all verifications are passed can the decryption process begin.

[0035] S32. After successful verification, the video stream completes decryption and decoding during runtime, and the output plaintext video frames are directly written to a protected non-persistent circular memory frame buffer. This circular buffer is a page-locked memory area, employing a process isolation mechanism, and can only be accessed by authorized modules. Each record in the buffer contains seven types of fields: buffer identifier, frame sequence number, frame timestamp, reference count, authorized algorithm identifier, lifespan, and erase status.

[0036] S33. Plaintext video frames exist only in the memory frame buffer throughout the entire process and are not written to any ordinary file directory. When the algorithm finishes reading, the reference count reaches zero, the lifespan expires, the buffer is recycled in a cycle, or the session is abnormal, the corresponding memory area is immediately erased with all zeros to ensure that no plaintext frames remain.

[0037] Step S4: Detection of authorization algorithm based on frame-level token usage Accept Figure 3 The memory-controlled processing flow, this step uses tokens at the frame level to implement fine-grained authorization calls to plaintext frames, is the core of the memory plaintext minimization mechanism, and the specific process is as follows: S41. When the algorithm service needs to call a certain frame of plaintext video for detection and analysis, the edge scheduling module generates a frame-level usage token specific to that frame based on the corresponding camera identifier, video stream identifier, frame sequence number, frame timestamp, buffer identifier, algorithm task identifier, and security policy version.

[0038] S42. Frame-level tokens are generated using a message authentication function, calculated according to the following formula: (2) In this embodiment, the message authentication function Use HMAC-SHA256; The frame token key is derived from the local master key; C is the camera identifier, V is the video stream identifier, and i is the frame sequence number. Here, B is the timestamp of the i-th frame, A is the memory buffer identifier, P is the algorithm task identifier, and P is the security policy version. This token strongly binds the plaintext frame, the algorithm task, and the security policy, preventing unauthorized modules from reading or reusing the plaintext frame.

[0039] S43. The algorithm service submits a frame-level usage token to the memory management module. The module verifies the token's validity, the algorithm's authorized scope, the frame time window, and the buffer status. After verification, the module only provides the algorithm service with a read-only memory view of the corresponding plaintext frame. The algorithm cannot modify or copy the frame data.

[0040] S44. Each plaintext frame read operation is synchronously written to the encrypted audit log. The log includes the algorithm called, frame number, read time, token verification result and buffer erase status, so as to achieve full auditability of memory access.

[0041] Step S5: Object-level Encryption and Disk Storage with Chain Integrity Protection Accept Figure 3 After the algorithm detection is completed, all business data to be persisted undergoes object-level encryption and integrity protection, completing the closed loop of edge data from plaintext memory to ciphertext storage. The specific process is as follows: S51. Divide the data that needs to be persistently stored locally on the edge gateway into 6 types of objects: configuration objects, authorization objects, cache frame objects, detection result objects, alarm objects, and operation log objects. Each type of object is stored in segments according to time windows.

[0042] S52. For each disk-written object, a corresponding object data key is independently derived, and an object-level envelope encryption mechanism is used. The key calculation formula is as follows: (3) in, Let F be the data key for the j-th object; F is the key derivation function HKDF-SHA256; The master key is stored locally; E is the identifier for the edge detection device. The type of the j-th object (e.g., configuration, detection result, etc.); Segment the storage of the j-th object; The time window to which the j-th object belongs; Let be the security level of the j-th object.

[0043] Different types of objects and objects in different time windows use independent data keys, which effectively reduces the impact of a single key leak.

[0044] S53. Encrypt the plaintext content of the corresponding object using the object data key using AES-GCM to generate a ciphertext object. Simultaneously using the device master key object data key The encrypted data is saved in an envelope-like encrypted structure; the final encrypted object is stored as a .edgeenc file in a local encrypted directory, and no plaintext business data exists on the local disk throughout the process.

[0045] S54. Generate a chain of integrity digests for all encrypted disk objects, constructing an immutable audit evidence chain. The digest calculation formula is as follows: (4) in, H is the necklace-style integrity digest for the j-th node; H is the SHA-256 hash function. This is a summary of the previous necklace-style integrity; This refers to the j-th encrypted disk object; Metadata for the j-th object (including object type, key version, camera to which it belongs, etc.); Let j be the time of the j-th operation; This is the subject of the j-th operation.

[0046] Through the chain digest structure, the system can automatically identify abnormal situations such as deletion, replacement, insertion, or rearrangement of encrypted objects; when the hard drive is unplugged, the directory is copied, or the device is analyzed offline, the external subject can only obtain the encrypted object and cannot restore any business data.

[0047] Step S6: Dynamic watermark traceability code generation and image overlay Combination Figure 4 As shown, when the detection screen enters the display stage, the system first completes the permission verification, and then generates and overlays a multi-dimensional dynamic watermark traceability code. The specific process is as follows: S61. When the display terminal or manual viewing interface requests to retrieve the test screen, the system first verifies the user's identity, terminal identity, access session status, and video stream viewing permissions. Only after the verification is passed can the screen be output.

[0048] S62. Based on the current device, camera, user, session, terminal, frame sequence number, frame time, and detection results, generate a unique dynamic watermark traceability code for each frame. The calculation formula is as follows: (5) in, R is the dynamic watermark traceability code for the i-th frame; R is the truncation function used to control the length of the traceability code. For HMAC-SHA256 message authentication functions; E is the watermark key; C is the edge detection device identifier; U is the viewing user identifier; S is the access session identifier; X is the display terminal identifier; i is the frame sequence number. This is the timestamp of the i-th frame; is the detection result identifier corresponding to the i-th frame; L is the traceability code length.

[0049] S63. The system uses a combination of explicit and implicit methods to overlay the watermark traceability code onto the output screen: the explicit identifier is semi-transparent text that displays the device number, camera number, user number, time and short traceability code to indicate that the screen is traceable; the implicit identifier is embedded in the screen space through brightness perturbation and texture perturbation, which cannot be detected by humans and is used for machine extraction after leakage.

[0050] The watermark's embedding position, transparency, font perturbation level, and display frequency dynamically change with the frame to prevent the watermark from being completely removed by cropping a fixed area.

[0051] Step S7: Tracing and matching the source of leaked footage Accept Figure 4 The system traces the source of the leak by extracting watermark information and matching it with encrypted audit logs when an image is leaked. The specific process is as follows: S71. When a screenshot, screen recording clip, or secondary dissemination video suspected of being leaked is obtained, the system first preprocesses the leaked image and extracts explicit character features, implicit perturbation features, image time features, and camera scene features.

[0052] S72. Based on the extracted features, combined with the watermark authentication results, audit log matching degree, time window matching degree, scene matching degree, and distortion penalty item, calculate the source matching score. The calculation formula is as follows:

[0053] in, The score is a source match score, with a value ranging from 0 to 1; Here is the Sigmoid normalization function; a, b, c, d, and e are the weight coefficients for watermark authentication matching degree, audit log matching degree, time window matching degree, scene matching degree, and distortion penalty term, respectively. For watermark authentication matching accuracy, For audit log matching degree, For time window matching degree, For scene matching, The distortion penalty value for cropping, masking, compressing, and reshooting; This represents the weighted concatenation operator; This represents the penalty deduction operator.

[0054] When the source matching score reaches the preset high-risk threshold, the system outputs candidate devices, cameras, users, sessions, display terminals, time ranges and detection results, and generates a complete evidence chain summary.

[0055] S73. If the leaked image is severely cropped, obscured, compressed, or distorted by re-photographing, and a single frame watermark cannot be completely extracted, the system integrates multi-frame watermark information, image time evolution characteristics, inherent characteristics of the camera image, and encrypted audit ledger to comprehensively sort the candidate sources and output the optimal matching result.

[0056] Step S8: Safety Closed-Loop Handling Accept Figure 4 The end-of-life handling process, after source tracing and matching, assesses the risk level based on the source matching results and automatically triggers actions such as session revocation, key rotation, authorization restriction, evidence preservation, and alarm push, forming a complete security closed loop. The specific process is as follows: S81. The system updates the risk level of this security incident based on the source matching score, user historical risk value, equipment operation risk value, leakage impact level and audit evidence completeness.

[0057] S82. When the risk level of an event reaches the automatic handling threshold, the system will automatically perform the following actions: revoke the corresponding access session, rotate the video session key / frame token key / watermark key, restrict the display authorization of the corresponding user and terminal, freeze the relevant audit objects to prevent tampering, solidify the leaked evidence files, and push security alerts to the administrator.

[0058] S83. When the risk level is in the pending review range, the system generates a manual review task. The security administrator will manually confirm the information by combining watermark information, access time, screen content, key version and chain digest. After confirmation, the corresponding action will be taken.

[0059] Preferred security control mechanism implementation example: To further enhance the adaptability and granularity of end-to-end security protection, this embodiment also configures the following security control mechanisms: 3.1 Adaptive Key Rotation Mechanism: The rotation interval of the video session key is dynamically adjusted according to link risk. The calculation formula is as follows:

[0060] in, The key rotation interval is the interval after the k-th risk assessment. The initial rotation interval is set to 30 minutes by default in this embodiment; The reference adjustment constant; This represents the link risk value in the k-th evaluation, ranging from 0 to 1. When high-risk behaviors such as abnormal link access or suspected eavesdropping are detected, the key rotation interval is automatically shortened, thereby increasing the key update frequency within the high-risk transmission window and enhancing security.

[0061] 3.2 Plaintext Frame Lifetime Control Mechanism To limit the exposure time of plaintext frames in memory, the allowed lifetime of a single plaintext frame is calculated using the following formula: (8) in, Let be the allowed lifetime of the plaintext in the i-th frame; min is the function that takes the minimum value. The maximum plaintext survival time set for the system is 2 seconds in this embodiment; The effective duration required for the algorithm to read this frame; This is the longest wait time for the circular buffer to be covered cyclically. A minimum value mechanism ensures that plaintext frames do not remain in memory for extended periods.

[0062] 3.3 Plaintext Frame Automatic Erasure Mechanism The system determines whether to perform a memory overwrite / erase based on the erase trigger value, calculated using the following formula:

[0063] in, is the erase trigger value for the i-th frame; I is an indicator function, which takes the value 1 if the condition is true, and 0 otherwise; This is the actual duration of the frame's existence. For the reference count of this frame; This is an exception flag for the session it belongs to. When the erase trigger value... When this happens, the system immediately performs a zero-overwrite erasure of the memory region corresponding to that frame.

[0064] 3.4 Dynamic Watermark Position Adaptive Mechanism To prevent watermark removal through fixed cropping, the watermark embedding position dynamically changes with frame and session, calculated using the following formula:

[0065] in, Let G be the embedding position number of the watermark in the i-th frame; G is the pseudo-random position function. is the watermark key; i is the frame sequence number; S is the access session identifier; N is the number of optional watermark embedding positions; For modulo operation; This is a concatenation operator. The watermark position varies across different users, sessions, and frames, significantly increasing the difficulty of cropping and removing the watermark.

[0066] 3.5 Confidence Assessment Mechanism for Watermark Extraction The reliability of watermark extraction from leaked images is assessed, and the confidence level is calculated using the following formula:

[0067] in, The system extracts the confidence level for watermarking leaked images; M represents the number of valid, authenticated watermarks; N represents the number of optional watermark embedding locations; and Q represents the image quality coefficient of the leaked image. When the confidence level is lower than a preset threshold, the system automatically enables multi-frame fusion and scene feature-assisted matching to ensure the accuracy of source tracing.

[0068] 3.6 Closed-loop risk assessment mechanism The closed-loop handling of security incidents is triggered by a risk index, calculated using the following formula:

[0069] in, Indicates the risk index for safe closed-loop handling; Indicates the source matching score weight; Indicates the user's historical risk weight; Indicates the risk weight of the equipment; Indicates the weighting of the impact level of the leak; Indicates the source matching score; This represents the user's historical risk value; Indicates the equipment operation risk value; The risk index indicates the level of impact of the leak. When the risk index obtained by formula (12) is greater than or equal to the disposal threshold, the system triggers session revocation, key rotation, authorization restriction, evidence preservation and audit alarm.

[0070] Implementation effect verification To further illustrate the technical advantages of this invention compared to traditional combinations of transmission encryption, disk encryption, or static watermarking, a comparison was made under the same video access and AI detection service conditions, based on the coverage of security mechanisms and binding elements. The results are shown in Table 1. The quantities in the table are based on the statistical analysis of the functional modules, formula binding elements, and control actions disclosed in this invention.

[0071] Table 1 Comparison of the security mechanisms of this invention and traditional solutions.

[0072] As can be seen from Table 1, the advantage of this invention is not simply the superposition of several encryption measures, but rather the use of session keys, frame-level usage tokens, object data keys, chain digests, and dynamic watermark traceability codes as association means to form a continuous secure chain of evidence for transmission, processing, storage, display, and post-processing; at the same time, the use of session-level secure bearer and memory-controlled decryption avoids unnecessary impacts on real-time detection and compatibility with existing video protocols caused by frame-by-frame independent re-encryption.

[0073] Table 1 above compares the differences between the two schemes at the functional mechanism level. To quantify the performance overhead and security benefits brought by the security enhancement of this invention, a standardized simulation test platform was built to conduct comparative experiments. The test platform consisted of Windows 11 64-bit, an Intel Core i7-14700F processor, and 32GB of memory. The software environment was Python 3.12.13, OpenCV 4.6.0, and cryptography 49.0.0. The traditional combined scheme only enabled session-level AES-GCM transmission decryption, fixed text watermarking, and plaintext result saving; the reference implementation of this invention additionally enabled frame-level token use, object-level envelope encryption, chain digest, and dynamic traceability code. Two sets of 1280×720 monitoring style video frames generated by the same batch of programs were used. The frame size, bit rate, and image complexity were consistent with the conventional monitoring videos of water conservancy reservoirs and sluice gates. The test conclusions can be equivalently transferred to water conservancy edge detection business scenarios. The test adopted single-threaded processing, and after a 30-frame warm-up, the test was repeated 5 times, with 300 frames each time. The results are shown in Table 2.

[0074] Table 2. Quantization performance test results based on the reference implementation

[0075] Note: Table 2 is reference implementation test data. The test input is the monitoring style video frames generated by the program, which is not equivalent to the on-site production deployment data. The test does not include PQC / QKD external device handshake latency and network jitter; "Detection result consistency rate" refers to the consistency rate of the box set output by the fixed detection function before and after security processing, which is not equivalent to the production AI model mAP; the fixed unit watermark of the traditional combination scheme does not contain session identifiers and cannot automatically associate with the leakage source session.

[0076] Combining the qualitative differences in functionality in Table 1 and the quantitative test data in Table 2, it can be seen that, under the premise of fully covering 6 major security domains, multi-level encryption, and dynamic traceability, this invention only brings about a 15% increase in single-frame latency and a 13% decrease in throughput, with minimal improvement in computing power and memory overhead. At the same time, it achieves a significant improvement in core security indicators such as source tracing of image leaks, prevention of plaintext data leakage, and prevention of log tampering, taking into account both the business needs of real-time detection of water conservancy AI and the data security of the entire chain, and solving the industry defects of traditional solutions such as security protection gaps, difficulty in tracing leaks, and local plaintext exposure.

[0077] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for encrypted detection and tracing of edge-side hydraulic video, characterized in that, Includes the following steps: Step S1: Register the identities of cameras or video platforms, edge detection devices, algorithm services, display terminals, access users and video streams, and establish a security policy that includes transmission protection, edge memory usage, local encrypted storage and image watermark tracing. Step S2: Before the camera or video platform sends the video stream to the edge detection device, a video session key is generated based on the post-quantum key negotiation key material, the quantum key distribution key material, or a hybrid key material of the two, and the encrypted video stream is sent through the protected transmission channel; Step S3: After receiving the encrypted video stream, the edge detection device verifies the channel identity, session key version, and data integrity, and decrypts and decodes the video stream into a protected memory frame buffer during runtime. Step S4: Generate a frame-level usage token for the plaintext video frame entering the memory frame buffer. The authorization algorithm service uses the frame-level usage token to call the plaintext video frame for target detection, event recognition, or alarm analysis. Step S5: After the algorithm analysis is completed, the system configuration, access authorization, cached frames, detection results, alarm records and running logs are encrypted and written to disk locally according to object type, and a chain-like integrity digest is established for the encrypted objects; Step S6: When the detection screen is output to the display terminal or manual viewing interface, a dynamic watermark traceability code is generated based on the device identifier, camera identifier, user identifier, session identifier, frame sequence number, timestamp, and detection result identifier, and then superimposed on the real-time screen. Step S7: When a screenshot, screen recording, or secondary dissemination of the leaked content occurs, extract the dynamic watermark traceability code from the leaked image and match it with the session records and display records in the local encrypted audit ledger to determine the source of the leak. Step S8: Update the risk level based on the matching results, trigger key rotation, restrict display authorization, solidify leakage evidence, and generate a security closed-loop record.

2. The edge-side hydraulic video encryption detection and tracing method according to claim 1, characterized in that, The specific steps for generating the video session key in step S2 are as follows: The edge detection device and the camera or video platform each generate random numbers, obtain the shared secret and quantum key distribution key fragments for quantum key negotiation, and generate the video session key through the following key derivation formula: In the formula, Let F be the video session key, and F be the key derivation function. The shared secret obtained after quantum key negotiation. This represents a key fragment obtained from quantum key distribution, where D is the identifier for the edge detection device and V is the identifier for the video stream. Random numbers generated for cameras or video platforms. A random number generated for the edge detection device, where P is the security policy version. For concatenation operators; when quantum key fragments are unavailable, the system uses a post-quantum shared secret and random number to derive a temporary session key and increases the key rotation frequency.

3. The edge-side water conservancy video encryption detection and tracing method according to claim 1, characterized in that, The protected transmission channel in step S2 includes SRT, TLS, VPN, leased encrypted tunnel or a combination thereof. The protected transmission channel carries the video stream with session-level encryption without requiring independent re-encryption of each video frame. The system maintains session key versions according to the number of camera channels and carries sequence numbers, timestamps and message authentication tags in the transmitted data to prevent eavesdropping, tampering, replay and unauthorized access.

4. The edge-side water conservancy video encryption detection and tracing method according to claim 1, characterized in that, The protected memory frame buffer in step S3 is a non-persistent circular buffer, which includes at least a buffer identifier, frame sequence number, frame timestamp, reference count, authorization algorithm identifier, live time, and erase status. Plaintext video frames exist only in the circular buffer, and when the algorithm finishes reading, the reference count reaches zero, the time-to-live expires, or the session is abnormal, the corresponding memory area is overwritten and erased.

5. The edge-side water conservancy video encryption detection and tracing method according to claim 1, characterized in that, The frame-level token used in step S4 is calculated from the frame token key, and the expression is: In the formula, Use a token at the frame level for the i-th frame. For message authentication functions, Here, C is the frame token key, C is the camera identifier, V is the video stream identifier, and i is the frame sequence number. Let B be the timestamp of the i-th frame, B be the memory buffer identifier, A be the algorithm task identifier, and P be the security policy version. The algorithm service can only read the corresponding plaintext video frame from the memory frame buffer when the token verification is successful and the authorized scope is consistent with the current detection task; each read operation is written to the audit log.

6. The edge-side water conservancy video encryption detection and tracing method according to claim 1, characterized in that, In step S5, local encryption to disk uses object-level envelope encryption. Object data keys are generated for configuration files, authorization files, cache frames, detection results, alarm records, and operation logs according to the following key derivation formula: In the formula, Let F be the data key for the j-th object, and let F be the key derivation function. The master key is stored locally, and E is the identifier for the edge detection device. Let j be the object type of the j-th object. For the storage segmentation of the j-th object, For the time window to which the j-th object belongs, The security level of the j-th object; The corresponding object content is then encrypted with the object data key, and the object data key is encrypted and saved with the device master key or key management service key; the encrypted object is stored in the form of an .edgeenc file, an encrypted directory, or an encrypted database record.

7. The edge-side hydraulic video encryption detection and tracing method according to claim 1, characterized in that, The chained integrity digest in step S5 is generated as follows: In the formula, Let H be the necklace-style integrity digest for the j-th node, and H be the hash function. This is a summary of the previous necklace-style integrity. For the j-th encrypted disk object, For the metadata of the j-th object, Let j be the time of the j-th operation. The subject of the j-th operation; When the local hard drive is removed, the directory is copied, or the system is analyzed offline, the external entity can only obtain the encrypted object and cannot directly restore the system configuration, authorization information, cache frames, detection results, and business logs.

8. The edge-side water conservancy video encryption detection and tracing method according to claim 1, characterized in that, The dynamic watermark traceability code in step S6 is generated from the watermark key in the following manner: In the formula, Let R be the dynamic watermark traceability code of the i-th frame, and R be the truncation function. For message authentication functions, Here, E is the watermark key, C is the edge detection device identifier, U is the viewing user identifier, S is the access session identifier, X is the display terminal identifier, and i is the frame sequence number. Let i be the timestamp of the i-th frame. Let L be the identifier of the detection result corresponding to the i-th frame, and L be the length of the traceability code. The watermark position, transparency, font perturbation, display frequency, and implicit embedding area are determined based on a pseudo-random position function; the dynamic watermark traceability code includes an explicit identifier that can be seen by humans and an implicit identifier that can be extracted by the system.

9. The edge-side hydraulic video encryption detection and tracing method according to claim 1, characterized in that, Step S7 involves tracing the source of the leak as follows: Extract one or more watermark traceability codes from leaked screenshots, screen recording frames, or secondary dissemination video frames; verify the message authentication value of the traceability codes; and retrieve candidate devices, cameras, users, sessions, time windows, and display terminals from the encrypted audit log. When leaked footage is cropped, obscured, compressed, or distorted by re-photographing, the system performs a fusion scoring based on multi-frame watermarks, image time features, camera image features, and audit records to obtain source matching results.

10. The edge-side hydraulic video encryption detection and tracing method according to claim 1, characterized in that, The specific method for generating the safety closed-loop record in step S8 is as follows: The security incident risk level is updated based on source matching score, user history risk, device operation risk, leakage impact level, and audit evidence completeness. When the risk level reaches the handling threshold, it triggers session revocation, key rotation, display of authorization restrictions, freezing of relevant audit objects, solidification of leaked evidence, and security alarm push. When the risk level is in the "pending review" range, a review task is generated, and the security administrator conducts manual verification by combining watermark, access time, screen content, key version, and chain digest.

Images