Method and device for protecting an incoming stream comprising an elementary stream made up of video packets

Abstract

Method and device for protecting an incoming stream comprising an elementary stream made up of video packets. This method for protecting an incoming stream (10), the incoming stream comprising at least one incoming elementary video stream (11), the incoming elementary video stream comprising a succession of incoming video packets (12), is characterized by: disassembling (32) the incoming stream to separate a current packet; encrypting the current packet with a session key (TEK); constructing (35) a confidentiality metadata packet comprising a timestamp field corresponding to a timestamp of the current packet and a confidentiality field containing the session key; encrypting the confidentiality data packet with an encryption key (KEK);the assembly (36) of an outgoing stream (20) comprising an elementary outgoing stream grouping the current encrypted packets (22) and an elementary privacy metadata stream comprising the encrypted privacy metadata packets (26). Figure for the abstract: Figure 1;

Description

Title of the invention: Method and device for protecting an incoming stream comprising an elementary stream consisting of video packets

[0001] The invention relates to the field of protection of data flows, in particular video data flows.

[0002] In this document, the level of confidentiality attributed to data associates a sensitivity of the data itself (“secret”, “confidential”, “restricted access”, etc.) with a right to know this data attributed to such or such consumer or user of this data.

[0003] The protection of data is then understood as the allocation of a level of confidentiality adapted to this data.

[0004] In the state of the art, data protection is carried out at the network level. This involves segregating different perimeters within a network, and assigning a specific level of confidentiality to each perimeter. Each perimeter is thus homogeneous in terms of the sensitivity of the data circulating there and the access rights of users (a user having the right to access a perimeter therefore has the right to know all the data circulating on this perimeter). This protection model is therefore centered on the network and not on the data itself.

[0005] However, the "data centric security" or "zero trust" paradigms have the general objective of refocusing protection measures on data in order to allow greater flexibility in data management, and this throughout the entire life cycle of each piece of data.

[0006] The life cycle of data is understood to be from the production of this data by a transmitter or producer, its transmission to a recipient or consumer, and the use of this data by the latter (the use being able to be the simple storage of the data).

[0007] Within the framework of the “data centric security” paradigm, we would like to be able to protect the data of a video data stream (or video stream).

[0008] In the case, for example, of a video stream generated by a surveillance camera, it would be desirable, for example, for the images delivered by this camera to be able to be seen by all users when they are in low resolution, and for, when this camera is controlled to provide high resolution images, these images to no longer be able to be seen except by authorized users.

[0009] One solution could be to encode images when they are reserved for an authorized user and to allow their decoding only when the user has been correctly identified. However, this protection technique is binary since an image can only be in two states, encoded or unencoded.

[0010] We would like more flexibility by having a means of protecting the data of a video stream at the most appropriate level, in particular by taking into account the producers and consumers of this data.

[0011] The present invention therefore aims to solve this problem by proposing a method and a device for multi-level protection of a video stream.

[0012] For this purpose, the invention relates to a method for protecting an incoming stream, the incoming stream comprising at least one incoming elementary video stream, the incoming elementary video stream comprising a succession of incoming video packets, the method being characterized in that it comprises the steps of: disassembling the incoming stream to separate a current packet; encrypting the current packet with a session key; constructing a confidentiality metadata packet comprising a time label field corresponding to a time label of the current packet and a confidentiality field repeating the session key; encrypting the confidentiality data packet with an encryption key; assembling an outgoing stream comprising an outgoing elementary stream grouping the encrypted current packets and a confidentiality metadata elementary stream comprising the encrypted confidentiality metadata packets.

[0013] According to particular embodiments, the method comprises one or more of the following characteristics, taken in isolation or in all technically possible combinations:

[0014] - the method further comprises the steps of: acquiring at least one indicator; and, determining a confidentiality level for the current packet from or each indicator, the step of constructing a confidentiality metadata packet further comprising a confidentiality level field repeating the confidentiality level determined for the current packet.

[0015] - the encryption key is selected according to the confidentiality level determined for the current packet.

[0016] - the acquisition step consists of filtering the incoming packet to evaluate at least one in dictator.

[0017] - the incoming stream includes, in addition to the elementary video stream, an elementary media stream context data, the disassembly step to separate a current context metadata packet.

[0018] - the current video packet is encrypted with a first session key, and the packet of Context metadata is encrypted with a second session key.

[0019] - the confidentiality metadata packet comprises a first confi field dentiality including the first session key and a second confidentiality field taking the second session key.

[0020] - the outgoing flow complies with the protocol "group of experts in animated images - Flow of transport» - MPEG-TS.

[0021] - the privacy metadata package has additional fields to be compatible with the “Motion Imaging Standard Profile” -MISP standard.

[0022] The invention also relates to a protection device suitable for implementing the preceding method.

[0023] The invention also relates to a computer program product for implementing the preceding method by a computer.

[0024] The invention and its advantages will be better understood on reading the detailed description which follows of two particular embodiments, given solely for illustrative and non-limiting purposes, the description being made with reference to the appended drawings in which: - [Fig.l] [Fig.l] is a schematic representation, in the form of functional modules, of a protection device according to a first embodiment of the invention; - [Fig.2] [Fig.2] is a block representation of the process of protection implemented by the device of [Fig.l]; and, - [Fig.3] [Fig.3] is a schematic representation, in the form of functional modules, of a protection device according to a second embodiment of the invention.

[0025] Generally speaking, the invention relates to a protection device, software or hardware, arranged as a cut-off on a transmission path of a video data stream, between a transmitter and a recipient of this stream.

[0026] The video stream is chunked or packetized, that is, it is made up of a succession of packets. The payload part of a packet complies with a video CODEC.

[0027] The protection device is adapted to apply a confidentiality policy making it possible to assign a protection level N adapted to each packet of the video stream.

[0028] This protection device is capable of retransmitting a composite stream comprising, in addition to an outgoing video stream derived from the incoming video stream, a confidentiality metadata stream. The outgoing data stream complies with the MPEG-TS formant. This metadata stream is also a packetized stream, each confidentiality metadata packet being closely associated with one or more packets of the video stream.

[0029] A first embodiment of the invention will now be described with reference to Figures 1 and 2.

[0030] This first embodiment is suitable for processing an incoming flow containing only a video elementary stream. The video elementary stream is a stream subdivided into video packets.

[0031] This is, for example, a raw stream, output from an acquisition device, such as a surveillance camera.

[0032] As shown in [Fig.l], the incoming stream 10 (or container) comprises an elementary video stream 11. The elementary video stream 11 consists of a succession of video packets 12.

[0033] In this first embodiment, the protection device is a gateway 30 located between two networks (not shown in this figure), the network of the source of the incoming flow 10 and the network of the recipient of the outgoing flow 20, retransmitted by the protection device 30.

[0034] A gateway is a computer comprising calculation means, such as a processor, and storage means, such as a memory. The memory stores the instructions of different programs, the execution of which by the processor makes it possible to provide the gateway 30 with different functionalities. In particular, the memory of the gateway 30 comprises the instructions of a multi-level protection program for the incoming flow.

[0035] The gateway 30 applies a protection policy to each of the video packets 12 of the incoming stream. The gateway 30 is configured to apply this policy, which is therefore pre-established.

[0036] The protection policy determines the confidentiality level N to be associated with the current video packet, based on one or more indicator(s), Id.

[0037] More precisely, the gateway 30 comprises an input interface 31, which is adapted for receiving the incoming stream 10.

[0038] Downstream of the input interface 31, the gateway 30 comprises a module 32 for disassembling the incoming stream 10. This module has the function of isolating the different video packets 12 of the elementary video stream 11 from the incoming stream 10.

[0039] Each video packet is applied as input to a filtering module 33. The function of module 33 is to determine the value of the or each of the Id indicators of the protection policy on the current video packet.

[0040] An indicator may be a context indicator, that is to say a parameter external to the incoming stream 10 and to the gateway 30. Such an indicator is then communicated to the gateway 30 by a third party. It is for example a date or an operational context of implementation of the camera, source of the video stream to be protected.

[0041] But, preferably, an indicator is an element derived from the current video packet. For example, the module 33 is adapted so as to implement an image recognition algorithm making it possible to identify on the image(s) of the current video packet the presence of a target (in the case for example of images from a camera If a target is actually detected, a "target presence" indicator switches from zero to unity.

[0042] The gateway 30 comprises, downstream of the module 33, a decision module 34. The module 34, from one or more of the indicators Id determined by the module 33 for the current video packet, decides on the value of the confidentiality level N to be assigned to this current video packet.

[0043] The gateway 30 comprises, downstream of the module 34, a module 35 for generating confidentiality metadata packets. The module 35 comprises a sub-module 43 for concatenating the different fields constituting a confidentiality metadata packet. A confidentiality metadata packet comprises a time labeling field making it possible to associate a confidentiality metadata packet with a video packet by assigning them the same date.

[0044] A metadata packet also includes a confidentiality level field indicating the value N calculated by the module 34 for the current video packet.

[0045] Finally, the metadata packet also includes a cryptographic field.

[0046] The module 35 comprises a sub-module 42 for encrypting a confidentiality metadata packet. Depending on the value of N indicating that the current video packet is reserved for authenticated recipients, the sub-module 42 selects a security key adapted to these recipients and encrypts the metadata packet associated with the current video packet. The sub-module 42 uses a security key, such as a key encryption key KEY.

[0047] The KEK security key is shared between the gateway 30 and the recipients of the video stream having the right to know the content of this stream. The manner of exchanging the KEK keys between the gateway and the recipient(s) is known as such and is not part of the present invention.

[0048] The gateway 30 comprises a module 36 for assembling elementary streams, both an outgoing video elementary stream 21 corresponding to the incoming video elementary stream 11 and the confidentiality metadata elementary stream 25 coming from the module 35 and composed of encrypted confidentiality metadata packets.

[0049] The gateway 30 comprises a cryptographic module 40.

[0050] The cryptographic module 40 takes as input the current video packet delivered as output from the disassembly module 32.

[0051] The cryptographic module 40 comprises a sub-module 41 capable of encrypting the current video packet using a session key, for example a traffic encryption key - TEK. The sub-module 41 is capable of generating a TEK session key per video packet to be protected. The encrypted video packet is transmitted to the assembly module 36. The different encrypted video packets 22 constitute the elementary video stream 21 of the outgoing video stream 20.

[0052] The sub-module 41 transmits the session key TEK to the sub-module 43.

[0053] It is this TEK key which is placed in the encryption field of the confidentiality metadata packet associated with the current video packet.

[0054] Finally, the gateway 30 includes an output interface 37 allowing the outgoing flow 20 constructed by the module 36 to be retransmitted onto the network to the recipient.

[0055] The outgoing stream 20 is therefore made up of an elementary video stream 21 and an elementary confidentiality metadata stream 25. The elementary video stream is made up of a succession of video packets 22. The elementary confidentiality metadata stream 25 is made up of a succession of confidentiality metadata packets 26.

[0056] The outgoing stream 20 complies with the MPEG-TS protocol (“Moving Picture Experts Group - Transport Stream”), in particular in its latest version dated IEC 13818-1 of September 2022.

[0057] [Fig.2] represents an embodiment of the protection method according to the invention resulting from the implementation of the gateway 30 of [Fig.l].

[0058] The method 50 begins with a step 51 of acquiring the incoming stream. Step 51 corresponds to the use of the input interface 31.

[0059] Then, the method 50 continues by decomposing the incoming stream 10 to find the elementary video stream 11 and the cutting of the elementary video stream 11 into different video packets 12. This step 52 corresponds to the execution of the module 32 for disassembling the incoming stream.

[0060] Step 53 corresponds to the filtering of the current video packet to evaluate one or more indicator(s) Id defined by the confidentiality policy implemented by the gateway 30. Step 53 corresponds to the execution of the module 33 for filtering the current video packet.

[0061] The different identifiers Id are transmitted to the decision module 34, which, in step 54, determines the confidentiality level N adapted to the current video packet.

[0062] The confidentiality level thus determined is transmitted to module 35.

[0063] Step 60 corresponds to the execution of module 40 on the current video packet.

[0064] In step 61, the current video packet is encrypted using the session key TEK to obtain an encrypted current video packet. The latter is transmitted to the elementary stream assembly module 36.

[0065] The session key TEK is transmitted to the module 35.

[0066] In step 55, corresponding to the execution of module 35, a confidentiality metadata packet is first constructed. It comprises different fields, in particular:

[0067] - a time labeling field containing the time label of the video packet current in order to associate a particular metadata packet with a video packet particular.

[0068] - a field for the confidentiality level N determined at the end of step 54.

[0069] - an encryption field allowing the transmission of the TEK session key used to the outcome of step 60 to encrypt the current video packet.

[0070] The confidentiality metadata packet is then encrypted using the KEK key adapted to the confidentiality level N (in particular adapted to the rights of users authorized to know the content of the flow).

[0071] The encrypted confidentiality metadata packet is transmitted to module 36.

[0072] In step 56, corresponding to the execution of module 36, the outgoing stream 20 is assembled from the elementary video streams (constructed from the succession of encrypted video packets output from step 61) and the elementary metadata stream (constructed from the succession of encrypted metadata packets output from step 55).

[0073] Finally, in step 57, the outgoing flow 20 is retransmitted to the recipient.

[0074] It should be noted that, in [Fig.l], the elementary streams of the outgoing stream are represented separately from each other, but the packets of these two elementary streams are in fact multiplexed in the outgoing stream, forming a container.

[0075] The preferred embodiment includes systematically encrypting the video packets with a TEK key and always includes encrypting the confidentiality metadata packet (in which the TEK key is located) with the KEK key.

[0076] The ability of a recipient to access, yes or no, the packets of a stream therefore depends on whether or not it has the KEK key. This therefore refers to the method of distributing the KEK key to make it available only to recipients who have a right to know the confidentiality metadata packets and, after extraction of the TEK key, the corresponding video packets.

[0077] Advantageously, the same TEK key can be used to encrypt each of the packets in a sequence of several successive video packets. A metadata packet is then generated not for each video packet, but for this sequence of video packets. A single confidentiality metadata packet is then associated with the sequence of encrypted video packets. Optionally, since a sequence may be long, the confidentiality metadata packet is repeated at a fixed frequency in the outgoing stream. The confidentiality metadata packet is encrypted using the same KEK at each repetition.

[0078] It should be emphasized that placing a TEK session key in the confidentiality metadata packet associated with an encrypted video packet allows an association between these packets not only by the time labeling field, but especially by the cryptographic field containing the TEK session key allowing the corresponding video packet to be decrypted. This therefore allows the recipient to decrypt the packet encrypted video associated with this TEK session key and only this one. While the association by a time field is weak, the association by an encryption key is a strong association, making this solution robust.

[0079] Encrypting the TEK key with the KEK key increases security by preventing any alteration of the stream by a third party. Indeed, if the TEK metadata were not encrypted, a third party could extract it and use it to decrypt the video packets or to construct new video packets, encrypt them with the TEK key, and insert them into the stream.

[0080] If the video packets are encrypted by the TEK key but only the TEK key is encrypted by the KEK key and none of the other metadata, this other confidentiality metadata can be known and possibly altered by an attacker.

[0081] In an example of use of this first embodiment, all the data are identified as belonging to the same level by the configured security policy. A single confidentiality metadata packet is then necessary to label all the data in the flow. The data are still encrypted with a TEK key in order to link them to the confidentiality metadata packet, and the confidentiality metadata packet is itself encrypted with a KEK key to guarantee the integrity and authenticity of the whole. The confidentiality metadata packet is repeated at regular intervals to allow a new entrant to the flow to be able to decrypt it. Its KEK key can remain the same.

[0082] [Fig.3] illustrates a second embodiment of the device according to the invention.

[0083] An element of the second embodiment of [Fig.3] which is similar to an element of the embodiment of [Fig.l] is referenced by a reference numeral corresponding to the reference numeral used in [Fig.l] to identify this similar element, increased by one hundred.

[0084] In this second embodiment, the gateway 130 is adapted to apply a confidentiality policy to an incoming flow 110, the latter now being a composite flow.

[0085] The incoming stream 110 contains a first elementary stream 110, which is a stream of video packets, and a second elementary stream 115.

[0086] The second elementary stream may not be correlated with the first elementary stream. For example, it could be another video elementary stream that is completely different and independent of the first video elementary stream.

[0087] Preferably, the second elementary stream is correlated to the first elementary stream. For example, it could be an audio elementary stream associated with the video elementary stream, each packet of the second elementary stream being associated with one or more packets of the first elementary stream.

[0088] In the following, the second elementary stream is a metadata elementary stream of context which is correlated to the elementary video stream.

[0089] The context metadata packets 116 of the second elementary stream 115 carry a time label making it possible to associate a metadata packet 116 with a video packet 112.

[0090] It should be noted that, in [Fig.3], the elementary streams of the incoming stream are represented separately from each other, but the packets of these two elementary streams are in fact multiplexed together in the incoming stream.

[0091] The incoming stream 10 preferably complies with the MPEG-TS protocol.

[0092] To apply a confidentiality policy to the stream 110, the gateway 130 comprises an input interface 131 for acquiring the incoming stream 110.

[0093] Downstream of the input interface 131, the gateway 130 comprises a module 132 for disassembling the incoming stream. The module 132 is capable of separating (in particular demultiplexing) the different elementary streams making up the incoming composite stream, and, for each elementary stream, of cutting it into packets. Thus, on a first output, the module 130 delivers a first current video packet and on a second output, the module 130 delivers a second current context metadata packet.

[0094] The gateway 130 comprises several filtering modules, each filtering module being adapted to the processing of packets of a particular elementary flow.

[0095] Thus a first filtering module 133.1 makes it possible to filter the current video packet to obtain one or more first indicators Id.1, while a second filtering module 133.2 makes it possible to filter the current context metadata packet, to obtain one or more second indicators Id.2.

[0096] In the embodiment of [Fig. 3], these two sets of indicators are transmitted to a module for making a decision regarding the confidentiality level to be applied to the current packets. In the embodiment of [Fig. 3], this module 134 is common to the two elementary streams. The module 134 delivers a confidentiality level N for the current video packet and the current context metadata packet.

[0097] The gateway 130 comprises, downstream of the module 134, a module 140.1 for encrypting the current video packet and a module 140.2 for encrypting the confidentiality metadata packet.

[0098] As in the first embodiment of [Fig.l], a first module 141.1 of the module 140.1 takes as input the current video packet delivered by the module 132 and encrypts it using a session key TEK1. The encrypted video packet is transmitted to a module 136 for assembling elementary streams.

[0099] In parallel, a second module 141.2 of the module 140.2 takes as input the current context metadata packet delivered by the module 132 and encrypts it with a session key TEK2. The packet thus encrypted is transmitted to the module 136.

[0100] Sub-module 143 of module 135 constructs a confidentiality metadata packet integrating:

[0101] - a time labeling field, allowing to associate a metadata packet confidentiality to a video packet and the context metadata packet by sharing a common time stamp;

[0102] - a confidentiality level field indicating the value N calculated for the current packets by module 134; and,

[0103] - a first cryptographic field, containing the session key TEK1,

[0104] - a second cryptographic field, containing the TEK2 session key.

[0105] A sub-module 142 of the module 135, depending on the value N of the confidentiality level assigned to the current packets by the module 134, encrypts the confidentiality metadata packet using a security key KEK. The sub-module 142 transmits the encrypted packet to the module 136.

[0106] The module 136 makes it possible to assemble (in particular to multiplex) the elementary streams, both the video elementary stream, the context metadata elementary stream and the confidentiality metadata elementary stream.

[0107] The gateway 130 comprises an output interface 137 adapted to retransmit the outgoing flow 120, constructed by the module 136, on the network to the recipient or recipients of the flow.

[0108] The outgoing stream 120 is therefore made up of an elementary video stream 121 and an elementary metadata stream 125. The elementary video stream is made up of a succession of encrypted video packets 122. The elementary metadata stream 125 is made up of a succession of metadata packets integrating both encrypted context metadata packets 116 (corresponding to the packets contained in the second elementary stream of the incoming stream) and confidentiality metadata packets 126 resulting from the application of the policy implemented by the gateway 130.

[0109] The outgoing stream 120 complies with the MPEG-TS protocol.

[0110] The different steps of the method resulting from the implementation of the device 130 are not described here in detail, but they are deduced from what has been presented above. In particular, each functional module of [Fig.3] could be seen as a step of implementation of the corresponding method.

[0111] In a use case of this second embodiment, a multiplexed composite incoming stream, with a video and contextual metadata belonging to the same program. The security policy is set so that the contextual metadata is stamped "Restricted Disclosure" - DR and the video data is stamped "Confidential" unless the position of the acquisition camera (for example given by a GPS system equipping the camera), which can be extracted from the contextual metadata, corresponds to a previously fixed area. The data video packets are then stamped "Secret". A single confidentiality metadata packet can therefore be used to label several contextual metadata packets. The TEK2 key used to encrypt the contextual metadata packets is embedded in the confidentiality metadata packet, which also carries the MISP information announcing the associated video packets as DR, and this is encrypted with a KEK key associated with the DR level. In this example, it may therefore be the case that two consecutive video packets do not have the same confidentiality level. They are then encrypted with different keys and each have their associated confidentiality metadata packet. A CD-level KEK key is used for one and an S-level KEK key is used for the other.

[0112] As a variant of this second embodiment, once the different elementary flows have been separated by the module 132, there could be completely independent processing chains making it possible to apply a specific confidentiality policy to each elementary flow of the incoming flow. These chains could use identical or different TEK session keys and / or identical or different KEK encryption keys.

[0113] The outgoing flow could then be composed, on the one hand, of a first elementary flow corresponding to the first elementary flow and a first elementary flow of confidentiality metadata associated with the first elementary flow, and, on the other hand, of a second elementary flow corresponding to the second elementary flow and a second elementary flow of confidentiality metadata associated with this second elementary flow.

[0114] If in the preceding embodiments the device for applying a confidentiality policy is an independent hardware device (for example a gateway between a local network and a public network), as a variant, the device for applying a confidentiality policy is essentially software, such as for example a driver at the output of an image acquisition camera.

[0115] The privacy policy implemented by the device may be redefined at intervals. This may require reprogramming the filtering module to determine the value of different indicators on incoming packets.

[0116] In this regard, the filtering module is adapted to associate one or more indicators with a current packet. This indicator can be determined from the current packet only, but could also depend on processing on a succession of packets, comprising the current packet and a certain number of previous packets. The indicator could be, for example, an average value over this succession of packets or the result of a comparison between the current packet and one or more previous packet(s).

[0117] Alternatively, the protection device does not include a filtering module and the confidentiality policy is reduced to encrypting the packets of a flow and encrypting the key of TEK session with a KEK encryption key tailored to the recipient.

[0118] Advantageously, when the confidentiality data are identical from one video packet to another for a sequence of video packets, a confidentiality metadata packet is only transmitted for the first of these video packets. The recipient of the stream then knows that it must associate a video packet with the confidentiality data of the last metadata packet received.

[0119] It should be noted that the "Motion Imagery Standard Profile" MISP ST 0102.12 STANAG 4609 standard (or "motion imagery standard profile" in French) standardizes the introduction of context metadata in video streams. Certain fields of this metadata indicate the confidentiality level of the associated video packets.

[0120] The confidentiality metadata package developed by module 35 (or module 135) could include all or part of the fields defined by the MISP standard, in particular to be compatible with this standard. Additional fields can therefore be considered.

[0121] Furthermore, ETSI has specified means of protecting video streams in the ETSI TS101197-DVB “SIMULCRYPT” standard.

[0122] In the same multiplexed stream, the SIMULCRYPT solution makes it possible to transmit encrypted “programs” and others in clear, a “program” being a collection of packets of different natures (audio, video, etc.) constituting a coherent stream (a program or a film for example). Thus, a program can be transmitted either unencrypted or encrypted. It is therefore a binary encryption (all or nothing), which does not allow the granularity of protection proposed by the present invention.

[0123] Furthermore, unlike the present invention, SIMULCRYPT does not allow an audio section to be encrypted with a key different from that used to encrypt the associated video section.

[0124] More importantly, SIMULCRYPT encrypts a stream to protect its confidentiality. In contrast, the present invention is first and foremost a solution for strongly linking confidentiality metadata to data, and protecting the data confidentially.

[0125] The present invention therefore makes it possible to separate, in a flow, the data by level of confidentiality and to apply to each data item a protection adapted to the required level of confidentiality. The separation of the data according to their level of confidentiality is understood for data from different elementary flows, but especially data from different packets of the same elementary flow. We could speak of a “temporal” separation between data (within the same data flow, assigning different levels of confidentiality from one packet to another) or of a “spatial” separation (the level of confidentiality of the data from different elementary flows can be treated independently).

[0126] Using a session key to encrypt a video data packet and placing that session key in the associated privacy metadata packet allows the video elementary stream and metadata packets to be tightly bound.

[0127] Furthermore, by encrypting the confidentiality metadata packet, the present invention makes it possible to ensure the integrity and authenticity of this metadata. The solution specified by NATO does not make it possible to ensure the integrity and authenticity of the metadata, nor to link it to the video stream by a cryptographic signature.

[0128] According to the invention, to guarantee the integrity and authenticity of the confidentiality metadata, the latter are included in the encryption by the KEK key.

[0129] The solution specified by ETSI does not allow for the management of complex security policies based on heterogeneous attributes and sensitivity levels in the same flow.

[0130] The present invention offers a binary capability: either the encryption key of the video stream is decrypted (to then be able to decrypt the video stream; or the encryption key cannot be decrypted. The present invention makes it possible to encrypt certain packets or sections of packets of a stream with one key, and other sections of this same stream with another key.

Claims

Claims

1. Method for protecting an incoming stream (10, 110), the incoming stream comprising at least one incoming elementary video stream (11, 111), the incoming elementary video stream comprising a succession of incoming video packets (12, 112), the method being characterized in that it comprises the steps of: - disassembling (52) the incoming stream to separate a current packet (12, 112, 116); - encrypting the current packet with a session key (TEK, TEK1, TEK2); - constructing (55) a confidentiality metadata packet comprising a time tag field corresponding to a time tag of the current packet and a confidentiality field repeating the session key; - encrypting the confidentiality data packet with an encryption key (KEK);- assembly (56) of an outgoing flow (20, 120) comprising an outgoing elementary flow grouping the encrypted current packets (22, 122, 116) and an elementary flow of confidentiality metadata comprising the encrypted confidentiality metadata packets (26, 126).;

2. Method according to claim 1, further comprising: - acquisition of at least one indicator (Id); and, - determination (54) of a confidentiality level (N) for the current packet from or from each indicator, the step of constructing (55) a confidentiality metadata packet further comprising a confidentiality level field repeating the confidentiality level determined for the current packet.

3. Method according to claim 2, wherein the encryption key (KEK) is selected according to the confidentiality level (N) determined for the current packet.

4. Method according to any one of the preceding claims, in which the acquiring step consists of filtering (53) the incoming packet to evaluate at least one indicator (Id).

5. Method according to any one of the preceding claims, in which the incoming stream comprises, in addition to the elementary video stream, an elementary stream of context metadata, the disassembly step making it possible to separate a current context metadata packet.

6. The method of claim 5, wherein the current video packet is encrypted with a first session key (TEK1), and the context metadata packet is encrypted with a second session key (TEK2).

7. The method of claim 6, wherein the confidentiality metadata packet comprises a first confidentiality field comprising the first session key and a second confidentiality field comprising the second session key.

8. Method according to any one of the preceding claims, in which the outgoing stream complies with the "Moving Image Expert Group - Transport Stream" - MPEG-TS protocol.

9. A method according to any preceding claim, wherein the privacy metadata packet includes additional fields to be compatible with the Motion Imaging Standard Profile - MISP standard.

10. Protection device (30) adapted to implement a protection method according to any one of claims 1 to 9 on an incoming stream, the incoming stream comprising at least one incoming elementary video stream.

11. Computer program comprising software instructions which, when executed by a computer, implement a protection method according to any one of claims 1 to 9 on an incoming stream, the incoming stream comprising an incoming elementary video stream, the incoming elementary video stream comprising a succession of incoming video packets.

Images