Granted Patent B2

US 12,177,293 · App. 17/852,709 · Granted Dec 24, 2024

Inventors: Vishwas Saxena (Bangalore, IN); Mukesh Kumar P (Bangalore, IN)

Assignee: Sandisk Technologies, Inc.

H04L67/104H04L9/0825H04L9/0838H04L9/0861H04L63/061H04L63/166H04N7/181

Abstract

Claims (108)

1. A system, comprising:

a video camera comprising:

a processor;

a memory;

a network interface configured for communication over a network;

a data storage device configured to store video data; and

a surveillance controller, stored in the memory for execution by the processor, configured to:

receive, from a user device through a relay server, a peer-to-peer connection request;

establish, responsive to the peer-to-peer connection request, a connection to a signaling server, wherein the connection is configured for exchanging a connectivity configuration associated with opening a secure peer-to-peer channel between the user device and the video camera;

establish the secure peer-to-peer channel with the user device;

send a session identifier to the user device via the secure peer-to-peer channel;

receive a signed session identifier from the user device;

verify the signed session identifier;

generate a camera public key associated with the user device;

send, to the user device via the secure peer-to-peer channel, the camera public key;

receive, from the user device via the secure peer-to-peer channel, a client public key;

store, in the memory, the client public key in association with the camera public key;

generate a shared key based on the camera public key and the client public key; and

encrypt, using the shared key, requested video data from the video camera.

2. The system of claim 1 , further comprising:

a registration module configured to receive a long-term device key from the user device upon installation, wherein the surveillance controller is further configured to verify the signed session identifier using the long-term device key.

3. The system of claim 2 , further comprising:

the user device configured to:

generate a long-term host key and the long-term device key upon registration; and

sign the session identifier using the long-term host key.

4. The system of claim 1 , further comprising:

the user device comprising a network server interface configured to:

receive, from the relay server, a user device notification indicating a signaling server for establishing the secure peer-to-peer channel;

receive, forwarded from the signaling server, an Interactive Connectivity Establishment (ICE) configuration of the video camera;

generate a responsive ICE configuration;

send the responsive ICE configuration to the signaling server;

receive exchanged candidates; and

establish the secure peer-to-peer channel.

5. The system of claim 4 , wherein the user device further comprises a video manager configured to:

send a media request for a manifest file to the video camera via the relay server;

receive data encrypted from the video camera via the relay server responsive to the media request; and

decrypt the data using the shared key to extract the manifest file.

6. The system of claim 1 , wherein the shared key is generated using a key derivation function.

7. The system of claim 1 , wherein the relay server is configured to receive requests through a hypertext transfer protocol (HTTP).

8. The system of claim 1 , wherein:

the network interface is configured to receive network communication from a network address translation device using a local network address; and

establishing the secure peer-to-peer channel comprises establishing a secure Datagram Transport Layer Security (DTLS) protocol between the video camera and the user device.

9. The system of claim 1 , wherein the surveillance controller is further configured to, responsive to a request via the relay server:

retrieve a manifest file from the data storage device;

encrypt the manifest file using the shared key; and

send the encrypted manifest file to the relay server.

10. The system of claim 1 , wherein the relay server comprises an authentication controller configured to authenticate the user device and the video camera to initiate the secure peer-to-peer channel.

11. A computer-implemented method, comprising:

establishing, between a video camera and a user device, a peer network connection using a Datagram Transport Layer Security (DTLS) protocol;

sending an encrypted data transfer session request to the user device;

receiving a signed session request from the user device;

verifying the signed session request;

generating a shared key with the user device;

receiving a media request for a manifest file through a relay server in a hypertext transfer protocol (HTTP) request;

retrieving the manifest file;

encrypting the manifest file using the shared key; and

sending the encrypted manifest file to the relay server in an HTTP response to the HTTP request.

12. The computer-implemented method of claim 11 , wherein:

the video camera comprises:

at least one image sensor configured to capture video images;

a processor;

a memory;

a network interface configured for communication over a network; and

a data storage device configured to store video data captured by the at least one image sensor; and

the manifest file includes video data stored in the data storage device.

13. The computer-implemented method of claim 11 , further comprising:

receiving, by the video camera, network communication from a network address translation device using a local network address for the video camera; and

establishing, for the peer network connection, a secure socket between the video camera and the user device.

14. The computer-implemented method of claim 11 , wherein generating the shared key includes using a key derivation function.

15. The computer-implemented method of claim 14 , further comprising:

exchanging, for the peer network connection, a plurality of combinations of network addresses and ports for:

the video camera; and

the user device; and

implementing a transport layer security protocol compatible with the peer network connection.

16. The computer-implemented method of claim 11 , further comprising:

receiving, by the relay server, a media connection request from the user device;

authenticating, by the relay server, the media connection request based on at least one public key associated with the media connection request;

determining, by the relay server and based on the media connection request, a target camera identifier from a plurality of camera identifiers supported by the relay server, wherein the target camera identifier corresponds to the video camera;

sending, by the relay server and based on the media connection request, a user device notification to the video camera; and

initiating, by the relay server, a signaling server to support negotiation of the peer network connection between the video camera and the user device.

17. The computer-implemented method of claim 16 , further comprising:

determining, by the relay server, signaling channel information for a signaling channel;

sending, by the relay server, the signaling channel information to the video camera and the user device;

establishing, by the signaling server, the signaling channel for use by the video camera and the user device; and

exchanging, by the signaling server, interactive connectivity establishment (ICE) configurations between the video camera and the user device.

18. The computer-implemented method of claim 11 , wherein:

retrieving the manifest file is from a data storage device in the video camera; and

generating the shared key is through an elliptic-curve Diffie-Hellman (ECDH) key exchange.

19. The computer-implemented method of claim 11 , further comprising:

generating, by the user device, a long-term host key and a long-term device key upon registration; and

receiving the long-term device key from the user device upon installation, wherein verifying the signed session request uses the long-term device key.

20. A video camera, comprising:

a processor;

a memory;

a network interface configured for communication over a network;

a data storage device configured to store video data;

means for receiving, from a user device and through a relay server, a peer-to-peer connection request;

means for establishing, responsive to the peer-to-peer connection request, a connection to a signaling server, wherein the connection is configured for exchanging a connectivity configuration associated with opening a secure peer-to-peer channel between the user device and the video camera;

means for establishing the secure peer-to-peer channel with the user device;

means for sending a session identifier to the user device via the secure peer-to-peer channel;

means for receiving a signed session identifier from the user device;

means for verifying the signed session identifier;

means for generating a camera public key associated with the user device;

means for sending, to the user device and via the secure peer-to-peer channel, the camera public key;

means for receiving, from the user device and via the secure peer-to-peer channel, a client public key;

means for storing, in the memory, the client public key in association with the camera public key;

means for generating a shared key based on the camera public key and the client public key; and

means for encrypting requested video data from the video camera using the shared key.

Assignments (8)