Granted Patent B2

US 12,362,943 · App. 18/985,870 · Granted Jul 15, 2025

Inventors: Bin Wang (Hangzhou, CN); Da Chen (Hangzhou, CN); Yuyin Wang (Hangzhou, CN); Jiadong Chen (Hangzhou, CN)

Assignee: HANGZHOU HIKVISION DIGITAL TECHNOLOGY CO., LTD.

H04L9/3242G06F21/16H04L9/0869H04L9/14H04L9/3234

Abstract

Claims (93)

1. A dynamic orchestration-based audio-video security protection method, being executed in a dynamic orchestration-based audio-video security protection system that comprises a security sharing gateway and a network and data security situation awareness platform, the method comprises:

identifying, by the security sharing gateway, a level of audio-video data in an audio-video code stream and an authority of an audio-video retrieval platform before forwarding the audio-video code stream to the audio-video retrieval platform;

in a case where the security sharing gateway retrieves no platform authority corresponding to the level of the audio-video data, reporting, by the security sharing gateway, alarm information to the network and data security situation awareness platform, wherein the alarm information comprises the level of the audio-video data and the authority of the audio-video retrieval platform,

in response to receiving the alarm information, the network and data security situation awareness platform issues a platform authority corresponding to the level of the audio-video data to the security sharing gateway according to the alarm information, and in response to determining that the level of the audio-video data does not match the authority of the audio-video retrieval platform, the network and data security situation awareness platform dynamically adjusts a security protection strategy of at least one other gateway in the dynamic orchestration-based audio-video security protection system, wherein security of the adjusted security protection strategy is higher than security of the security protection strategy before adjustment; and

in a case where the security sharing gateway determines that the authority of the audio-video retrieval platform matches the level of the audio-video data in the audio-video code stream, performing, by the security sharing gateway, application-layer protocol parsing on the audio-video code stream to determine whether a hash-based message authentication code (HMAC) value exists in the audio-video code stream;

in response to determining that the HMAC value does not exist in the audio-video code stream,

adding, by the security sharing gateway, an encoding-layer watermark on the audio-video data in the audio-video code stream,

generating, by the security sharing gateway, a first HMAC value according to a randomly generated first key and the encoding-layer watermark, and

encapsulating, by the security sharing gateway, the first HMAC value and a cipher text of the first key into a security parameter struct of the audio-video code stream, wherein the cipher text of the first key is obtained by encrypting the first key according to a first protection key, and the protection key is obtained by a request according to a first unique identification;

in response to determining that the HMAC value exists in the audio-video code stream,

acquiring, by the security sharing gateway, a second HMAC value and a cipher text of a second key in the security parameter struct of the audio-video code stream,

requesting, by the security sharing gateway, the first protection key according to the first unique identification,

obtaining, by the security sharing gateway, the second key by decrypting the cipher text of the second key using the first protection key, and

generating, by the security sharing gateway, a third HMAC value according to the encoding-layer watermark of the audio-video data and the second key;

intercepting, by the security sharing gateway, the audio-video code stream in response to determining that the third HMAC value is inconsistent with the second HMAC value; and

in response to determining that the third HMAC value is consistent with the second HMAC value, adding, by the security sharing gateway, an encoding-layer watermark on the audio-video data in the audio-video code stream, and generating a fourth HMAC value according to a randomly generated third key, the encoding-layer watermark added by a present node, and the second HMAC value, and encapsulating the fourth HMAC value and a cipher text of the third key into the security parameter struct of the audio-video code stream, wherein the cipher text of the third key is obtained by encrypting the third key according to a second protection key, and the second protection key is obtained by a request according to a second unique identification.

2. The dynamic orchestration-based audio-video security protection method according to claim 1 , wherein the dynamic orchestration-based audio-video security protection system further comprises a security access gateway, and the method further comprises:

for the audio-video code stream output by an audio-video source, performing, by the security access gateway, application-layer protocol parsing on the audio-video code stream, and performing encryption and integrity protection processing on the audio-video data in the audio-video code stream;

replacing, by the security access gateway, the audio-video data before the processing with the processed audio-video data, and re-encapsulating the processed audio-video data into the audio-video code stream.

3. The dynamic orchestration-based audio-video security protection method according to claim 1 , wherein the dynamic orchestration-based audio-video security protection system further comprises a security storage gateway, and the method further comprises:

for the audio-video code stream to be stored, in a case where the audio-video code stream is to be stored in a cloud storage, performing, by the security storage gateway, encryption and integrity protection processing on an audio-video file corresponding to the audio-video code stream using a security protection plug-in in an operating system kernel of a storage node where the audio-video code stream is to be stored, wherein the security protection plug-in acts between a virtual file system and an underlying file system for performing encryption and integrity protection processing on stored audio-video files, and wherein the security protection plug-in is further configured to perform decryption and integrity verification processing on a retrieved audio-video code stream; and/or

for the audio-video code stream to be stored, in a case where the audio-video code stream is to be stored in a video recorder device, performing, by the security storage gateway, application-layer protocol parsing on the audio-video code stream, performing encryption and integrity protection processing on the audio-video data in the audio-video code stream, replacing the audio-video data before the processing with the processed audio-video data, re-encapsulating the processed audio-video data into the audio-video code stream, and storing the audio-video code stream in the video recorder device.

4. The dynamic orchestration-based audio-video security protection method according to claim 3 , wherein the method further comprises:

for the audio-video code stream to be retrieved, intercepting, by the security storage gateway, the audio-video code stream in a case where it is determined that an authority of an audio-video retrieval party does not match the level of audio-video data in the audio-video code stream.

5. The dynamic orchestration-based audio-video security protection method according to claim 1 , wherein the method further comprises:

wherein the security protection strategy adjustment comprises one or more of:

encoding-layer encryption strategy adjustment; wherein the encoding-layer encryption strategy adjustment comprises one or more of key update period adjustment, algorithm strength adjustment and key strength adjustment;

data flow authority control strategy adjustment; wherein the data flow authority control strategy adjustment comprises adjusting a corresponding relationship between a level of the audio-video data and a platform authority, and/or adjusting a corresponding relationship between a level of the audio-video data and an authority of an audio-video retrieval party;

sensitive data desensitization strategy adjustment; wherein the sensitive data desensitization strategy is used for instructing to desensitize specified audio-video data in the audio-video data; and

encoding-layer watermark strategy adjustment; wherein the encoding-layer watermark strategy adjustment comprises one or more of adjustment of information contained in an encoded watermark, watermark superimposition frequency adjustment and watermark verification frequency adjustment.

6. The dynamic orchestration-based audio-video security protection method according to claim 1 , wherein the dynamically adjusting of the security protection strategy of the at least one other gateway in the dynamic orchestration-based audio-video security protection system comprises:

for the security sharing gateway, performing one or more of encoding-layer encryption strategy adjustment, data flow authority control strategy adjustment, sensitive data desensitization strategy adjustment, and encoding-layer watermark strategy adjustment;

wherein:

the encoding-layer encryption strategy adjustment comprises one or more of shortening a key update period, improving algorithm strength, and improving key strength;

the data flow authority control strategy adjustment comprises adding a platform authority corresponding to a new level of audio-video data;

the sensitive data desensitization strategy adjustment comprises increasing a proportion of specified audio-video data in audio-video data and/or extending a type of the specified audio-video data;

the encoding-layer watermark strategy adjustment comprises one or more of increasing information contained in an encoded watermark, increasing a watermark superimposition frequency and increasing a watermark verification frequency; and/or

for a security access gateway, performing encoding-layer encryption strategy adjustment, wherein the encoding-layer encryption strategy adjustment comprises one or more of shortening a key update period, improving algorithm strength, and improving key strength; and/or

for a security storage gateway, performing encoding-layer encryption strategy adjustment and/or data flow authority strategy update, wherein

the encoding-layer encryption strategy adjustment comprises one or more of shortening a key update period, improving algorithm strength, and improving key strength;

the data flow authority control strategy adjustment comprises adding an authority of an audio-video retrieval party corresponding to a new level of audio-video data; and/or

for a security display gateway, performing encoding-layer watermark strategy adjustment, wherein

the security display gateway is configured to add an encoding-layer watermark on the audio-video data to be displayed;

the encoding-layer watermark strategy adjustment comprises one or more of increasing information contained in an encoded watermark, increasing a watermark superimposition frequency and increasing a watermark verification frequency.

7. An electronic device comprising:

a processor; and

a memory configured to store a computer program, wherein the processor is configured to, when executing the computer program stored in the memory, perform following operations comprising:

identifying a level of audio-video data in an audio-video code stream and an authority of an audio-video retrieval platform before forwarding the audio-video code stream to an audio-video retrieval platform;

reporting, to a network and data security situation awareness platform, alarm information in a case where the security sharing gateway retrieves no platform authority corresponding to the level of the audio-video data, wherein the alarm information comprises the level of the audio-video data and the authority of the audio-video retrieval platform;

receiving, in response to the alarm information and from the network and data security situation awareness platform, a platform authority corresponding to the level of the audio-video data issued by the network and data security situation awareness platform, and in response to determining that the level of the audio-video data does not match the authority of the audio-video retrieval platform, the network and data security situation awareness platform dynamically adjusts a security protection strategy of at least one other gateway in a dynamic orchestration-based audio-video security protection system, wherein security of the adjusted security protection strategy is higher than security of the security protection strategy before adjustment; and

performing, in response to determining that the authority of the audio-video retrieval platform matches the level of the audio-video data in the audio-video code stream, an application-layer protocol parsing on the audio-video code stream to determine whether a hash-based message authentication code (HMAC) value exists in the audio-video code stream;

in response to determining that the HMAC value does not exist in the audio-video code stream, adding an encoding-layer watermark on the audio-video data in the audio-video code stream, generating a first HMAC value according to a randomly generated first key and the encoding-layer watermark, and encapsulating the first HMAC value and a cipher text of the first key into a security parameter struct of the audio-video code stream, wherein the cipher text of the first key is obtained by encrypting the first key according to a first protection key, and the protection key is obtained by a request according to a first unique identification;

in response to determining that the HMAC value exists in the audio-video code stream, acquiring a second HMAC value and a cipher text of a second key in the security parameter struct of the audio-video code stream, requesting the first protection key according to the first unique identification, obtaining the second key by decrypting the cipher text of the second key using the first protection key, and generating a third HMAC value according to the encoding-layer watermark of the audio-video data and the second key;

intercepting the audio-video code stream in response to determining that the third HMAC value is inconsistent with the second HMAC value; and

in response to determining that the third HMAC value is consistent with the second HMAC value, adding an encoding-layer watermark on the audio-video data in the audio-video code stream, and generating a fourth HMAC value according to a randomly generated third key, the encoding-layer watermark added by a present node, and the second HMAC value, and encapsulating the fourth HMAC value and a cipher text of the third key into the security parameter struct of the audio-video code stream, wherein the cipher text of the third key is obtained by encrypting the third key according to a second protection key, and the second protection key is obtained by a request according to a second unique identification.

8. A dynamic orchestration-based audio-video security protection system, comprises:

a network and data security situation awareness platform and a security sharing gateway, wherein the security sharing gateway, being implemented by a hardware processor, is configured to:

identify a level of audio-video data in an audio-video code stream and an authority of an audio-video retrieval platform before forwarding the audio-video code stream to the audio-video retrieval platform;

report, to the network and data security situation awareness platform, alarm information in a case where the security sharing gateway retrieves no platform authority corresponding to the level of the audio-video data, wherein the alarm information comprises the level of the audio-video data and the authority of the audio-video retrieval platform;

receive, in response to the alarm information and from the network and data security situation awareness platform, a platform authority corresponding to the level of the audio-video data issued by the network and data security situation awareness platform, wherein in response to determining that the level of the audio-video data does not match the authority of the audio-video retrieval platform, the network and data security situation awareness platform dynamically adjusts a security protection strategy of at least one other gateway in the dynamic orchestration-based audio-video security protection system, and wherein security of the adjusted security protection strategy is higher than security of the security protection strategy before adjustment;

perform, in response to determining that the authority of the audio-video retrieval platform matches the level of the audio-video data in the audio-video code stream, an application-laver protocol parsing on the audio-video code stream to determine whether a hash-based message authentication code (HMAC) value exists in the audio-video code stream;

in response to determining that the HMAC value does not exist in the audio-video code stream, add an encoding-layer watermark on the audio-video data in the audio-video code stream, generate a first HMAC value according to a randomly generated first key and the encoding-layer watermark, and encapsulate the first HMAC value and a cipher text of the first key into a security parameter struct of the audio-video code stream, wherein the cipher text of the first key is obtained by encrypting the first key according to a first protection key, and the protection key is obtained by a request according to a first unique identification;

in response to determining that the HMAC value exists in the audio-video code stream, acquire a second HMAC value and a cipher text of a second key in the security parameter struct of the audio-video code stream, request the first protection key according to the first unique identification, obtain the second key by decrypting the cipher text of the second key using the first protection key, and generate a third HMAC value according to the encoding-layer watermark of the audio-video data and the second key;

intercept the audio-video code stream in response to determining that the third HMAC value is inconsistent with the second HMAC value; and

in response to determining that the third HMAC value is consistent with the second HMAC value, add an encoding-layer watermark on the audio-video data in the audio-video code stream, and generate a fourth HMAC value according to a randomly generated third key, the encoding-laver watermark added by a present node, and the second HMAC value, and encapsulate the fourth HMAC value and a cipher text of the third key into the security parameter struct of the audio-video code stream, wherein the cipher text of the third key is obtained by encrypting the third key according to a second protection key, and the second protection key is obtained by a request according to a second unique identification.

9. The dynamic orchestration-based audio-video security protection system according to claim 8 , wherein the dynamic orchestration-based audio-video security protection system further comprises a security access gateway, and wherein the security access gateway, being implemented by a processor, is configured to:

for the audio-video code stream output by an audio-video source, perform application-layer protocol parsing on the audio-video code stream, and perform encryption and integrity protection processing on the audio-video data in the audio-video code stream; and

replace the audio-video data before the processing with the processed audio-video data, and re-encapsulate the processed audio-video data into the audio-video code stream.

10. The dynamic orchestration-based audio-video security protection system according to claim 8 , wherein the dynamic orchestration-based audio-video security protection system further comprises a security storage gateway, wherein the security storage gateway, being implemented by a processor, is configured to:

for the audio-video code stream to be stored, in a case where the audio-video code stream is to be stored in a cloud storage, perform encryption and integrity protection processing on an audio-video file corresponding to the audio-video code stream using a security protection plug-in in an operating system kernel of a storage node where the audio-video code stream is to be stored, wherein the security protection plug-in acts between a virtual file system and an underlying file system for performing encryption and integrity protection processing on stored audio-video file, and wherein decryption and integrity verification processing on a retrieved audio-video code stream can further be performed by using the security protection plug-in; and/or

for the audio-video code stream to be stored, in a case where the audio-video code stream is to be stored in a video recorder device, perform application-layer protocol parsing on the audio-video code stream, perform encryption and integrity protection processing on the audio-video data in the audio-video code stream, replace the audio-video data before the processing with the processed audio-video data, re-encapsulate the processed audio-video data into the audio-video code stream, and store the audio-video code stream in the video recorder device.

11. The dynamic orchestration-based audio-video security protection system according to claim 10 , wherein the security storage gateway, being implemented by the processor, is further configured to:

for the audio-video code stream to be retrieved, in response to determining that an authority of an audio-video retrieval party does not match a level of the audio-video data in the audio-video code stream, intercept the audio-video code stream and report the alarm information to the network and data security situation awareness platform,

wherein the security protection strategy of the security storage gateway comprises a data flow authority control strategy, and the data flow authority control strategy comprises a corresponding relationship between a level of the audio-video data and an authority of an audio-video retrieval party.

12. The dynamic orchestration-based audio-video security protection system according to claim 8 , wherein the security protection strategy adjustment comprises one or more of:

encoding-layer encryption strategy adjustment, wherein the encoding-layer encryption strategy adjustment comprises one or more of key update period adjustment, algorithm strength adjustment and key strength adjustment;

data flow authority control strategy adjustment, wherein the data flow authority control strategy adjustment comprises adjusting a corresponding relationship between a level of the audio-video data and a platform authority, and/or adjusting a corresponding relationship between a level of the audio-video data and an authority of an audio-video retrieval party;

sensitive data desensitization strategy adjustment, wherein the sensitive data desensitization strategy is used for instructing to desensitize specified audio-video data in the audio-video data; and the sensitive data desensitization strategy adjustment comprises adjustment of a specified audio-video data type and/or adjustment of a specified audio-video data proportion; and

encoding-layer watermark strategy adjustment, wherein the encoding-layer watermark strategy adjustment comprises one or more of adjustment of information contained in an encoded watermark, watermark superimposition frequency adjustment and watermark verification frequency adjustment.

13. The dynamic orchestration-based audio-video security protection system according to claim 8 , wherein the dynamically adjusting of the security protection strategy of at least one other gateway in the dynamic orchestration-based audio-video security protection system comprises:

for the security sharing gateway, performing one or more of encoding-layer encryption strategy adjustment, data flow authority control strategy adjustment, sensitive data desensitization strategy adjustment, and encoding-layer watermark strategy adjustment;

wherein:

the encoding-layer encryption strategy adjustment comprises one or more of shortening a key update period, improving algorithm strength, and improving key strength;

the data flow authority control strategy adjustment comprises adding a platform authority corresponding to a new level of the audio-video data;

the sensitive data desensitization strategy adjustment comprises increasing a proportion of specified audio-video data in audio-video data and/or extending a type of the specified audio-video data;

the encoding-layer watermark strategy adjustment comprises one or more of increasing information contained in an encoded watermark, increasing a watermark superimposition frequency and increasing a watermark verification frequency; and/or

for a security access gateway being implemented by a processor, performing encoding-layer encryption strategy adjustment wherein the encoding-layer encryption strategy adjustment comprises one or more of shortening a key update period, improving algorithm strength, and improving key strength; and/or

for a security storage gateway being implemented by the processor, performing encoding-layer encryption strategy adjustment and/or data flow authority strategy update, wherein:

the encoding-layer encryption strategy adjustment comprises one or more of shortening a key update period, improving algorithm strength, and improving key strength; and

the data flow authority control strategy adjustment comprises adding an authority of an audio-video retrieval party corresponding to a new level of the audio-video data; and/or

for a security display gateway being implemented by the processor, performing encoding-layer watermark strategy adjustment, wherein:

the security display gateway is configured to add an encoding-layer watermark on the audio-video data to be displayed; and

the encoding-layer watermark strategy adjustment comprises one or more of increasing information contained in an encoded watermark, increasing a watermark superimposition frequency and increasing a watermark verification frequency.

Assignments (2)

Priority Claims (1)

Continuity (1)

References Cited (41)