CN117728962A - Signature transmission method for ensuring storage consistency of multi-level video data - Google Patents

Abstract

The application provides a signature transmission method for ensuring storage consistency of multi-level video data, and belongs to the technical field of data processing. To store the user's video data centrally in a secure environment by verifying the previous information to avoid security risks. The method comprises the following steps: under the condition that the service functional entity receives a first video data packet from the first terminal, the service functional entity determines that the first video data packet is a first packet in a first video stream sent by the first terminal by verifying first signature information in the first video data packet; in response to the first video data packet being a first packet in a first video stream sent by the first terminal, the service function entity creates a first storage space for the first video stream, wherein the first storage space is a secure environment and is used to store only video data packets of the first video stream.

Description

Signature transmission method for ensuring storage consistency of multi-level video data

Technical Field

The application relates to the technical field of data processing, in particular to a signature transmission method for ensuring storage consistency of multi-level video data.

Background

Cloud services are not limited to storage, but also include a variety of functions such as computing, database, analysis, etc., providing users with flexible, scalable, highly available solutions. The terminal equipment can upload various types of data to the cloud according to actual needs, so that the sharing and the coordination of the data are realized. The cloud service not only saves the local storage space of the terminal, but also improves the safety and reliability of data. The cloud server generally adopts advanced security technology and management system to ensure the security and reliability of the user data. In addition, the cloud service can also realize the backup and recovery of the data, and further ensure the safety of the data.

For video data, since video data is one type of data that the terminal occupies most of the storage space locally, uploading video data to the cloud storage by the terminal is the most commonly used use scenario for users. Specifically, the cloud server can store video data in a distributed manner according to the information of the user. The storage mode has the advantages that the storage space of the cloud can be more efficiently utilized, but the disadvantage is that time data can be stored in a position with safety risk due to distributed reasons, and the theft risk exists.

With increasing importance on user privacy security, how to avoid security risk when video data is stored in the cloud is a hotspot problem in current research.

Disclosure of Invention

The embodiment of the application provides a signature transmission method for ensuring the storage consistency of multi-level video data, which is used for intensively storing video data of a user in a security environment by verifying the previous information so as to avoid security risks.

In order to achieve the above purpose, the present application adopts the following technical scheme:

in a first aspect, an embodiment of the present application provides a signature transmission method for ensuring consistency of multi-level video data storage, where the signature transmission method is applied to a service functional entity, and the service functional entity establishes a communication connection with a first terminal, where the method includes: under the condition that the service functional entity receives a first video data packet from the first terminal, the service functional entity determines that the first video data packet is a first packet in a first video stream sent by the first terminal by verifying first signature information in the first video data packet; in response to the first video data packet being a first packet in a first video stream sent by the first terminal, the service function entity creates a first storage space for the first video stream, wherein the first storage space is a secure environment and is used to store only video data packets of the first video stream.

Optionally, the service function entity determines that the first video data packet is a first packet in the first video stream sent by the first terminal by verifying the first signature information in the first video data packet, including: under the condition that the service functional entity determines that the first video data packet carries the first signature information, the service functional entity verifies the first signature information and determines whether the verification of the first signature information is passed or not; and under the condition that the first signature information passes verification, the service functional entity determines that the first video data packet is the first packet in the first video stream sent by the first terminal according to the fact that the service functional entity does not receive the video data packet in the first video stream in advance or that the service functional entity does not create a storage space for the first video stream in advance.

For example, the service function entity verifies the first signature information and determines whether the verification of the first signature information is passed, including: the service functional entity takes the first video data packet as a first input parameter according to the identifier of the first terminal carried by the first video data packet, and executes an integrity verification algorithm on the first input parameter by using a symmetric key of the first terminal locally stored by the service functional entity to obtain first verification information; the service functional entity determines whether the first verification information is consistent with the first signature information, wherein if the first verification information is consistent with the first signature information, the first signature information is verified to pass, otherwise, if the first verification information is inconsistent with the first signature information, the first signature information is verified to not pass; the first signature information is verified by indicating that the first signature information is that the first terminal takes the first video data packet as a second input parameter, and an integrity protection algorithm is executed on the second input parameter by using a symmetric key of the first terminal locally stored by the first terminal, so as to obtain the first signature information.

Optionally, the method further comprises: under the condition that the service functional entity receives a second video data packet from the first terminal, the service functional entity determines that the second video data packet is a tail packet in the first video stream sent by the first terminal by verifying second signature information in the second video data packet; and in response to the second video data packet being a tail packet in the first video stream sent by the first terminal, the service function entity stores the second video data packet in the first storage space and releases the redundant first storage space in the first storage space.

Optionally, the service function entity determines that the first video data packet is a first packet in the first video stream sent by the first terminal by verifying the first signature information in the first video data packet, including: under the condition that the service functional entity determines that the second video data packet carries second signature information, the service functional entity verifies the second signature information and determines whether the verification of the second signature information is passed or not; and under the condition that the second signature information passes verification, the service functional entity determines that the first video data packet is a tail packet in the first video stream sent by the first terminal according to the fact that the service functional entity has received the video data packet in the first video stream in advance or the service functional entity has created a first storage space for the first video stream in advance.

For example, the service function entity verifies the second signature information and determines whether the verification of the second signature information is passed, including: the service functional entity takes the first video data packet as a third input parameter according to the identification of the first terminal carried by the video data packet, and executes an integrity verification algorithm on the third input parameter by using a symmetric key of the first terminal locally stored by the service functional entity to obtain second verification information; the service functional entity determines whether the second verification information is consistent with the second signature information, wherein if the second verification information is consistent with the second signature information, the second signature information is verified to pass, otherwise, if the second verification information is inconsistent with the second signature information, the second signature information is verified to not pass; and verifying the second signature information by indicating that the second signature information is the second signature information, wherein the second signature information is obtained by using the second video data packet as a second private input parameter by the first terminal, and executing an integrity protection algorithm on a fourth input parameter by using a symmetric key of the first terminal locally stored by the first terminal.

Optionally, the service functional entity belongs to a functional entity in the data network, and the service functional entity establishes communication connection with the first terminal to establish communication connection of the user plane between the data network and the first terminal; the service function entity receives a first video data packet from a first terminal, including: the service functional entity receives a first video data packet from a first terminal through at least one user plane functional network element in a user plane; accordingly, the service function entity creates a first storage space for the first video stream, including: the service functional entity creates a first storage space corresponding to the condition that the security level establishes the secure connection with the at least one user plane functional network element according to the condition that the secure connection is established with the at least one user plane functional network element.

Optionally, the at least one user plane function network element includes an anchor user plane function network element and a non-anchor user plane function network element; the service function entity creates a first storage space corresponding to the condition that the security level establishes the security connection with the at least one user plane function network element according to the condition that the at least one user plane function network element establishes the security connection, and the service function entity comprises: the service function entity establishes sectional type safety connection with the first terminal according to the anchor point user plane function network element, determines the safety level of the storage space as a first safety level, and establishes the first storage space with the safety level as the first safety level; or alternatively; the service function entity establishes end-to-end safety connection with the first terminal according to the anchor point user plane function network element, determines the safety level of the storage space as a second safety level, and establishes a first storage space with the safety level as the second safety level; or alternatively; the service functional entity establishes sectional type safety connection with the first terminal according to the non-anchor user plane functional network element, establishes end-to-end safety connection with the anchor user plane functional network element, determines the safety level of the storage space as a third safety level, and establishes a first storage space with the safety level as the third safety level; or alternatively; the service functional entity establishes end-to-end safety connection with the first terminal according to the non-anchor user plane functional network element, establishes end-to-end safety connection with the anchor user plane functional network element, determines the safety level of the storage space to be a fourth safety level, and establishes a first storage space with the safety level to be the fourth safety level; wherein, from the first security level to the fourth security level, the respective security levels thereof are sequentially increased.

Optionally, the first video data packet carries first user plane information encapsulated by the anchor point user plane function network element, where the first user plane information is used to instruct the anchor point user plane function network element to establish segmented secure connection with the first terminal or establish end-to-end secure connection; and/or; the first video data packet carries second user plane information encapsulated by the non-anchor user plane functional network element, and the second user plane information is used for indicating the non-anchor user plane functional network element to establish segmented safe connection with the first terminal or establish end-to-end safe connection.

Optionally, the method further comprises: under the condition that the first storage space is created, the service function entity stores the video data packet in the first video stream received from the first terminal into the first storage space; if the service functional entity determines that the storage of the first storage space reaches the upper limit and still continues to receive the video data packet in the first video stream sent by the first terminal, the service functional entity expands the first storage space and stores the video data packet in the first video stream which is continuously received and sent by the first terminal into the expanded first storage space.

Optionally, for the non-first packet and the non-last packet in the first video stream sent by the first terminal, the service functional entity does not perform verification of signature information on the non-first packet and the non-last packet, and directly stores the non-first packet and the non-last packet in the first storage space.

In a second aspect, an embodiment of the present application provides a signature transmission apparatus for ensuring consistency of multi-level video data storage, applied to a service functional entity, where the service functional entity establishes a communication connection with a first terminal, the apparatus being configured to: under the condition that the service functional entity receives a first video data packet from the first terminal, the service functional entity determines that the first video data packet is a first packet in a first video stream sent by the first terminal by verifying first signature information in the first video data packet; in response to the first video data packet being a first packet in a first video stream sent by the first terminal, the service function entity creates a first storage space for the first video stream, wherein the first storage space is a secure environment and is used to store only video data packets of the first video stream.

Optionally, the service function entity determines that the first video data packet is a first packet in the first video stream sent by the first terminal by verifying the first signature information in the first video data packet, including: under the condition that the service functional entity determines that the first video data packet carries the first signature information, the service functional entity verifies the first signature information and determines whether the verification of the first signature information is passed or not; and under the condition that the first signature information passes verification, the service functional entity determines that the first video data packet is the first packet in the first video stream sent by the first terminal according to the fact that the service functional entity does not receive the video data packet in the first video stream in advance or that the service functional entity does not create a storage space for the first video stream in advance.

For example, the service function entity verifies the first signature information and determines whether the verification of the first signature information is passed, including: the service functional entity takes the first video data packet as a first input parameter according to the identifier of the first terminal carried by the first video data packet, and executes an integrity verification algorithm on the first input parameter by using a symmetric key of the first terminal locally stored by the service functional entity to obtain first verification information; the service functional entity determines whether the first verification information is consistent with the first signature information, wherein if the first verification information is consistent with the first signature information, the first signature information is verified to pass, otherwise, if the first verification information is inconsistent with the first signature information, the first signature information is verified to not pass; the first signature information is verified by indicating that the first signature information is that the first terminal takes the first video data packet as a second input parameter, and an integrity protection algorithm is executed on the second input parameter by using a symmetric key of the first terminal locally stored by the first terminal, so as to obtain the first signature information.

Optionally, the apparatus is configured to: under the condition that the service functional entity receives a second video data packet from the first terminal, the service functional entity determines that the second video data packet is a tail packet in the first video stream sent by the first terminal by verifying second signature information in the second video data packet; and in response to the second video data packet being a tail packet in the first video stream sent by the first terminal, the service function entity stores the second video data packet in the first storage space and releases the redundant first storage space in the first storage space.

Optionally, the service function entity determines that the first video data packet is a first packet in the first video stream sent by the first terminal by verifying the first signature information in the first video data packet, including: under the condition that the service functional entity determines that the second video data packet carries second signature information, the service functional entity verifies the second signature information and determines whether the verification of the second signature information is passed or not; and under the condition that the second signature information passes verification, the service functional entity determines that the first video data packet is a tail packet in the first video stream sent by the first terminal according to the fact that the service functional entity has received the video data packet in the first video stream in advance or the service functional entity has created a first storage space for the first video stream in advance.

For example, the service function entity verifies the second signature information and determines whether the verification of the second signature information is passed, including: the service functional entity takes the first video data packet as a third input parameter according to the identification of the first terminal carried by the video data packet, and executes an integrity verification algorithm on the third input parameter by using a symmetric key of the first terminal locally stored by the service functional entity to obtain second verification information; the service functional entity determines whether the second verification information is consistent with the second signature information, wherein if the second verification information is consistent with the second signature information, the second signature information is verified to pass, otherwise, if the second verification information is inconsistent with the second signature information, the second signature information is verified to not pass; and verifying the second signature information by indicating that the second signature information is the second signature information, wherein the second signature information is obtained by using the second video data packet as a second private input parameter by the first terminal, and executing an integrity protection algorithm on a fourth input parameter by using a symmetric key of the first terminal locally stored by the first terminal.

Optionally, the service functional entity belongs to a functional entity in the data network, and the service functional entity establishes communication connection with the first terminal to establish communication connection of the user plane between the data network and the first terminal; the service function entity receives a first video data packet from a first terminal, including: the service functional entity receives a first video data packet from a first terminal through at least one user plane functional network element in a user plane; accordingly, the service function entity creates a first storage space for the first video stream, including: the service functional entity creates a first storage space corresponding to the condition that the security level establishes the secure connection with the at least one user plane functional network element according to the condition that the secure connection is established with the at least one user plane functional network element.

Optionally, the at least one user plane function network element includes an anchor user plane function network element and a non-anchor user plane function network element; the service function entity creates a first storage space corresponding to the condition that the security level establishes the security connection with the at least one user plane function network element according to the condition that the at least one user plane function network element establishes the security connection, and the service function entity comprises: the service function entity establishes sectional type safety connection with the first terminal according to the anchor point user plane function network element, determines the safety level of the storage space as a first safety level, and establishes the first storage space with the safety level as the first safety level; or alternatively; the service function entity establishes end-to-end safety connection with the first terminal according to the anchor point user plane function network element, determines the safety level of the storage space as a second safety level, and establishes a first storage space with the safety level as the second safety level; or alternatively; the service functional entity establishes sectional type safety connection with the first terminal according to the non-anchor user plane functional network element, establishes end-to-end safety connection with the anchor user plane functional network element, determines the safety level of the storage space as a third safety level, and establishes a first storage space with the safety level as the third safety level; or alternatively; the service functional entity establishes end-to-end safety connection with the first terminal according to the non-anchor user plane functional network element, establishes end-to-end safety connection with the anchor user plane functional network element, determines the safety level of the storage space to be a fourth safety level, and establishes a first storage space with the safety level to be the fourth safety level; wherein, from the first security level to the fourth security level, the respective security levels thereof are sequentially increased.

Optionally, the first video data packet carries first user plane information encapsulated by the anchor point user plane function network element, where the first user plane information is used to instruct the anchor point user plane function network element to establish segmented secure connection with the first terminal or establish end-to-end secure connection; and/or; the first video data packet carries second user plane information encapsulated by the non-anchor user plane functional network element, and the second user plane information is used for indicating the non-anchor user plane functional network element to establish segmented safe connection with the first terminal or establish end-to-end safe connection.

Optionally, the apparatus is configured to: under the condition that the first storage space is created, the service function entity stores the video data packet in the first video stream received from the first terminal into the first storage space; if the service functional entity determines that the storage of the first storage space reaches the upper limit and still continues to receive the video data packet in the first video stream sent by the first terminal, the service functional entity expands the first storage space and stores the video data packet in the first video stream which is continuously received and sent by the first terminal into the expanded first storage space.

Optionally, for the non-first packet and the non-last packet in the first video stream sent by the first terminal, the service functional entity does not perform verification of signature information on the non-first packet and the non-last packet, and directly stores the non-first packet and the non-last packet in the first storage space.

In summary, the method and the device have the following technical effects:

in the case that the service functional entity receives the first video data packet from the first terminal, the service functional entity may determine that the first video data packet is the first packet in the first video stream sent by the first terminal by verifying the first signature information in the first video data packet, thereby creating a corresponding storage space for the first video stream, such as a secure environment and the first storage space used for storing only the video data packet of the first video stream, and further store the video data of the user in the secure environment in a centralized manner, so as to avoid a security risk.

Drawings

Fig. 1 is a schematic architecture diagram of a communication system according to an embodiment of the present application;

fig. 2 is a flowchart of a signature transmission method for ensuring consistency of multi-level video data storage according to an embodiment of the present application.

Detailed Description

In the embodiment of the invention, the descriptions of "when … …", "in the case of … …", "if" and "if" all refer to that the device will perform corresponding processing under some objective condition, and are not limited in time, nor do the descriptions require that the device must have a judging action when implementing, nor do the descriptions mean that other limitations exist.

In the description of the embodiments of the present invention, unless otherwise indicated, "/" means that the objects associated in tandem are in a "or" relationship, e.g., A/B may represent A or B; the "and/or" in the embodiment of the present invention is merely an association relationship describing the association object, and indicates that three relationships may exist, for example, a and/or B may indicate: a alone, a and B together, and B alone, wherein A, B may be singular or plural. Also, in the description of the embodiments of the present invention, unless otherwise indicated, "plurality" means two or more than two. "at least one of" or the like means any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one (one) of a, b or c may represent: a, b, c, a-b, a-c, b-c, or a-b-c, wherein a, b, c may be single or plural. In addition, in order to facilitate the clear description of the technical solution of the embodiments of the present invention, in the embodiments of the present invention, the words "first", "second", etc. are used to distinguish the same item or similar items having substantially the same function and effect. It will be appreciated by those of skill in the art that the words "first," "second," and the like do not limit the amount and order of execution, and that the words "first," "second," and the like do not necessarily differ. Meanwhile, in the embodiments of the present invention, words such as "exemplary" or "such as" are used to mean serving as examples, illustrations or explanations. Any embodiment or design described herein as "exemplary" or "e.g." in an embodiment should not be taken as preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "such as" is intended to present related concepts in a concrete fashion that may be readily understood.

The network architecture and the service scenario described in the embodiments of the present invention are for more clearly describing the technical solution of the embodiments of the present invention, and do not constitute a limitation on the technical solution provided by the embodiments of the present invention, and those skilled in the art can know that, with the evolution of the network architecture and the appearance of the new service scenario, the technical solution provided by the embodiments of the present invention is applicable to similar technical problems.

The technical solutions in the present application will be described below with reference to the accompanying drawings.

Referring to fig. 1, an embodiment of the present application provides a communication system, including: the service function entity and the first terminal.

The service functional entity may be a server or a server cluster in the cloud, that is, an entity device, or may also be a functional entity in the server or the server cluster, that is, a virtual device. The cloud may also be referred to as a Data Network (DN).

The first terminal may be a terminal having a transceiver function, or a chip system that may be disposed on the terminal. The terminal may also be referred to as a User Equipment (UE), an access terminal, a subscriber unit (subscriber unit), a subscriber station, a Mobile Station (MS), a remote station, a remote terminal, a mobile device, a user terminal, a wireless communication device, a user agent, or a user device. The terminals in embodiments of the present application may be mobile phones (mobile phones), cellular phones (cellular phones), smart phones (smart phones), tablet computers (pads), wireless data cards, personal digital assistants (personal digital assistant, PDAs), wireless modems (modems), handheld devices (handsets), laptop computers (lap computers), machine type communication (machine type communication, MTC) terminals, computers with wireless transceiving functions, virtual Reality (VR) terminals, augmented reality (augmented reality, AR) terminals, wireless terminals in industrial control (industrial control), wireless terminals in unmanned aerial vehicle (self driving), wireless terminals in smart grid (smart grid), wireless terminals in transportation security (transportation safety), wireless terminals in smart city (smart city), wireless terminals in smart home (smart home), roadside units with functions, RSU, etc. The terminal of the present application may also be an in-vehicle module, an in-vehicle component, an in-vehicle chip, or an in-vehicle unit built into a vehicle as one or more components or units.

The service function entity establishes communication connection with the first terminal, specifically, the data network establishes communication connection of a user plane with the first terminal. For example, the user plane may comprise at least one user plane function network element (UPF), and the communication connection of the user plane may be carried by the at least one user plane function network element.

The interaction between the service function entity and the first terminal in the above communication system will be described in detail with reference to the method.

Referring to fig. 2, an embodiment of the present application provides a signature transmission method for ensuring consistency of multi-level video data storage, the method including:

s201, in the case that the service functional entity receives the first video data packet from the first terminal, the service functional entity determines that the first video data packet is the first packet in the first video stream sent by the first terminal by verifying the first signature information in the first video data packet.

The service functional entity can verify the first signature information under the condition that the service functional entity determines that the first video data packet carries the first signature information, and determines whether the verification of the first signature information is passed. For example, the service functional entity uses the first video data packet as a first input parameter according to the identifier of the first terminal carried by the first video data packet, and uses a symmetric key of the first terminal locally stored by the service functional entity to execute an integrity verification algorithm on the first input parameter to obtain first verification information. The service function entity may determine whether the first verification information is consistent with the first signature information, wherein if the first verification information is consistent with the first signature information, the first signature information is verified to pass, otherwise, if the first verification information is inconsistent with the first signature information, the first signature information is verified to not pass. The first signature information is verified by indicating that the first signature information is that the first terminal takes the first video data packet as a second input parameter, and an integrity protection algorithm is executed on the second input parameter by using a symmetric key of the first terminal locally stored by the first terminal, so as to obtain the first signature information.

It is understood that the integrity verification algorithm and the integrity protection algorithm may be the same algorithm, such as a hash algorithm, and specifically may be MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512/224, SHA-512/256, etc., without limitation. Thus, the first signature information may also be understood as an integrity protection value and the first verification information may also be understood as an integrity verification finger. Normally, the first input parameter and the second input parameter should coincide such that the integrity verification passes. If the first video data packet is tampered in the transmission process, the first input parameter is inconsistent with the second input parameter, so that the integrity verification fails. In addition, the input parameters are not limited to the first video data packet, but may also include other parameters, such as a random number, which is not limited thereto.

In the case of verifying that the first signature information passes, the service functional entity may determine that the first video data packet is a first packet in the first video stream sent by the first terminal according to whether the service functional entity has not received the video data packet in the first video stream in advance, or whether the service functional entity has not created a storage space for the first video stream in advance. Alternatively, the service functional entity may determine that the first video data packet is the first packet in the first video stream sent by the first terminal in any other possible manner, which is not limited.

S202, the service functional entity creates a first storage space for the first video stream in response to the first video data packet being a first packet in the first video stream sent by the first terminal.

Wherein the first storage space is a secure environment and is used for storing only video data packets of the first video stream. For example, the first memory space is a hardware and/or software isolated memory space to ensure that it is a secure environment. The service function entity may create a first storage space for the first video stream according to a preset storage space size.

In summary, in the case that the service functional entity receives the first video data packet from the first terminal, the service functional entity may determine that the first video data packet is the first packet in the first video stream sent by the first terminal by verifying the first signature information in the first video data packet, thereby creating a corresponding storage space for the first video stream, such as a secure environment and the first storage space used to store only the video data packet of the first video stream, and further store the video data of the user in the secure environment in a centralized manner, so as to avoid a security risk.

Optionally, in combination with the above S201 to S202, the method further includes:

Step 1: in the case that the service functional entity receives the second video data packet from the first terminal, the service functional entity determines that the second video data packet is a tail packet in the first video stream sent by the first terminal by verifying second signature information in the second video data packet.

Under the condition that the service functional entity determines that the second video data packet carries second signature information, the service functional entity verifies the second signature information and determines whether the verification of the second signature information is passed, for example, the service functional entity takes the first video data packet as a third input parameter according to the identification of the first terminal carried by the video data packet, and executes an integrity verification algorithm on the third input parameter by using a symmetric key of the first terminal locally stored by the service functional entity to obtain second verification information; the service functional entity determines whether the second verification information is consistent with the second signature information, wherein if the second verification information is consistent with the second signature information, the second signature information is verified to pass, otherwise, if the second verification information is inconsistent with the second signature information, the second signature information is verified to not pass; the verification of the second signature information indicates that the second signature information is that the first terminal uses the second video data packet as a second private input parameter, and uses a symmetric key of the first terminal stored locally by the first terminal to execute an integrity protection algorithm on a fourth input parameter to obtain the second signature information, and the specific implementation can also refer to the related description of S201. And under the condition that the second signature information passes verification, the service functional entity determines that the first video data packet is a tail packet in the first video stream sent by the first terminal according to the fact that the service functional entity has received the video data packet in the first video stream in advance or the service functional entity has created a first storage space for the first video stream in advance.

Step 2: and in response to the second video data packet being a tail packet in the first video stream sent by the first terminal, the service function entity stores the second video data packet in the first storage space and releases the redundant first storage space in the first storage space.

Optionally, the service function entity stores the video data packet in the first video stream received from the first terminal into the first storage space when the first storage space is created; if the service functional entity determines that the storage of the first storage space reaches the upper limit and still continues to receive the video data packet in the first video stream sent by the first terminal, the service functional entity expands the first storage space, for example, expands the first storage space according to a preset size, for example, expands 10MB/20MB each time, and stores the video data packet in the first video stream which continues to be received by the first terminal into the expanded first storage space.

Optionally, for the non-first packet and the non-last packet in the first video stream sent by the first terminal, the service functional entity does not perform verification of signature information on the non-first packet and the non-last packet, and directly stores the non-first packet and the non-last packet in the first storage space, so as to reduce processing overhead and improve storage efficiency.

Optionally, in combination with S201 to S202, the service function entity receives a first video data packet from a first terminal, including: the service function entity receives a first video data packet from a first terminal through at least one user plane function network element in the user plane. Accordingly, the service function entity creates a first storage space for the first video stream, including: the service functional entity creates a first storage space corresponding to the condition that the security level establishes the secure connection with the at least one user plane functional network element according to the condition that the secure connection is established with the at least one user plane functional network element.

Specifically, the at least one user plane function network element includes an anchor user plane function network element and a non-anchor user plane function network element. The anchor user plane function network element stores all user plane configurations of the first terminal, which may be SMF network element configurations. The non-anchor user plane function network element in the embodiment of the present application is different from the existing non-anchor user plane function network element, and the non-anchor user plane function network element in the embodiment of the present application may also be configured to a part of user plane configuration of the first terminal, or may also be configured to an SMF network element, for example, include an identifier of the first terminal, security capability information, and the like, so that the non-anchor user plane function network element is used to establish a secure connection.

On the basis, the service functional entity establishes a sectional type (i.e. the first terminal establishes a secure connection (such as IPsec) with a base station to which the first terminal is connected) with the first terminal according to the anchor user plane functional network element, the base station establishes a secure connection with the anchor user plane functional network element, determines the security level of the storage space to be the first security level, and establishes the first storage space with the security level of the first security level. Or alternatively; the service function entity establishes end-to-end (i.e. the first terminal directly establishes a secure connection with the anchor user plane function network element and the base station transparently transmits the data packet of the user plane) secure connection with the first terminal, determines the security level of the storage space to be a second security level, and establishes a first storage space with the security level of the second security level. Optionally, the first video data packet may carry first user plane information encapsulated by the anchor user plane functional network element, where the first user plane information may be two values of 1 bit, which are respectively used to instruct the anchor user plane functional network element to establish a segmented secure connection with the first terminal.

Or alternatively; the service function entity establishes a segmented security connection between the non-anchor user plane function network element and the first terminal (i.e., the first terminal establishes a security connection (such as IPsec) with a base station to which the first terminal accesses), the base station establishes a security connection with the non-anchor user plane function network element (the non-anchor user plane function network element establishes a security connection with a part of the user plane configuration configured by the SMF network element), and the non-anchor user plane function network element establishes an end-to-end security connection with the anchor user plane function network element, determines that the security level of the storage space is a third security level, and creates a first storage space with the security level of the third security level. Or alternatively; the service function entity directly establishes a secure connection according to the end-to-end secure connection between the non-anchor user plane function network element and the first terminal (i.e., the first terminal establishes the secure connection with the non-anchor user plane function network element (the non-anchor user plane function network element uses a part of the user plane configuration configured by the SMF network element to establish the secure connection), the base station transparently transmits the data packet of the user plane), and the non-anchor user plane function network element establishes the end-to-end secure connection with the anchor user plane function network element, determines the security level of the storage space to be the fourth security level, and establishes the first storage space with the security level to be the fourth security level. Optionally, the first video data packet carries second user plane information encapsulated by the non-anchor user plane functional network element, where the second user plane information may be two values of 1 bit and is used to instruct the non-anchor user plane functional network element to establish a segmented secure connection with the first terminal or establish an end-to-end secure connection with the first terminal.

It can be appreciated that whether the non-anchor user plane functional network element needs to establish a secure connection may depend on the security level of the first terminal when signing up with the network, where a higher security level needs to establish a secure connection, e.g. a segmented secure connection, and where a higher security level needs to establish an end-to-end secure connection. Whether the anchor user plane functional network element establishes an end-to-end or a segmented secure connection may also depend on the security level of the first terminal when signing up for the network.

The security levels of the first security level and the fourth security level are sequentially improved, and the isolation modes of the first storage space are different, for example, the first security level is software isolation and hardware sharing corresponding to the first storage space, the second security level is hardware isolation and software sharing corresponding to the first storage space, the third security level is hardware isolation and software isolation corresponding to the first storage space, the fourth security level is hardware isolation and software isolation corresponding to the first storage space, the access right is limited, and only the management right with high security right can be allowed to access.

The method provided in the embodiment of the present application is described in detail above in connection with fig. 2. The following describes a signature transmission apparatus for ensuring consistency of multi-level video data storage for performing the method provided by the embodiments of the present application.

The apparatus is configured to: under the condition that the service functional entity receives a first video data packet from the first terminal, the service functional entity determines that the first video data packet is a first packet in a first video stream sent by the first terminal by verifying first signature information in the first video data packet; in response to the first video data packet being a first packet in a first video stream sent by the first terminal, the service function entity creates a first storage space for the first video stream, wherein the first storage space is a secure environment and is used to store only video data packets of the first video stream.

Optionally, the service function entity determines that the first video data packet is a first packet in the first video stream sent by the first terminal by verifying the first signature information in the first video data packet, including: under the condition that the service functional entity determines that the first video data packet carries the first signature information, the service functional entity verifies the first signature information and determines whether the verification of the first signature information is passed or not; and under the condition that the first signature information passes verification, the service functional entity determines that the first video data packet is the first packet in the first video stream sent by the first terminal according to the fact that the service functional entity does not receive the video data packet in the first video stream in advance or that the service functional entity does not create a storage space for the first video stream in advance.

For example, the service function entity verifies the first signature information and determines whether the verification of the first signature information is passed, including: the service functional entity takes the first video data packet as a first input parameter according to the identifier of the first terminal carried by the first video data packet, and executes an integrity verification algorithm on the first input parameter by using a symmetric key of the first terminal locally stored by the service functional entity to obtain first verification information; the service functional entity determines whether the first verification information is consistent with the first signature information, wherein if the first verification information is consistent with the first signature information, the first signature information is verified to pass, otherwise, if the first verification information is inconsistent with the first signature information, the first signature information is verified to not pass; the first signature information is verified by indicating that the first signature information is that the first terminal takes the first video data packet as a second input parameter, and an integrity protection algorithm is executed on the second input parameter by using a symmetric key of the first terminal locally stored by the first terminal, so as to obtain the first signature information.

Optionally, the apparatus is configured to: under the condition that the service functional entity receives a second video data packet from the first terminal, the service functional entity determines that the second video data packet is a tail packet in the first video stream sent by the first terminal by verifying second signature information in the second video data packet; and in response to the second video data packet being a tail packet in the first video stream sent by the first terminal, the service function entity stores the second video data packet in the first storage space and releases the redundant first storage space in the first storage space.

Optionally, the service function entity determines that the first video data packet is a first packet in the first video stream sent by the first terminal by verifying the first signature information in the first video data packet, including: under the condition that the service functional entity determines that the second video data packet carries second signature information, the service functional entity verifies the second signature information and determines whether the verification of the second signature information is passed or not; and under the condition that the second signature information passes verification, the service functional entity determines that the first video data packet is a tail packet in the first video stream sent by the first terminal according to the fact that the service functional entity has received the video data packet in the first video stream in advance or the service functional entity has created a first storage space for the first video stream in advance.

For example, the service function entity verifies the second signature information and determines whether the verification of the second signature information is passed, including: the service functional entity takes the first video data packet as a third input parameter according to the identification of the first terminal carried by the video data packet, and executes an integrity verification algorithm on the third input parameter by using a symmetric key of the first terminal locally stored by the service functional entity to obtain second verification information; the service functional entity determines whether the second verification information is consistent with the second signature information, wherein if the second verification information is consistent with the second signature information, the second signature information is verified to pass, otherwise, if the second verification information is inconsistent with the second signature information, the second signature information is verified to not pass; and verifying the second signature information by indicating that the second signature information is the second signature information, wherein the second signature information is obtained by using the second video data packet as a second private input parameter by the first terminal, and executing an integrity protection algorithm on a fourth input parameter by using a symmetric key of the first terminal locally stored by the first terminal.

Optionally, the service functional entity belongs to a functional entity in the data network, and the service functional entity establishes communication connection with the first terminal to establish communication connection of the user plane between the data network and the first terminal; the service function entity receives a first video data packet from a first terminal, including: the service functional entity receives a first video data packet from a first terminal through at least one user plane functional network element in a user plane; accordingly, the service function entity creates a first storage space for the first video stream, including: the service functional entity creates a first storage space corresponding to the condition that the security level establishes the secure connection with the at least one user plane functional network element according to the condition that the secure connection is established with the at least one user plane functional network element.

Optionally, the at least one user plane function network element includes an anchor user plane function network element and a non-anchor user plane function network element; the service function entity creates a first storage space corresponding to the condition that the security level establishes the security connection with the at least one user plane function network element according to the condition that the at least one user plane function network element establishes the security connection, and the service function entity comprises: the service function entity establishes sectional type safety connection with the first terminal according to the anchor point user plane function network element, determines the safety level of the storage space as a first safety level, and establishes the first storage space with the safety level as the first safety level; or alternatively; the service function entity establishes end-to-end safety connection with the first terminal according to the anchor point user plane function network element, determines the safety level of the storage space as a second safety level, and establishes a first storage space with the safety level as the second safety level; or alternatively; the service functional entity establishes sectional type safety connection with the first terminal according to the non-anchor user plane functional network element, establishes end-to-end safety connection with the anchor user plane functional network element, determines the safety level of the storage space as a third safety level, and establishes a first storage space with the safety level as the third safety level; or alternatively; the service functional entity establishes end-to-end safety connection with the first terminal according to the non-anchor user plane functional network element, establishes end-to-end safety connection with the anchor user plane functional network element, determines the safety level of the storage space to be a fourth safety level, and establishes a first storage space with the safety level to be the fourth safety level; wherein, from the first security level to the fourth security level, the respective security levels thereof are sequentially increased.

Optionally, the first video data packet carries first user plane information encapsulated by the anchor point user plane function network element, where the first user plane information is used to instruct the anchor point user plane function network element to establish segmented secure connection with the first terminal or establish end-to-end secure connection; and/or; the first video data packet carries second user plane information encapsulated by the non-anchor user plane functional network element, and the second user plane information is used for indicating the non-anchor user plane functional network element to establish segmented safe connection with the first terminal or establish end-to-end safe connection.

Optionally, the apparatus is configured to: under the condition that the first storage space is created, the service function entity stores the video data packet in the first video stream received from the first terminal into the first storage space; if the service functional entity determines that the storage of the first storage space reaches the upper limit and still continues to receive the video data packet in the first video stream sent by the first terminal, the service functional entity expands the first storage space and stores the video data packet in the first video stream which is continuously received and sent by the first terminal into the expanded first storage space.

Optionally, for the non-first packet and the non-last packet in the first video stream sent by the first terminal, the service functional entity does not perform verification of signature information on the non-first packet and the non-last packet, and directly stores the non-first packet and the non-last packet in the first storage space.

The above embodiments may be implemented in whole or in part by software, hardware (e.g., circuitry), firmware, or any other combination. When implemented in software, the above-described embodiments may be implemented in whole or in part in the form of a computer program product. The computer program product comprises one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, the processes or functions in accordance with the embodiments of the present application are produced in whole or in part. The computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable apparatus. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from one website site, computer, server, or data center to another website site, computer, server, or data center by wired (e.g., infrared, wireless, microwave, etc.) means. Computer readable storage media can be any available media that can be accessed by a computer or data storage devices, such as servers, data centers, etc. that contain one or more collections of available media. The usable medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. The semiconductor medium may be a solid state disk.

It should be understood that the term "and/or" is merely an association relationship describing the associated object, and means that three relationships may exist, for example, a and/or B may mean: there are three cases, a alone, a and B together, and B alone, wherein a, B may be singular or plural. In addition, the character "/" herein generally indicates that the associated object is an "or" relationship, but may also indicate an "and/or" relationship, and may be understood by referring to the context.

In the present application, "at least one" means one or more, and "a plurality" means two or more. "at least one of" or the like means any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one (one) of a, b, or c may represent: a, b, c, a-b, a-c, b-c, or a-b-c, wherein a, b, c may be single or plural.

It should be understood that, in various embodiments of the present application, the sequence numbers of the foregoing processes do not mean the order of execution, and the order of execution of the processes should be determined by the functions and internal logic thereof, and should not constitute any limitation on the implementation process of the embodiments of the present application.

Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described systems, apparatuses and units may refer to corresponding procedures in the foregoing method embodiments, and are not repeated herein.

In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the partitioning of elements is merely a logical functional partitioning, and there may be additional partitioning in actual implementation, e.g., multiple elements or components may be combined or integrated into another system, or some feature fields may be omitted, or not implemented. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed over a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit.

The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer-readable storage medium. Based on such understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution, in the form of a software product stored in a storage medium, including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a read-only memory (ROM), a random access memory (random access memory, RAM), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

The foregoing is merely specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily think about changes or substitutions within the technical scope of the present application, and the changes or substitutions are intended to be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims (9)

1. A signature transmission method for ensuring consistency of multi-level video data storage, the signature transmission method being applied to a service function entity, the service function entity establishing a communication connection with a first terminal, the method comprising:

under the condition that the service functional entity receives a first video data packet from a first terminal, the service functional entity determines that the first video data packet is a first packet in a first video stream sent by the first terminal by verifying first signature information in the first video data packet;

in response to the first video data packet being a first packet in a first video stream sent by the first terminal, the service function entity creates a first storage space for the first video stream, wherein the first storage space is a secure environment and is used to store only video data packets of the first video stream.

2. The method of claim 1, wherein the service function entity determines that the first video data packet is a first packet in a first video stream transmitted by the first terminal by verifying first signature information in the first video data packet, comprising:

the service function entity verifies the first signature information and determines whether the verification of the first signature information is passed or not under the condition that the service function entity determines that the first video data packet carries the first signature information;

and under the condition that the first signature information passes verification, the service functional entity determines that the first video data packet is the first packet in the first video stream sent by the first terminal according to the fact that the service functional entity does not receive the video data packet in the first video stream in advance or the service functional entity does not create a storage space for the first video stream in advance.

3. The method according to claim 1, wherein the method further comprises:

under the condition that the service functional entity receives a second video data packet from the first terminal, the service functional entity determines that the second video data packet is a tail packet in the first video stream sent by the first terminal by verifying second signature information in the second video data packet;

And in response to the second video data packet being a tail packet in the first video stream sent by the first terminal, the service function entity stores the second video data packet in the first storage space and releases redundant first storage space in the first storage space.

4. A method according to claim 3, wherein the service function entity determines that the first video data packet is the first packet in the first video stream transmitted by the first terminal by verifying first signature information in the first video data packet, comprising:

the service function entity verifies the second signature information and determines whether the verification of the second signature information is passed or not under the condition that the second video data packet carries the second signature information;

and under the condition that the second signature information passes verification, the service functional entity determines that the first video data packet is a tail packet in the first video stream sent by the first terminal according to the fact that the service functional entity has received the video data packet in the first video stream in advance or the service functional entity has created the first storage space for the first video stream in advance.

5. The method according to claim 1, wherein the serving functional entity belongs to a functional entity in a data network, and wherein the serving functional entity establishes a communication connection with the first terminal for the data network to establish a communication connection of a user plane with the first terminal; the service function entity receives a first video data packet from a first terminal, and the method comprises the following steps:

the service functional entity receives the first video data packet from the first terminal through at least one user plane functional network element in the user plane;

accordingly, the service function entity creates a first storage space for the first video stream, including:

and the service functional entity creates the first storage space with the security level corresponding to the condition that the at least one user plane functional network element establishes the security connection according to the condition that the at least one user plane functional network element establishes the security connection.

6. The method of claim 5, wherein the at least one user plane function network element comprises an anchor user plane function network element and a non-anchor user plane function network element; the service function entity creates the first storage space with the security level corresponding to the condition that the at least one user plane function network element establishes the security connection according to the condition that the at least one user plane function network element establishes the security connection, and the method comprises the following steps:

The service function entity establishes sectional type safety connection with the first terminal according to the anchor point user plane function network element, determines the safety level of the storage space as a first safety level, and establishes the first storage space with the safety level as the first safety level;

or alternatively;

the service function entity establishes end-to-end safety connection with the first terminal according to the anchor point user plane function network element, determines the safety level of the storage space to be a second safety level, and establishes the first storage space with the safety level of the second safety level;

or alternatively;

the service function entity establishes sectional type safety connection with the first terminal according to the non-anchor user plane function network element, and establishes end-to-end safety connection with the anchor user plane function network element, determines the safety level of a storage space to be a third safety level, and establishes the first storage space with the safety level of the third safety level;

or alternatively;

the service function entity establishes end-to-end safety connection with the first terminal according to the non-anchor user plane function network element, establishes end-to-end safety connection with the anchor user plane function network element, determines the safety level of a storage space to be a fourth safety level, and establishes the first storage space with the safety level of the fourth safety level;

Wherein, from the first security level to the fourth security level, the respective security levels thereof are sequentially increased.

7. The method according to claim 6, wherein:

the first video data packet carries first user plane information encapsulated by the anchor point user plane functional network element, and the first user plane information is used for indicating the anchor point user plane functional network element to establish sectional type safe connection with the first terminal or establish end-to-end safe connection;

and/or;

the first video data packet carries second user plane information encapsulated by the non-anchor user plane functional network element, and the second user plane information is used for indicating the non-anchor user plane functional network element to establish segmented safe connection with the first terminal or establish end-to-end safe connection.

8. The method according to any one of claims 1-7, further comprising:

under the condition that the first storage space is created, the service functional entity stores video data packets in the first video stream received from the first terminal into the first storage space;

if the service function entity determines that the storage of the first storage space reaches the upper limit and still continues to receive the video data packet in the first video stream sent by the first terminal, the service function entity expands the first storage space and stores the video data packet in the first video stream which is continuously received by the first terminal into the expanded first storage space.

9. The method according to any of claims 1-7, wherein for non-first packets and non-last packets in the first video stream sent by the first terminal, the service function entity does not perform verification of signature information on the non-first packets and the non-last packets, but directly stores the non-first packets and the non-last packets in the first storage space.