CN117857844A - Video code stream encryption method, video code stream decryption method and related devices - Google Patents

Abstract

The application discloses a video code stream encryption method, a video code stream decryption method and related devices. The video code stream encryption method comprises the following steps: encoding the video to obtain video code stream data; encrypting a transmission data unit in video code stream data according to at least one encryption mode to obtain an encrypted code stream; wherein the encryption mode specifies an encryption level of at least one transmission data unit in the video bitstream data, the encryption level of the transmission data unit including transmission data unit full encryption and transmission data unit partial encryption. The encryption and decryption method and device can reduce encryption and decryption complexity and improve encryption and decryption flexibility.

Description

Video code stream encryption method, video code stream decryption method and related devices

Technical Field

The present disclosure relates to the field of video encoding and decoding technologies, and in particular, to a video code stream encryption method, a video code stream decryption method, and related devices.

Background

The video image data size is relatively large, and video pixel data (RGB, YUV, etc.) is usually required to be compressed, and the compressed data is called a video code stream, and the video code stream is transmitted to a user terminal through a wired or wireless network and then decoded and watched. The whole video coding flow comprises the processes of block division, prediction, transformation, quantization, coding and the like.

After video encoding, in order to improve the security of the video code stream, encryption and decryption processing can be performed on the code stream data. However, the existing code stream encryption and decryption methods have some defects, for example, the encryption and decryption complexity is too high, and the encryption and decryption flexibility is poor.

Disclosure of Invention

The application provides a video code stream encryption method, a video code stream decryption method and related devices, which can reduce the complexity of encryption and decryption and improve the flexibility of encryption and decryption.

In order to achieve the above object, the present application provides a video bitstream encryption method, which includes:

encoding the video to obtain video code stream data;

encrypting a transmission data unit in video code stream data according to at least one encryption mode to obtain an encrypted code stream;

wherein the encryption mode specifies an encryption level of at least one transmission data unit in the video bitstream data, the encryption level of the transmission data unit including transmission data unit full encryption and transmission data unit partial encryption.

In order to achieve the above objective, the present application further provides a video code stream decryption method, which includes:

decrypting the encrypted transmission data unit in the encrypted code stream according to at least one encryption mode to obtain a code stream original text;

Decoding the code stream original text;

wherein the encryption mode specifies respective encryption levels of at least two transmission data units corresponding to the encrypted transmission data unit, the encryption levels of the transmission data unit including transmission data unit full encryption and transmission data unit partial encryption.

To achieve the above object, the present application further provides an electronic device, which includes a processor and a memory connected to each other, the memory being configured to store a program, and the processor being configured to execute the program to implement the steps of the above-described method.

To achieve the above object, the present application also provides a computer-readable storage medium storing a program capable of being executed to implement the above method.

The application provides a code stream encryption method, which comprises the steps of after video is encoded to obtain video code stream data, carrying out encryption processing on transmission data units in the video code stream data according to at least one encryption mode to obtain encrypted code streams; the encryption mode specifies the encryption level of at least one transmission data unit in the video code stream data, and the encryption level of the transmission data unit comprises full encryption of the transmission data unit and partial encryption of the transmission data unit, so that the encryption level of a plurality of transmission data units in a range can be determined through the encryption mode, and the complexity and the flexibility of the code stream encryption method are lower.

Drawings

The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application and do not constitute an undue limitation to the application. In the drawings:

FIG. 1 is a flow chart of a related art code stream encryption and decryption method;

FIG. 2 is a schematic diagram of tree type digest in a related art code stream encryption method;

FIG. 3 is a flow chart illustrating an embodiment of a video stream encryption method according to the present application;

FIG. 4 is a flow chart illustrating an embodiment of a video stream encryption method according to the present application;

FIG. 5 is a flowchart illustrating an embodiment of a video bitstream decryption method according to the present application;

FIG. 6 is a schematic structural diagram of an embodiment of an electronic device of the present application;

fig. 7 is a schematic structural diagram of an embodiment of a computer-readable storage medium of the present application.

Detailed Description

The following description of the technical solutions in the embodiments of the present application will be made clearly and completely with reference to the accompanying drawings in the embodiments of the present application, and it is apparent that the described embodiments are only some embodiments of the present application, not all embodiments. All other embodiments, which can be made by one of ordinary skill in the art without undue burden from the present disclosure, are within the scope of the present disclosure. In addition, the term "or" as used herein refers to a non-exclusive "or" (i.e., "and/or") unless otherwise indicated (e.g., "or otherwise" or in the alternative "). Also, the various embodiments described herein are not necessarily mutually exclusive, as some embodiments may be combined with one or more other embodiments to form new embodiments.

The main process of encrypting and decrypting the code stream in the related art is shown in fig. 1.

The encryption process comprises the following steps:

(1) The encoder periodically randomly generates 128bit VEK.

(2) And reading RBSP data of the coded slice NAL to be encrypted.

(3) And (3) when the following conditions are met, the current VEK is disabled, a new VEK is activated, and otherwise, the current VEK is continuously used.

The RBSP is the first slice data at the start of the GOP;

new VEKs are available.

(4) The encoder randomly generates a 128bit IV.

(5) The flow key is generated using the VEK and IV using the OFB mode of the agreed block encryption algorithm.

(6) And the encryption stream key and the code slice RBSP data to be encrypted are aligned according to the bit, and the exclusive OR operation is carried out to obtain the encrypted code slice RBSP data.

(7) VCL NAL encapsulating this encrypted RBSP, encryption_idc=1.

(8) If a new VEK is activated or a new IV is used, the security extension information NAL should be encapsulated and output prior to this VCL NAL.

The decryption process specifically comprises the following steps:

(1) Ciphertext of IV and VEK is obtained from the security parameter set NAL and is marked as E (VEK), and the E (VEK) is decrypted by the VKEK to obtain the VEK.

(2) And reading the code slice RBSP data to be decrypted.

(3) And (3) when the following conditions are met, the current VEK is disabled, a new VEK is activated, and otherwise, the current VEK is continuously used.

The RBSP is the first slice data at the start of the GOP;

new VEKs are available.

(4) The flow key is generated using the VEK and IV using the OFB mode of the agreed block encryption algorithm.

(5) And the decryption stream key and the code slice RBSP data to be decrypted are aligned according to the bit, and the exclusive OR operation is carried out to obtain the decrypted code slice RBSP data.

The related art security parameter set sentence method is specifically shown in table 1:

TABLE 1 schematic table of the definition of the security parameter set RBSP

Wherein the encryption_flag in table 1 is an encryption flag. The encryption flag may be a binary variable; a value of '1' indicates that encryption of the display image encoding slice, the display image sequence parameter set, the display image parameter set, the non-display knowledge image encoding slice, the knowledge image sequence parameter set, the knowledge image parameter set and/or the extended data unit is supported, i.e. the RBSP in the transmission data unit may be encrypted; a value of '0' indicates that encryption of RBSPs in the transmission data unit is not supported.

The authentication_flag in table 1 is an authentication flag. The authentication mark may be a binary variable; the value of '1' indicates that the access unit supporting the authentication of the entire frame image, the transmission data unit for authentication includes a coded slice displaying the image or the knowledge image, and the sequence parameter set, the image parameter set, the security parameter set, and the extension data unit transmitted in the frame. When authentication of the data content is supported, absolute time extension information must be carried in the encoded bit stream, and authentication data carried in the encoded bit stream should be Base64 encoded. Authentication data is transmitted by a transmission data unit having nal_unit_type equal to 10. If there are transmission data units with authentication_idc equal to 1 and nal_unit_type equal to 0-9, 12,14,17 and 18 in an access unit, hash calculation is performed once after the transmission data units with authentication_idc equal to 1 in the access unit are arranged according to the decoding order, and digest data of the access unit is generated. an authentication flag equal to 0 indicates that authentication of the encoded video sequence is not supported, and that no transmission data unit having nal_unit_type equal to 10 should be included in the encoded video sequence. If authentication_flag is 1 and encryption_flag is 1, that is, the current coded video sequence supports both encryption and authentication, it should be encrypted and then authenticated, that is, the data used for authentication should be encrypted transmission data unit.

The encryption_type in table 1 is an encryption type. The encryption type may be a 4-bit unsigned integer, which may be used to indicate the algorithm used for encryption, and the specific correspondence may be seen in table 2.

Table 2 correspondence between encryption type and specific encryption algorithm

Value of encryption_type	Encryption algorithm
		0	SM1
1	SM4
		2～15	Reservation of

Vek _flag in table 1 is a video encryption key flag. The video encryption key flag may be a binary variable; a value of '1' indicates that the carry vek and a value of '0' indicates that the vkek is not carried.

Iv_flag in table 1 is an initial vector flag. The initial vector indicator may be a binary variable; a value of '1' indicates carrying iv and a value of '0' indicates not carrying iv.

Vek _encryption_type in table 1 is a video encryption key encryption type. The video encryption key encryption type may be a 4-bit unsigned integer, which is used to indicate the encryption type of the video encryption key, and the specific correspondence may be the same as the correspondence in table 2.

Evek_length_minus1 in table 1 is the encrypted video encryption key length. The encrypted video encryption key length may be an 8-bit unsigned integer that indicates the encrypted video encryption key length in bytes.

Evek in table 1 is the encrypted video encryption key. The encrypted video encryption key may be an n-bit unsigned integer that is used to represent the encrypted video encryption key for encryption calculations, the length being evek_length_minus1 plus 1 byte.

Vkey_version length_minus1 in table 1 may be the video encryption key version number length. The video encryption key version number may be an 8-bit unsigned integer that indicates the video encryption key version number length in bytes.

Vkey_version in table 1 is the video encryption key version number. The video encryption key version number may be an n-bit unsigned integer that indicates the video encryption key version number, which is vkek_version_length_minus1 plus 1 byte in length.

Iv_length_minus1 in table 1 is the initial vector length. The initial vector length may be an 8-bit unsigned integer that is used to indicate the initial vector length in bytes.

Iv in table 1 is an initial vector (the initial vector is the second key described above), which may be an n-bit unsigned integer, which is used to indicate the initial vector, and is used for packet encryption, and the length is iv_length_minus1 plus 1 byte.

Hash_type in table 1 is a hash type. The hash type may be a 2-bit unsigned integer, which is used to indicate the algorithm used for authentication, and the specific correspondence is shown in table 3.

TABLE 3 correspondence of hash types to specific algorithms

Value of hash_type	Authentication algorithm	Summary data length (bytes)
			0	SM3	32
1～3	Reservation of	Reservation of

The hash_discard_non_output_library_pictures_flag in table 1 is a non-display knowledge image hash authentication flag. The non-display knowledge image hash authentication mark can be a binary variable, and a value of '1' indicates that the non-display knowledge image is not authenticated; equaling 0 means that the non-displayed knowledge image is authenticated. The authentication mode of the non-display knowledge image is that only the digest data of the image is digitally signed to obtain authentication data. If hash_discard_library_pictures are not in the bitstream, default its value is equal to 1. Authentication idc for each transmitted data unit in the image that is not authenticated should be equal to 0.

The hash_discard_pb_pictures_flag in table 1 is a P/B frame hash authentication flag. The P/B frame hash authentication flag may be a binary variable whose value of '1' indicates that no authentication is performed on other images than the random access point image and the knowledge image; equaling 0 means that other images than the random access point image and the knowledge image are authenticated. If hash_discard_pb_pictures are not in the stream, default its value is equal to 1. Authentication idc for each transmitted data unit in the image that is not authenticated should be equal to 0.

The success_hash_pictures_minus1 in table 1 is the number of consecutive authentication image frames. The number of consecutive authentication image frames may be an 8-bit unsigned integer representing the number of consecutive display images or knowledge picture slices digitally signed in decoding order, and these consecutive display consecutive images or knowledge picture slices are limited to one random access image or RLI frame image interval. The value of the success_hash_pictures_minus1 should be 0 to 255.

Where, successhashpictures=successhash picture_minus1+1.

If success_hash_pictures_minus1 is equal to 0, digest data of each authenticated display image or knowledge image slice is digitally signed.

If the success_hash_picture_minus1 is larger than 0, tree summary data is first generated for summary data of consecutive success hashPictures display images or knowledge picture slices in decoding order, and then digital signature is performed for tree top summary data. As shown in fig. 2, the tree top digest data of n images is digest data generated by a method shown as hash_type after the tree top digest data of the first n-1 images and the digest data of the nth image are arranged.

And (3) injection: the first authenticated image after activation of the security parameter set should be the first image of the sequential images of the successive hashpictures. One random access image should be the first of the sequential images of the successvehashifigures. If the display image and the display knowledge image which are authenticated in a random access image or RLIDR image interval are insufficient in the display knowledge image, digest data corresponding to signature data of the display image and the display knowledge image are all display images and display knowledge image digest data contained in the random access image or the RLIDR image interval.

The signature_type in table 1 is a digital signature type. The digital signature type may be a 2-bit unsigned integer that indicates an algorithm for digitally signing digest data of an image, as shown in table 4.

TABLE 4 correspondence of digital signature types to specific encryption algorithms

Value of signature_type	Signature algorithm
		0	SM2
1～3	Reservation of

Signature_fmt in table 1 is the signature data format. The signature data format may be a 2-bit unsigned integer indicating the signature data format, and a specific definition of the correspondence between the meaning of the signature_fmt value and the signature_type syntax is shown.

TABLE 5 correspondence of signature data formats to specific syntactic valuations

And (3) injection: r|s represents the result of direct concatenation of the secret R and S output by the SM2 encryption algorithm, with specific reference to the standard GM/T0003.1-2012SM2 elliptic curve public key cryptography algorithm part 1: general rule 4.2.2 conversion of integers to byte strings, and GM/T0003.2-2012SM2 elliptic curve public key cryptography algorithm part 2: digital signature algorithm 6.1 digital signature generation algorithm.

Asn.1der coding is a coding system for the tag, length and value of each element, specifically referring to the standard GM/T0009-2012 SM2 cryptographic algorithm using the specification, 7.3 signature data format.

Camera idc in table 1 is a camera certificate identification. The camera certificate identification may be a 152-bit string, which may indicate the certificate identification of the camera from which the image originated.

Camera_id in table 1 is a camera identification. The camera identification may be a 152 bit string that may be used to indicate the camera ID of the source of the image.

NAL syntax semantics in the related art are shown in Table 6.

TABLE 6NAL syntax schematic table

Here, encryption_idc in table 6 is an encryption flag, which is a binary variable that may indicate whether a transmission data unit is encrypted. A value of '0' indicates that the RBSP in the transmission data unit is not encrypted, a value of '1' indicates that the RBSP in the transmission data unit is encrypted with an encryption method designated in the security parameter set, and the last byte of the RBSP is not encrypted.

Authentication idc in table 6 is an authentication flag, which may be a binary variable that may indicate whether the transmitted data unit is authenticated. A value of '0' indicates that the transmission data unit is not authenticated, a value of '1' indicates that the transmission data unit is authenticated by an authentication method specified in the security parameter set, and absolute time extension information must be carried in the encoded bitstream for identifying the authentication time.

The encryption and decryption method in the related art determines whether to encrypt the whole NAL (namely, the transmission data unit) at the NAL level, and for larger NAL, the complexity is higher, the flexibility is poorer, and the user cannot balance confidentiality and encryption speed.

Based on the above, the application provides a code stream encryption method, which comprises the steps of after video is encoded to obtain video code stream data, carrying out encryption processing on transmission data units in the video code stream data according to at least one encryption mode to obtain an encrypted code stream; the encryption mode specifies the encryption level of at least one transmission data unit in the video code stream data, and the encryption level of the transmission data unit comprises full encryption of the transmission data unit and partial encryption of the transmission data unit, so that the encryption level of a plurality of transmission data units in a range can be determined through the encryption mode, and the complexity and the flexibility of the code stream encryption method are lower.

Specifically, as shown in fig. 3, the above-described code stream encryption method may include the following steps. It should be noted that the following step numbers are only for simplifying the description, and are not intended to limit the execution order of the steps, and the execution order of the steps of the present embodiment may be arbitrarily changed without departing from the technical idea of the present application.

S110: and encoding the video to obtain video code stream data.

S120: and carrying out encryption processing on the transmission data unit in the video code stream data according to at least one encryption mode to obtain an encrypted code stream.

After video is encoded to obtain video code stream data, encrypting a transmission data unit in the video code stream data according to at least one encryption mode to obtain an encrypted code stream; wherein the encryption mode specifies an encryption level of at least one transmission data unit in the video bitstream data, the encryption level of the transmission data unit including transmission data unit full encryption and transmission data unit partial encryption.

The transmission data unit of the present application may be RBSP (Raw Byte Sequence Payload, original data byte sequence) in NAL (Network Abstract Layer, network abstraction layer) unit, or may be another kind of transmission data unit, which is not limited herein. Where the transport data unit is an RBSP in a NAL unit, transport data unit full encryption may refer to the RBSP in the transport data unit encrypting all bytes except the last byte. Alternatively, in other embodiments, where the transport data unit is an RBSP in a NAL unit, transport data unit full encryption may also refer to all bytes of the RBSP in the transport data unit being encrypted.

The types of the transmission data units may include a coded slice, an image parameter set, a sequence parameter set, an extension data unit (e.g., monitoring extension information), and the like. The code segments may further include display image code segments, non-display knowledge image code segments, and the like.

The encryption mode may specify the encryption level of a part of the types of transmission data units in the video stream data, or may specify the encryption level of all types of transmission data units in the video stream data, and is not limited herein. Alternatively, in the case where the encryption mode specifies the encryption level of a part of the kinds of transmission data units in the video bitstream data, the part of the kinds of transmission data units in the video bitstream data specified by the encryption mode may be directly encrypted according to the corresponding encryption mode; the transmission data units of the type not specified by the encryption mode may be encrypted by default (e.g., full encryption or partial encryption) or by other parameters (e.g., encryption level specification parameters in each nal unit header or a new syntax in a new security parameter set).

Alternatively, one or more encryption modes may be set. Under the condition that multiple encryption modes are set, the types of all encrypted transmission data units corresponding to different encryption modes are different in range, and the types of corresponding partially encrypted transmission data units are also different in range, so that the partial encryption and decryption can be performed by setting multiple encryption modes and corresponding to the transmission data units in different ranges, and the flexibility of video code stream encryption can be improved by setting multiple encryption modes. For example, 3 encryption modes are set, wherein the first encryption mode only adopts a partial encryption mode for RBSPs of the coded slice NAL units, and RBSPs of the rest NALs are fully encrypted; in the second encryption mode, only the coding sheet and RBSP of the monitoring extension information NAL unit adopt a partial encryption mode, and RBSP of the rest NAL are fully encrypted; the third encryption mode is RBSP full encryption of all NAL.

Wherein the at least one encryption mode may be set in accordance with at least one encryption tendency of the transmission data unit for indicating a degree to which the transmission data unit is prone to full encryption or for indicating a degree to which the transmission data unit is prone to partial encryption. Preferably, all transmission data units with an encryption level of full encryption in each encryption mode tend to be more fully encrypted than all transmission data units with an encryption level of partial encryption, or so to speak, all transmission data units with an encryption level of full encryption tend to be less partially encrypted than all transmission data units with an encryption level of partial encryption in each encryption mode; when the encryption tendency of the transmission data unit is used for indicating the degree of the transmission data unit tending to be fully encrypted, the transmission data unit with high degree of tendency to be fully encrypted can be set to be fully encrypted according to the encryption tendency of the transmission data unit, so that a user can conveniently balance confidentiality and encryption speed, when the user tends to improve confidentiality, the encryption tendency threshold set by the full encryption level is reduced, so that more types of transmission data units are encrypted by using the full encryption mode, fewer types (even none) of transmission data units are encrypted by using the partial encryption mode, thereby improving confidentiality of user video data, and when the user tends to improve encryption speed, the encryption tendency threshold set by the full encryption level is improved, so that fewer types of transmission data units are encrypted by using the full encryption mode, and more types of transmission data units are encrypted by using the partial encryption mode, thereby improving encryption speed of user video data. Accordingly, when the encryption tendency of the transmission data unit is used to indicate the degree to which the transmission data unit tends to be partially encrypted, the transmission data unit with a low degree of tendency to be partially encrypted may be set to be fully encrypted according to the encryption tendency of the transmission data unit, so that the user can balance between confidentiality and encryption speed, and in the case that the user tends to increase confidentiality, the encryption tendency threshold set for the fully encrypted level is increased, so that more types of transmission data units are all encrypted in a fully encrypted manner, and fewer types (even none) of transmission data units are encrypted in a partially encrypted manner, so that the confidentiality of the user video data is increased, and in the case that the user tends to increase encryption speed, the encryption tendency threshold set for the fully encrypted level is decreased, so that fewer types of transmission data units are all encrypted in a fully encrypted manner, and more types of transmission data units are encrypted in a partially encrypted manner, so that the encryption speed of the user video data is increased.

The above described encryption propensity of a transmitted data unit may be related to the data size, importance and encryption validity of the transmitted data unit.

Alternatively, transmission data units with small data amounts tend to be fully encrypted, i.e. the degree to which transmission data units with small data amounts tend to be fully encrypted is generally higher, because the complexity is not inherently high; that is, the data amount of a transmission data unit is small, so that the degree of the transmission data unit tending to be fully encrypted is increased, and the degree of the transmission data unit tending to be partially encrypted is reduced; accordingly, the amount of data in a transmission data unit is large, the degree to which the transmission data unit tends to be fully encrypted is reduced, and the degree to which the transmission data unit tends to be partially encrypted is increased. As such, if the encryption propensity of the transmission data unit is used to indicate the extent to which the transmission data unit tends to be fully encrypted, the amount of data of the transmission data unit is a factor that negatively affects the encryption propensity of the transmission data unit.

Transmission data units of high importance tend to be fully encrypted, transmission data units of low importance tend to be partially encrypted, i.e. transmission data units of high importance tend to be fully encrypted to a generally higher degree and transmission data units of low importance tend to be fully encrypted to a generally lower degree. That is, because of the high importance of a transmission data unit, the degree to which the transmission data unit tends to be fully encrypted is increased, and the degree to which the transmission data unit tends to be partially encrypted is reduced; accordingly, the degree to which a transmission data unit tends to be fully encrypted is reduced and the degree to which the transmission data unit tends to be partially encrypted is increased due to the low importance of the transmission data unit. As such, if the encryption propensity of the transmission data unit is used to indicate the extent to which the transmission data unit tends to be fully encrypted, the importance of the transmission data unit is a factor that positively affects the encryption propensity of the transmission data unit.

Some transmission data units are regular, only partial encryption cannot achieve the confidentiality effect, encryption effectiveness is poor, and the transmission data units tend to be fully encrypted; otherwise, partial encryption is preferred. That is, the encryption effectiveness of a transmission data unit is poor, so that the encryption degree of the transmission data unit is increased, and the encryption degree of the transmission data unit is reduced; accordingly, the encryption effectiveness of a transmission data unit is high, the encryption tendency of the transmission data unit is reduced, and the encryption tendency of the transmission data unit is increased. As such, if the encryption propensity of the transmission data unit is used to indicate the extent to which the transmission data unit tends to be fully encrypted, the encryption validity of the transmission data unit is a factor that negatively affects the encryption propensity of the transmission data unit.

Thus, the encryption tendency of each transmission data unit can be determined by comprehensively considering the above rules, and then n different levels of hierarchical encryption modes are set. Some hierarchical encryption modes are more strict, and most of transmission data units are fully encrypted; some hierarchical encryption schemes are more relaxed and may require full encryption only for highly encrypted transmission data units, and the remaining transmission data units may be partially encrypted. The user can select the hierarchical encryption mode according to the own demand, so that the user can select to encrypt partial data of partial NAL according to the consideration of the data volume, importance and encryption effectiveness of the NAL unit, the encryption and decryption speed is accelerated, and different service scenes and demands can be adapted more flexibly.

In a specific example, partial encryption can achieve good confidentiality considering that encryption effectiveness of the coded slice transmission data unit is good, and in addition, the transmission data unit data size of the monitoring extension information is large, and the complexity of full encryption is high. Setting a hierarchical encryption mode of 3 levels based on the above two points of consideration:

class 1: only the coded slice transmission data unit is partially encrypted, and RBSP of the rest NALs are fully encrypted;

class 2: only the coded slice and the monitoring extension information transmission data unit are partially encrypted, and RBSP of the rest NALs are fully encrypted;

grade 3: RBSP full encryption of all NAL.

It will be appreciated that in the case where one encryption mode is set, after encoding video to obtain video stream data, at least one transmission data unit in the video stream data may be directly encrypted by using the set encryption mode to obtain encrypted stream data, and specifically, all types of transmission data units that are fully encrypted and specified by the encryption mode in the video stream data may be fully encrypted, and at least some of all types of transmission data units that are partially encrypted and specified by the encryption mode in the video stream data may be partially encrypted.

In the case where only one encryption mode is set, the encryption mode syntax may not be transmitted because the decoding side will also decrypt the encrypted code stream data using only one encryption mode. Of course, in some embodiments, in the case where only one encryption mode is set, the encryption mode syntax may also be transmitted.

In case of setting a plurality of encryption modes, one encryption mode may be selected from the plurality of encryption modes to encrypt the current transmission data unit and/or at least one transmission data unit subsequent to the current transmission data unit with the selected one encryption mode, in particular, all kinds of transmission data units specified by the one encryption mode in the current transmission data unit and/or the at least one transmission data unit subsequent to the current transmission data unit may be fully encrypted, and at least part of data in all kinds of transmission data units specified by the one encryption mode in the current transmission data unit and/or the at least one transmission data unit subsequent to the current transmission data unit may be partially encrypted. In this case, when a plurality of encryption modes are set, one encryption mode may be used for one video stream, or a plurality of encryption modes may be used, and the present invention is not limited thereto.

In the case where a plurality of encryption modes are set, an encryption mode syntax may be transmitted to let the decoding end know which encryption mode to use for decryption.

Alternatively, the encryption mode syntax may be written into the security parameter set, in which case all transmission data units corresponding to the security parameter set are encrypted using the encryption mode corresponding to the encryption mode syntax value.

Alternatively, the encryption mode syntax may be written into the header of the transmission data unit, in which case only the transmission data unit may be encrypted using the encryption mode corresponding to the encryption mode syntax value, or the transmission data unit and all transmission data units between the transmission data unit and the transmission data unit having the next written encryption mode syntax may be encrypted using the encryption mode corresponding to the encryption mode syntax value of the transmission data unit, or all transmission data units in all transmission data units corresponding to the security parameter set corresponding to the transmission data unit and transmission data units following the transmission data unit may be encrypted using the encryption mode corresponding to the encryption mode syntax value of the transmission unit.

For a transmission data unit, the encryption level of the transmission data unit may be determined based on a security parameter set corresponding to the transmission data unit and/or an encryption mode syntax in a header of the transmission data unit. Specifically, when there is no encryption mode syntax in the header of a transmission data unit, the encryption level of the transmission data unit may be determined based on the encryption mode syntax in the security parameter set corresponding to the transmission data unit or the encryption mode syntax in the header of the transmission data unit in which the encryption mode syntax is written most recently before the transmission data unit; when there is an encryption mode syntax in the header of a transmission data unit, the encryption level of the transmission data unit may be determined using the encryption mode corresponding to the value of the encryption mode syntax in the header of the transmission data unit.

It is understood that the total number of encryption mode syntax values may be greater than or equal to the total number of encryption modes. For example, assume that 3 encryption modes are set, the first encryption mode only adopts a partial encryption mode for the RBSPs of the coded slice NAL unit, and the RBSPs of the remaining NAL units are fully encrypted; in the second encryption mode, only the coding sheet and RBSP of the monitoring extension information NAL unit adopt a partial encryption mode, and RBSP of the rest NAL are fully encrypted; the third encryption mode is RBSP full encryption of all NAL; the encryption mode syntax encryption_mode may be a 2-bit unsigned integer, which has 4 total values, alternatively, encryption_mode=0 represents the third encryption mode, encryption_mode=1 represents the first encryption mode, encryption_mode=2 represents the second encryption mode, and encryption_mode=3 is a reserved item.

When encrypting the current transmission data unit and/or at least one transmission data unit subsequent to the current transmission data unit using the selected one encryption mode, the specific encryption content of the transmission data unit to be partially encrypted may also be determined, and then the determined specific encryption content is encrypted to obtain an encrypted transmission data unit.

Alternatively, the specific encrypted content of the transmission data unit to be partially encrypted may be determined by determining the encryption start position and the encryption length. Wherein the content of the encryption length can be continuously selected from the encryption starting position in the transmission data unit as the specific encrypted content of the transmission data unit. As shown in fig. 4, for a current transmission data unit, when determining that an encryption level of the current transmission data unit is partially encrypted based on an encryption mode corresponding to the current transmission data unit, determining an encryption starting position and an encryption length of the current transmission data unit; and encrypting the current transmission data unit by taking the content of the encryption length continuously selected from the encryption starting position in the current transmission data unit as the specific encryption content of the current transmission data unit to obtain an encryption transmission data unit.

The encryption start position may be a default position, which may be set according to practical situations, and is not limited herein, for example, the encryption start position may be a beginning of the transmission data unit. Alternatively, the encryption start position may not be a default position, and may be flexibly set.

Accordingly, the encryption length may be a default length, which may be set according to actual situations, and is not limited herein. Alternatively, the encryption length may be set flexibly instead of the default length. The encryption length may refer to the number of encrypted bytes or the encrypted content duty ratio, and is not limited herein. In the case where the encryption length represents the number of encrypted bytes, the number of encrypted bytes may be configured by at least two parameters. Preferably, the product of the at least two parameters is equal to the number of encrypted bytes it is configured with. Illustratively, the encryption start position is fixed to 0, i.e. from the beginning of transmitting the data unit, the encryption length needs to be flexibly configured: let the encryption length be configured by two parameters, one is the encryption basic byte length and one is the number of encryption basic byte lengths, and the final encryption length = encryption basic byte length. This embodiment summarizes the encrypted base byte length settings 4: 16 bytes, 64 bytes, 256 bytes, 1024 bytes; the number of the encryption basic byte lengths is set to 1 to 256. If the RBSP of the current NAL adopts a partial encryption mode, and takes the length of the encrypted basic byte as 16 bytes, and the number of the encrypted basic byte lengths as 2, the final encrypted data length of the NAL is 16×2=32 bytes.

It can be understood that if the starting position of the encrypted and decrypted data is the beginning of the transmission data unit and the configured encryption length is greater than the data amount of the whole transmission data unit, the encrypted data can be regarded as full encryption.

For the encryption starting position and the encryption length, if the starting position is a pre-fixed starting position (i.e. default position) and the data length is a pre-fixed data length (i.e. default length), the encryption starting position and the encryption length may not be transmitted through syntax; if a flexibly configurable starting location, it is necessary to syntactically indicate where the encryption starting location is; if flexible configurable encryption length, it is necessary to syntactically indicate what the length of the encrypted content is.

The encryption start position and the syntax of the encryption length may be placed in the security parameter set or in the header of the transmission data unit. If the transmission data unit is placed in the safety parameter set, all transmission data units which are corresponding to the safety parameter set and are subjected to partial encryption are encrypted by using the same encryption starting position and encryption length; if placed in the header of the transmission data unit, different transmission data units may use different encryption starting positions and different encryption lengths. That is, if the syntax of the encryption start position and the encryption length is written into the header of the transmission data unit, in this case, if the transmission data unit is partially encrypted in its encryption mode, the transmission data unit may be partially encrypted using the encryption start position and the encryption length, respectively corresponding to the syntax values of the encryption start position and the encryption length.

In a specific example, partial encryption can achieve good confidentiality considering that the encryption effectiveness of the coded slice transmission data unit is good, and in addition, the data size of the transmission data unit for monitoring the extension information is large, and the complexity of full encryption is high. Setting a hierarchical encryption mode of 3 levels based on the above two points of consideration: class 1: only the coded slice transmission data unit is partially encrypted, and RBSP of the rest NALs are fully encrypted; class 2: only the coded slice and the monitoring extension information transmission data unit are partially encrypted, and RBSP of the rest NALs are fully encrypted; grade 3: RBSP full encryption of all NAL.

The encryption starting position is fixed to 0, that is, from the beginning of transmitting the data unit, the encryption length needs to be flexibly configured: let the encryption length be configured by two parameters, one is the encryption basic byte length and one is the number of encryption basic byte lengths, and the final encryption length = encryption basic byte length. This embodiment summarizes the encrypted base byte length settings 4: 16 bytes, 64 bytes, 256 bytes, 1024 bytes; the number of encrypted basic byte lengths may be set to 1 to 256. If the RBSP of the current NAL adopts a partial encryption mode, and takes the length of the encrypted basic byte as 16 bytes, and the number of the encrypted basic byte lengths as 2, the final encrypted data length of the NAL is 16×2=32 bytes.

It is assumed that the syntax is set in the security parameter set. As shown in table 7, the syntax of one hierarchical encryption mode is set to encryption_mode, encryption_mode=0 represents an encryption mode of level 3, encryption_mode=1 represents an encryption mode of level 1, and encryption_mode=2 represents an encryption mode of level 2.

Since the start position fix is the beginning of the NAL unit, no syntax needs to be set.

Since the encryption length is configured by two parameters, two syntax elements are added correspondingly: the encryption_base_byte may be a 2-bit unsigned integer for indicating the encryption basic byte length, and the encryption_byte_num may be an 8-bit unsigned integer for indicating the number of encryption basic byte lengths. Where encryption_base_byte=0 indicates that the encryption basic byte length is 16 bytes, encryption_base_byte=1 indicates that the encryption basic byte length is 64 bytes, encryption_base_byte=2 indicates that the encryption basic byte length is 256 bytes, and encryption_base_byte=3 indicates that the encryption basic byte length is 1024 bytes. The value of encryption_byte_num is 1 to 255. Under this syntax setting, the value of encryption_byte_num cannot be 0.

In addition, the syntax of the number information of the encrypted basic byte length can be expressed by the encryption_byte_num_minus1, the encryption_byte_num can also be an 8-bit unsigned integer, the value of the encryption_byte_num_minus1+1 is 0-255, and the number of the real encrypted basic byte length is expressed only, namely, the number of the real encrypted basic byte length is 1-256. Final encryption data length=encryption_base_byte (encryption_byte_num_minus1+1).

TABLE 7 safety parameter set RBSP definition table

In addition, in the case where the selected encryption mode is that all kinds of transmission data units are encrypted, the encryption start position and the encryption length may not be transmitted. That is, when the at least one encryption mode includes a preset mode, not writing the syntax related to the encryption start position and the encryption length into a header and a security parameter set of a transmission data unit corresponding to the preset mode; the preset mode means that all kinds of transmission data units are encrypted in a full encryption mode.

It is understood that when the transmission data unit is an RBSP in a NAL unit, the header of the transmission data unit may refer to a NAL header in the NAL unit to which the transmission data unit belongs.

In a specific example, partial encryption can achieve good confidentiality considering that encryption effectiveness of the coded slice transmission data unit is good, and in addition, the transmission data unit of the monitoring extension information has large data volume and high complexity of full encryption. Setting a hierarchical encryption mode of 3 levels based on the above two points of consideration: class 1: only the coded slice transmission data unit is partially encrypted, and RBSP of the rest NALs are fully encrypted; class 2: only the coded slice and the monitoring extension information transmission data unit are partially encrypted, and RBSP of the rest NALs are fully encrypted; grade 3: RBSP full encryption of all NAL.

The encryption starting position is fixed to 0, that is, from the beginning of transmitting the data unit, the encryption length needs to be flexibly configured: let the encryption length be configured by two parameters, one is the encryption basic byte length and one is the number of encryption basic byte lengths, and the final encryption length = encryption basic byte length. This embodiment summarizes the encrypted base byte length settings 4: 16 bytes, 64 bytes, 256 bytes, 1024 bytes; the number of encrypted basic byte lengths may be set to 1 to 256. If the RBSP of the current NAL adopts a partial encryption mode, and takes the length of the encrypted basic byte as 16 bytes, and the number of the encrypted basic byte lengths as 2, the final encrypted data length of the NAL is 16×2=32 bytes.

It is assumed that the syntax is set in the security parameter set. As shown in table 8, the syntax of one hierarchical encryption mode is set to encryption_mode, encryption_mode=0 represents an encryption mode of level 3, encryption_mode=1 represents an encryption mode of level 1, and encryption_mode=2 represents an encryption mode of level 2.

Since the start position fix is the beginning of the NAL unit, no syntax needs to be set.

The encryption length is not transmitted when the encryption_mode value is 0, and the encryption length is transmitted when the encryption_mode value is 1 and 2.

Since the encryption length is configured by two parameters, two syntax elements are added correspondingly: encryption_base_byte represents the encryption basic byte length, and encryption_byte_num represents the number of encryption basic byte lengths. Where encryption_base_byte=0 indicates that the encryption basic byte length is 16 bytes, encryption_base_byte=1 indicates that the encryption basic byte length is 64 bytes, encryption_base_byte=2 indicates that the encryption basic byte length is 256 bytes, and encryption_base_byte=3 indicates that the encryption basic byte length is 1024 bytes. The value of encryption_byte_num is 1 to 255. Under this syntax setting, the value of encryption_byte_num cannot be 0.

In addition, the syntax of the number information of the encrypted basic byte length can be expressed by using the encryption_byte_num_minus1, the value is 0-255, and the number of the real encrypted basic byte length is expressed only by using the encryption_byte_num_minus1+1, namely, the number of the real encrypted basic byte length is 1-256. Final encryption data length=encryption_base_byte (encryption_byte_num_minus1+1).

TABLE 8 safety parameter set RBSP definition table

In other embodiments, the partial encryption may be an even byte encryption or an odd byte encryption in the transmission data unit, which is not limited herein.

Accordingly, as shown in fig. 5, the video bitstream decryption method according to an embodiment of the present application may include the following steps. It should be noted that the following step numbers are only for simplifying the description, and are not intended to limit the execution order of the steps, and the execution order of the steps of the present embodiment may be arbitrarily changed without departing from the technical idea of the present application.

S210: and decrypting the encrypted transmission data unit in the encrypted code stream according to at least one encryption mode to obtain the code stream text.

S220: and decoding the code stream original text.

Wherein the encryption mode specifies respective encryption levels of at least two transmission data units corresponding to the encrypted transmission data unit, the encryption levels of the transmission data unit including transmission data unit full encryption and transmission data unit partial encryption.

It can be understood that the video code stream decryption method and the video code stream encryption method are in a reciprocal relationship, and the details of the video code stream decryption method can be described in detail with reference to the video code stream encryption method, which is not described herein.

Referring to fig. 6, fig. 6 is a schematic structural diagram of an embodiment of an electronic device according to the present application. The present electronic device 20 comprises a processor 22, the processor 22 being adapted to execute instructions to implement the above-described method. The specific implementation process is described in the above embodiments, and will not be described herein.

The processor 22 may also be referred to as a CPU (Central Processing Unit ). The processor 22 may be an integrated circuit chip having signal processing capabilities. Processor 22 may also be a general purpose processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components. The general purpose processor may be a microprocessor or the processor 22 may be any conventional processor or the like.

The electronic device 20 may further comprise a memory 21 for storing instructions and data needed for the operation of the processor 22.

The processor 22 is configured to execute instructions to implement the methods provided by any of the embodiments of the methods of the present application and any non-conflicting combinations described above.

The electronic device of the present application may be an encoder or a decoder, which is not limited herein.

Referring to fig. 7, fig. 7 is a schematic structural diagram of a computer readable storage medium according to an embodiment of the present application. The computer readable storage medium 30 of the embodiments of the present application stores a program 31, which when executed, implements the methods provided by any of the embodiments of the methods of the present application, as well as any non-conflicting combination. The program 31 may form a program file stored in the storage medium 30 in the form of a software product, so that a computer device (may be a personal computer, a server, or a network device, etc.) or a processor (processor) performs all or part of the steps of the methods of the embodiments of the present application. And the aforementioned storage medium 30 includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, an optical disk, or other various media capable of storing program codes, or a terminal device such as a computer, a server, a mobile phone, a tablet, or the like.

In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods may be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of elements is merely a logical functional division, and there may be additional divisions of actual implementation, e.g., multiple elements or components may be combined or integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.

It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article or apparatus that comprises an element.

The foregoing is only the embodiments of the present application, and not the patent scope of the present application is limited by the foregoing description, but all equivalent structures or equivalent processes using the contents of the present application and the accompanying drawings, or directly or indirectly applied to other related technical fields, which are included in the patent protection scope of the present application.

Claims (10)

1. A method for encrypting a video stream, the method comprising:

encoding the video to obtain video code stream data;

encrypting a transmission data unit in video code stream data according to at least one encryption mode to obtain an encrypted code stream;

wherein the encryption mode specifies an encryption level of at least one transmission data unit in the video bitstream data, the encryption level of the transmission data unit including transmission data unit full encryption and transmission data unit partial encryption.

2. The method for encrypting a video stream according to claim 1, wherein said encrypting the transmission data unit in the video stream data according to at least one encryption mode to obtain an encrypted stream comprises:

setting at least one of said encryption modes according to an encryption tendency of said at least one transmission data unit, said encryption tendency of said transmission data unit being indicative of a degree to which said transmission data unit is prone to full encryption or of a degree to which said transmission data unit is prone to partial encryption;

The types of the partially encrypted transmission data units corresponding to different encryption modes are different in scope.

3. The video stream encryption method according to claim 2, wherein in each encryption mode, all transmission data units with an encryption level of full encryption tend to be fully encrypted to a higher degree than all transmission data units with an encryption level of partial encryption tend to be fully encrypted.

4. The video stream encryption method according to claim 2, wherein the encryption tendency of the transmission data unit is used to indicate the degree to which the transmission data unit tends to be fully encrypted,

the data amount of the transmission data unit is a factor which negatively affects the encryption tendency of the transmission data unit, the importance of the transmission data unit is a factor which positively affects the encryption tendency of the transmission data unit, and the encryption effectiveness of the transmission data unit is a factor which negatively affects the encryption tendency of the transmission data unit.

5. The video bitstream encryption method according to claim 1, wherein the encrypting the transmission data unit in the video bitstream data according to the at least one encryption mode to obtain the encrypted bitstream comprises:

When the encryption grade of the current transmission data unit is determined to be partial encryption based on the encryption mode corresponding to the current transmission data unit, determining the encryption starting position and the encryption length of the current transmission data unit;

and encrypting the current transmission data unit by taking the content of the encryption length continuously selected from the encryption starting position in the current transmission data unit as the specific encryption content of the current transmission data unit to obtain an encryption transmission data unit.

6. The method for encrypting a video stream according to claim 5, wherein said encrypting the transmission data unit in the video stream data according to at least one encryption mode to obtain an encrypted stream comprises:

and writing the encryption mode, encryption starting position and/or encryption length related syntax corresponding to the current transmission data unit into a security parameter set corresponding to the current transmission data unit or a header of the current transmission data unit.

7. The method for encrypting a video stream according to claim 6, wherein said encrypting the transmission data unit in the video stream data according to at least one encryption mode to obtain an encrypted stream comprises:

When the at least one encryption mode comprises a preset mode, not writing the syntax related to the encryption starting position and the encryption length into a header and a security parameter set of a transmission data unit corresponding to the preset mode;

the preset mode means that all kinds of transmission data units are encrypted in a full encryption mode.

8. A method for decoding a video stream, the method comprising:

decrypting the encrypted transmission data unit in the encrypted code stream according to at least one encryption mode to obtain a code stream original text;

decoding the code stream original text;

wherein the encryption mode specifies respective encryption levels of at least two transmission data units corresponding to the encrypted transmission data unit, the encryption levels of the transmission data unit including transmission data unit full encryption and transmission data unit partial encryption.

9. An electronic device comprising a transmitter and a memory connected to each other, the memory being for storing a program, the transmitter being for executing the program to carry out the steps of the method according to any one of claims 1-8.

10. A computer readable storage medium, on which a program is stored, characterized in that the program, when being executed by a processor, implements the steps of the method according to any of claims 1-8.