JP2024518798A - Method, apparatus, system and electronic device for encrypting video data slices - Google Patents

Abstract

The present invention provides a method, apparatus, system and electronic device for encrypting a video data slice, the method including the steps of: a target encryption node obtains a first key ID, and obtains a first protection key from the key management system based on the first key ID; the target encryption node generates a first random number, and uses the first random number as a first video key to encrypt a video data slice to be encrypted to obtain a first video ciphertext; the target encryption node encrypts the first video key with the first protection key to obtain a first key ciphertext; and the target encryption node stores the first key ciphertext and the first key ID in the first video ciphertext. The method can improve the security of the video data slice.

Description

The present invention relates to the technical field of information security, and in particular to a method, apparatus, system and electronic device for encrypting video data slices.

In order to improve the security of video data, video data encryption is usually required when the video data is stored or transmitted. In order to reduce the computational complexity and resource consumption of video data encryption, video slicing and encryption technology has gradually become a common research direction for video data encryption.

However, in practice, traditional video slice encryption techniques have proven to be less secure, as all slices of the same video are typically encrypted and decrypted using the same key.

Based on the above, the present invention provides a method, device, and system for encrypting video data slices.

Specifically, the present invention is realized by the following technical solutions:

According to a first aspect of an embodiment of the present invention, there is provided a method for encrypting a video data slice to be applied to a target encryption node in a video data slice encryption system including a key management system and a plurality of encryption nodes, the target encryption node being one of the plurality of encryption nodes, and a plurality of video data slices obtained by slicing a same video stream or video file are assigned to at least two of the plurality of encryption nodes for encryption, the method comprising:
the target encryption node obtains a first key ID, obtains a first protection key from the key management system based on the first key ID, the target encryption node generates a first random number, and uses the first random number as a first video key to encrypt a video data slice to obtain a first video ciphertext, where the protection keys corresponding to the same key ID are the same;
the target encryption node encrypting the first video key with the first protection key to obtain a first key ciphertext;
the target encryption node storing the first key ciphertext and the first key ID in the first video ciphertext.

According to a second aspect of an embodiment of the present invention, there is provided an apparatus for encrypting a video data slice to be applied to a target encryption node in a video data slice encryption system including a key management system and a plurality of encryption nodes, the target encryption node being one of the plurality of encryption nodes, a plurality of video data slices obtained by slicing a same video stream or video file are assigned to at least two of the plurality of encryption nodes for encryption, the apparatus comprising:
An acquisition unit for acquiring a first key ID and acquiring a first protection key from the key management system according to the first key ID, where protection keys corresponding to the same key ID are the same;
an encryption unit for generating a first random number and encrypting a video data slice to be encrypted with the first random number as a first video key to obtain a first video ciphertext, the encryption unit being further used to encrypt the first video key with the first protection key to obtain a first key ciphertext;
a processing unit for storing the first key ciphertext and the first key ID in the first video ciphertext.

According to a third aspect of an embodiment of the present invention, there is provided a system for encrypting video data slices, the system comprising a key management system and a plurality of encryption nodes, wherein a plurality of video data slices obtained by slicing a same video stream or video file are assigned to at least two of the plurality of encryption nodes for encryption;
When the encryption node is a target encryption node, obtain a first key ID, obtain a first protection key from the key management system according to the first key ID, generate a first random number, and use the first random number as a first video key to encrypt the video data slice to be encrypted to obtain a first video ciphertext, and the protection keys corresponding to the same key ID are the same;
if the key management system passes the verification of the target encryption node, to transmit the first protection key corresponding to the first key ID to the target encryption node;
if the encryption node is a target encryption node, the encryption node further comprises encrypting the first video key with the first protection key to obtain a first key ciphertext;
If the encryption node is a target encryption node, it is further used to store the first key ciphertext and the first key ID in the first video ciphertext.

According to a fourth aspect of an embodiment of the present invention, there is provided an electronic device adapted to be a target encryption node in an encryption system for video data slices comprising a key management system and a plurality of encryption nodes, the target encryption node being any one of the plurality of encryption nodes, a plurality of video data slices obtained by slicing a same video stream or video file are assigned to at least two of the plurality of encryption nodes for encryption, the electronic device comprising a processor and a machine-readable storage medium, the machine-readable storage medium storing machine-executable instructions, the processor executing the machine-executable instructions to:
Obtain a first key ID, and obtain a first protection key from the key management system based on the first key ID, and the protection keys corresponding to the same key ID are the same;
generating a first random number, and encrypting the video data slice to be encrypted using the first random number as a first video key to obtain a first video ciphertext;
encrypting the first video key with the first protection key to obtain a first key ciphertext;
The device is configured to perform an operation of storing the first key ciphertext and the first key ID in the first video ciphertext.

A video data slice encryption method according to an embodiment of the present invention assigns multiple video data slices obtained by slicing the same video stream or video file to at least two encryption nodes for encryption processing, and encrypts different video data slices of the same video stream or video file using the at least two encryption nodes, thereby realizing distributed encryption and improving the encryption efficiency of the video data slices. In addition, when encrypting the video data slices, the encryption node can use the generated random number as a video key and encrypt the video key using a protection key obtained from a key management system, thereby ensuring the security of the video key and improving the security of the video data slices.

3 is a flowchart of a method for encrypting a video data slice in an embodiment of the present invention; 4 is a flow chart of a target encryption node obtaining a first protection key from the key management system based on a first key ID in one embodiment of the present invention. 4 is a flowchart of a method for decoding a video data slice in an embodiment of the present invention; FIG. 2 is an architecture schematic diagram of a specific application scenario of the video data slice encryption method in one embodiment of the present invention; 4 is a flow chart of first to fourth steps of a method for encrypting a video data slice in accordance with an embodiment of the present invention; FIG. 2 is a structural schematic diagram of a video data slice encryption device in an embodiment of the present invention; FIG. 11 is a structural schematic diagram of another video data slice encryption device in another embodiment of the present invention; FIG. 2 is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention; FIG. 2 is a structural schematic diagram of a video data slice encryption system in one embodiment of the present invention;

Now, exemplary embodiments will be described in detail, examples of which are illustrated in the drawings. Where the following description refers to the drawings, the same numerals in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present invention, as detailed in the appended claims.

The terms used in the present invention are not intended to limit the present invention but are intended to describe particular embodiments. As used in the embodiments of the present invention and the appended claims, the singular forms "a," "the," and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

In order to enable those skilled in the art to better understand the technical solutions provided by the embodiments of the present invention, and to make the above-mentioned objectives, features and advantages of the embodiments of the present invention more obvious and understandable, the technical solutions in the embodiments of the present invention will be described in more detail below in conjunction with the drawings.

FIG. 1 is a flowchart of a method for encrypting a video data slice provided by an embodiment of the present invention. As shown in FIG. 1, the flow of the method for encrypting a video data slice may include steps S100 to S130.

In an embodiment of the present invention, in order to improve the efficiency and security of the encryption of video data slices, the video data slice encryption system may include multiple encryption nodes, and multiple video data slices obtained by slicing the same video stream or video file may be assigned to at least two of the multiple encryption nodes for encryption processing.

Exemplarily, the at least two encryption nodes use different keys (which may be referred to as video encryption keys (abbreviated as VEK) or video keys) when encrypting the different assigned video data slices.

In an embodiment of the present invention, to further improve the security of the video data slices, the VEK used by each encryption node when encrypting the video data slices may be encrypted and stored, and the key for encrypting the VEK (which may be referred to as a video key encryption key (abbreviated as VKEK) or a protection key) may be maintained by a key management system in the video data slice encryption system.

For example, the execution subject of steps S100 to S130 may be any one of the multiple encryption nodes (referred to as the target encryption node in this specification).

Note that the size of the numbers of each step in the embodiments of the present invention does not imply the order of execution, and the order of execution of each process should be determined by its function and inherent logic, without constituting a limitation on the implementation process of the embodiments of the present invention.

In step S100, the target encryption node obtains a first key identifier (ID) and obtains a first protection key from the key management system based on the first key ID. Here, the first protection key is sent to the target encryption node by the key management system if it passes the verification of the target encryption node, and the protection keys corresponding to the same key ID are the same.

In step S110, the target encryption node generates a first random number and uses the first random number as a first video key to encrypt the video data slice to be encrypted to obtain a first video ciphertext.

In an embodiment of the present invention, when the target encryption node needs to encrypt the assigned video data slice, the target encryption node may generate a random number (referred to herein as a first random number) and use the first random number as a video key (referred to herein as a first video key) to encrypt the assigned video data slice to be encrypted (referred to herein as a video data slice to be encrypted) to obtain a corresponding video ciphertext (referred to herein as a first video ciphertext).

Exemplarily, to further improve the security of the video data, the video keys used to encrypt different video data slices may be different. Thus, even if one video key is compromised, it does not affect the security of other video data slices.

Meanwhile, the target encryption node may obtain a protection key (referred to herein as the first protection key) for encrypting the first video key from the key management system.

Exemplarily, for the protection key, the key management system may maintain a mapping relationship between the key ID and the protection key, i.e., the key management system may maintain a mapping relationship between the key ID and the protection key. The encryption node may obtain the protection key corresponding to the key ID from the key management system based on the key ID.

Exemplarily, the mapping relationship between key IDs and protection keys may be a one-to-one mapping, i.e., the same key ID corresponds to the same protection key and different key IDs correspond to different protection keys.

In one example, the target encryption node may generate a key ID (referred to herein as the first key ID) for obtaining the first protection key.

For example, the target encryption node may generate the first key ID based on a timestamp.

For example, when the key management system receives a request to obtain a protection key (which may be referred to as a first protection key obtainment request) sent from a target cryptographic node and to which a first key ID is attached, the key management system may determine and record a mapping relationship between the first protection key and the first key ID.

For example, the key management system may generate a certain number of protection keys in advance, and upon receiving a first protection key acquisition request, select one unused protection key from the certain number of protection keys as the first protection key, and record the mapping relationship between the first protection key and the first key ID.

Alternatively, the key management system may generate a first protection key when receiving a first protection key acquisition request and record a mapping relationship between the first protection key and the first key ID.

In another example, when the target encryption node needs to obtain a first protection key, it first obtains a first key ID from the key management system, and then obtains the first protection key from the key management system based on the first key ID.

In step S120, the target encryption node encrypts the first video key using the first protection key to obtain a first key ciphertext.

In step S130, the target encryption node stores the first key ciphertext and the first key ID in the first video ciphertext.

In an embodiment of the present invention, when the first protection key is obtained by the above method, in order to improve the security of the first video key, the target encryption node may encrypt the first video key using the first protection key to obtain a corresponding key ciphertext (referred to as the first key ciphertext in this specification).

When encrypting the first video key to obtain the first key ciphertext, the target encryption node may store the first key ciphertext and the first key ID in the first video ciphertext. This allows the legitimate node to obtain a first protection key from the key management server based on the first key ID in the first video ciphertext, decrypt the first key ciphertext based on the first protection key to obtain the first video key, and further decrypt the first video ciphertext based on the first video key to obtain the first video data slice.

Exemplarily, the legitimate node may include any one of the plurality of encryption nodes, or any other node that has the authority to obtain the video data.

Exemplarily, the target encryption node may store the first video ciphertext in a concatenated manner with the first key ciphertext and the first key ID, i.e., concatenate the first key ciphertext and the first key ID into the first video ciphertext.

Thus, in the method flow shown in FIG. 1, multiple video data slices obtained by slicing the same video stream or video file are assigned to at least two encryption nodes for encryption, and different video data slices of the same video stream or video file are encrypted by the at least two encryption nodes, thereby realizing distributed encryption and improving the encryption efficiency of the video data slices. In addition, when encrypting the video data slices, the encryption node can use the generated random number as a video key and encrypt the video key using a protection key obtained from the key management system, thereby ensuring the security of the video key and improving the security of the video data slices.

In some embodiments, as shown in FIG. 2, in step S100, the step in which the target encryption node obtains a first protection key from the key management system based on the first key ID may be realized by the following steps S101 to S106.

In step S101, the target encryption node generates a second random number and generates key parameters using the elliptic curve dot product algorithm based on the second random number and a base point on the elliptic curve.

In step S102, the target encryption node signs the device ID, the first key ID, and the key parameters of the target encryption node using an elliptic curve cryptography (ECC) algorithm based on the private key of the target encryption node to obtain first signature data.

In step S103, the target encryption node transmits the device ID, the first key ID, the key parameters, and the first signature data to the key management system, thereby causing the key management system to obtain the public key of the target encryption node based on the device ID, and to verify the first signature data using an elliptic curve cryptography algorithm based on the public key of the target encryption node, and if the verification is successful, to encrypt the first protection key corresponding to the first key ID based on a third key to obtain a protection key ciphertext. The third key is generated by the key management system based on the key parameters and the private key of the key management system using an elliptic curve dot product algorithm.

In step S104, the target encryption node receives the protected key ciphertext sent from the key management system.

In step S105, the target encryption node generates a fourth key using the elliptic curve dot product algorithm based on the public key of the key management system and the second random number.

In step S106, the target encryption node decrypts the protection key ciphertext based on the fourth key to obtain the first protection key.

For example, to improve the security of the protection key and further improve the security of the video data slices, when obtaining the protection key from the key management system, the obtaining device may be verified based on an asymmetric algorithm.

For example, when it is necessary to obtain the first protection key, the target encryption node may generate one random number (referred to as the second random number in this specification) and generate key parameters using an elliptic curve dot product algorithm based on the second random number and a base point on an elliptic curve. For the elliptic curve, for example, a curve commonly used in the Elliptic Curve Digital Signature Algorithm (ECDSA) may be selected, and the embodiment of the present invention does not place any particular limitation on the selection of the elliptic curve. Once the elliptic curve is determined, the base point is also determined.

For example, if the second random number is r and the base point on the elliptic curve is G, the key parameter R can be generated as follows:
R = G r
Here, "." represents an elliptic curve dot product.

For example, when the target encryption node generates key parameters using the above method, the target encryption node may sign the device ID of the target encryption node, the first key ID, and the generated key parameters using an elliptic curve cryptography algorithm based on the private key of the target encryption node to obtain corresponding signature data (referred to as first signature data in this specification).

The target encryption node may send the device ID, the first key ID, the key parameters, and the first signature data to the key management system.

When the key management system receives the device ID, the first key ID, the key parameters, and the first signature data sent from the target encryption node, it may, on the one hand, query the public key of the target encryption node based on the device ID.

As an example, each encryption node in a video data slice encryption system may register with a key management system before encrypting the video data slice. During the registration process, once identity authentication is complete, the key management system may store the encryption node's public key, and the encryption node may store the public key of the key management system.

For example, if the key management system queries the public key of the target encryption node, the first signature data may be verified using an elliptic curve cryptography algorithm based on the public key of the target encryption node.

The key management system may, on the other hand, generate a corresponding key (referred to herein as a third key) using an elliptic curve dot product algorithm based on the received key parameters and the key management system's private key.

For example, given the key parameters R and the private key of the key management system s, the third key k can be generated as follows:
k = R s

If the key management system passes the verification of the first signature data, it can determine that the target encryption node is a legitimate node, and in this case, the key management system may use a third key to encrypt a protection key (e.g., the above-mentioned first protection key) corresponding to the first key ID to obtain a protection key ciphertext, and transmit the protection key ciphertext to the target encryption node.

Exemplarily, when the target encryption node receives the protected key ciphertext, it may generate a corresponding key (referred to herein as the fourth key) using an elliptic curve dot product algorithm based on the public key of the key management system and the second random number.

For example, if the second random number is r and the public key of the key management system is S, then the fourth key k′ can be generated as follows:
k' = S r

Note that if the target cryptographic node and the key management system are both legitimate devices, the values of k and k' are the same.

If the target encryption node generates a fourth key, it may use the fourth key to decrypt the received protection key ciphertext to obtain the first protection key.

In one example, before step S106 (i.e., the target encryption node decrypts the protected key ciphertext based on the fourth key),
receiving, by the target cryptographic node, a key parameter ciphertext sent from the key management system, the key parameter ciphertext being obtained by encrypting the key parameters by the key management system with a third key;
The method may further include the step of the target encryption node decrypting the key parameter ciphertext with the fourth key, and if the decryption result matches the key parameters, deciding to perform an operation to decrypt the protected key ciphertext based on the fourth key.

For example, to improve the reliability of the protection key and further improve the security of the video data slices, the key management system may encrypt the received key parameters using a third key to obtain a key parameter ciphertext before transmitting the protection key ciphertext to the target encryption node, and transmit the key parameter ciphertext and the protection key ciphertext obtained by the above method to the target encryption node.

When the target encryption node receives the key parameter ciphertext and the protection key ciphertext, it decrypts the key parameter ciphertext using the fourth key, compares the decryption result with the above key parameters, and if the two match, determines that the key parameter ciphertext and the protection key ciphertext were sent from the key management system. In this case, the target encryption node may decrypt the protection key ciphertext using the fourth key to obtain the first protection key.

In addition, if the target encryption node does not receive the key parameter ciphertext, or if it fails to decrypt the received key parameter ciphertext based on the fourth key, or if the decryption result does not match the above key parameters, it may determine that the received protection key ciphertext is not trustworthy, in which case the target encryption node does not need to decrypt the protection key ciphertext.

In some embodiments, as shown in FIG. 3, the video data slice encryption method provided by the embodiment of the present invention may further include the following steps S300 to S330.

In step S300, if the target encryption node detects a decryption instruction for the second video ciphertext, it extracts the second key ciphertext and the second key ID from the second video ciphertext.

In step S310, the target encryption node obtains a second protection key from the key management system based on the second key ID. Here, the second protection key is sent to the target encryption node by the key management system if the second protection key passes the verification of the target encryption node.

In step S320, the target encryption node decrypts the second key ciphertext based on the second protection key to obtain a second video key.

In step S330, the target encryption node decrypts the second video ciphertext based on the second video key.

Exemplarily, the second video ciphertext may be the first video ciphertext, or the second video ciphertext may be any other video ciphertext other than the first video ciphertext, encrypted according to the video data slice encryption method provided by an embodiment of the present invention.

For example, when the target encryption node detects a decryption instruction for the second video ciphertext, the target encryption node may extract from the second video ciphertext a key ciphertext (referred to herein as the second key ciphertext) and a key ID (referred to herein as the second key ID) stored in the second video ciphertext.

Note that if the second video ciphertext is the first video ciphertext, the second key ciphertext is the first key ciphertext, and the second key ID is the first key ID.

For example, the target encryption node may obtain a corresponding protection key (referred to as the second protection key in this specification) from the key management system based on the extracted second key ID.

Exemplarily, a specific implementation in which the target encryption node obtains a second protection key from a key management system based on a second key ID may refer to the implementation related to the target encryption node obtaining a first protection key from the key management system based on a first key ID described in the above embodiment, and will not be repeated in the embodiments of the present invention.

The target encryption node may decrypt the second key ciphertext extracted from the second video ciphertext based on the obtained second protection key to obtain a corresponding video key (referred to herein as the second video key), and decrypt the second video ciphertext based on the second video key.

In order to help those skilled in the art better understand the technical solutions provided by the embodiments of the present invention, the technical solutions provided by the embodiments of the present invention will be described below in relation to specific application scenarios.

Referring to FIG. 4, it is an architecture schematic diagram of a specific application scenario of the video data slice encryption method provided by an embodiment of the present invention. As shown in FIG. 4, the video data slice encryption system may include a plurality of encryption nodes (e.g., encryption node 1 to encryption node N in FIG. 4, where N is a positive integer equal to or greater than 2) and a key management system (KMS). The key management system may provide the VKEK to the outside, and specifically, the key management system may be responsible for generating, distributing, destroying, etc. the VKEK. In some embodiments, the key management system may include the above-mentioned key management server.

As shown in FIG. 4, in order to improve the security of video data, video data (video stream or video file) may be sliced to obtain multiple video data slices (e.g., U1 to U5 in FIG. 4), and the multiple video data slices may be pushed to each encryption node, and each encryption node may randomly generate a working key (e.g., the above-mentioned video key), obtain a VKEK (e.g., the above-mentioned protection key) by interacting with a KMS, encrypt the working key using the obtained VKEK to obtain a working key ciphertext (e.g., the above-mentioned key ciphertext), encrypt the video data slices using the generated working key to obtain a video ciphertext (e.g., EU1 to EU5 in FIG. 4), and concatenate the key ID corresponding to the VKEK and the working key ciphertext to the video ciphertext.

In this embodiment, the encryption method for video data slices may include a registration stage, a key request stage, a video encryption stage, and a video decryption stage, and the implementation flow of each stage is described below.

Phase 1, registration phase

In 1.1, the encryption node sends the node's public key (assumed to be D) and device ID to the KMS, and after the KMS passes the encryption node's verification, it associates and stores the encryption node's public key D and device ID.

Exemplarily, the public key of the encryption node may be attached to a certificate and sent to the KMS, and the encryption node may be verified by the KMS based on the certificate. If the encryption node passes verification by the KMS, the KMS may extract the encryption node's public key from the certificate and store it in association with the device ID of the encryption node.

In 1.2, the KMS sends the KMS public key (assumed to be S) to the encryption node, which stores the KMS public key.

Exemplarily, the KMS public key may be attached to a certificate and sent to the encryption node, which may then verify the KMS based on the certificate. If the encryption node passes the KMS verification, the encryption node may extract the KMS public key from the certificate and store the public key.

Phase 2, key request phase

In 2.1, the encryption node randomly generates r and uses the elliptic curve dot product algorithm to calculate R = G r to obtain the key parameter R. Illustratively, G is the base point on the elliptic curve.

In 2.2, the encryption node uses an ECC algorithm to sign the encryption node's device ID, key ID (which may be generated by the encryption node or may be generated, for example, based on a timestamp), and key parameters R based on the encryption node's private key, to obtain signature data Sig(Device ID || Key ID || R) (e.g., the first signature data described above).

For example, "||" indicates string concatenation.

In 2.3, the encryption node sends device ID || key ID || R || Sig (device ID || key ID || R) to the KMS.

In 2.4, the KMS queries the public key of the encryption node according to the device ID, and verifies Sig(Device ID || Key ID || R) using the ECC algorithm based on the public key. If the verification passes, it executes 2.5, otherwise it returns an error.

In 2.5, the KMS calculates k = R · s using the elliptic curve dot product algorithm based on the KMS's private key (assumed to be s) and key parameters, and obtains the corresponding key k (e.g., the third key mentioned above).

In 2.6, the KMS queries the VKEK (assuming it is v) that corresponds to the key ID based on the key ID.

In 2.7, the KMS encrypts R and v using k as the symmetric key to obtain corresponding ciphertexts c1 (e.g., the key parameter ciphertext) and c2 (e.g., the protection key ciphertext).

In 2.8, KMS sends c1 and c2 to the encryption node.

In 2.9, the encryption node calculates k' = S · r using the elliptic curve dot product algorithm based on the KMS public key S and the random number r, and obtains the corresponding key k' (e.g., the fourth key).

In 2.10, the encryption node decrypts c1 using k', and if the decrypted result is R, executes 2.11; otherwise, it returns an error.

In 2.11, the encryption node decrypts c2 using k' to obtain the protection key v.

Phase 3: Video encryption phase

In 3.1, if an encryption instruction for any of the allocated video data slices is detected, the encryption node may generate a key ID based on the timestamp and obtain a protection key v from the KMS based on the key ID. For the implementation process, please refer to the description of the key request phase above.

In 3.2, the encryption node generates a random number vek (e.g., the first random number described above) and sets vek as the working key (i.e., the video key).

In 3.3, the encryption node encrypts the video data slice using vek to obtain a video ciphertext.

In 3.4, the encryption node encrypts vek using v to obtain the vek ciphertext (e.g., the key ciphertext above).

In 3.5, the encryption node concatenates the vek ciphertext and the key ID to the video ciphertext.

Fourth stage: video decoding stage

In 4.1, when a decryption instruction is detected for any video ciphertext (e.g., the video ciphertext obtained in the video encryption stage above), the encryption node extracts the vek ciphertext and key ID that are attached to the video ciphertext.

In 4.2, the encryption node obtains the protection key v from the KMS based on the key ID. See the description of the key request stage above for the implementation process.

In 4.3, the encryption node uses v to decrypt the vek ciphertext and obtain vek.

In 4.4, the encryption node uses vek to decrypt the video ciphertext.

As an example, a flowchart of the above steps 1 to 4 is shown in Figure 5.

The above describes the method provided by the present invention. Below, we will explain the device and system provided by the present invention.

Referring to FIG. 6, FIG. 6 is a structural schematic diagram of a video data slice encryption device provided by an embodiment of the present invention. The video data slice encryption device may be applied to the encryption node in the above embodiment, and as shown in FIG. 6, the video data slice encryption device may include an acquisition unit 610, an encryption unit 620, and a processing unit 630.

The acquisition unit 610 is used to acquire a first key ID and acquire a first protection key from the key management system based on the first key ID. Here, the first protection key is sent by the key management system to the target encryption node if it passes the verification of the target encryption node, and the protection keys corresponding to the same key ID are the same.

The encryption unit 620 is used to generate a first random number and use the first random number as a first video key to encrypt the video data slice to be encrypted to obtain a first video ciphertext.

The encryption unit 620 is further used to encrypt the first video key using the first protection key to obtain a first key ciphertext.

The processing unit 630 is used to store the first key ciphertext and the first key ID in the first video ciphertext.

In some embodiments, the obtaining unit 610 obtains a first protection key from the key management system based on the first key ID, the first protection key being obtained by the obtaining unit 610 comprising:
generating a second random number and generating key parameters based on the second random number and a base point on an elliptic curve using an elliptic curve dot product algorithm;
signing a device ID of the target encryption node, the first key ID, and the key parameters using an elliptic curve cryptography algorithm based on a private key of the target encryption node to obtain first signature data;
sending the device ID, the first key ID, the key parameters, and the first signature data to the key management system, causing the key management system to obtain a public key of the target encryption node based on the device ID, verify the first signature data based on the public key of the target encryption node using an elliptic curve cryptography algorithm, and if the verification is successful, encrypt the first protection key corresponding to the first key ID based on a third key to obtain a protection key ciphertext, wherein the third key is generated by the key management system based on the key parameters and a private key of the key management system using an elliptic curve dot product algorithm;
receiving the protected key ciphertext transmitted from the key management system;
generating a fourth key based on a public key of the key management system and the second random number using an elliptic curve dot product algorithm;
decrypting the protection key ciphertext based on the fourth key to obtain the first protection key.

In some embodiments, before decrypting the protected key ciphertext based on a fourth key, the obtaining unit 610 further
receiving a key parameter ciphertext transmitted from the key management system, the key parameter ciphertext being obtained by encrypting the key parameters using the third key by the key management system;
The fourth key is used to decrypt the key parameter ciphertext, and if the decryption result matches the key parameters, it is used to determine to perform an operation of decrypting the protection key ciphertext based on the fourth key.

In some embodiments, referring to FIG. 7, the apparatus further includes an extraction unit 640 and a decoding unit 650;
The extraction unit 640 is used to extract a second key ciphertext and a second key ID from the second video ciphertext when detecting a decryption instruction for the second video ciphertext;
The obtaining unit 610 is further used for obtaining a second protection key from the key management system according to the second key ID, and the second protection key is sent to the target encryption node by the key management system if the second protection key passes the verification of the target encryption node;
a decryption unit 650 is used to decrypt the second key ciphertext based on the second protection key to obtain a second video key;
The decryption unit 650 is further used for decrypting the second video ciphertext based on the second video key.

Referring to FIG. 8, FIG. 8 is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. The electronic device includes a processor 801 and a machine-readable storage medium 802, in which machine-executable instructions are stored. The processor 801 and the machine-readable storage medium 802 may communicate via a system bus 803. The processor 801 can then read and execute the machine-executable instructions corresponding to the encryption control logic of the video data slices in the machine-readable storage medium 802 to execute the encryption method of the video data slices.

The machine-readable storage medium 802 referred to herein may be any electronic, magnetic, optical, or other physical storage device capable of containing or storing information, such as executable commands, data, etc. For example, the machine-readable storage medium may be a RAM (Random Access Memory), a volatile memory, a non-volatile memory, a flash memory, a storage drive (e.g., a hard disk drive), a solid-state drive, any type of storage disk (e.g., an optical disk, a dvd, etc.), or a similar storage medium, or a combination thereof.

In some embodiments, a machine-readable storage medium is provided that stores machine-executable instructions that, when executed by a processor, perform the method for encrypting the video data slices. For example, the machine-readable storage medium may be a ROM, RAM, CD-ROM, tape, floppy disk, optical data storage device, etc.

9, which is a structural schematic diagram of a video data slice encryption system provided by an embodiment of the present invention. As shown in FIG. 9, the video data slice encryption system includes a key management system 910 and a plurality of encryption nodes 920, and a plurality of video data slices obtained by slicing the same video stream or video file are assigned to at least two of the plurality of encryption nodes 920 for encryption;
When the encryption node 920 is a target encryption node, obtain a first key ID, obtain a first protection key from the key management system according to the first key ID, generate a first random number, and use the first random number as a first video key to encrypt the video data slice to be encrypted to obtain a first video ciphertext, and the protection keys corresponding to the same key ID are the same;
if the key management system 910 passes the verification of the target encryption node, to send the first protection key corresponding to the first key ID to the target encryption node;
If the encryption node 920 is a target encryption node, it is further used to encrypt the first video key with the first protection key to obtain a first key ciphertext;
If the encryption node 920 is the target encryption node, it is further used to store the first key ciphertext and the first key ID in the first video ciphertext.

In some embodiments, when the encryption node 920 is a target encryption node, the following steps are specifically used: generate a second random number; generate key parameters using an elliptic curve dot product algorithm based on the second random number and a base point on an elliptic curve; sign a device ID of the target encryption node, the first key ID, and the key parameters using an elliptic curve cryptography algorithm based on a private key of the target encryption node, obtain first signature data, and send the device ID, the first key ID, the key parameters, and the first signature data to the key management system;
The key management system 910 is specifically used to verify the first signature data according to the public key of the target encryption node using an elliptic curve cryptography algorithm, and if the verification is passed, generate a third key according to the key parameters and a private key of the key management system using an elliptic curve dot product algorithm;
The key management system 910 is further specifically used for encrypting the first protection key corresponding to the first key ID according to the third key to obtain a protection key ciphertext, and sending the protection key ciphertext to the target encryption node;
When the encryption node 920 is a target encryption node, it is further used to receive the protection key ciphertext sent from the key management system, generate a fourth key using an elliptic curve dot product algorithm based on the public key of the key management system and the second random number, decrypt the protection key ciphertext based on the fourth key, and obtain the first protection key.

In some embodiments, the key management system 910 is further used to encrypt the key parameters using the third key to obtain a key parameter ciphertext, and send the key parameter ciphertext to the encryption node;
When the encryption node 920 is a target encryption node, the encryption node 920 is further used to receive a key parameter ciphertext sent from the key management system, decrypt the key parameter ciphertext using the fourth key, and if the decryption result matches the key parameters, decrypt the protection key ciphertext based on the fourth key.

It should be noted that, in this specification, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that such an actual relationship or sequence exists between those entities or operations. Furthermore, the terms "comprise", "consist of", or other variations are intended to be non-exclusive inclusive, whereby a process, method, article, or device that includes a set of elements includes not only those elements, but also other elements not expressly listed or elements inherent in such process, method, article, or device. In the absence of further limitations, an element limited by the expression "comprises" does not exclude the presence of other identical elements in the process, method, article, or device that includes the element.

The above are merely examples of the present invention and are not intended to limit the present invention. Those skilled in the art can make various modifications and changes to the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of the claims of the present invention.

610 Acquisition unit 620 Encryption unit 630 Processing unit 640 Extraction unit 650 Decryption unit 801 Processor 802 Machine-readable storage medium 803 System bus 910 Key management system 920 Encryption node

SUMMARY OF THE DISCLOSURE In view of the above, the present invention provides a method, apparatus , system and electronic device for encrypting video data slices.

According to a first aspect of an embodiment of the present invention, there is provided a method for encrypting a video data slice to be applied to a target encryption node in a video data slice encryption system including a key management system and a plurality of encryption nodes, the target encryption node being one of the plurality of encryption nodes, and a plurality of video data slices obtained by slicing a same video stream or video file are assigned to at least two of the plurality of encryption nodes for encryption, the method comprising:
the target encryption node obtains a first key ID, obtains a first protection key from the key management system according to the first key ID, the target encryption node generates a first random number, and uses the first random number as a first video key to encrypt a video data slice to obtain a first video ciphertext, where the protection key is used to encrypt the video key, and the protection keys corresponding to the same key ID are the same;
the target encryption node encrypting the first video key with the first protection key to obtain a first key ciphertext;
the target encryption node storing the first key ciphertext and the first key ID in the first video ciphertext.

According to a second aspect of an embodiment of the present invention, there is provided an apparatus for encrypting a video data slice to be applied to a target encryption node in a video data slice encryption system including a key management system and a plurality of encryption nodes, the target encryption node being one of the plurality of encryption nodes, a plurality of video data slices obtained by slicing a same video stream or video file are assigned to at least two of the plurality of encryption nodes for encryption, the apparatus comprising:
an acquiring unit for acquiring a first key ID and acquiring a first protection key from the key management system according to the first key ID, the protection key being used to encrypt a video key, and the protection keys corresponding to the same key ID are the same;
an encryption unit for generating a first random number and encrypting a video data slice to be encrypted with the first random number as a first video key to obtain a first video ciphertext, the encryption unit being further used to encrypt the first video key with the first protection key to obtain a first key ciphertext;
a processing unit for storing the first key ciphertext and the first key ID in the first video ciphertext.

According to a third aspect of an embodiment of the present invention, there is provided a system for encrypting video data slices, the system comprising a key management system and a plurality of encryption nodes, wherein a plurality of video data slices obtained by slicing a same video stream or video file are assigned to at least two of the plurality of encryption nodes for encryption;
When the encryption node is a target encryption node, obtain a first key ID, obtain a first protection key from the key management system according to the first key ID, generate a first random number, and use the first random number as a first video key to encrypt the video data slice to be encrypted to obtain a first video ciphertext, the protection key is used to encrypt the video key, and the protection keys corresponding to the same key ID are the same;
if the key management system passes the verification of the target encryption node, to transmit the first protection key corresponding to the first key ID to the target encryption node;
if the encryption node is a target encryption node, the encryption node further comprises encrypting the first video key with the first protection key to obtain a first key ciphertext;
If the encryption node is a target encryption node, it is further used to store the first key ciphertext and the first key ID in the first video ciphertext.

According to a fourth aspect of an embodiment of the present invention, there is provided an electronic device adapted to be a target encryption node in an encryption system for video data slices comprising a key management system and a plurality of encryption nodes, the target encryption node being any one of the plurality of encryption nodes, a plurality of video data slices obtained by slicing a same video stream or video file are assigned to at least two of the plurality of encryption nodes for encryption, the electronic device comprising a processor and a machine-readable storage medium, the machine-readable storage medium storing machine-executable instructions, the processor executing the machine-executable instructions to:
Obtain a first key ID, and obtain a first protection key from the key management system according to the first key ID, the protection key is used to encrypt a video key, and the protection keys corresponding to the same key ID are the same;
generating a first random number, and encrypting the video data slice to be encrypted using the first random number as a first video key to obtain a first video ciphertext;
encrypting the first video key with the first protection key to obtain a first key ciphertext;
The device is configured to perform an operation of storing the first key ciphertext and the first key ID in the first video ciphertext.

In step S100, a target encryption node obtains a first key identifier (ID), and obtains a first protection key from the key management system based on the first key ID, where the protection key is used to encrypt a video key, and the protection keys corresponding to the same key ID are the same.

Meanwhile, the target encryption node may obtain a protection key (herein referred to as a first protection key) for encrypting the first video key from the key management system , which is sent to the target encryption node by the key management system if the first protection key passes the verification of the target encryption node.

The obtaining unit 610 is used to obtain a first key ID, and obtain a first protection key from the key management system according to the first key ID, where the protection key is used to encrypt a video key, and the protection keys corresponding to the same key ID are the same.

9, which is a structural schematic diagram of a video data slice encryption system provided by an embodiment of the present invention. As shown in FIG. 9, the video data slice encryption system includes a key management system 910 and a plurality of encryption nodes 920, and a plurality of video data slices obtained by slicing the same video stream or video file are assigned to at least two of the plurality of encryption nodes 920 for encryption;
When the encryption node 920 is a target encryption node, obtain a first key ID, obtain a first protection key from the key management system according to the first key ID, generate a first random number, and use the first random number as a first video key to encrypt the video data slice to be encrypted to obtain a first video ciphertext, the protection key is used to encrypt the video key, and the protection keys corresponding to the same key ID are the same;
if the key management system 910 passes the verification of the target encryption node, to send the first protection key corresponding to the first key ID to the target encryption node;
If the encryption node 920 is a target encryption node, it is further used to encrypt the first video key with the first protection key to obtain a first key ciphertext;
If the encryption node 920 is the target encryption node, it is further used to store the first key ciphertext and the first key ID in the first video ciphertext.

Claims (15)

A video data slice encryption method applied to a target encryption node in a video data slice encryption system including a key management system and a plurality of encryption nodes, the target encryption node being one of the plurality of encryption nodes, wherein a plurality of video data slices obtained by slicing a same video stream or video file are assigned to at least two of the plurality of encryption nodes and encrypted;
the target encryption node obtains a first key ID, and obtains a first protection key from the key management system based on the first key ID, the protection key is used to encrypt a video key, and the protection keys corresponding to the same key ID are the same;
the target encryption node generating a first random number and encrypting the to-be-encrypted video data slice with the first random number as a first video key to obtain a first video ciphertext;
the target encryption node encrypting the first video key with the first protection key to obtain a first key ciphertext;
the target encryption node storing the first key ciphertext and the first key ID in the first video ciphertext. The step of the target encryption node obtaining a first protection key from the key management system based on the first key ID, comprising:
the target cryptographic node generating a second random number and generating key parameters based on the second random number and a base point on an elliptic curve using an elliptic curve dot product algorithm;
the target encryption node signing the device ID of the target encryption node, the first key ID, and the key parameters using an elliptic curve cryptography algorithm based on a private key of the target encryption node to obtain first signature data;
the target encryption node sends the device ID, the first key ID, the key parameters, and the first signature data to the key management system, causing the key management system to obtain a public key of the target encryption node based on the device ID, verify the first signature data using an elliptic curve cryptography algorithm based on the public key of the target encryption node, and if the verification is successful, encrypt the first protection key corresponding to the first key ID based on a third key to obtain a protection key ciphertext, wherein the third key is generated by the key management system based on the key parameters and a private key of the key management system using an elliptic curve dot product algorithm;
receiving, by the target cryptographic node, the protected key ciphertext transmitted from the key management system;
the target cryptographic node generating a fourth key based on the public key of the key management system and the second random number using an elliptic curve dot product algorithm;
and the target encryption node decrypting the protection-key ciphertext based on the fourth key to obtain the first protection key. before the target encryption node decrypts the protection key ciphertext based on the fourth key,
receiving, by the target cryptographic node, a key parameter ciphertext sent from the key management system, the key parameter ciphertext being obtained by encrypting, by the key management system, the key parameters with the third key;
3. The method of claim 2, further comprising: the target encryption node decrypting the key parameter ciphertext with the fourth key, and if the decryption result matches the key parameters, determining to perform an operation to decrypt the protected key ciphertext based on the fourth key. extracting a second key ciphertext and a second key ID from the second video ciphertext when the target encryption node detects a decryption instruction for the second video ciphertext;
the target encryption node obtaining a second protection key from the key management system based on the second key ID, the second protection key being sent by the key management system to the target encryption node in response to a request sent from the target encryption node for a protection key to which the second key ID is attached, if the second protection key passes verification by the target encryption node;
the target encryption node decrypting the second key ciphertext based on the second protection key to obtain a second video key;
2. The method of claim 1, further comprising the step of the target encryption node decrypting the second video ciphertext based on the second video key. A video data slice encryption device applied to a target encryption node in a video data slice encryption system including a key management system and a plurality of encryption nodes, the target encryption node being one of the plurality of encryption nodes, wherein a plurality of video data slices obtained by slicing a same video stream or video file are assigned to at least two of the plurality of encryption nodes and encrypted;
An acquisition unit for acquiring a first key ID and acquiring a first protection key from the key management system according to the first key ID, where protection keys corresponding to the same key ID are the same;
an encryption unit for generating a first random number and encrypting a video data slice to be encrypted with the first random number as a first video key to obtain a first video ciphertext, the encryption unit being further used to encrypt the first video key with the first protection key to obtain a first key ciphertext;
a processing unit for storing the first key ciphertext and the first key ID in the first video ciphertext. When obtaining the first protection key from the key management system based on the first key ID, the obtaining unit:
generating a second random number; and generating key parameters based on the second random number and a base point on an elliptic curve using an elliptic curve dot product algorithm;
signing the device ID of the target encryption node, the first key ID, and the key parameters using an elliptic curve cryptography algorithm based on a private key of the target encryption node to obtain first signature data;
sending the device ID, the first key ID, the key parameters, and the first signature data to the key management system, causing the key management system to obtain a public key of the target encryption node based on the device ID, verify the first signature data based on the public key of the target encryption node using an elliptic curve cryptography algorithm, and if the verification is successful, encrypt the first protection key corresponding to the first key ID based on a third key to obtain a protection key ciphertext, where the third key is generated by the key management system based on the key parameters and a private key of the key management system using an elliptic curve dot product algorithm;
receiving the protected key ciphertext transmitted from the key management system;
generating a fourth key based on the public key of the key management system and the second random number using an elliptic curve dot product algorithm;
6. The apparatus of claim 5, wherein the apparatus is used to decrypt the protection key ciphertext based on the fourth key to obtain the first protection key. Before decrypting the protected key ciphertext based on the fourth key, the obtaining unit further:
receiving a key parameter ciphertext transmitted from the key management system, the key parameter ciphertext being obtained by encrypting the key parameters using the third key by the key management system;
7. The apparatus of claim 6, further comprising: a fourth key for decrypting the key parameter ciphertext; and, if the result of the decryption matches the key parameters, determining to perform an operation of decrypting the protection key ciphertext based on the fourth key. The apparatus further includes an extracting unit and a decoding unit;
The extraction unit is used to extract a second key ciphertext and a second key ID from the second video ciphertext when detecting a decryption instruction for the second video ciphertext;
The obtaining unit is further used to obtain a second protection key from the key management system based on the second key ID, and the second protection key is sent by the key management system to the target encryption node in response to a request for obtaining a protection key with the second key ID attached thereto, if the second protection key passes the verification of the target encryption node;
the decryption unit is used to decrypt the second key ciphertext based on the second protection key to obtain a second video key;
6. The apparatus of claim 5, wherein the decryption unit is further used for decrypting the second video ciphertext based on the second video key. A video data slice encryption system, comprising: a key management system and a plurality of encryption nodes, wherein a plurality of video data slices obtained by slicing a same video stream or video file are assigned to at least two of the plurality of encryption nodes for encryption;
When the encryption node is a target encryption node, obtain a first key ID, obtain a first protection key from the key management system according to the first key ID, generate a first random number, and use the first random number as a first video key to encrypt the video data slice to be encrypted to obtain a first video ciphertext, and the protection keys corresponding to the same key ID are the same;
if the key management system passes the verification of the target encryption node, to transmit the protection key corresponding to the first key ID to the target encryption node;
if the encryption node is a target encryption node, the encryption node further comprises encrypting the first video key with the first protection key to obtain a first key ciphertext;
When the encryption node is a target encryption node, the encryption node is further used to store the first key ciphertext and the first key ID in the first video ciphertext. if the encryption node is a target encryption node, generating a second random number, generating key parameters using an elliptic curve dot product algorithm based on the second random number and a base point on an elliptic curve, signing a device ID of the target encryption node, the first key ID, and the key parameters using an elliptic curve cryptography algorithm based on a private key of the target encryption node, obtaining first signature data, which is used to send the device ID, the first key ID, the key parameters, and the first signature data to the key management system;
the key management system verifies the first signature data using an elliptic curve cryptography algorithm based on the public key of the target encryption node, and if the verification is successful, generates a third key using an elliptic curve dot product algorithm based on the key parameters and a private key of the key management system;
the key management system is further adapted to encrypt the first protection key corresponding to the device ID based on the third key to obtain a protection key ciphertext, and send the protection key ciphertext to the target encryption node;
10. The system of claim 9, wherein when the encryption node is a target encryption node, the encryption node is further used to receive the protection key ciphertext sent from the key management system, generate a fourth key using an elliptic curve dot product algorithm based on a public key of the key management system and the second random number, and decrypt the protection key ciphertext based on the fourth key to obtain the first protection key. the key management system is further adapted to encrypt the key parameters using the third key to obtain a key parameter ciphertext, and to transmit the key parameter ciphertext to the encryption node;
11. The system of claim 10, wherein when the encryption node is a target encryption node, the encryption node further receives the key parameter ciphertext sent from the key management system, decrypts the key parameter ciphertext using the fourth key, and, if a result of the decryption matches the key parameters, is used to decrypt the protection key ciphertext based on the fourth key. An electronic device adapted to be a target encryption node in a video data slice encryption system including a key management system and a plurality of encryption nodes, the target encryption node being any one of the plurality of encryption nodes, and a plurality of video data slices obtained by slicing a same video stream or video file are assigned to at least two of the plurality of encryption nodes for encryption, the electronic device including a processor and a machine-readable storage medium;
The machine-readable storage medium has machine-executable instructions stored thereon;
The processor executes the machine-executable instructions to:
Obtain a first key ID, and obtain a first protection key from the key management system based on the first key ID, and the protection keys corresponding to the same key ID are the same;
generating a first random number, and encrypting the video data slice to be encrypted using the first random number as a first video key to obtain a first video ciphertext;
encrypting the first video key with the first protection key to obtain a first key ciphertext;
13. An electronic device configured to perform an operation of storing the first key ciphertext and the first key ID in the first video ciphertext. When obtaining a first protection key from the key management system based on the first key ID, the processor further executes the machine-executable instructions to:
generating a second random number; and generating key parameters based on the second random number and a base point on an elliptic curve using an elliptic curve dot product algorithm;
signing the device ID of the target encryption node, the first key ID, and the key parameters using an elliptic curve cryptography algorithm based on a private key of the target encryption node to obtain first signature data;
sending a device ID of the target encryption node, the first key ID, the key parameters, and the first signature data to the key management system, causing the key management system to obtain a public key of the target encryption node based on the device ID, verify the first signature data based on the public key of the target encryption node using an elliptic curve cryptography algorithm, and if the verification is successful, encrypt the first protection key corresponding to the first key ID based on a third key to obtain a protection key ciphertext, the third key being generated by the key management system based on the key parameters and a private key of the key management system using an elliptic curve dot product algorithm;
receiving the protected key ciphertext transmitted from the key management system;
generating a fourth key based on the public key of the key management system and the second random number using an elliptic curve dot product algorithm;
13. The electronic device of claim 12, configured to perform an operation of decrypting the protection key ciphertext based on the fourth key to obtain the first protection key. Prior to decrypting the protected key ciphertext based on the fourth key, the processor further executes the machine-executable instructions to:
receiving a key parameter ciphertext transmitted from the key management system, the key parameter ciphertext being obtained by encrypting the key parameters using the third key by the key management system;
14. The electronic device of claim 13, further configured to perform an operation of determining to decrypt the key parameter ciphertext using the fourth key and, if a result of the decryption matches the key parameters, to perform an operation of decrypting the protection key ciphertext based on the fourth key. The processor further executes the machine-executable instructions to:
When detecting a decryption instruction for the second video ciphertext, extracting a second key ciphertext and a second key ID from the second video ciphertext;
obtaining a second protection key from the key management system based on the second key ID, the second protection key being sent by the key management system to the target encryption node in response to a request sent from the target encryption node for obtaining a protection key to which the second key ID is attached, if the second protection key passes verification by the target encryption node;
decrypting the second key ciphertext based on the second protection key to obtain a second video key;
The electronic device of claim 12 , configured to perform an operation of decrypting the second video ciphertext based on the second video key.