KR101784943B1 - image signal encoding apparatus - Google Patents

Abstract

The present invention relates to a plug-in video encryption system for a network-based video equipment, which comprises a data packet analysis module for analyzing a header and data from a packet transmitted from an IP camera connected through a communication interface, An encrypted packet generation module for encrypting the video data and generating encoded packets by adding the encrypted additional information to the header if the video data is present, and transmitting the encrypted packets generated by the encrypted packet generation module to the destination communication address via the Internet And an encryption packet transmission module. According to the plug-in image encryption system for network-based video equipment, it is easy to securely process the image generated in the network-based video equipment, and it is possible to use the existing network-based video equipment as it is.

Description

A plug-in video encryption system for network-based video equipment {image signal encoding apparatus}

The present invention relates to a plug-in image encryption system for a network-based video device, and more particularly, to a plug-in image encryption system for a network-based video device that encrypts an image generated in a network- .

IP camera is a digital camera installed for surveillance and has the function to send or receive data through Internet. Network-based video equipment, such as IP cameras, has the problem of being exposed to a variety of people, including hackers, when video data must be transmitted over the Internet.

In order to encrypt the image, there is a method of encrypting the image data itself and a method of encrypting the image after the image is compressed. However, there is a problem in that the encryption of the image data itself has a large amount of computation. Therefore, .

Korean Patent Laid-Open No. 10-2017-0032776 discloses a method for selecting and encrypting a part of a compressed image, and Korean Patent No. 10-0712328 also discloses a method for partially encrypting image data.

This partial encryption scheme has a disadvantage in that the encapsulation process becomes rather complicated rather than encrypting a packet transmitted from an existing IP camera installed.

SUMMARY OF THE INVENTION The present invention has been made in order to overcome the above problems, and it is an object of the present invention to provide a plug-in image encryption system for a network-based video device which can easily encrypt and decrypt image data included in a packet transmitted in a network- The purpose is to provide.

According to an aspect of the present invention, there is provided a plug-in image encryption system for a network-based video equipment, including: a data packet analysis module for analyzing a header and data from a packet transmitted from a network-based video equipment connected through a communication interface; If the packet analyzed by the data packet analysis module includes image data, encrypting the image data and adding encryption additional information to the header to generate an encrypted packet; And an encrypted packet transmission module for transmitting the encrypted packet generated by the encrypted packet generation module to the destination communication address via the Internet.

Preferably, the terminal connected via the communication interface transmits a message asking whether it is an IP camera which is a network video equipment through the communication interface, determines whether it is an IP camera from a message received through the communication interface, And a camera classification module for processing the received packet to be analyzed by the data packet analysis module when the terminal is confirmed as an IP camera.

The apparatus of claim 1, further comprising an encryption receiver for receiving and processing an encryption packet transmitted from an encryption transmitter including the data packet analysis module, the encryption packet generation module, and the encryption packet transmission module, A packet receiving module for receiving an encrypted packet transmitted from the module; An encrypted packet analysis module for analyzing the encrypted additional information of the encrypted packet received by the packet receiving module; And an encrypted packet decryption module for decrypting the encrypted data using the analyzed information in the encrypted packet analysis module and outputting the decrypted data as image data.

According to the plug-in image encryption system for a network-based video equipment according to the present invention, it is possible to securely process the image generated in the network-based video equipment such as IP cameras and to utilize the existing network-based video equipment as it is do.

1 is a block diagram illustrating a video encryption system according to the present invention,
FIG. 2 is a flowchart showing a packet processing process of the encrypting transmitter of the video encrypting apparatus of FIG. 1,
FIG. 3 is a diagram showing a packet structure before and after an encryption process in the image encryption system according to the present invention.

Hereinafter, a plug-in image encryption system for network-based video equipment according to a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing a video encryption system according to the present invention.

Referring to FIG. 1, a video encryption system 100 according to the present invention includes an encryption transmitter 110 and an encryption receiver 210.

In the following description, an IP camera is applied as a network-based video equipment.

The encryption transmitter 110 includes a camera classification module 120, a packet analysis module 130, an encryption packet generation module 140, and an encryption packet transmission module 150.

A port 112 can be used to connect the Internet cable to the communication interface provided in the encryption transmitter 110.

The camera classifying module 120 is configured to perform data processing on the IP camera 10 applied as an example of network video equipment in a plug-in manner.

The camera classifying module 120 transmits a message to the terminal connected through the communication interface 112 to inquire whether the camera is an IP camera which is a network video equipment in a known manner via the communication interface 1120 and transmits the message via the communication interface 112 And if the connected terminal is confirmed as an IP camera, the packet received through the communication interface 112 is processed to be analyzed by the data packet analysis module 130, which will be described later.

The data packet analysis module 130 is connected via the communication interface 112 and analyzes the header and the data from the packet transmitted from the IP camera 10 determined as the IP camera 10 in the camera classification module 120 .

The data packet analysis module 130 determines whether the received packet is TCP or UDP, identifies the size of the header and the size of the data included in the packet, separates the header and the compressed image data from the transmitted packet, Finally, the encrypted additional information is inserted.

The encryption packet generation module 140 adds the encryption additional information, encrypts the image data based on the encryption additional information, and combines the header with the encrypted additional information and the encrypted image data portion to generate an encryption packet.

3, the encryption packet generation module 140 encrypts the packet header 41 from the IP camera 10 and the encrypted image data 43 in the packet header 141 142 are added to the encrypted image data 143 to generate an encrypted packet.

Here, the encrypted side information includes an encryption device ID code 142a, an encrypted program version number 142b, and an index number 142c of a randomly selected encrypted seed Seed table.

The encryption device ID code 142a is identification information uniquely assigned to the encryption transmitter 110. The encryption program version number 142b is a version of the encryption program applied by the encryption packet generation module 140, The index number will be described later.

The encryption receiver 210 receives the encryption packet transmitted from the encryption packet transmission module 150 via the communication network.

The encryption packet analysis module 230 analyzes the encryption additional information of the encryption packet received from the packet reception module 220.

The encryption packet decryption module 240 decrypts the encrypted data using the information analyzed by the encryption packet analysis module 230 and outputs the decrypted data as image data.

In the illustrated example, it is illustrated that the decrypted image is output to the image display 20 by the encryption packet decryption module 240, but it is needless to say that it is possible to process the decrypted image by being stored in the storage device.

Hereinafter, a process of encrypting image data in the encryption packet generation module 140 of the encryption transmitter 110 will be described first.

First, referring to FIG. 2, a packet header and data are separated from a packet received from the IP camera 10 (step 310). Then, it is determined whether image data is included (step 320), and if the image data is not included, the packet is transmitted to the destination address without modification (step 330).

Alternatively, if it is determined that image data is included, the index number of the encryption seed table is randomly extracted (step 340), and the encrypted additional information is added to the header (step 350). In addition, encryption information corresponding to the extracted index number, that is, seed data is extracted (step 360), an encryption key is generated from the extracted encryption information, and the image data is encrypted (step 370).

Then, an encryption packet is generated (step 380), and transmission processing of the generated encryption packet is performed.

Here, the encryption additional information added for encryption is applied to the encryption device ID code, the encryption program version number, and the index number of the encrypted seed table as exemplified below.

- Encryption Device ID Code: EM2017000010000001

- Encryption program Version number: 1.0

- Index number of the encrypted Seed table: 2

On the other hand, the content of the encryption seed table is provided so that the encryption transmitter 110 and the encryption receiver 210 can use the same information.

The encryption seed table is recorded in a memory (not shown) for use in the encryption packet generation module 140, and is illustrated in Table 1 below.

Index number r _-1 x _-1 r ₀ x ₀ Direction of rotation
(Direction
= 1 or 0) R rot ₀ One 1.9 0.95 1.8 0.65 One 3.8 0.95 2 1.5 0.75 1.6 0.91 0 3.9 0.84 ... ... ... M 1.6 0.73 1.9 0.88 One 2.9 0.99

Arranged along the lateral direction in the encryption seed table above Table _{1 r -1, x -1, r} 0, x 0, the rotation direction (Direction), R, seed data by the index number assigned to the vertical against rot ₀ Parameter The values are given differently.

Here, the encryption seed table is composed of M index columns, and the encryption performance increases as the number of M increases. In addition, the encryption seed table is shared so as to have the same value in the encryption transmitter 110 and the encryption receiver 210, and may be updated from time to time through a secure channel.

Among the parameters of the encryption seed table, r _-1 , x _-1 , r ₀ , and x ₀ correspond to an initial value for generating a logistic sequence.

The value of r _-1 is in the range of 0 <r _-1 <2, the value of r ₀ is in the range of 0 <r ₀ <2, the value of x _-1 is in the range of 0 <x _-1 <1, The value of x ₀ is in the range of 0 <x ₀ <1.

The encryption packet generation module 140 is provided with an index number random extractor for extracting an index number to be applied to encryption in a random manner with respect to the encryption seed table of Table 1 above, As an example.

Since the randomly extracted encryption seed table index number is 2, the seed data for each parameter to be used for the encryption to be read in the encryption seed table is r _-1 = 1.5, x _-1 = 0.75, r ₀ = 1.6, x ₀ = 0.91, Direction = 0, R = 3.9, and rot ₀ = 0.84.

Also, for the purpose of encryption, the logistic sequence (x _i ) is calculated by the following equation (1) which linearly combines two logistic functions.

&Quot; (1) &quot;

_{x i = r -1 * x i} -2 * (1-x i-2) + r 0 * x i-1 * (1-x i-1), i = 1, 2, ..., N and ,

Here, the N value is an integer larger than 2 and may be suitably applied.

Therefore, when the selected index number is 2, x ₁ is calculated as follows.

x ₁ = 0.4123 = 1.5 * 0.75 * (1-0.75) + 1.6 * 0.91 * (1-0.91)

The values of x ₂ , x ₃ , ..., which are sequentially calculated, can be calculated by Equation (1) above, and only the values of x ₂ and x ₃ are as follows.

x ₂ = 0.5105 = 1.5 * 0.91 * (1-0.91) + 1.6 * 0.4123 * (1-0.4123)

x ₃ = 0.7633 = 1.5 * 0.4123 * (1-0.4123) + 1.6 * 0.5105 * (1-0.5105).

On the other hand, R, rot ₀ A rotation shift value (rot _i R0 is a value within the range of ₀ &lt; rot ₀ < 1, rot ₀ is a value within the range of ₀ < rot _{0 &lt;} Value.

&Quot; (2) &quot;

rot _i = R * rot _{i -1} * (1-rot _{i -1} ), i = 1, 2, ..., N.

Therefore, when the index number selected by 2 in Table 1, and _{R = 3.9, rot 0 = 0.84} , rot 1, rot 2, which is calculated sequentially ... it is calculated through equation (2) above, rot _1, rot ₂ will be described below.

rot ₁ = 0.5242 = 3.9 * 0.84 * (1-0.84),

rot ₂ = 0.9727 = 3.9 * 0.5242 * (1-0.5242)

The logistic sequence generated by Equation (1) is multiplied by an integer 65535, converted to a 16-bit number by integerization, the circular shift value generated by Equation (2) is multiplied by 16, 3 to generate an encryption key.

&Quot; (3) &quot;

if Direction = 0 (Rotate left),

K _i = round (65535 * x _i ) << round (16 * rot _i ), i = 1, 2, ..., N,

else if Direction = 1 (Rotate right),

K _i = round (65535 * x _i ) >> round (16 * rot _i ), i = 1, 2, ..., N

In Equation (3), the round () function means a function that returns the closest integer value. In addition, &quot; << denotes a rotational shift to the left, and &quot; denotes a rotational shift to the right.

The rotation shift direction is rotationally shifted left or right depending on the Direction value.

If K _{i, which} is the encryption key value generated by Equation (3), is 16 bits and the value obtained by reading 16 bits of the compressed video bitstream is D _i , the final encrypted bitstream E _i is expressed by Equation By XORing the encryption key sequence value and the image bitstream sequence data.

&Quot; (4) &quot;

E _i = K _i XOR D _i , i = 1, 2, ..., N

When the index number is 2 in the process of generating the bit stream by Equations (3) and (4), Direction = 0 is first given, which means a rotational shift to the left.

Therefore, K ₁ and K ₂ generated by Equation (3) are expressed as follows.

K ₁ = round (65535 * (0.4123)) << round (16 * 0.5242)

K ₂ = round (65535 * (0.5105)) << round (16 * 0.9727).

That is, K ₁ = (27020 << 8), and K ₁ = (0101 1001 1000 1100 << 8), which is rotationally shifted leftward with respect to 8 bits, K ₁ = 1000 1100 0101 1001.

The key value before the rotation shift was 0101 1001 1000 1100, and the final key value after 8-bit leftward rotational shift is 1000 1100 0101 1001.

On the other hand, if the 16-bit data D ₁ read from the image bitstream is 0000 0010 1011 1110, the final encrypted data E ₁ = K ₁ XOR D ₁ is obtained.

    1000 1100 0101 1001

XOR 0000 0010 1011 1110

-------------------------------------

E ₁ = 1000 1110 1110 0111

When the generation of the encryption code is completed, the encryption unit ID code, the encryption program version number, the encrypted seed Seed table index &lt; RTI ID = 0.0 &gt; Adds the encrypted data to the header, attaches the encrypted data, and transmits the data to the destination Internet communication address set through the encrypted packet transmission module 150.

A packet newly composed of the packet header 141, the encryption additional information 142 and the encrypted bit stream E shown in FIG. 3 is transmitted to the destination IP address.

The encryption packet analysis module 230 of the destination encryption receiver 210 separates the header of the received encryption packet, reads the encryption side information 142, checks the encryption device ID code and the encryption program version number, And the encrypted seed data is read using the index of the identified encrypted seed table.

Also, the encryption packet decryption module 240 reads the parameter value used for encryption using the encryption seed table shared with the encryption transmitter 110 and the received index number, and stores the encryption program version used in the encryption transmitter 110 The encryption key value K _i is generated by using the same method as used in FIG.

The encryption packet decryption module 240 decrypts the 16-bit E _i And finds the original signal bit stream D _i using Equation (5) below.

Equation (5)

D _i = K _i XOR E _i , i = 1, 2, ..., N

Thereafter, the decompressed compressed bitstream D is decompressed into an image after decompression, and is transmitted to the image display 20 and displayed.

Meanwhile, in the present embodiment, an IP camera is described as an example of a network-based image device, and the network-based image device other than the IP camera can be constructed to perform the encryption and decryption processes described above.

According to the plug-in image encryption system for the network-based video equipment described above, the security processing of the image generated in the network-based video equipment is easy and the existing network-based video equipment can be directly connected and utilized.

120: camera classification module 130: packet analysis module
140: Encrypted packet generation module 150: Encrypted packet transmission module

Claims (8)

A data packet analysis module for analyzing a header and data from a packet transmitted from a network video equipment connected through a communication interface;
An encrypted packet generation module for encrypting the image data and adding the encrypted additional information to the header to generate an encrypted packet if the packet analyzed by the data packet analysis module includes image data;
And an encrypted packet transmission module for transmitting the encrypted packet generated by the encrypted packet generation module to a destination communication address via the Internet,
Wherein the encryption additional information includes an encryption device ID code, an encryption program version number, and an index number of a randomly selected encrypted seed Seed table,
The encryption seed table has different seed data for each index number,
The encryption seed is the table _{r -1, x -1, r 0} , x 0, the rotation direction (Direction), R, and is a seed value assigned to the data for each index number for the parameter rot _0, the r _-1, x _{- 1} , r ₀ , x ₀ corresponds to an initial value for generating a logistic sequence, the value of r _-1 is in the range of 0 <r _-1 <2, and the value of r ₀ corresponds to 0 <r ₀ <2 _Wherein the value of x _-1 is in the range of 0 <x _-1 <1, the value of x ₀ is in the range of 0 <x ₀ <1, and the logistic sequence (x _i ) However,
Equation _{1: x i = r -1 *} x i-2 * (1-x i-2) + r 0 * x i-1 * (1-x i-1), i = 1, 2, .. ., N,
R and rot ₀ are seed values for generating a circular shift value rot _{i where} R is 0 <R <4 and rot ₀ is 0 <rot ₀ <1 has a value in the range, generates a specific sequence rot _i value by equation (2) below,
Rot _i = R * rot _i-1 * (1-rot _i-1 ), i = 1, 2, ..., N,
The logistic sequence (x _i ) generated by Equation (1) is multiplied by an integer 65535, converted into a 16-bit number by integrating and integrating, and the circular shift value generated by Equation 2 is multiplied by 16, The encryption key value K _i is generated by Equation (3), and the shifting direction is rotationally shifted to the left (Direction = 0) or right (Direction = 1) according to the direction of rotation,
Equation 3: if Direction = 0 (rotational shift to the left)
I = 1, 2, ..., N where K _i = round (65535 * x _i ) << round (16 * rot _i )
If else if Direction = 1 (rotational shift to the right)
I = 1, 2, ..., N where K _i = round (65535 * x _i ) >> round (16 * rot _i )
The round () function is a function that returns the closest integer,
Encryption key values generated by Equation 3 K _i is a 16-bit integer, if the 16 bits of the bit stream of encrypted before image data D _i, the final encrypted bitstream E _i is the encryption key sequence value and the video bit The stream sequence data is determined by performing XOR operation on each bit by the following expression (4)
E _i = K _i XOR D _i , i = 1, 2, ..., N,
Wherein the encryption process is performed using a randomly selected index number for each packet. The method of claim 1, further comprising: transmitting, via the communication interface, a message to the terminal connected through the communication interface as to whether the IP camera is a network video equipment, determining whether the IP camera is a message received through the communication interface And a camera classification module for processing the received packet to be analyzed by the data packet analysis module when the connected terminal is confirmed as an IP camera. The mobile communication terminal of claim 1, further comprising an encryption receiver for receiving and processing an encryption packet transmitted from an encryption transmitter including the data packet analysis module, the encryption packet generation module, and the encryption packet transmission module,
The encryption receiver
A packet receiving module for receiving the encrypted packet transmitted from the encrypted packet transmitting module;
An encrypted packet analysis module for analyzing the encrypted additional information of the encrypted packet received by the packet receiving module;
And an encryption packet decryption module for decrypting the encrypted data using the analyzed information in the encryption packet analysis module and outputting the decrypted data as image data. The method of claim 1, wherein the data packet analysis module
It is confirmed whether the received packet is TCP or UDP, and the size of the header and the size of the data included in the packet are checked to separate the header and the compressed image data part in the transmitted packet, and the encryption side information is inserted at the end of the header Based video device to a network-based video device. The method of claim 4, wherein the encryption packet generation module
Wherein the encrypting unit adds the encryption unit information, encrypts the image data based on the encryption unit information, and combines the encrypted image data portion with the header to which the encryption additional information is added to generate an encryption packet. Cost plug-in video encryption system. delete delete delete

Images