KR101847618B1 - Method for privacy object masking and key management for user authentication in video surveillance system and video surveillance system using the same - Google Patents

Abstract

In a key management method in a video security system, a client transmits authentication information and identification information, which is obtained by encrypting identification information and a time stamp for identifying the client, based on a first shared key previously shared between a client and an authentication server, to an authentication server The authentication server retrieving the key stored in the database using the identification information; The authentication server decrypts the authentication information based on the key to generate identification information and a time stamp. The authentication server verifies whether the client is authentic based on the identification information and the time stamp. The authentication server generates a session key, And generating a first ticket by encrypting the class information and the time stamp of the client based on a second shared key previously shared between the authentication server and the key management server.

Description

FIELD OF THE INVENTION [0001] The present invention relates to a key management method for privacy object masking and user authentication in a video security system, and a video security system using such a method.

The present invention relates to a video security system, and more particularly, to a key management method for privacy object masking and user authentication in a video security system and a video security system using the method.

With the development of information technology (IT) technology, systems that incorporate advanced IT technology in the field of video security are being developed. The evolution of such video security is represented by network cameras, and furthermore, an intelligent image security system for integrating and controlling various image security devices is evolving.

The video security system was developed for the purpose of benefiting from crime and terrorism, but it also has the dysfunction that can infringe human rights by exposure of privacy to camera.

Furthermore, in the analog environment of the past VCR (video cassette recorder), it is difficult to access the video information due to its closed nature, but it is exposed to malicious acts such as hacking and the security of the video information is threatened.

To solve this problem, there is a need for a cryptographic application technology for preventing intrusion of a network camera for CCTV (closed circuit television), prevention of forgery / alteration of image acquisition information, and secure transmission. Before implementing these functions, establishment of key management techniques and systems should be preceded.

Key plays a key role in most functions such as user authentication, encryption of transmission information, control of access to network, etc., and privacy masking is performed for an image that is expected to infringe privacy, or privacy masking is restored from the forensic viewpoint in an emergency It will be an important technology to manage the level of information access for various users.

Therefore, the key management technology in video security system is the key. In other words, there is a need for research on how to manage keys, and how to distribute keys securely without being exposed to malicious hackers.

Korean Patent Application No. 10-2003-0035501 filed on June 03, 2003, entitled " Image Security System and Method for Privacy Protection "

SUMMARY OF THE INVENTION The present invention provides a key management method for privacy object masking and user authentication in a video security system.

According to another aspect of the present invention, there is provided an apparatus for performing a key management method for privacy object masking and user authentication in a video security system.

A key management method in a video security system according to an aspect of the present invention is a method for a client to encrypt identification information and a timestamp for identification of a client based on a first shared key previously shared between the client and an authentication server Transmitting the authentication information and the identification information to an authentication server, the authentication server retrieving a key stored in a database using the identification information, the authentication server decrypting the authentication information based on the key, Generating the session key, the class information of the client, and the time stamp of the client based on the identification information and the time stamp; verifying authenticity of the client based on the identification information and the time stamp; The time stamp is previously shared between the authentication server and the key management server Second step of encryption based on the shared key to generate a first ticket, and may include the step of the authentication server sending the session key and the first ticket to the client, encrypted with the first share.

The key management method in the image security system according to the above feature may further comprise the steps of: the client extracting the session key and the first ticket based on the first shared key; and transmitting the first ticket to the key management server Step < / RTI >

According to another aspect of the present invention, there is provided a key management method in a video security system, the key management server decrypting the first ticket based on the second shared key to extract the session key, the class information and the time stamp, Wherein the key management server generates a distribution key and encrypts the distribution key, the session key, the class information, and the time stamp based on a third shared key shared between the key management server and the video security server, The key management server encrypts the distribution key and the second ticket with the session key, and the key management server transmits the distribution key encrypted with the session key and the second ticket to the client The method comprising the steps of:

Further, in the key management method according to the above aspect, the client decrypts the distribution key encrypted with the session key and the second ticket based on the session key, and extracts the distribution key and the second ticket Further comprising the step of the client sending the second ticket to the video security server and the video security server decrypting the second ticket to verify the distribution key, the class information and the timestamp .

An image security system for performing a key management method according to another aspect of the present invention includes authentication information for identifying identification information and a timestamp, which are encrypted based on a first shared key previously shared between the client and the authentication server And a client configured to transmit the identification information to an authentication server, a key stored in the database using the identification information, decrypting the authentication information based on the key to generate the identification information and the time stamp, And authenticating the authenticity of the client based on the identification information and the time stamp, generating a session key, classifying the session key, class information of the client, and the time stamp, Generating a first ticket by encrypting based on a second shared key, Key and may encrypt the first key, the first ticket contains the shared authentication server, which is implemented to send to the client.

Meanwhile, the client may extract the session key and the first ticket based on the first shared key, and transmit the first ticket to the key management server.

Also, the image security system according to the above feature decrypts the first ticket based on the second shared key to extract the session key, the class information, and the time stamp, generates a distribution key, Encrypting the session key, the class information, and the time stamp based on a third shared key shared between the key management server and the image security server to generate a second ticket, and transmitting the distribution key and the second ticket to the session And transmitting the distribution key encrypted with the session key and the second ticket to the client.

The client decrypts the distribution key encrypted with the session key and the second ticket based on the session key to extract the distribution key and the second ticket and transmits the second ticket to the video security server And the image security server may be configured to decrypt the second ticket to check the distribution key, the class information, and the time stamp.

According to the key management method for privacy object masking and user authentication according to this characteristic and the image security system using this method, inefficiency generated by managing individual keys in the existing image security system by managing keys by class And the user can receive an appropriate image accurately and quickly for each class.

1 is a conceptual diagram illustrating a video security system.
2 is a conceptual diagram illustrating a structure and a key distribution process of a conventional image security system.
3 is a conceptual diagram illustrating a structure and a key distribution process of a conventional image security system.
4 is a conceptual diagram illustrating a key distribution and management method for each class using a cover loss according to an embodiment of the present invention.
FIG. 5 is a conceptual diagram illustrating a process of distributing keys by class using a cover loss protocol according to an embodiment of the present invention.
FIG. 6 is a conceptual diagram illustrating a process of distributing keys by class based on round keys according to an embodiment of the present invention.
FIG. 7 is a conceptual diagram illustrating a process of distributing keys by class based on round keys according to an embodiment of the present invention.

The following detailed description of the invention refers to the accompanying drawings, which illustrate, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that the various embodiments of the present invention are different, but need not be mutually exclusive. For example, certain features, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in connection with an embodiment. It is also to be understood that the position or arrangement of the individual components within each disclosed embodiment may be varied without departing from the spirit and scope of the invention. The following detailed description is, therefore, not to be taken in a limiting sense, and the scope of the present invention is to be limited only by the appended claims, along with the full scope of equivalents to which such claims are entitled, if properly explained. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

Hereinafter, a method for securely managing keys in a video security system is disclosed. More specifically, when privacy masking is performed, a method for applying user authentication, authority setting, and the like is disclosed. Also disclosed is an effective key management scheme for solving an excessive key management problem that occurs when privacy masking is performed.

Hereinafter, an exemplary embodiment of the present invention discloses a structure of a video security system, a key management scheme for each class of a video security system (a key distribution and management technique using a cover loss, a round key, and a hash chain).

1 is a conceptual diagram illustrating a video security system.

1, the image security system includes a video security server 100 for providing images, a camera 120 for image collection, and a user device 140 for receiving images collected from the camera 120 .

The camera 120 may be implemented to collect image information. The camera 120 has changed as it evolved from a digital video recorder (DVR) -based image compression transmission technology to a digital age in the analog CCTV era based on a VCR (video cassette recorder) storage device. Currently, the camera 120 is being changed into a network camera combined with Internet Protocol based technology.

The video security server 100 may be implemented for distribution and security of images collected through the camera 120. In addition, the video security server 100 may be implemented to transmit an image to the user device 140 and to solve the connection overload problem of the camera 120.

When a plurality of users try to directly connect to the camera 120, it is difficult to smoothly transmit data due to overload due to direct connection. Therefore, an unintended distributed denial of service (DDoS) attack may occur. Accordingly, a connection overload problem can be solved by connecting to the video security server 100 through the user device 140 and connecting the camera 120 to the video security server 100 as well.

The user device 140 may be implemented to receive image information from the image security server 100. User device 140 may be assigned a class level.

For example, a class level can be assigned to each user device such as a class 1 (class 1) of a general user, a class 2 (class 2) of an administrator, and a class 3 of a user apparatus of an investigation agency. The class level can be used to control access to image information. This class level classification can be used for different levels of privacy masking for each class when the privacy masking technique is applied to the image information for privacy protection. Privacy masking may mean masking some of the image information to protect privacy.

If the class level is used, the difficulty of key distribution to be used for applying and restoring privacy masking can be resolved. If individual keys are distributed, the number of keys to be distributed may be much different from the number of keys distributed per class. The number of keys to be managed is directly related to the difficulty of key management and distribution. Thus, a class-based key distribution scheme may be a more efficient scheme.

The development process of camera and video security server can be expressed as shown in Table 1 below.

Development process Explanation Analog CCTV via VCR Means a complete analog system that connects an analog camera to a VCR with a coaxial cable and uses analog tape for data storage Analog CCTV over DVR Means an analog system using a digital storage device called a DVR, and the acquired image information is digitized and stored in a digital storage device such as a hard disk instead of a video tape Analog CCTV over network DVR Network connection is available through the Ethernet port added to the existing DVR function, and the network DVR becomes the server, so you can check or adjust the image information taken from the remote site Network system using video server It means a network environment that uses Ethernet in the form of a video server connected to an analog camera Network system using IP camera A complete digital system with no analogue elements delivers video information over the network

As shown in Table 1, the analog camera has developed into a camera that transmits image information through a network, and various methods for solving the connection overload and privacy protection generated there have been studied.

The video security system can be classified into an image distribution server and a centralized management system (CMS).

Since the network camera is basically composed of an embedded system equipped with a low-performance processor, it has a disadvantage in that it can not cope when multiple users are connected. Accordingly, a separate image distribution server that can distribute and serve images when a plurality of users connect to the network cameras is required to collect and store images from a plurality of network cameras in real time. This can overcome the overload caused by multiple accesses.

As the image changes from analog to digital, the basis for integrated management of the method of using image information has been established. Image security is often used for surveillance. Traditionally, image security systems transmit image information from a camera to a central control room, and transmitted images can be stored in a DVR. However, current image security systems are becoming more sophisticated, intelligent, and larger, so that past image security systems that are not standardized at present can not cope with them. Therefore, a network-based system that is easy to link with various applications is taking its place as a stream of video security system.

The video integration control system is a system that integrates and manages the existing DVR / video server / network camera connected to the network from the remote server. In this system, all functions of DVR, video server, and network camera are managed by software, and it has the advantage that many functions such as recording, backup, PTZ (pan tilt zoom) camera control can be performed simultaneously. In addition, in the image integration control system, the network state, recording state, event generation, motion detection, etc. can be checked in real time, and intelligent function can be performed by using functions such as notifying an alarm when a specific motion is detected.

2 is a conceptual diagram illustrating a structure and a key distribution process of a conventional image security system.

Referring to FIG. 2, key management may play a key role in a video security system. The image security system separately provides a key management server 210 for managing keys. In the key management server 210, keys for user authentication and privacy masking are generated, and the generated keys are managed through a separate database When the camera and the user request a key, the generated key can be distributed.

The key is distributed to the user device 220 of the general user, the user device 220 of the administrator and the user device 220 of the investigation agency on the basis of the key management server 210, An image may be transmitted to each of the user device 220 of the general user, the user device 220 of the administrator, and the user device 220 of the investigation agency. That is, the images transmitted to the user device 220 of the general user, the user device 220 of the administrator, and the user device 220 of the investigation agency may be different according to the assigned keys.

3 is a conceptual diagram illustrating a structure and a key distribution process of a conventional image security system.

In the existing image security system, the key must be managed separately for the camera and the user. Therefore, a very wide and much information may be needed for key management.

Referring to FIG. 3, a key distribution process when the camera and the user are separately managed is disclosed.

When the number of users is N, the network camera requests the key management server to key the image corresponding to the privacy registered by each user (step S300).

The key management server searches registered users and generates keys (N) as many as the number of users (step S310).

All of the generated keys (N) are transmitted to the camera, and keys (K _A , K _B , ..., K _N ) corresponding to the connected user are transmitted to the user (step S320).

When the key distribution is completed, the camera masks the area corresponding to the privacy registered by the user using the received key, and transmits the masked area (step S330).

The user device restores the received image through the distributed key and receives the image service (step S340).

In the case where the user designates the privacy zone for each user and performs masking on the privacy zone, the user can receive a service image masking the privacy zone designated by another user despite the normal user.

For example, the user A can receive a normal image in the privacy zone set by the user A. However, there is no corresponding key for the area set by the users B, C, ..., N. Thus, images masked by users B, C, ..., N can not be serviced. That is, the user A does not receive normal service even though it is a normal user. Therefore, a new alternative in terms of structure is required and a more efficient method is needed in terms of managing the keys since the number of keys must be managed by the number of users.

In order to solve the above problems, a method for securely distributing keys and efficiently managing keys is disclosed in an embodiment of the present invention. Also disclosed is a technique of classifying the characteristics of users and managing the keys for each class by class rather than managing the keys for each user.

In the embodiment of the present invention, a video security system classifies a class according to an access right, and a class according to a user's authority is assigned to a user when the user is registered in a video security system. When this method is used, users are grouped by class. Thus, when users are grouped by class, the privacy masking rate is reduced and the amount of managed keys is much reduced, which can be a more efficient system.

In the embodiment of the present invention, class distribution and management of classes by class using Kerberos, class distribution and management of classes by using a round key, class distribution and management of classes by using a double hash chain, Lt; / RTI >

4 is a conceptual diagram illustrating a key distribution and management method for each class using a cover loss according to an embodiment of the present invention.

In FIG. 4, the Kerberos protocol can operate based on an authentication server, a ticket granting server (TGS), a service server serving a client, and a client.

The client can receive the ticket from the authentication server and the ticket approval server and access the ticket approval server and the service server.

The client may transmit the identification information of the user to the authentication server (AS) (step S400), and may request a ticket permitting use of the TGS.

_AS)(SG, TG), TG: E_{K ( TGS}

_AS)(SG))을 클라이언트로 전송할 수 있다(단계 S410).The authentication server uses a pre-shared key between the client and the authentication server to transmit a key (E _{K (C}

_AS) (SG, TG), TG: E _{K ( TGS}

_AS) SG) to the client (step S410).

The client may request the service grant ticket to the TGS by encrypting and transmitting the ticket received from the cover loss server with the session key received from the authentication server (step S420).

The TGS may issue a ticket to the client (step S430).

S), T_S), TS : E_{K ( TGS}

_S)(K(C

S))) 전송될 수 있다.The ticket is encrypted with the secret key of the TGS and the service server that the client wishes to access, encrypted with the session key for communication between the client and the service server along with the ticket (E _SG (K

_{S), T S), TS} : E K (TGS

_S) (K (C

S))).

The client connects to the server without a separate approval process by transmitting the ticket to the service server (step S440).

The process of distributing keys by class using the Kerberos protocol according to the embodiment of the present invention is as follows. Basically, the overall configuration is similar to the Kerberos protocol, and consists of an authentication server, a key management server, a video security server, and a client. The proposed key distribution process is shown in FIG. 5 below.

Tables 2 and 3 are definitions of keys and terms used in FIG.

<Table 2>

<Table 3>

FIG. 5 is a conceptual diagram illustrating a process of distributing keys by class using a cover loss protocol according to an embodiment of the present invention.

Referring to FIG. 5, the client inputs identification information (ID ') for authentication (step S500).

AS))를 기반으로 암호화한다(단계 S505).The input identification information (ID ') and the TimeStamp are transmitted to the authentication server by a key (K (C

AS) (step S505).

And transmits the ID 'received from the user and the encrypted authentication information (C1) to the authentication server (step S510).

The key stored in the database (DB) is retrieved using the ID 'received by the authentication server (step S515).

AS))를 기반으로 수신한 인증 정보(C1)을 복호화하여 ID'과 TimeStamp를 추출한다(단계 S520).If the authentication server determines that the retrieved key K (C

AS), and extracts ID 'and TimeStamp (step S520).

The authentication server compares the decrypted ID 'with the ID to check whether it is a correct user (step S525).

The authentication server generates a session key (K _SS ) for communication between the client and the key management server (step S530).

KMS))를 기반으로 암호화하여 티켓(T1)을 생성한다(단계 S535).The authentication server generates a session key (K _SS ), a class information of a user (Class), TimeStamp as a key (K (AS

KMS) to generate a ticket T1 (step S535).

AS))를 기반으로 암호화(C2)한다(단계 S540).The authentication server transmits the generated session key (K _SS ) and the ticket (T1) to the shared key (K (C

AS) (step S540).

The authentication server transmits C2 to the client (step S545).

AS))를 기반으로 복호화하여 세션키(K_SS)와 티켓(T1)을 추출한다(단계S550).The client sends the received C2 the key (K (C

AS) and extracts the session key K _SS and the ticket T1 (step S550).

The client transmits the extracted ticket (T1) to the key management server (step S555).

KMS))를 기반으로 복호화하여 세션키(K_SS)와 사용자의 클래스 정보(Class), TimeStamp를 추출한다(단계 S560).The key management server transmits a ticket (T1) received from the client to a key (K (AS

KMS), and extracts the session key K _SS , the class information of the user, and the TimeStamp (step S560).

VSS))를 생성한다(단계 S565).The key management server includes a distribution key K (C

VSS)) (step S565).

VSS))와 사용자의 클래스 정보(Class), TimeStamp를 키 관리 서버와 영상 보안 서버 간 공유된 키(K(KMS

VSS))를 기반으로 암호화하여 티켓(T2)를 생성한다(단계 S570).The key management server sends the generated distribution key K (C

VSS), the class information of the user, and the TimeStamp to the key management server K

VSS)) to generate a ticket T2 (step S570).

VSS))와 티켓(T2)를 세션키(K_SS)로 암호화(C3)한다(단계 S575).The key management server sends the generated distribution key K (C

VSS) and the ticket T2 with the session key K _SS (step S575).

The key management server transmits C3 to the client (step S580).

VSS))와 티켓(T2)을 추출한다(단게 S585).The client receives C3, decrypts C3 using the session key (T _SS ) and sends the distribution key K (C

VSS) and the ticket T2 (step S585).

The client transmits the ticket T2 to the video security server (step S590).

VSS))와 사용자의 클래스 정보(Class), TimeStamp를 확인한다(단계 S595).The video security server decrypts the ticket (T2) received from the client and sends the distribution key K (C

VSS), the class information of the user, and the TimeStamp (step S595).

If a class-based key distribution and management method using a cover loss is used, it may be necessary to store a key corresponding to the class number separately. A user with a high class level can perform restoration of an image with all keys of a user having a low class level.

FIG. 6 is a conceptual diagram illustrating a process of distributing keys by class based on round keys according to an embodiment of the present invention.

The process of distributing keys by class based on round keys is different from the process of distributing keys by classes using the Kerberos protocol (for example, a mechanism in which the same value is always generated based on a specific value) Can be used.

Referring to FIG. 6, a seed value for generating an initial key is generated, and a round key can be used as a class key based on the generated seed value.

Assuming that the class exists as C ₁ , C ₂ , and C ₃ , encryption, masking, and restoration functions can be provided using K _R1 , K _R2 , and K _R3 , which are generated for each round, as class keys. If key distribution and management is configured in this way, it can be said to be very efficient since only the initial seed value needs to be managed. The basic communication process can be basically the same as the protocol using the Kerberos.

First, the network camera requests a key for each class to the key management server to mask the image corresponding to the privacy (step S600).

The key management server generates a seed value to generate a key for each class, and generates a key for each round based on the generated seed value (step S610).

For example, the result of the first round is a key of class 1, and the result of the second round is a key of class 2, thereby generating a whole class key. That is, a separate key may be generated for each individual class and assigned to a user device for each class.

The key management server transmits all of the generated keys (N) to the camera, and transmits the class-specific keys KR1, KR2, ..., KRN to the user device (step S620).

The key of class 1 may be transmitted to the user equipment corresponding to class 1, the key of class 2 may be transmitted to the user equipment corresponding to class 2, and the key of class 3 may be transmitted to the user equipment corresponding to class 3.

When the distribution of the keys of the key management server is completed, the network camera can mask the area corresponding to the privacy of each class using the received key, and transmit the masked information to the user device.

In addition, the user device can receive the image of each class by restoring the image received through the video security server from the network camera through the distributed key.

FIG. 7 is a conceptual diagram illustrating a process of distributing keys by class based on round keys according to an embodiment of the present invention.

A hash chain can be defined as a chain of values that are output through a iterative one-way hash function on the basis of a given seed value. The hash chain is denoted by h ¹ (seed), h ² (seed), ..., h ⁿ (seed), and n can mean the number of iterations of the hash function.

For a single hash chain to obtain the ^{i + 1} h (seed) from h ⁱ (seed), but has a one-way you can not obtain the inverse function. Therefore, a single hash chain is not applicable to the key management of the image security system. Accordingly, a method of distributing and managing a class-specific key using a double-hash chain capable of calculating in both directions when a specific hash value is given is disclosed.

A more robust key management scheme can be constructed using a double hash chain.

Referring to FIG. 7, the key management server may generate two seed values x and y, and may generate two hash chains having a length of the class maximum value (n) using a one-way hash function.

Verifier to verify the generated hash chain v (h ^j (x) h ^nj (y)) may be generated.

J is class information, and h ^j (x) is a hash function of x as a seed value and j times as a seed value, and the transmitted message is in the form of [j, h ^j (x), h ^nj (y), v As a result of repetition of the hash function, h ^nj (y) may be a result of repeating the hash function by (nj) times the seed value of y, and v (j) may be the jth identifier information.

The camera and the user device can calculate h ^j (x) based on the received j and check whether the result is normal using the received h ^nj (y) and v (j). Accordingly, it is possible to generate a class-specific key corresponding to a user's authority on the basis of the generated key, and since the key is a hash chain, all the keys of the sub-class can be generated, thereby enabling more efficient distribution and management.

The reason for configuring two hash chains is that when a single hash chain is used, the vulnerability is exposed to attacks that threaten integrity. If an attacker hijacked h ^j (x), h ^{j + 1} (x) can be calculated easily. However, dual hash chains can not be modulated by an attacker, so a double hash chain can be used.

In the above-described embodiment, if an individual is managing a key in an existing image security system, problems due to masking restoration or a lot of information must be utilized, which is inefficient. Thus, a method of managing a key for each class has been disclosed.

In addition, we propose a protocol that uses Kerberos to securely distribute class-specific keys, and a scheme using a round key and a scheme using a double hash chain are disclosed for more effective management.

Key management methods for privacy object masking and user authentication in a video security system may be implemented in an application or implemented in the form of program instructions that may be executed through various computer components and recorded on a computer readable recording medium. The computer-readable recording medium may include program commands, data files, data structures, and the like, alone or in combination.

The program instructions recorded on the computer-readable recording medium may be those specially designed and configured for the present invention and may be those known and used by those skilled in the computer software arts.

Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like.

Examples of program instructions include machine language code such as those generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules for performing the processing according to the present invention, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made therein without departing from the spirit and scope of the invention as defined in the appended claims. It will be possible.

Claims (8)

Transmitting, by the client, the authentication information and identification information obtained by encrypting the identification information and the timestamp for identification of the client based on a first shared key previously shared between the client and the authentication server, and the identification information to the authentication server;
The authentication server retrieving a key stored in a database using the identification information,
Wherein the authentication server decrypts the authentication information based on the key to generate the identification information and the time stamp and confirms authenticity of the client based on the identification information and the time stamp,
The authentication server generates a session key, and generates a first ticket by encrypting the session key, the class information of the client, and the time stamp based on a second shared key previously shared between the authentication server and the key management server Step, and
Encrypting the session key and the first ticket with the first shared key and transmitting the encrypted session key and the first ticket to the client
And a key management method in a video security system. The method of claim 1,
The client extracting the session key and the first ticket based on the first shared key, and
The client transmitting the first ticket to the key management server
The key management method comprising: 3. The method of claim 2,
The key management server decrypting the first ticket based on the second shared key to extract the session key, the class information and the time stamp,
Wherein the key management server generates a distribution key and encrypts the distribution key, the session key, the class information, and the time stamp based on a third shared key shared between the key management server and the video security server, , &Lt; / RTI &gt;
The key management server encrypting the distribution key and the second ticket with the session key, and
The key management server transmitting the distribution key encrypted with the session key and the second ticket to the client
The key management method comprising: 4. The method of claim 3,
The client decrypting the distribution key and the second ticket encrypted with the session key based on the session key to extract the distribution key and the second ticket,
The client transmitting the second ticket to the video security server, and
Wherein the video security server decrypts the second ticket to identify the distribution key, the class information, and the time stamp
The key management method comprising: A client that is configured to transmit authentication information obtained by encrypting identification information for identification and a time stamp (timestamp) based on a first shared key previously shared between a client and an authentication server, and the identification information to an authentication server; and
Retrieving a key stored in a database using the identification information, decrypting the authentication information based on the key to generate the identification information and the time stamp, and based on the identification information and the time stamp, And generates a first ticket by encrypting the session key, the class information of the client, and the time stamp on the basis of a second shared key previously shared between the authentication server and the key management server And encrypting the session key and the first ticket with the first shared key and transmitting the encryption key to the client. The method of claim 5,
Wherein the client extracts the session key and the first ticket based on the first shared key, and transmits the first ticket to the key management server. The method of claim 6,
Extracting the session key, the class information, and the time stamp, decrypting the first ticket based on the second shared key, generating a distribution key, and transmitting the session key, the class information, Encrypting the distribution key and the second ticket with the session key by encrypting a stamp based on a third shared key shared between the key management server and the image security server to generate a second ticket, The key management server being configured to transmit the distribution key and the second ticket to the client,
Further comprising: 8. The method of claim 7,
The client decrypts the distribution key encrypted with the session key and the second ticket based on the session key, extracts the distribution key and the second ticket, and transmits the second ticket to the video security server And,
The video security system includes:
And to decrypt the second ticket to identify the distribution key, the class information and the time stamp,
Further comprising
Video security system.

Images