WO2010025638A1

WO2010025638A1 - Method, equipment and system of peer to peer live broadcast stream transfer

Info

Publication number: WO2010025638A1
Application number: PCT/CN2009/072786
Authority: WO
Inventors: 王志兵; 姜海军
Original assignee: 华为技术有限公司
Priority date: 2008-09-04
Filing date: 2009-07-16
Publication date: 2010-03-11
Also published as: CN101667999A; CN101667999B

Abstract

A method, equipment and system of P2P live broadcast stream transfer which can prevent the P2P live broadcast stream from being juggled viciously during the transfer, and meanwhile avoid making big shock to the P2P system performance. The method in an embodiment of the present invention includes that: a digital signature equipment(401) generates a pair of public and private keys of digital signature algorithm, sends the private key to a content release server(402) and sends the public key to a resource management server(403); the content release server(402) signs to the source live broadcast stream according to the private key, slices the signed live broadcast stream and then sends the sliced live broadcast stream to a P2P client terminal(404); the resource management server(403) transmits the public key to the P2P client terminal(404), by which the public key utilized to perform signature verification to the received P2P live broadcast stream. The embodiment of the present invention applies not only in centralized P2P networking, but also in distributed P2P networking based on CDN architecture.

Description

Method, device and system for transmitting peer-to-peer live stream This application claims China, filed on September 4, 2008, with the application number 200810146670.9, the invention titled "Peer-to-point live stream delivery method, system, digital signature device and client" Priority of the application, the entire contents of which are incorporated herein by reference.

Technical field

The present invention relates to the field of communications technologies, and in particular, to a peer-to-peer (P2P, Peer to Peer) live stream delivery method, apparatus, and system. Background technique

Data encryption technology can be divided into data transmission, data storage, data integrity authentication and key management technology. Two encryption algorithms are generally used in network applications: symmetric key algorithm and asymmetric key algorithm.

The so-called symmetric key algorithm means that the encryption key and the decryption key of one encryption algorithm are the same, or although they are not the same, one can easily derive another one, that is, the key is shared by both parties. The so-called asymmetric key algorithm means that the encryption key and the decryption key of one encryption algorithm are different, or another key cannot be derived from one of the keys. One of the two keys is called a public key. , used for decryption, is public, and the other is called private key, used for encryption, is confidential, and it is computationally infeasible to calculate the private key from the public key.

The message-digest algorithm (MD5) refers to generating a message-digest for a piece of information to prevent tampering. MD5 treats the entire file as a large text message, and through its irreversible string transformation algorithm, produces a unique MD5 message digest. MD5 belongs to a symmetric key algorithm.

More commonly used in the Internet is the asymmetric key algorithm. The commonly used asymmetric key algorithm is the RSA algorithm, which has high encryption strength and does not require the communication parties to establish some trust relationship or share some secret in advance. Very suitable for Internet use. Digital Signature technology is a typical application of asymmetric key algorithms. The so-called digital signature (Digital Signature) is some data attached to the data unit, or a password conversion to the data unit. These data or transformations allow the recipient of the data unit to confirm the integrity of the source and data unit of the data unit and to protect the data from counterfeiting by a person (e.g., a recipient). It is a method of signing messages in electronic form, a signed message can be transmitted in a communication network. The main functions of digital signature are: to ensure the integrity of information transmission, sender identity authentication, to prevent the occurrence of repudiation in transactions.

The application of the digital signature (e.g., RSA algorithm) based on the MD5 algorithm is to encrypt the summary information using the sender's private key and transmit it to the recipient along with the original text. The receiver can decrypt the encrypted digest information only by using the transmitted public key, and use the HASH function to generate a summary information of the received original text, which is compared with the decrypted digest information. If they are the same, the received information is complete and has not been modified during the transmission. Otherwise, the information has been modified. Therefore, the digital signature based on the MD5 algorithm can verify the integrity of the information.

A typical feature of P2P is content sharing between user nodes (Peer). The content data of the child nodes is provided by the parent node. Especially for some low-rate live broadcasts, one child node may only obtain content from one parent node. The prior art uses the information-digest algorithm MD5. For the P2P download content existing in the file format, the user obtains the MD5 check code before downloading, and then performs verification during the download process, so that the content can be found in the download process in time. Whether it is maliciously tampering, and does not need to complete the MD5 verification after downloading the complete content.

In the process of implementing the present invention, the inventor finds that at least the problem exists in the prior art: Since the P2P live stream is a real-time service, the P2P server needs to generate a P2P live stream check code in real time to provide the user, if all users are used The method of taking the check code in real time to the server will have a big impact on the system performance. If the node passes the check code, because the MD5 uses the symmetric key, the parent node can re-make the content of the live stream. The check code is generated to provide different content for the child nodes, so that the content is not tamper-proof. Summary of the invention The embodiment of the invention provides a method, a device and a system for transmitting P2P live stream, which can prevent the P2P live stream from being maliciously falsified during the transmission process, and avoids a big impact on the performance of the P2P system.

To achieve the above objective, the embodiment of the present invention is implemented by the following technical solutions:

A method for delivering a peer-to-peer live stream includes:

Generating a public key and a private key pair of the digital signature algorithm;

Signing the source live stream according to the private key, and slicing the signed live broadcast stream, and delivering the sliced live stream to the peer-to-peer client;

The public key is sent to the peer-to-peer client, so that the peer-to-peer client uses the public key to perform signature verification on the received peer-to-peer live stream.

A digital signature device comprising:

a signature key generating unit, configured to generate a public key and a private key pair of the digital signature algorithm; a signature key issuing unit, configured to send the private key to the content publishing server, so that the content publishing server uses The private key is used to sign the source live stream, and the signed source live stream is sliced; and the public key is sent to the resource management server, so that the point-to-point client obtains the public on the resource management server. The key uses the public key to perform signature verification on the received peer-to-peer live stream.

A system for point-to-point live stream delivery, including:

a digital signature device, configured to generate a public key and a private key pair of the digital signature algorithm, and send the private key to the content distribution server, and send the public key to the resource management server;

a content publishing server, configured to sign the source live stream by using a private key, and slice the signed source live stream;

The resource management server is configured to maintain and deliver the peer-to-peer client-side key, so that the peer-to-peer client obtains the public key and uses the public key to perform signature verification on the received peer-to-peer live stream.

A peer-to-peer client, including: a signature key obtaining unit, configured to acquire a digital signature algorithm public key;

A signature verification unit is configured to sign the received point-to-point live stream using the obtained digital signature algorithm public key.

According to the above technical solution, by introducing a digital signature technology into the P2P architecture, the digital signature device generates a key pair of the digital signature algorithm, and the private key is sent to the content distribution server, and the public key is sent to the resource management server, and the content distribution server uses The private key signs the live broadcast stream, and slices the signed live broadcast stream. The P2P client obtains the public key from the resource management server and uses the obtained public key to perform signature verification on the received P2P live stream to prevent P2P live broadcast. The purpose of the flow is tampering; the embodiment of the present invention uses an asymmetric key algorithm to ensure that the content of the P2P live broadcast service is not maliciously falsified during the delivery process, and the P2P client does not need to go to the content publishing server in real time. Obtaining the check code can avoid a big impact on the performance of the P2P system. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor.

FIG. 1 is a flowchart of a P2P live stream delivery method according to an embodiment of the present invention; FIG. 2 is a flowchart of another P2P live stream delivery method according to an embodiment of the present invention; A structural diagram of a digital signature device is provided;

FIG. 4 is a structural diagram of a P2P live stream delivery system according to an embodiment of the present invention; FIG. 5 is a structural diagram of a P2P client according to an embodiment of the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, those of ordinary skill in the art do not make All other embodiments obtained under the premise of creative labor are within the scope of the invention. Referring to FIG. 1, FIG. 1 is a schematic diagram of a P2P live stream delivery method according to an embodiment of the present invention, including: Step 101: A P2P content management system generates a public key and a private key pair of a digital signature algorithm. Step 102: The P2P content management system signs the source live stream according to the private key, and slices the signed source live stream, and sends the sliced live stream to the peer-to-peer client.

Step 103: The P2P content management system sends the public key to the peer-to-peer client, so that the peer-to-peer client uses the public key to perform signature verification on the received peer-to-peer live stream.

The P2P live stream delivery method provided by the embodiment of the invention, the P2P content management system completes the digital signature of the P2P live stream by the generation and distribution of the digital signature key, signature generation and signature verification, and prevents the P2P live stream from being transmitted. The purpose of being tampered with. Because the digital signature technology of the asymmetric key algorithm is used, it can ensure that the P2P live broadcast content of the P2P live broadcast service process will not be maliciously falsified during the transmission process, and the P2P client does not need to obtain the check code in the system in real time. Can avoid a big impact on the performance of P2P systems.

Referring to FIG. 2, an embodiment of the present invention provides another method for transmitting a peer-to-peer live stream, including: Step 201: A digital signature device generates a key pair of a digital signature algorithm, and the private key is sent to a content publishing server, and the public key is sent to the public key. Resource management server.

Before performing the live channel distribution operation, the digital signature device can flexibly configure the digital signature type and the signature mode, wherein the types of the digital signature include: all message signatures, key frame signatures, frame header signatures or key frame header signatures; digital signatures The methods include: digital signature algorithm, digital signature algorithm based on information-digest algorithm. For example, the configured digital signature type and signature method can be: Digital signature type: 0x00-no signature; 0x01-all message signature; 0x02-keyframe signature only; 0x03-frame header signature only; 0x04-keyframe only header signature .

Signature: 0x01-RSA; 0x02-RSA over MD5„

According to the configured digital signature type and signature method, perform the corresponding operations:

If a signature is required, a digital signature algorithm key pair is generated, such as an RSA key pair, and the private key is sent to the content distribution server, and the public key is sent to the resource management server. If the signature method is a digital signature algorithm based on the information-digest algorithm, an information-summary algorithm key, such as an MD5 key, is generated, and the information-summary algorithm key is simultaneously delivered to the content publishing server and the resource management server.

In the embodiment of the present invention, the content publishing server may be a P2P central media server CS-P, which is responsible for digital signature and slicing of the live stream. For example, under the distributed P2P networking architecture, the content publishing server further includes a P2P edge content server ES. ~P, CS-P distributes the signed and sliced live broadcast stream to the P2P edge content server ES-P. The ES P serves as the super node of the P2P network and provides service guarantee for the P2P client.

As the P2P client service management component, the resource management server is responsible for information maintenance of the Peer of the entire network node and scheduling of P2P client resources.

Step 202: The content distribution server performs a signature on the source live stream according to the private key, and slices the signed live broadcast stream, and delivers the sliced live stream to the peer-to-peer client.

The content publishing server obtains the source live stream from the live source, and signs the source live stream according to the configured digital signature type and signature mode. Signatures that can be combined according to signature type and signature method. The class in the tooth can be shown in Table 1: Table 1 Combination of signature type and signature method

The content publishing server slices the signed source live stream and sends the sliced live stream to the peer-to-peer client.

Step 203: The client obtains the public account from the resource management server, and uses the obtained public key to perform signature verification on the received live stream. When the P2P client initiates a live broadcast request to the P2P portal, the P2P client requests the P2P resource list from the P2P resource management server, and the resource management server carries the public key in the response message according to the configured signature type and signature mode. If the signature mode is a digital signature algorithm based on the information-digest algorithm, such as the RSA over MD5 signature mode, the message-summary algorithm key, such as the MD5 key, is also carried in the response message.

The P2P client receives the P2P live stream from the P2P edge content server ES-P or other P2P client according to the returned P2P resource list information. The P2P client uses the obtained public key, such as the RSA public key, to perform signature verification on the received P2P live stream.

Step 204: If the signature verification fails, the P2P client records the parent node information of the P2P live stream, and reports it to the P2P content management system for alarm, and re-receives the P2P live stream from other parent nodes.

The P2P live stream delivery method provided by the embodiment of the present invention generates a digital signature by the content publishing server according to the private key to the source live stream through the generation and distribution of the digital signature key of the digital signature device, and the P2P client to the resource management server The public key is obtained, and the digital signature of the received P2P live stream is signature verified to prevent the P2P live stream from being tampered with during the delivery process. Because the digital signature technology of the asymmetric key algorithm is used, it can ensure that the P2P live broadcast content of the P2P live broadcast service process will not be maliciously falsified during the transmission process, and the P2P client does not need to obtain the verification in real time to the content publishing server. The code can avoid a big impact on the performance of the P2P system.

Further, in the embodiment of the present invention, by using the digital signature method based on the information-digest algorithm, the manner of digesting and re-signing the content to be encrypted may be firstly reduced, thereby reducing the performance loss caused by the introduction of the signature algorithm. Moreover, according to the result of the signature verification, the P2P client may record the parent node information of the P2P live stream whose signature verification fails, and report it to the content management system for alarm, and if the signature verification fails, the P2P may be automatically received from other parent nodes. Live stream to protect user service and experience.

The method in the embodiment of the present invention is applicable to a centralized P2P networking, and is also applicable to a distributed P2P networking based on a Content Delivery Network (CDN) architecture. Referring to FIG. 3, an embodiment of the present invention further provides a digital signature device, including: a signature key generation unit 301, configured to generate a public key and a private key pair of a digital signature algorithm; and a signature key issuing unit 302, And sending the private key to the content publishing server, so that the content publishing server signs the source live stream by using the private key, and slicing the signed source live stream; and placing the public key Sending to the resource management server, so that the P2P client obtains the public key from the resource management server and uses the public key to perform signature verification on the received point-to-point live stream.

If it is a digital signature algorithm based on the information-digest algorithm:

The signature key generating unit 301 is further configured to generate an information-digest algorithm key, such as an MD5 key.

The signature key issuing unit 302 is further configured to send the information-summary algorithm key to the content publishing server, so that the content publishing server uses the information-summary algorithm key and the private key pair source The live stream is signed; and the information-summary algorithm key is simultaneously sent to the resource management server, so that the P2P client obtains the information-summary algorithm key from the resource management server and uses the information-summary algorithm key And the public key performs signature verification on the received point-to-point live stream.

The digital signature device further includes:

A signature type configuration unit 303 is configured to configure a digital signature type.

The configured digital signature types include: All message signatures, key frame signatures, frame header signatures, or key frame header signatures. The types of signatures that can be performed according to the signature type and signature method can be seen in Table 1 in the above table.

The digital signature device can be set either on the content management system CMS in the P2P construction or independently.

Referring to FIG. 4, based on the foregoing method and apparatus of the embodiments of the present invention, an embodiment of the present invention provides a P2P live stream delivery system, including:

The digital signature device 401 is configured to generate a public key and a private key pair of the digital signature algorithm, and the private key is sent to the content distribution server 402, and the public key is sent to the resource management server 403; The content publishing server 402 is configured to sign the source live stream by using a private key, and slice the signed source live stream;

The resource management server 403 is configured to maintain and deliver the P2P client side key, so that the P2P client obtains the public key from the resource management server 403 and uses the public key to perform signature verification on the received P2P live stream.

The digital signature device 401 is further configured to generate an information-summary algorithm key, and simultaneously deliver the information-summary algorithm key to the content distribution server and the resource management server;

The content distribution server 402 is further configured to use the information-digest algorithm key and the private key to sign the source live stream;

The resource management server 403 is further configured to acquire the information-digest algorithm key from the P2P client to the resource management server, and perform signature verification on the received point-to-point live stream by using the information-digest algorithm key and the public key. .

The digital signature device 401 is further configured to configure a digital signature type; the configured digital signature type includes: all message signature, key frame signature, frame header signature or key frame header signature;

The content distribution server 402 is further configured to sign the source live stream according to the configured digital signature type.

Referring to FIG. 5, an embodiment of the present invention further provides a P2P client, including:

a signature key obtaining unit 501, configured to acquire a digital signature algorithm public key;

The method for obtaining the public key may be: the P2P client requests the P2P resource information list from the resource management server; and receives the request response message of the P2P resource information list returned by the resource management server, where the request response message carries the public key.

The signature verification unit 502 is configured to sign the received P2P live stream using the obtained digital signature algorithm public key.

If it is a digital signature algorithm based on the information-digest algorithm, such as an MD5-based RSA digital signature algorithm, the signature key acquisition unit 501 is further configured to acquire an information-digest algorithm key; The signature verification unit 502 is further configured to perform signature verification on the received point-to-point live stream by using the obtained information-summary algorithm key and the digital signature algorithm public key.

The P2P client in the embodiment of the present invention further includes:

The alarm unit 503 is configured to record the parent node information of the P2P live stream when the signature verification fails, and report the alarm. as well as,

The live stream re-receiving unit 504 is configured to re-receive the P2P live stream from other parent nodes when the signature verification fails.

The embodiment of the invention introduces a digital signature technology in the P2P architecture to prevent the P2P live stream from being maliciously falsified, thereby enhancing the security of the P2P live broadcast. The digital signature key pair is generated by the digital signature device, and the private key is sent to the content distribution server, and the public key is sent to the resource management server. The content distribution server digitally signs and slices the source live stream, and the P2P client goes to the resource. Obtaining the signature public key on the management server and performing signature verification on the received P2P live stream can prevent the P2P live stream from being tampered with. Because the digital signature technology of the asymmetric key algorithm is used, it is ensured that the P2P live stream content is not maliciously falsified during the delivery process of the P2P live stream, and the P2P client does not need to obtain the check code on the content publishing server in real time. It can avoid a big impact on the performance of P2P systems.

Further, in the embodiment of the present invention, the information-summary algorithm key is generated by the digital signature device, and the method for performing the abstract re-signature of the content to be encrypted may be firstly reduced to reduce the performance loss caused by the introduction of the signature algorithm. Moreover, according to the result of the signature verification, the P2P client can record the parent node information of the P2P live stream whose signature verification fails, and report it to the content management system for alarm, and can automatically receive the P2P live stream from other parent nodes to ensure User service and experience.

Through the description of the above embodiments, those skilled in the art can clearly understand that the embodiments of the present invention do not need to introduce independent functional components, and can be implemented by means of software plus a necessary general hardware platform, and thus will not be existing. The P2P system architecture has an architectural impact. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium. A number of instructions are included to cause a P2P content management system or P2P client to perform the methods described in various embodiments of the present invention. The storage medium referred to herein is, for example, a ROM/RAM, a magnetic disk, an optical disk, or the like.

The description of the above embodiments is only for the purpose of facilitating the understanding of the method and the idea of the present invention; any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention, and should cover the protection of the present invention. Within the scope. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Claim

A method for delivering a peer-to-peer live stream, comprising:

Signing the source live stream according to the private key, and slicing the signed live stream, and delivering the sliced live stream to the peer-to-peer client;

2. The method according to claim 1, wherein the method further comprises: generating an information-digest algorithm key;

And signing the source live stream according to the information-summary algorithm key and the private key, and slicing the signed live broadcast stream, and sending the sliced live stream to the peer-to-peer client;

The information-digest algorithm key is sent to the peer-to-peer client, so that the peer-to-peer client uses the information-digest algorithm key and the public key to perform signature verification on the received peer-to-peer live stream.

The method according to claim 1 or 2, wherein the method further comprises: configuring a digital signature type;

The source live stream is digitally signed according to the configured data signature type.

4. The method according to claim 1 or 2, characterized in that

Generating a public key and a private key pair of the digital signature algorithm by a digital signature device;

And the private key is sent to the content distribution server by the digital signature device, and the public key is sent to the resource management server.

5. The method of claim 2, wherein

Generating the information-digest algorithm key by a digital signature device;

And the information-summary algorithm key is respectively sent by the digital signature device to the content distribution server and the resource management server.

The method according to claim 1 or 2, wherein the method further comprises: If the signature verification fails, the peer-to-peer client records the parent node information of the peer-to-peer live stream and reports it to the content management system for alarm.

7. The method according to claim 6, wherein the method further comprises: if the signature verification fails, the peer-to-peer client re-receives the peer-to-peer live stream from the other parent node.

8. A digital signature device, comprising:

a signature key generating unit, configured to generate a public key and a private key pair of the digital signature algorithm; a signature key issuing unit, configured to deliver the private key to the content publishing server, so that the content publishing server Signing the source live stream using the private key, and slicing the signed source live stream; and delivering the public key to the resource management server, so that the peer-to-peer client obtains the The public key uses the public key to perform signature verification on the received peer-to-peer live stream.

9. Apparatus according to claim 8 wherein:

The signature key generating unit is further configured to generate an information-digest algorithm key;

The signing key issuing unit is further configured to send the information-summary algorithm key to the content publishing server, so that the content publishing server uses the information-summary algorithm key and the private key pair source to broadcast The stream is signed; and the information-summary algorithm key is simultaneously sent to the resource management server, so that the peer-to-peer client obtains the information-digest algorithm key from the resource management server, and uses the information-summary algorithm key And the public key performs signature verification on the received point-to-point live stream.

The device according to claim 8 or 9, wherein the device further comprises: a signature type configuration unit, configured to configure a digital signature type.

11. A system for point-to-point live stream delivery, comprising:

a content publishing server, configured to sign the source live stream by using the private key, and slice the signed source live stream;

Resource management server, used for maintenance and delivery of peer-to-peer client-side keys for point-to-point customers The client obtains the public key and uses the public key to perform signature verification on the received peer-to-peer live stream.

12. The system of claim 11 wherein:

The digital signature device is further configured to generate an information-digest algorithm key, and send the information-summary algorithm key to the content publishing server and the resource management server at the same time;

The content distribution server is further configured to sign the source live stream by using the information-summary algorithm key and the private key;

The resource management server is further configured to obtain the information-digest algorithm key by the peer-to-peer client, and perform signature verification on the received point-to-point live stream by using the information-summary algorithm key and the public key.

13. A system according to claim 11 or 12, characterized in that

The digital signature device is further configured to configure a digital signature type;

The content publishing server is further configured to sign the source live stream according to the configured digital signature type.

14. A peer-to-peer client, comprising:

a signature key obtaining unit, configured to acquire a digital signature algorithm public key;

The signature verification unit is configured to perform signature verification on the received point-to-point live stream by using the obtained digital signature algorithm public key.

15. The point-to-point client of claim 14 wherein:

The signature key obtaining unit is further configured to acquire an information-digest algorithm key;

The signature verification unit is further configured to perform signature verification on the received point-to-point live stream according to the acquired information-summary algorithm key and the digital signature algorithm public key.

The client according to claim 14 or 15, wherein the point-to-point client further comprises:

Recording an alarm unit, used to record the parent node information of the point-to-point live stream when the signature verification fails, and report the alarm; and,

The live stream re-receiving unit is configured to re-receive the peer-to-peer live stream from other parent nodes when the signature verification fails.