WO2012164280A1

WO2012164280A1 - Data distribution system

Info

Publication number: WO2012164280A1
Application number: PCT/GB2012/051210
Authority: WO
Inventors: Nithin Thomas; Rockman Law
Original assignee: Sqr Systems
Priority date: 2011-05-31
Filing date: 2012-05-29
Publication date: 2012-12-06
Also published as: GB201109026D0

Abstract

In some data distribution systems particularly in security environments a number of source devices such as CCTV, body scanners will provide data and a number of users will have monitor devices such as screens and PDA devices. The data can be encrypted but it would be advantageous to provide a common communications path with data streaming for different data categories dependent on source, type of data and who is authorized to see it. By providing a data categorization processor or engine input data from sources can be categorized and concatenated so that receiver monitors can review different data stream categories if authorized.

Description

Data Distribution System

This invention relates generally to data distribution systems and more particularly, but not exclusively, to data distribution systems used in security environments such as airports where there are a number of security source devices such as CCTV cameras and a variety of personnel who may want access to the information provided.

There are currently a wide variety of security systems available to protect physical assets and people from malicious individuals. These range from CCTV systems to monitor premises to body scanners and x-ray machines in airports. The varied nature of these different systems means that they are often monitored by various people using a variety of devices, leading to different bits of data reaching different people or all of the data could be available to some people all of the time or at selected times such as an emergency.

Normally no one individual gets access to all the data so the full picture is often missing. For instance, staff in a control room have access to all CCTV footage but the data from the x-ray machines is only available to the security staff dealing with passengers in that area.

Conversely, the sensitive nature of much of this data means that it is essential that only the individuals authorized to view this information are allowed access to it. This problem leads to two requirements on the data distribution mechanism used: · The distribution system must be able to cope with a variety of data sources with

different coding/transmission protocols and be able to efficiently deliver the data to a variety of monitor device platforms.

• The distribution system must be able to protect the information in such a way as to allow varying levels of access to different users.

In some circumstance there can also be issues with a user's concerns with undue information dissemination so not completely justified information retention and ownership. It is not unknown for separate systems to be installed rather than integrate systems adding to complexity, cost and delay to avoid unauthorised or inadvertent data distribution.

In accordance with aspects of the present invention there is provided a data distribution system comprising a plurality of source devices, a data categorisation processor, a communications path and at least one monitor device, each source device configured to provide data to the categorisation processor for categorisation of the data into one or more of a plurality of data stream categories by applying a streaming criteria, the data with the streaming criteria presented on the communication path in a concatenated form by the categorisation processor, the monitor device associated with the communication path and configured and/or authorised to receive the concatenated form to the extent dependent upon the data stream category.

Also in accordance with aspects of the present invention there is provided a method of data distribution from a plurality of source devices to a monitor device through a communication path, the method comprising providing data to a categorisation processor for categorising the data from each source device into one or more of a plurality of data stream categories and applying a streaming criteria, the data and the streaming criteria presented to the communication path in a concatenated form whereby in accordance with the method the monitor device is associated with the communication path and configured and/or authorised to receive the data and the streaming criteria in the concatenated form to the extent authorised for that monitor device and dependent upon the data stream category.

The communication path may be common to all the source devices and the monitor devices. The communication path may be wired or wireless. The communication path may be a single bit or digital signal stream. Typically there may be a plurality of monitor devices. The monitor devices may be fixed monitor screens or PDA devices or alarm devices.

The source devices may be CCTV cameras, x-ray machines, body scanners or PIR sensors. At least some of the source devices and/or the monitor devices may be security devices. The security devices may be individually addressable or identifiable as part to the data. A probable sequence path for source devices may be defined in terms of an expected time or order sequence for data expected with regard to the same subject from the source devices. The data may be provided in packets. The packets may be of equal size. The packets may have a size related to the source device. The packets may be divided into sub-packets with the streaming criteria inter-linking the sub-packets whereby the monitor device can consolidate some or all of the sub-packets to the extent authorised for that monitor device and dependent upon the data stream category. The sub-packets may be of equal or unequal size. The streaming criteria may be associated with one or more data packets.

The concatenated form may include encryption of all or part of the data and/or the streaming criteria. The encryption may depend on the category of data stream. The encryption may be scaled or scalable dependent upon the data and/or the data stream category and/or a desired security level and/or the source device and/or the monitor device. Encryption may be different for different data from the same source device over time and/or different for different data from different sources devices. Encryption may be different for different data stream categories. Encryption may be different for different source devices irrespective of the data provided by that source device. Encryption may be different for different monitor devices. Encryption may be different for different time periods. Encryption may be different with elected associated changes in the source devices and/or monitor devices individually or as pairs or as groups. Monitor devices may be configured and/or authorised permanently and fixed. Monitor devices may be configured and/or authorised to be variable by variation means. The variation means for each monitor device may be individually variable. The variation means for each monitor device may be variable in a group of monitor devices or relative to other monitor devices.

The input data may be from one source device. The input data may be from more than one source device.

The source devices may transmit only. The monitor devices may receive only.

The streaming criteria is a header and/or sizing of data packets for a device.

Embodiments of the invention will now be described by way of example only with reference to the accompanying drawings in which:

Figure 1 is a schematic illustration of a data categorisation part of a data distribution system in accordance with aspects of the present invention;

Figure 2 is a schematic illustration of data categorisation for multiple data types;

Figure 3 is a schematic illustration of utilisation data categorisation in implementation of a data distribution system in accordance with aspects of the present invention; and, Figure 4 is a schematic illustration of a data distribution system where scaleable encryption is provided.

Aspects of the present invention provide techniques for enabling different types of security source devices to transmit data to multiple receiving monitor devices with different capabilities and characteristics. This technique allows all the devices to access the security information from a single bit stream, containing the individual components from the various transmitting source devices. The receiving monitor devices can access different portions of the bit stream depending on the authority of the user. This approach has the benefit of allowing more efficient access to all the security information, increasing the situational awareness of security staff. When combined with a scalable encryption technique, there is an additional benefit of allowing end to end security when transmitting sensitive information.

It will be understood normally each source device will have an identifier which is either unique or at least a descriptor for the type or location of the source device. Similarly, each receiving monitor device will be identifiable but more importantly can be defined by is capabilities and inherent or acquired authority such as through part of an encryption regime. In any event with a single bit stream it will be understood that the flow can only be appreciated in an output seen or appreciable to a user if the monitor device is properly configured and authorised. For example a monitor device might be able to determine there is data stream flow in a particular transmission scheme e.g. Bluetooth but without the capability to read Bluetooth and having the de-coding key such information is useless. With aspects of the present invention capability and authorisation is system based but also authorisation is levelled or tiered in terms of data stream categorisation with a monitor configured in a fixed manner or dependent upon the user to receive one or more data stream categorisation levels. These levels or categories could be grouped for particular personnel in a fixed manner or possibly interactively so for example normally some personnel may only see x-ray scanners from associated source devices but when searching for particular individuals CCTV images may be flashed on to their monitor device. The levels and categories allow encryption for each category and so sensitivity to be more focussed as required. Encryption may slow distribution and add to processor time so by limiting high level encryption to certain categories of data the distribution of lower level data may be speeded up as it is only subject to an appropriate level of encryption along with higher level more sensitive data as there is less of that higher level data to process.

Aspects of the present invention are described below by way of example in the context of airport security but it will be appreciated by persons skilled in the technology and recognized that these problems can occur in any application where different types of data are delivered to a variety of users accessing the data from different monitor device platforms.

Aspects of the present invention provide a system by which all data from any source device can be sent to anybody using any type of viewing platform or monitor device. For example, in an airport, this approach and system could allow source devices which provide CCTV footage, body scanner and x-ray machine data to be viewed by any of the security staff. In addition, the data can be accessed and viewed using any type of viewing monitor device. These monitor devices could range from fixed high-definition monitors to hand-held mobile devices. An encryption device can encrypt all of this data at the source in such a way that allows it to be modified to suit the destination monitor device. Enabling this end-to-end security is a key benefit of this invention.

Data will normally be presented in packets of data. The packets will be categorised in such packets and the categorisation automatically determined but with a potential to adjust specifically for a time period or for particular packets from a source device. The data packets may be split into sub-data packets with the streaming criteria used by monitor device to reassembly the sub-packets to provide an output at the monitor device. The sub-packets may be of equal size or differing size as part of a typically unitary data packet. The sub-packets may be severable for presentation in their own right and may be differently encrypted for better security. Figure 1 shows an example of a data categorization processor or engine (DCE) 1 that is used to categorize two different data streams X, Y into a category 1 stream A and a category 2 stream B. The use of such an engine 1 is a key part of this invention. For the sake of simplicity, the example shows two input streams X, Y and 2 categories A, B. In reality, there is no limit to the number of input data streams and the number of data stream categories that can be implemented. The categorized data streams A, B can then be combined to a single stream and optionally is encrypted using a suitable technique such as that developed in US Patent Application number 1 2/732,006 - Data Encryption

Technique or "A Novel H.264 SVC Encryption Scheme for Secure

BitrateTranscoding". N. Thomas, D. Bull and D. Redmill Proceedings of the 27th Picture Coding Symposium. May 2009 to allow adaptation of an encrypted data stream transmitted or broadcast as required. These techniques will be readily understood by those skilled in the technology and the subject matter is incorporated here by reference. The benefit of this approach is that all the data can be sent using a single channel and the different components of the data can be separated further down the distribution channel to allow selective delivery. By enabling such a converged approach, the data can be delivered more efficiently from a range of devices. This would also allow better use of the security data by enabling a single point of entry for access to all security information. An example of a scenario where this could be useful is where many types of security data are captured at an airport to be transmitted to a law enforcement agency such as the local Police. All the data can be transmitted to the agency where the categorization can be used to separate the data in encrypted form in order to deliver the different components to different members of staff. It will be understood that the encryption provides a base security but further identification is provided in a number of ways so for example an actual user may have an individual access PIN, the monitor device may have an identification response to be used with the encryption technique in a probable public key/secret key combination, the device may be identifiable from its location virtually in a network or physically, the monitor device may be identified or at least grouped based upon its capability or lack of capability to receive data as encrypted or open/plain after de-coding/decryption etc. for adequate display. The monitor device takes part of the data stream as authorised and as will be described later that authorisation can take many forms. It will as be understood that a monitor device could be a primary monitor device and secondary and even tertiary sub-monitor devices such as back up memory or 'off-line' recognition checker could be connected to the primary monitor device. Figure 2 shows an example of where a DCE 21 can be implemented for a system 200 that uses video 22, image 23 and text 24 based communications data. The video 22 and image 23 streams can be categorized by encoding them with a scalable codec such as H.264 SVC [H. Schwarz, D. Marpe, and T. Weigand, Overview of the Scalable Video Coding Extension of the H.264/AVC Standard," I EEE Transactions on Circuits and Systems for Video Technology, vol. 1 7, no. 9, pp. 1 1 03-1 1 20, September 2007] for video and JPEG2000 [C. Christopoulos, A. Skodras, T. Ebrahimi, "The JPEG2000 still image coding system : an overview", I EEE Transactions on Consumer Electronics, vol. 46, issue 4, pp. 1 1 03-1 1 27, August 2000.] for images. Each message categorization system may need to be custom built to suit the application or it may also be possible to provide a standardised system with access control for security and to make the system closed to open access. The types of messages that could be supported included traditional text based messages for communication purposes and alarm systems for various other technologies such as event detection, including behaviour analysis, number plate and face recognition, as well as intruder and disaster detection mechanisms including fire alarms. All this information can be integrated into a single messaging stream where the different components are categorized differently. This information can then be transmitted using a single channel where the different components can be extracted by various users through monitor devices depending on their requirements and authorization levels. The use of an encoding scheme such as presented in C. Christopoulos, A. Skodras, T. Ebrahimi, "The JPEG2000 still image coding system : an overview", I EEE Transactions on Consumer Electronics, vol. 46, issue 4, pp. 1 103-1 127, August 2000. with suitable encryption as described before allows all this to be carried out ensure end-to-end security. The subject matter of this document is incorporated by reference but it will be understood that similar techniques could be used. Figure 3 shows an example of an implementation of the message categorization

arrangement in a data distribution system 300 where four different modules 301 , 302, 303, 304 are feeding data into the data distribution system 300.The data is first categorized and concatenated into a single stream 305 by a DCE 306. The categorization is once again implemented using respective streaming criterias inserted into the stream. The concatenated stream can then be optionally passed into an encryption scheme as shown in Figure 4.

As can be seen in figure 4 a data distribution system 400 in accordance with aspects of the present invention as described previously takes an input stream 401 from a source device (not shown) and presents that data stream 401 to a DCE 402. The DCE categories the data as category 1 stream AA or category 2 stream BB. The streams AA, BB are scalable encrypted 403 and put through a data extractor 404 before transmission or broadcast to target platform monitor devices 405, 406 in the form of fixed monitors watched by personnel or PDA devices or the like. The level and scale of encryption can be variable by appropriate means dependent upon the data, the source device and the monitor device as well as the communication path. The encryption variation means itself can vary dependent upon configuration of the systems as well variations in the source and monitor devices

themselves. In such circumstances the monitor device and/or the source device or the elected communication path will be individually addressable so the necessary variations can be made.

Aspects of the present invention provide:- · The ability to deliver data from multiple source devices which will mean that the

security staff are better connected to all the security equipment in use. • The support for multiple viewing monitor devices means there is no requirement for the security staff to be present in a control room; PDAs can be authorised as required.

• The use of a scalable encryption technique allows the data to be delivered with

highest quality possible without compromising on the security and integrity of the data.

• The ability to deliver all security data through a single system means that data

sharing services and cloud based services can be set up to drastically reduce costs.

The use of a DCE along with scalable encryption techniques presents several benefits to security staff. By providing all the security information through a single bit stream, different users can access portions of the bit stream depending on the type of device used and the level of the user's authority. By implementing this technique with scalable encryption techniques, end to end security can be achieved. Aside from increasing the situational awareness of the authorized individuals, leading to more coordinated efforts against possible threats, cost savings are possible through enabling data sharing and cloud services.

It will be appreciated by those skilled in the art that any number of combinations of the aforementioned features and/or those shown in the appended drawings provide clear advantages over the prior art and are therefore within the scope of the invention described herein.

Claims

1. A data distribution system comprising a plurality of source devices, a data categorisation processor, a communications path and at least one monitor device, each source device configured to provide data to the categorisation processor for categorisation of the data into one or more of a plurality of data stream categories by applying a streaming criteria, the data and the streaming criteria presented on the communication path in a concatenated form by the categorisation processor, the monitor device associated with the communication path and configured and/or authorised to receive the concatenated form to the extent dependent upon the data stream category.

2. A data distribution system as claimed in claim 1 wherein the communication path is common to all the source devices and the monitor devices.

3. A data distribution system as claimed in claim 1 or claim 2 wherein the communication path is wired and/or wireless.

4. A data distribution system as claimed in any of claims 1 to 3 wherein the communication path is a single bit or digital signal stream.

5. A data distribution system as claimed in any proceeding claim wherein there is a plurality of monitor devices.

6. A data distribution system as claimed in any proceeding claim wherein each monitor device is a fixed monitor screen or a PDA device or an alarm device.

7. A data distribution system as claimed in any proceeding claim wherein the source devices are CCTV cameras and/or x-ray machines and/or body scanners and/or PIR sensors.

8. A data distribution system as claimed in any proceeding claim wherein at least some of the source devices and/or the monitor devices are security devices.

9. A data distribution system as claimed in claim 8 wherein the security devices are individually addressable or identifiable as part to the data.

10. A data distribution system as claimed in any proceeding claim wherein a probable sequence path for source devices is defined in terms of an expected time or order sequence for data expected with regard to the same subject from the source devices.

11. A data distribution system as claimed in any proceeding claim wherein the data is provided in packets.

12. A data distribution system as claimed in claim 1 wherein the packets are of equal size.

13. A data distribution system as claimed in claim 1 1 or claim 12 wherein the packets have a size related to the source device.

14. A data distribution system as claimed in any of claims 11 to 13 wherein the packets are divided into sub-packets with the streaming criteria inter-linking the sub-packets whereby the monitor device can consolidate some or all of the sub-packets to the extent authorised for that monitor device and dependent upon the data stream category.

15 A data distribution system as claimed in claim 14 wherein the sub-packets are of equal or unequal size.

16. A data distribution system as claimed in any proceeding claim wherein the streaming criteria is associated with one or more data packets.

17. A data distribution system as claimed in any proceeding claim wherein the concatenated form includes encryption of all or part of the data and/or the streaming criteria.

18. A data distribution system as claimed in claim 17 wherein the encryption depends on the category of data stream.

19. A data distribution system as claimed in claim 17 or claim 18 wherein the encryption is scaled or scalable dependent upon the data and/or the data stream category and/or a desired security level and/or the source device and/or the monitor device.

20. A data distribution system as claimed in any of claims 17 to 19 wherein encryption is different for different data from the same source device over time and/or different for different data from different sources devices.

21. A data distribution system as c)aimed in any of claims 17 to 20 wherein the encryption is different for different data stream categories.

22. A data distribution system as claimed in any of claims 17 to 2 wherein the encryption is different for different source devices irrespective of the data provided by that source device.

23. A data distribution system as claimed in any of claims 17 to 22 wherein the encryption is different for different monitor devices.

24. A data distribution system as claimed in any of claims 17 to 23 wherein the encryption is different for different time periods.

25. A data distribution system as claimed in any of claims 16 to 24 wherein the encryption is different with elected associated changes in the source devices and/or monitor devices individually or as pairs or as groups.

26. A data distribution system as claimed in any proceeding claim wherein each monitor device is configured and/or authorised permanently and fixed.

27. A data distribution system as claimed in any of claims 1 to 25 wherein each monitor devices is configured and/or authorised to be variable by variation means.

28. A data distribution system as claimed in claim 27 wherein the variation means for each monitor device may be individually variable.

29. A data distribution system as claimed in claim 27 or claim 28 wherein the variation means for each monitor device is variable in a group of monitor devices or relative to other monitor devices.

30. A data distribution system as claimed in any proceeding claim wherein the input data is from one source device.

31. A data distribution system as claimed in any of claims 1 to 29 wherein the input data is from more than one source device.

32. A data distribution system as claimed in any proceeding claim wherein the source devices are transmit only.

33. A data distribution system as claimed in any proceeding claim wherein each monitor device is receive only.

34. A data distribution system in which the streaming criteria is a header and/or data packet sizing for a device.

35. A data distribution system substantially as hereinbefore described with reference to the accompanying drawings.

36. A method of data distribution from a plurality of source devices to a monitor device through a communication path, the method comprising providing data to a categorisation processor for categorising the data from each source device in one or more of a plurality of data stream categories with a streaming criteria, the data and the streaming criteria presented to the communication path in a concatenated form whereby in accordance with the method the monitor device is associated with the communication path and configured and/or authorised to receive the data and the streaming criteria in the concatenated form to the extent authorised for that monitor device and dependent upon the data stream category.

37. A method as claimed in claim 36 wherein a probable sequence path for source devices is defined in terms of an expected time or order sequence for data expected with regard to the same subject from the source devices.

38. A method as claimed in claim 36 or claim 37 wherein the data is provided in packets.

39. A method as claimed in claim 38 wherein the packets are of equal size.

40. A method as claimed in claim 38 or claim 39 wherein the packets have a size related to the source device.

41. A method as claimed in claim 40 wherein the packets are divided into sub-packets with the streaming criteria inter-linking the sub-packets whereby the monitor device can consolidate some or all of the sub-packets to the extent authorised for that monitor device and dependent upon the data stream category.

42. A method as claimed in claim 41 wherein the sub-packets are of equal or unequal size.

43. A method as claimed in any of claims 36 to 42 wherein the streaming criteria is associated with one or more data packets.

44. A method as claimed in any of claims 36 to 43 wherein the concatenated form includes encryption of all or part of the data and/or the streaming criteria.

45. A method as claimed in 44 wherein the encryption depends on the category of data stream.

46. A method as claimed in 44 or claim 45 wherein the encryption is scaled or scalable dependent upon the data and/or the data stream category and/or a desired security level and/or the source device and/or the monitor device.

47. A method as claimed in any of claims 44 to 46 wherein the encryption is different for different data from the same source device over time and/or different for different data from different sources devices.

48. A method as claimed in any of claims 44 to 47 wherein the encryption is different for different data stream categories.

49. A method as claimed in any of claims 44 to 48 wherein the encryption is different for different source devices irrespective of the data provided by that source device.

50. A method as claimed in any of claims 44 to 49 wherein the encryption is different for different monitor devices.

51. A method as claimed in any of claims 44 to 50 wherein the encryption is different for different time periods.

52. A method as claimed in any of claims 44 to 51 wherein the encryption is different with elected associated changes in the source devices and/or monitor devices individually or as pairs or as groups.

53. A method as claimed in any of claims 41 to 52 wherein each monitor devices is configured and/or authorised permanently and fixed.

54. A method as claimed in any of claims 41 to 52 wherein each monitor devices is configured and/or authorised to be variable by variation means.

55. A method as claimed in claim 54 wherein the variation means for each monitor device is individually variable.

56. A method as claimed in claim 54 or 55 wherein the variation means for each monitor device is variable in a group of monitor devices or relative to other monitor devices.

57. A method as claimed in any of claims 41 to 56 wherein the input data is from one source device.

58. A method as claimed in any of claims 41 to 57 wherein the input data is from more than one source device.

59. A method of as claimed in any of claims 36 to 58 in which the streaming criteria is a header and/or data packet sizing for a device.

60. A method of data distribution from a plurality of source devices to a monitor device through a communication path substantially as hereinbefore described with reference to the accompanying drawing.

61. A recordable device programmed and arranged to store the method as claimed in an of claims 36 to 60.