WO2017198069A1 - 一种流媒体文件的处理方法及装置 - Google Patents

一种流媒体文件的处理方法及装置 Download PDF

Info

Publication number
WO2017198069A1
WO2017198069A1 PCT/CN2017/082748 CN2017082748W WO2017198069A1 WO 2017198069 A1 WO2017198069 A1 WO 2017198069A1 CN 2017082748 W CN2017082748 W CN 2017082748W WO 2017198069 A1 WO2017198069 A1 WO 2017198069A1
Authority
WO
WIPO (PCT)
Prior art keywords
streaming media
media file
signed
ott
processing
Prior art date
Application number
PCT/CN2017/082748
Other languages
English (en)
French (fr)
Inventor
周美艳
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017198069A1 publication Critical patent/WO2017198069A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/60—Network streaming of media packets
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/60—Network streaming of media packets
    • H04L65/65—Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the present application relates to, but is not limited to, the technical field of communication applications, and in particular, to a method and an apparatus for processing a streaming media file.
  • the HTTP Live Streaming (HLS) protocol based on Hypertext Transfer Protocol is an HTTP-based streaming media transfer protocol implemented by Apple.
  • the protocol uses HTTP transmission.
  • the code rate can be adaptively adjusted according to the network bandwidth, that is, the server is allowed to store multiple multimedia streams of different code rates for the same program content, and the terminal can adaptively adjust the code rate of the multimedia stream to be downloaded according to the actual network download speed.
  • the terminal can achieve non-stop playback by reducing the code rate; and compared to other streaming communication protocols, the HLS protocol can be better compatible with other related technologies when the service is deployed.
  • the present application provides a method and an apparatus for processing a streaming media file to ensure security during a code stream transmission process.
  • An embodiment of the present invention provides a method for processing a streaming media file, including:
  • OTT streaming media file is a real-time streaming transmission through a hypertext transfer protocol.
  • the step of performing signature processing on the OTT streaming media file to obtain the signed OTT streaming media file includes:
  • the step of performing signature processing on the fragment file in the OTT streaming media file to obtain signature information of the fragment file includes:
  • the step of performing signature processing on the fragment file in the OTT streaming media file according to the asymmetric encryption algorithm, and obtaining the signature information of the fragment file includes:
  • the step of transmitting the signed OTT streaming media file to the streaming media file receiving end includes:
  • the signed OTT streaming media file and the signed transmission public key are transmitted to the streaming media file receiving end.
  • An embodiment of the present invention further provides a processing device for streaming media files, including:
  • the signature module is configured to perform signature processing on the Internet-based OTT streaming media file to obtain a signed OTT streaming media file, where the OTT streaming media file is a streaming media that is transmitted by a real-time streaming HLS protocol based on a hypertext transfer protocol. file;
  • a transmission module configured to transmit the signed OTT streaming media file to a streaming media file Receiving end.
  • An embodiment of the present invention further provides a method for processing a streaming media file, including:
  • the signed OTT streaming media file is a streaming media file transmitted by a real-time streaming HLS protocol based on a hypertext transfer protocol;
  • the step of acquiring the signed OTT streaming media file transmitted by the sending end of the streaming media file includes:
  • the signed public key of the signed OTT streaming media file is obtained after the signature processing.
  • the step of verifying the signed OTT streaming media file includes:
  • the step of verifying the signed OTT streaming media file according to the signature information, the asymmetric algorithm, and the signed transmission public key includes:
  • signature information is included in the signature information, verifying the signed transmission public key
  • the signed OTT streaming media file is verified according to an asymmetric algorithm.
  • An embodiment of the present invention further provides a processing device for streaming media files, including:
  • An acquiring module configured to obtain a signed OTT streaming media file transmitted by a streaming media file sending end, where the OTT streaming media file is a streaming media file that is transmitted by a real-time streaming HLS protocol based on a hypertext transfer protocol;
  • the verification module is configured to perform verification on the signed OTT streaming media file, and perform predetermined service processing on the successfully verified OTT streaming media file.
  • Embodiments of the present invention also provide a computer readable storage medium storing computer executable instructions that, when executed by a processor, implement a method of processing the streaming media file.
  • the foregoing technical solution of the embodiment of the present invention performs signature processing on the Internet-based OTT streaming media file to obtain a signed OTT streaming media file, and transmits the signed OTT streaming media file to the streaming media file receiving end.
  • the OTT streaming media file transmitted based on the HLS protocol is subjected to signature processing to prevent tampering of the OTT code stream during the transmission process, thereby ensuring security in the code stream transmission process.
  • FIG. 1 is a first working flowchart of a method for processing a streaming media file according to an embodiment of the present invention
  • FIG. 2 is a second working flowchart of a method for processing a streaming media file according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of a first transmission of an HLS code stream and key information according to an embodiment of the present invention
  • FIG. 4 is a first structural block diagram of a processing device for streaming media files according to an embodiment of the present invention
  • FIG. 5 is a third working flowchart of a method for processing a streaming media file according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of a second transmission of an HLS code stream and key information according to an embodiment of the present invention.
  • FIG. 7 is a second structural block diagram of a processing device for streaming media files according to an embodiment of the present invention.
  • Embodiments of the present invention provide a method and an apparatus for processing a streaming media file to ensure security in a code stream transmission process.
  • the method for processing the streaming media file in the embodiment of the present invention is applied to the sending end of the streaming media file, and the sending end of the streaming media file may be a central node in a Content Delivery Network (CDN), as shown in FIG. 1 .
  • Processing methods include:
  • Step 11 Perform signature processing on the Internet-based OTT streaming media file to obtain a signed OTT streaming media file, where the OTT streaming media file is a streaming media file transmitted by a real-time streaming HLS protocol based on a hypertext transfer protocol.
  • the streaming media file sending end performs signature processing on the OTT streaming media file to obtain an OTT streaming media file carrying the signature information, and transmits the OTT streaming media file carrying the signature information to the streaming media.
  • the file receiving end enables the streaming media file receiving end to verify the streaming media file according to the signature information, and performs predetermined service processing on the successfully verified OTT streaming media file.
  • the streaming media transmitting end may be a central node in the CDN, the central node acquires an HLS encoder code stream (OTT streaming media file) from the HLS provider, and streams the signed HLS encoder code stream over the entire CDN based on the HLS protocol. Transfer within the node.
  • the OTT media file includes an index file and a fragmented media file (ie, a fragment file), and an extension field is added in the index file, and signature information of the OTT streaming media file is saved in an extension field of the index file.
  • Step 12 The signed OTT streaming media file is transmitted to the streaming media file receiving end.
  • the streaming media sending end may perform signature processing on the OTT streaming media file by using an asymmetric algorithm, and transmit the signed OTT streaming media file and the transmission public key used to decrypt the signed OTT streaming media file to the streaming media file.
  • Receiving end may perform signature processing on the OTT streaming media file by using an asymmetric algorithm, and transmit the signed OTT streaming media file and the transmission public key used to decrypt the signed OTT streaming media file to the streaming media file.
  • Receiving end may further ensure the security of the OTT streaming media file transmission.
  • the transmission public key is subjected to signature processing according to the asymmetric algorithm, and the signature-processed transmission public key is sent to the streaming media file receiving end.
  • the streaming media file receiving end may be an edge node or a terminal in the CDN network. If the streaming media file receiving end is an edge node in the CDN network, the edge node performs verification processing on the signed OTT streaming media file, and Verify that the successful OTT streaming media file is transmitted to the terminal; The receiving end of the streaming media file is a terminal, and the terminal performs verification processing on the signed OTT streaming media file, and plays the OTT streaming media file with successful verification.
  • the method for processing a streaming media file in the embodiment of the present invention performs signature processing on an Internet-based OTT streaming media file to obtain a signed OTT streaming media file, and transmits the signed OTT streaming media file to a streaming media file receiving end.
  • the OTT streaming media file transmitted based on the HLS protocol is subjected to signature processing to prevent tampering of the OTT code stream during the transmission process, thereby ensuring security in the code stream transmission process.
  • a method for processing a streaming media file includes:
  • Step 21 Perform signature processing on the fragment file in the OTT streaming media file to obtain signature information of the fragment file.
  • the fragment file in the OTT streaming media file may be subjected to signature processing according to an asymmetric encryption algorithm to obtain signature information of the fragment file.
  • an asymmetric encryption algorithm According to the ECC (Elliptic Curves Cryptography) algorithm and a transmission private key, the fragment file is signed and processed, and the signature information of the fragment file is obtained.
  • ECC Elliptic Curves Cryptography
  • the implementation process of the signature is as follows: sampling method is adopted.
  • the signature information of the slice file is obtained by sampling, and the step size of the sample and the width of the sample can be configured.
  • sampling is performed by sampling.
  • the step size of the sampling and the width of the sampling can be configured, and the range of the sampling step is limited to prevent sampling steps in the transmission process.
  • the length is maliciously modified, and the streaming file receiving end verifies whether the sampling step is within a reasonable range.
  • Step 22 Save the signature information of the fragment file in an extension field of the index file of the OTT streaming media file to obtain the signed OTT streaming media file.
  • the signature information of the fragment file is written into the index file, and an extension field is added to each fragment in the index file to put the signature information.
  • Step 23 The signed OTT streaming media file is transmitted to the streaming media file receiving end.
  • the transmission public key for decrypting the signed OTT streaming media file may be signed according to an asymmetric algorithm (such as an ECC algorithm) to obtain a signed transmission public key; and the signed OTT streaming media file and The signed transmission public key is transmitted to the streaming media file receiving end.
  • an asymmetric algorithm such as an ECC algorithm
  • the signature and the verification are in the form of a double key
  • the key of the signature is a "transport private key”
  • the "transport public key” paired with the authentication is used for verification.
  • a strong secure transmission of the two-level key is adopted, that is, the HLS code stream is signed and verified by using a double key, and the transmission of the public key is also signed and verified by using a double key.
  • the dual keys are the "root private key” and the "root public key”.
  • an embodiment of the present invention further provides a processing device for streaming media files, including:
  • the signature module 41 is configured to perform signature processing on the Internet-based OTT streaming media file to obtain a signed OTT streaming media file, where the OTT streaming media file is a stream transmitted by a real-time streaming HLS protocol based on a hypertext transfer protocol.
  • the transmission module 42 is configured to transmit the signed OTT streaming media file to the streaming media file receiving end.
  • the signature module 41 includes:
  • the first signature sub-module 411 is configured to perform signature processing on the fragment file in the OTT streaming media file to obtain signature information of the fragment file.
  • the saving submodule 412 is configured to save the signature information of the fragment file in an extension field of the index file of the OTT streaming media file to obtain the signed OTT streaming media file.
  • the first signature sub-module 411 is configured to perform signature processing on the fragment file in the OTT streaming media file according to an asymmetric encryption algorithm, to obtain the fragment file. Signature information.
  • the processing device of the streaming media file in the embodiment of the present invention, the first signature sub-module 411 package include:
  • the signature unit 4111 is configured to perform signature processing on the fragment file according to the ECC algorithm and a transmission private key to obtain signature information of the fragment file.
  • the transmission module 42 includes:
  • the second signature sub-module 421 is configured to perform a signature process on the transport public key used to decrypt the signed OTT streaming media file according to an asymmetric algorithm, to obtain a signed transport public key;
  • the transmission submodule 422 is configured to transmit the signed OTT streaming media file and the signed transmission public key to the streaming media file receiving end.
  • the device is a device corresponding to the foregoing method embodiment, and all implementations in the foregoing method embodiments are applicable to the embodiment of the device, and the same technical effects can be achieved.
  • the foregoing technical solution of the embodiment of the present invention performs signature processing on the Internet-based OTT streaming media file to obtain a signed OTT streaming media file, and transmits the signed OTT streaming media file to the streaming media file receiving end.
  • the OTT streaming media file transmitted based on the HLS protocol is subjected to signature processing to prevent tampering of the OTT code stream during the transmission process, thereby ensuring security in the code stream transmission process.
  • an embodiment of the present invention further provides a method for processing a streaming media file, which is applied to a streaming media file receiving end, where the streaming media receiving end may be an edge node or a terminal in a CDN network, and the processing method is include:
  • Step 51 Obtain a signed OTT streaming media file that is sent by the sending end of the streaming media file, and the signed OTT streaming media file is obtained after the streaming media file sending end performs signature processing on the OTT streaming media file, and
  • the OTT streaming media file is a streaming media file that is transmitted by a real-time streaming HLS protocol based on a hypertext transfer protocol.
  • the signed OTT streaming media file and the signed transmission public key transmitted by the streaming media file sending end are obtained, wherein the signed transmission public key is the streaming media file sending end according to the non-
  • the symmetric algorithm obtains a signature process for decrypting the transport public key of the signed OTT streaming media file.
  • Step 52 Perform verification on the signed OTT streaming media file, and perform predetermined service processing on the successfully verified OTT streaming media file.
  • the signature information of the OTT streaming media file is obtained from an extension field of an index file of the OTT streaming media file; and the signature information, the asymmetric algorithm, and the signed transmission public key pair are obtained according to the signature information.
  • the signed OTT streaming file is verified.
  • the step of verifying the signed OTT streaming media file according to the signature information, the asymmetric algorithm, and the signed transmission public key includes: determining whether the signature information includes signature information; If the signature information is included in the signature information, the signed public key is verified; if the signed public key is successfully verified, the signed OTT streaming is performed according to an asymmetric algorithm. The file is verified.
  • the predetermined service processing may be: transmitting the OTT streaming media file with successful verification to the edge node; if the receiving end of the streaming media file is a terminal, the predetermined service is The processing may be to play an OTT streaming file that is successfully verified.
  • the HLS content provider 61 provides the HLS content through the HLS encoder, including the main index index.m3u8, the sub-index $rateid.m3u8, and the fragment ts file corresponding to the sub-index.
  • the central node 62 of the OTT CDN receives the encoder's HLS code stream stored locally, and the central node's signature server 66 signs the code stream according to the ECC algorithm.
  • the algorithm can refer to IEEE Std 1363.
  • the algorithm index and signature length are shown in Table 1.
  • the signature of the HLS only signs the content of the fragment file, sampling by sampling, the step size of the sampling and the width of the sampling can be configured, and the server side limits the range of the sampling step to prevent the transmission process.
  • the sampling step size is maliciously modified, and the signature detecting server 67 verifies whether the sampling step size is within a reasonable range.
  • the information related to the HLS fragment signature is written into the index file, and an extension field is added to the signature information in each fragment of the index file.
  • the signature information includes: flag, algorithm, sampling step size, sampling width, Signature, URI signature, such as:
  • the signature and verification are in the form of a double key.
  • the signed key is the “transport private key”, and the “transport public key” paired with it is used for verification.
  • a strong secure transmission of the two-level key is adopted, that is, the HLS code stream is signed and verified by the double key, and the public key is transmitted securely, and the double key is used for signature and verification.
  • the latter's dual keys are the "root private key” and the "root public key”.
  • the HLS code stream with signature information is transmitted in the OTT streaming media network.
  • the entire network includes a number of cache nodes 63, and the final code stream is transmitted to the edge node 64.
  • the signature detection server 67 of the edge node determines whether to perform signature detection according to whether the sub-index includes the #EXT-X-SIGN tag, and the detection process is as follows:
  • the index file M3U8 may also be maliciously tampered with.
  • the URI in the M3U8 index file is signed to ensure that the accessed fragment is the content injected by the OTT CDN, preventing the URI from being maliciously changed to an illegal source. station;
  • the code stream alarm for detecting failure is passed, and the HLS terminal 65 can only request the edge node 64 to detect the passing HLS code stream playback.
  • the method for processing a streaming media file in the embodiment of the present invention is as shown in FIG. 6.
  • the source end provides an OTT original code stream.
  • the HLS content provider 61 obtains an HLS source code stream through an HLS encoder, and includes a description file and a media file.
  • the central node 62 receives the original code stream by using the HTTP protocol, the signature server 66 signs the code stream according to a certain algorithm, and the signature information stream (signature key information) is transmitted to the edge signature detection server 67 in an out-of-band manner; with signature information
  • the HLS code stream uses a strong secure transmission of two-level keys in the OTT network, that is, the digital signature of the code stream and the digital signature of the public key certificate are generated using two different keys; the code stream is transmitted to the edge node 64, and the signature is detected.
  • the server 67 performs signature verification on the code stream, and alerts the code stream that does not conform to the signature; the HLS terminal 65 requests the edge node 64 to verify the passed media file for playback.
  • an embodiment of the present invention further provides a processing device for streaming media files, including:
  • the obtaining module 71 is configured to obtain the signed OTT streaming media file transmitted by the streaming media file sending end, where the OTT streaming media file is a streaming media file that is transmitted by using a real-time streaming HLS protocol based on a hypertext transfer protocol;
  • the verification module 72 is configured to verify the signed OTT streaming media file and perform predetermined service processing on the successfully verified OTT streaming media file.
  • the acquiring module 71 is configured to acquire a signed OTT streaming media file and a signed transmission public key transmitted by the sending end of the streaming media file, wherein the signed transmission public key is used by the sending end of the streaming media file according to an asymmetric algorithm pair for decryption
  • the signed public key of the signed OTT streaming media file is obtained after the signature processing.
  • the device for processing a streaming media file according to the embodiment of the present invention, wherein the verification module 72 includes:
  • the obtaining sub-module 721 is configured to obtain signature information of the OTT streaming media file from an extension field of an index file of the OTT streaming media file.
  • the verification sub-module 722 is configured to verify the signed OTT streaming media file according to the signature information, the asymmetric algorithm, and the signed transmission public key.
  • the device for processing a streaming media file includes:
  • the determining unit 7221 is configured to determine whether the signature information is included in the signature information
  • the first verification unit 7222 is configured to: if the signature information is included in the signature information, verify the signed transmission public key;
  • the second verification unit 7223 is configured to verify the signed OTT streaming media file according to an asymmetric algorithm if the signed transmission public key verification succeeds.
  • the method for processing a streaming media file in the embodiment of the present invention performs signature processing on an Internet-based OTT streaming media file to obtain a signed OTT streaming media file, and transmits the signed OTT streaming media file to a streaming media file receiving end.
  • the OTT streaming media file transmitted based on the HLS protocol is subjected to signature processing to prevent tampering of the OTT code stream during the transmission process, thereby ensuring security in the code stream transmission process.
  • Embodiments of the present invention also provide a computer readable storage medium storing computer executable instructions that, when executed by a processor, implement the streaming media described in the first embodiment or the second embodiment described above The processing method of the file.
  • Embodiments of the present invention also provide a computer readable storage medium storing computer executable instructions that, when executed by a processor, implement the fourth embodiment described above The processing method of streaming media files.
  • each module/unit in the above embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program stored in the memory by a processor. / instruction to achieve its corresponding function.
  • Embodiments of the invention are not limited to any specific form of combination of hardware and software.
  • the OTT streaming media file transmitted based on the HLS protocol is subjected to signature processing to prevent tampering of the OTT code stream during the transmission process, thereby ensuring security in the code stream transmission process.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Multimedia (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Storage Device Security (AREA)

Abstract

本文公布一种流媒体文件的处理方法及装置，所述流媒体文件的处理方法包括：对基于互联网的OTT流媒体文件进行签名处理，得到签名后的OTT流媒体文件，所述OTT流媒体文件为通过基于超文本传输协议的实时流传输HLS协议进行传输的流媒体文件；将所述签名后的OTT流媒体文件传输给流媒体文件接收端。

Description

一种流媒体文件的处理方法及装置 技术领域
本申请涉及但不限于通信应用的技术领域，特别是指一种流媒体文件的处理方法及装置。
背景技术
基于超文本传输协议的实时流传输(HTTP Live Streaming，HLS)协议是苹果公司实现的基于HTTP的流媒体传输协议，近年来，HLS协议在流媒体领域得到了广泛应用，该协议采用了HTTP传输，可以根据网络带宽自适应地调整码率，即允许服务器为同一节目内容存放多个不同码率的多媒体流，终端可根据实际的网络下载速度自适应地调整所要下载的多媒体流的码率，在网络带宽紧张时，终端可通过降低码率实现不间断播放；并且相对于其他流媒体通信协议，HLS协议在服务部署时能够更好地与其他相关技术兼容。
由于HLS协议的这些优势，基于互联网的OTT(Over The Top，通过互联网向用户提供各种应用服务)流媒体得以广泛应用，码流安全问题越来越成为迫切需要解决的问题。在OTT码流的传输过程中，存在多处风险，码流的内容容易被篡改或者给被替换，可能导致非认证的内容在终端播放
发明概述
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本申请提供一种流媒体文件的处理方法及装置，用以保证码流传输过程中的安全性。
本发明实施例提供了一种流媒体文件的处理方法，包括：
对基于互联网的OTT流媒体文件进行签名处理，得到签名后的OTT流媒体文件，所述OTT流媒体文件为通过基于超文本传输协议的实时流传输 HLS协议进行传输的流媒体文件；
将所述签名后的OTT流媒体文件传输给流媒体文件接收端。
在一实施方式中，所述对OTT流媒体文件进行签名处理，得到签名后的OTT流媒体文件的步骤包括：
对所述OTT流媒体文件中的分片文件进行签名处理，得到所述分片文件的签名信息；
将所述分片文件的签名信息保存于所述OTT流媒体文件的索引文件的扩展字段中，得到所述签名后的OTT流媒体文件。
在一实施方式中，所述对所述OTT流媒体文件中的分片文件进行签名处理，得到所述分片文件的签名信息的步骤包括：
根据非对称加密算法对所述OTT流媒体文件中的分片文件进行签名处理，得到所述分片文件的签名信息。
在一实施方式中，所述根据非对称加密算法对所述OTT流媒体文件中的分片文件进行签名处理，得到所述分片文件的签名信息的步骤包括：
根据椭圆曲线密码编码学ECC算法及一传输私钥，对所述分片文件进行签名处理，得到所述分片文件的签名信息。
在一实施方式中，所述将所述签名后的OTT流媒体文件传输给流媒体文件接收端的步骤包括：
根据非对称算法对用于解密所述签名后的OTT流媒体文件的传输公钥进行签名处理，得到签名后的传输公钥；
将签名后的OTT流媒体文件及签名后的传输公钥传输给流媒体文件接收端。
本发明的实施例还提供了一种流媒体文件的处理装置，包括：
签名模块，设置为对基于互联网的OTT流媒体文件进行签名处理，得到签名后的OTT流媒体文件，所述OTT流媒体文件为通过基于超文本传输协议的实时流传输HLS协议进行传输的流媒体文件；
传输模块，设置为将所述签名后的OTT流媒体文件传输给流媒体文件 接收端。
本发明的实施例还提供了一种流媒体文件的处理方法，包括：
获取流媒体文件发送端传输的、签名后的OTT流媒体文件，所述OTT流媒体文件为通过基于超文本传输协议的实时流传输HLS协议进行传输的流媒体文件；
对所述签名后的OTT流媒体文件进行验证，并对验证成功的OTT流媒体文件进行预定业务处理。
在一实施方式中，所述获取流媒体文件发送端传输的、签名后的OTT流媒体文件的步骤包括：
获取流媒体文件发送端传输的、签名后的OTT流媒体文件及签名后的传输公钥，其中，所述签名后的传输公钥为所述流媒体文件发送端根据非对称算法对用于解密所述签名后的OTT流媒体文件的传输公钥进行签名处理后得到的。
在一实施方式中，所述对所述签名后的OTT流媒体文件进行验证的步骤包括：
从所述OTT流媒体文件的索引文件的扩展字段中，获取所述OTT流媒体文件的签名信息；
根据所述签名信息、非对称算法及签名后的传输公钥对所述签名后的OTT流媒体文件进行验证。
在一实施方式中，根据所述签名信息、非对称算法及签名后的传输公钥对所述签名后的OTT流媒体文件进行验证的步骤包括：
判断所述签名信息中是否包含有签名标志信息；
若所述签名信息中包含有所述签名标志信息，则对所述签名后的传输公钥进行验证；
若所述签名后的传输公钥验证成功，则根据非对称算法对所述签名后的OTT流媒体文件进行验证。
本发明的实施例还提供了一种流媒体文件的处理装置，包括：
获取模块，设置为获取流媒体文件发送端传输的、签名后的OTT流媒体文件，所述OTT流媒体文件为通过基于超文本传输协议的实时流传输HLS协议进行传输的流媒体文件；
验证模块，设置为对所述签名后的OTT流媒体文件进行验证，并对验证成功的OTT流媒体文件进行预定业务处理。
本发明的实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被处理器执行时实现上述流媒体文件的处理方法。
本发明实施例具有以下有益效果：
本发明实施例的上述技术方案，对基于互联网的OTT流媒体文件进行签名处理，得到签名后的OTT流媒体文件；将所述签名后的OTT流媒体文件传输给流媒体文件接收端。本发明实施例中通过对基于HLS协议进行传输的OTT流媒体文件进行签名处理，来防止OTT码流在传输过程中的篡改，从而保证码流传输过程中的安全性。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1为本发明实施例的流媒体文件的处理方法的第一工作流程图；
图2为本发明实施例的流媒体文件的处理方法的第二工作流程图；
图3为本发明实施例中HLS码流及密钥信息的第一传输示意图；
图4为本发明实施例的流媒体文件的处理装置的第一结构框图；
图5为本发明实施例的流媒体文件的处理方法的第三工作流程图；
图6为本发明实施例中HLS码流及密钥信息的第二传输示意图；
图7为本发明实施例的流媒体文件的处理装置的第二结构框图。
详述
下面将结合实施例及附图进行详细描述。
本发明的实施例提供了一种流媒体文件的处理方法及装置，保证码流传输过程中的安全性。
第一实施例：
本发明实施例的流媒体文件的处理方法，应用于流媒体文件发送端，该流媒体文件发送端可为内容分发网络(Content Delivery Network，CDN)中的中心节点，如图1所示，该处理方法包括：
步骤11：对基于互联网的OTT流媒体文件进行签名处理，得到签名后的OTT流媒体文件，所述OTT流媒体文件为通过基于超文本传输协议的实时流传输HLS协议进行传输的流媒体文件。
在本发明的实施例中，流媒体文件发送端对所述OTT流媒体文件进行签名处理，得到携带有签名信息的OTT流媒体文件，并将携带有签名信息的OTT流媒体文件传输给流媒体文件接收端，使得流媒体文件接收端根据签名信息对流媒体文件进行验证，并对验证成功的OTT流媒体文件进行预定业务处理。这里，流媒体发送端可以为CDN中的中心节点，该中心节点从HLS提供商获取HLS编码器码流(OTT流媒体文件)，并基于HLS协议将签名后的HLS编码器码流在整个CDN节点内传输。
另外，本发明实施例中OTT媒体文件包括索引文件和分片媒体文件(即分片文件)，在索引文件中增加扩展字段，OTT流媒体文件的签名信息保存于所述索引文件的扩展字段中。
步骤12：将所述签名后的OTT流媒体文件传输给流媒体文件接收端。
上述流媒体发送端可以通过非对称算法对OTT流媒体文件进行签名处理，并将签名后的OTT流媒体文件及用于解密所述签名后的OTT流媒体文件的传输公钥传输给流媒体文件接收端。为进一步保证OTT流媒体文件传输的安全性，在一实施方式中，根据非对称算法对传输公钥进行签名处理，并将签名处理后的传输公钥发送给流媒体文件接收端。
这里，流媒体文件接收端可为CDN网络中的边缘节点或终端，若流媒体文件接收端为CDN网络中的边缘节点，则由边缘节点对签名后的OTT流媒体文件进行验证处理，并将验证成功的OTT流媒体文件传输给终端；若 流媒体文件接收端为终端，则由终端对签名后的OTT流媒体文件进行验证处理，并播放验证成功的OTT流媒体文件。
本发明实施例的流媒体文件的处理方法，对基于互联网的OTT流媒体文件进行签名处理，得到签名后的OTT流媒体文件；将所述签名后的OTT流媒体文件传输给流媒体文件接收端。本发明实施例中通过对基于HLS协议进行传输的OTT流媒体文件进行签名处理，来防止OTT码流在传输过程中的篡改，从而保证码流传输过程中的安全性。
第二实施例：
如图2所示，本发明实施例的流媒体文件的处理方法，包括：
步骤21：对所述OTT流媒体文件中的分片文件进行签名处理，得到所述分片文件的签名信息。
这里，可根据非对称加密算法对所述OTT流媒体文件中的分片文件进行签名处理，得到所述分片文件的签名信息。其中，可以根据ECC(Elliptic Curves Cryptography，椭圆曲线密码编码学)算法及一传输私钥，对分片文件进行签名处理，得到分片文件的签名信息，签名的实现过程如下：采用抽样的方式进行采样得到分片文件的签名信息，抽样的步长和抽样的宽度可以配置。
上述签名过程，只对分片文件的内容进行签名，采用抽样的方式进行采样，抽样的步长和抽样的宽度可以配置，且对抽样步长的范围进行限制，防止在传输的过程中抽样步长被恶意修改，流媒体文件接收端验证抽样步长是否在合理的范围内。
步骤22：将所述分片文件的签名信息保存于所述OTT流媒体文件的索引文件的扩展字段中，得到所述签名后的OTT流媒体文件。
在本发明的实施例中，分片文件的签名信息写入到索引文件中，在索引文件中每一个分片增加一个扩展字段放入签名信息。签名信息可包括：标志，算法，抽样步长，抽样宽度，签名，URI(Uniform Resource Identifier，统一资源标识符)签名，例如：#EXT-X-SIGN:INDEX＝10,STEP＝100,WIDTH＝100,SIGN＝BASE64(sign),URISIGN＝BASE64( urisign)。
步骤23：将所述签名后的OTT流媒体文件传输给流媒体文件接收端。
其中，可根据非对称算法(如ECC算法)对用于解密所述签名后的OTT流媒体文件的传输公钥进行签名处理，得到签名后的传输公钥；将签名后的OTT流媒体文件及签名后的传输公钥传输给流媒体文件接收端。
在本发明的实施例中，如图3所示，签名和验证采用双密钥的形式，签名的密钥是“传输私钥”，验证时使用与之配对的“传输公钥”。为了保证码流和传输公钥的安全性，采用两级密钥的强安全传输，即HLS码流采用双密钥进行签名和验证，同时传输公钥也采用双密钥进行签名和验证，后者的双密钥分别为“根私钥”和“根公钥”。
第三实施例：
如图4所示，本发明的实施例还提供了一种流媒体文件的处理装置，包括：
签名模块41，设置为对基于互联网的OTT流媒体文件进行签名处理，得到签名后的OTT流媒体文件，所述OTT流媒体文件为通过基于超文本传输协议的实时流传输HLS协议进行传输的流媒体文件；
传输模块42，设置为将所述签名后的OTT流媒体文件传输给流媒体文件接收端。
本发明实施例的流媒体文件的处理装置，所述签名模块41包括：
第一签名子模块411，设置为对所述OTT流媒体文件中的分片文件进行签名处理，得到所述分片文件的签名信息；
保存子模块412，设置为将所述分片文件的签名信息保存于所述OTT流媒体文件的索引文件的扩展字段中，得到所述签名后的OTT流媒体文件。
本发明实施例的流媒体文件的处理装置，所述第一签名子模块411设置为根据非对称加密算法对所述OTT流媒体文件中的分片文件进行签名处理，得到所述分片文件的签名信息。
本发明实施例的流媒体文件的处理装置，所述第一签名子模块411包 括：
签名单元4111，设置为根据ECC算法及一传输私钥，对所述分片文件进行签名处理，得到所述分片文件的签名信息。
本发明实施例的流媒体文件的处理装置，所述传输模块42包括：
第二签名子模块421，设置为根据非对称算法对用于解密所述签名后的OTT流媒体文件的传输公钥进行签名处理，得到签名后的传输公钥；
传输子模块422，设置为将签名后的OTT流媒体文件及签名后的传输公钥传输给流媒体文件接收端。
需要说明的是，该装置是与上述方法实施例对应的装置，上述方法实施例中所有实现方式均适用于该装置的实施例中，也能达到相同的技术效果。
本发明实施例的上述技术方案，对基于互联网的OTT流媒体文件进行签名处理，得到签名后的OTT流媒体文件；将所述签名后的OTT流媒体文件传输给流媒体文件接收端。本发明实施例中通过对基于HLS协议进行传输的OTT流媒体文件进行签名处理，来防止OTT码流在传输过程中的篡改，从而保证码流传输过程中的安全性。
第四实施例：
如图5所示，本发明的实施例还提供了一种流媒体文件的处理方法，应用于流媒体文件接收端，该流媒体接收端可为CDN网络中的边缘节点或终端，该处理方法包括：
步骤51：获取流媒体文件发送端传输的、签名后的OTT流媒体文件，所述签名后的OTT流媒体文件为所述流媒体文件发送端对OTT流媒体文件进行签名处理后得到的，且所述OTT流媒体文件为通过基于超文本传输协议的实时流传输HLS协议进行传输的流媒体文件。
在一实施方式中，获取流媒体文件发送端传输的、签名后的OTT流媒体文件及签名后的传输公钥，其中，所述签名后的传输公钥为所述流媒体文件发送端根据非对称算法对用于解密所述签名后的OTT流媒体文件的传输公钥进行签名处理后得到的。
步骤52：对所述签名后的OTT流媒体文件进行验证，并对验证成功的OTT流媒体文件进行预定业务处理。
在一实施方式中，从所述OTT流媒体文件的索引文件的扩展字段中，获取所述OTT流媒体文件的签名信息；根据所述签名信息、非对称算法及签名后的传输公钥对所述签名后的OTT流媒体文件进行验证。
其中，根据所述签名信息、非对称算法及签名后的传输公钥对所述签名后的OTT流媒体文件进行验证的步骤包括：判断所述签名信息中是否包含有签名标志信息；若所述签名信息中包含有所述签名标志信息，则对所述签名后的传输公钥进行验证；若所述签名后的传输公钥验证成功，则根据非对称算法对所述签名后的OTT流媒体文件进行验证。
另外，若流媒体文件接收端为CDN网络中的边缘节点，则上述预定业务处理可以是将验证成功的OTT流媒体文件传输给该边缘节点；若流媒体文件接收端为终端，则上述预定业务处理可以是播放验证成功的OTT流媒体文件。
下面结合图6说明本发明实施例的流媒体文件的处理方法的实现流程。
本发明实施例中，HLS内容提供商61通过HLS编码器提供HLS内容，其中包括主索引index.m3u8、子索引$rateid.m3u8和子索引对应的分片ts文件。
OTT CDN的中心节点62接收编码器的HLS码流保存在本地，中心节点的签名服务器66根据ECC算法将码流进行签名，该算法可参考IEEE Std1363。算法索引和签名长度如表1所示。
表1
Figure PCTCN2017082748-appb-000001
Figure PCTCN2017082748-appb-000002
签名的实现如下：
1、HLS的签名只对分片文件的内容进行签名，采用抽样的方式进行采样，抽样的步长和抽样的宽度可以配置，服务器端对抽样步长的范围进行限制，防止在传输的过程中抽样步长被恶意修改，签名检测服务器67验证抽样步长是否在合理的范围内.
2、HLS分片签名相关的信息写入到索引文件中，在索引文件中每一个分片增加一个扩展字段放入签名的信息，签名的信息包括：标志，算法，抽样步长，抽样宽度，签名，URI签名，比如：
#EXT-X-SIGN:INDEX＝10,STEP＝100,WIDTH＝100,SIGN＝BASE64(sign),URISIGN＝BASE64(urisign)
3、ECC算法中，签名和验证采用双密钥的形式，签名的密钥是“传输私钥”，验证时使用与之配对的“传输公钥”。为了保证码流和安全传输公钥的安全性，采用两级密钥的强安全传输，即HLS码流采用双密钥进行签名和验证同时安全传输公钥也采用双密钥进行签名和验证，后者的双密钥分别为“根私钥”和“根公钥”。
带有签名信息的HLS码流在OTT流媒体网络中传输，整个网络包括若干个缓存节点63，最终码流传输到边缘节点64。边缘节点的签名检测服务器67根据子索引中是否包含#EXT-X-SIGN标签决定是否进行签名检测，检测的过程如下：
1、对每一个传输的分片文件进行位扫描签名，只要有一位发生变化就可以检测出被篡改；也可以对分片文件进行抽样签名，此时抽样的内容被篡改才可检测出来，没有被抽样内容的篡改则忽略；如果HLS的索引文件支持I帧#EXT-X-I-FRAMES-ONLY，也可以仅仅对I帧进行签名，简化了检测流程；
2、索引文件M3U8也可能被恶意篡改，为了防止M3U8被恶意篡改，采用对M3U8索引文件中的URI进行签名，从而保证访问的分片是OTT CDN注入的内容，防止URI被恶意篡改为非法源站；
3、对检测不通过的码流告警，并且HLS终端65只能向边缘节点64请求检测通过的HLS码流播放。
本发明实施例的流媒体文件的处理方法，如图6所示，源端提供OTT原始码流，比如HLS内容提供商61通过HLS编码器得到HLS原始码流，其中包含描述文件和媒体文件；中心节点62采用HTTP协议接收上述原始码流，签名服务器66将码流按一定算法进行签名，签名信息流(签名密钥信息)通过带外的方式传送到边缘的签名检测服务器67；带签名信息的HLS码流在OTT网络中采用两级密钥的强安全传输，即码流的数字签名和公钥证书的数字签名使用两级不同的密钥生成；码流传输到边缘节点64，签名检测服务器67对码流进行签名验证，对不符合签名的码流进行告警；HLS终端65向边缘节点64请求验证通过的媒体文件进行播放。
第五实施例：
如图7所示，本发明的实施例还提供了一种流媒体文件的处理装置，包括：
获取模块71，设置为获取流媒体文件发送端传输的、签名后的OTT流媒体文件，所述OTT流媒体文件为通过基于超文本传输协议的实时流传输HLS协议进行传输的流媒体文件；
验证模块72，设置为对所述签名后的OTT流媒体文件进行验证，并对验证成功的OTT流媒体文件进行预定业务处理。
本发明实施例的流媒体文件的处理装置，所述获取模块71设置为获取 流媒体文件发送端传输的、签名后的OTT流媒体文件及签名后的传输公钥，其中，所述签名后的传输公钥为所述流媒体文件发送端根据非对称算法对用于解密所述签名后的OTT流媒体文件的传输公钥进行签名处理后得到的。
本发明实施例的流媒体文件的处理装置，其中，所述验证模块72包括：
获取子模块721，设置为从所述OTT流媒体文件的索引文件的扩展字段中，获取所述OTT流媒体文件的签名信息；
验证子模块722，设置为根据所述签名信息、非对称算法及签名后的传输公钥对所述签名后的OTT流媒体文件进行验证。
本发明实施例的流媒体文件的处理装置，其中，根据验证子模块722包括：
判断单元7221，设置为判断所述签名信息中是否包含有签名标志信息；
第一验证单元7222，设置为若所述签名信息中包含有所述签名标志信息，则对所述签名后的传输公钥进行验证；
第二验证单元7223，设置为若所述签名后的传输公钥验证成功，则根据非对称算法对所述签名后的OTT流媒体文件进行验证。
本发明实施例的流媒体文件的处理方法，对基于互联网的OTT流媒体文件进行签名处理，得到签名后的OTT流媒体文件；将所述签名后的OTT流媒体文件传输给流媒体文件接收端。本发明实施例中通过对基于HLS协议进行传输的OTT流媒体文件进行签名处理，来防止OTT码流在传输过程中的篡改，从而保证码流传输过程中的安全性。
本发明的实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被处理器执行时实现上述第一实施例或第二实施例所述的流媒体文件的处理方法。
本发明的实施例还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令被处理器执行时实现上述第四实施例所述的 流媒体文件的处理方法。
本领域普通技术人员可以理解上述方法中的全部或部分步骤可通过程序来指令相关硬件(例如处理器)完成，所述程序可以存储于计算机可读存储介质中，如只读存储器、磁盘或光盘等。上述实施例的全部或部分步骤也可以使用一个或多个集成电路来实现。相应地，上述实施例中的各模块/单元可以采用硬件的形式实现，例如通过集成电路来实现其相应功能，也可以采用软件功能模块的形式实现，例如通过处理器执行存储于存储器中的程序/指令来实现其相应功能。本发明实施例不限制于任何特定形式的硬件和软件的结合。
以上所述仅为本发明的实施例而已，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。
工业实用性
本发明实施例中通过对基于HLS协议进行传输的OTT流媒体文件进行签名处理，来防止OTT码流在传输过程中的篡改，从而保证码流传输过程中的安全性。

Claims (13)

  1. 一种流媒体文件的处理方法，包括：
    对基于互联网的OTT流媒体文件进行签名处理，得到签名后的OTT流媒体文件，所述OTT流媒体文件为通过基于超文本传输协议的实时流传输HLS协议进行传输的流媒体文件；
    将所述签名后的OTT流媒体文件传输给流媒体文件接收端。
  2. 根据权利要求1所述的流媒体文件的处理方法，其中，所述对OTT流媒体文件进行签名处理，得到签名后的OTT流媒体文件的步骤包括：
    对所述OTT流媒体文件中的分片文件进行签名处理，得到所述分片文件的签名信息；
    将所述分片文件的签名信息保存于所述OTT流媒体文件的索引文件的扩展字段中，得到所述签名后的OTT流媒体文件。
  3. 根据权利要求2所述的流媒体文件的处理方法，其中，所述对所述OTT流媒体文件中的分片文件进行签名处理，得到所述分片文件的签名信息的步骤包括：
    根据非对称加密算法对所述OTT流媒体文件中的分片文件进行签名处理，得到所述分片文件的签名信息。
  4. 根据权利要求3所述的流媒体文件的处理方法，其中，所述根据非对称加密算法对所述OTT流媒体文件中的分片文件进行签名处理，得到所述分片文件的签名信息的步骤包括：
    根据椭圆曲线密码编码学ECC算法及一传输私钥，对所述分片文件进行签名处理，得到所述分片文件的签名信息。
  5. 根据权利要求3所述的流媒体文件的处理方法，其中，所述将所述签名后的OTT流媒体文件传输给流媒体文件接收端的步骤包括：
    根据非对称算法对用于解密所述签名后的OTT流媒体文件的传输公钥进行签名处理，得到签名后的传输公钥；
    将签名后的OTT流媒体文件及签名后的传输公钥传输给流媒体文件接 收端。
  6. 一种流媒体文件的处理装置，包括：
    签名模块，设置为对基于互联网的OTT流媒体文件进行签名处理，得到签名后的OTT流媒体文件，所述OTT流媒体文件为通过基于超文本传输协议的实时流传输HLS协议进行传输的流媒体文件；
    传输模块，设置为将所述签名后的OTT流媒体文件传输给流媒体文件接收端。
  7. 一种流媒体文件的处理方法，包括：
    获取流媒体文件发送端传输的、签名后的OTT流媒体文件，所述OTT流媒体文件为通过基于超文本传输协议的实时流传输HLS协议进行传输的流媒体文件；
    对所述签名后的OTT流媒体文件进行验证，并对验证成功的OTT流媒体文件进行预定业务处理。
  8. 根据权利要求7所述的流媒体文件的处理方法，其中，所述获取流媒体文件发送端传输的、签名后的OTT流媒体文件的步骤包括：
    获取流媒体文件发送端传输的、签名后的OTT流媒体文件及签名后的传输公钥，其中，所述签名后的传输公钥为所述流媒体文件发送端根据非对称算法对用于解密所述签名后的OTT流媒体文件的传输公钥进行签名处理后得到的。
  9. 根据权利要求8所述的流媒体文件的处理方法，其中，所述对所述签名后的OTT流媒体文件进行验证的步骤包括：
    从所述OTT流媒体文件的索引文件的扩展字段中，获取所述OTT流媒体文件的签名信息；
    根据所述签名信息、非对称算法及签名后的传输公钥对所述签名后的OTT流媒体文件进行验证。
  10. 根据权利要求9所述的流媒体文件的处理方法，其中，根据所述签名信息、非对称算法及签名后的传输公钥对所述签名后的OTT流媒体文件进行验证的步骤包括：
    判断所述签名信息中是否包含有签名标志信息；
    若所述签名信息中包含有所述签名标志信息，则对所述签名后的传输公钥进行验证；
    若所述签名后的传输公钥验证成功，则根据非对称算法对所述签名后的OTT流媒体文件进行验证。
  11. 一种流媒体文件的处理装置，包括：
    获取模块，设置为获取流媒体文件发送端传输的、签名后的OTT流媒体文件，所述OTT流媒体文件为通过基于超文本传输协议的实时流传输HLS协议进行传输的流媒体文件；
    验证模块，设置为对所述签名后的OTT流媒体文件进行验证，并对验证成功的OTT流媒体文件进行预定业务处理。
  12. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1-5任一项的流媒体文件的处理方法。
  13. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求7-10任一项的流媒体文件的处理方法。
PCT/CN2017/082748 2016-05-18 2017-05-02 一种流媒体文件的处理方法及装置 WO2017198069A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610330217.8A CN107404379A (zh) 2016-05-18 2016-05-18 一种流媒体文件的处理方法及装置
CN201610330217.8 2016-05-18

Publications (1)

Publication Number Publication Date
WO2017198069A1 true WO2017198069A1 (zh) 2017-11-23

Family

ID=60326433

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/082748 WO2017198069A1 (zh) 2016-05-18 2017-05-02 一种流媒体文件的处理方法及装置

Country Status (2)

Country Link
CN (1) CN107404379A (zh)
WO (1) WO2017198069A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113840162A (zh) * 2021-09-27 2021-12-24 中通服创立信息科技有限责任公司 一种iptv视频文件防篡改方法
CN116319112A (zh) * 2023-05-24 2023-06-23 中国人民解放军军事科学院系统工程研究院 一种报文完整性验证方法及系统

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110138716B (zh) * 2018-02-09 2020-11-27 网宿科技股份有限公司 一种密钥的提供、视频播放方法、服务器及客户端
CN110300308B (zh) * 2018-03-22 2021-10-08 贵州白山云科技股份有限公司 一种流媒体回播方法及装置
CN111526378B (zh) * 2019-02-02 2022-01-14 华为技术有限公司 一种签名信息的传输方法及装置
CN110300186B (zh) * 2019-07-15 2022-05-13 中国科学院计算机网络信息中心 一种基于边缘计算技术的点对点文件传输方法
CN111181989B (zh) * 2020-01-02 2021-11-19 烽火通信科技股份有限公司 一种实现hls分发防篡改的方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140096271A1 (en) * 2012-09-28 2014-04-03 Futurewei Technologies, Inc. Segment Authentication for Dynamic Adaptive Streaming
US20140344575A1 (en) * 2013-05-14 2014-11-20 Morega Systems Inc. Client proxy for key exchange in http live streaming
CN104255009A (zh) * 2012-04-25 2014-12-31 华为技术有限公司 用于自适应流媒体的片段完整性和真实性的系统和方法
US20150033023A1 (en) * 2013-07-25 2015-01-29 Adobe Systems Incorporated Preventing playback of streaming video if ads are removed
US20150121484A1 (en) * 2013-10-28 2015-04-30 Futurewei Technologies Inc. System and method for signaling and verifying url signatures for both url authentication and url-based content access authorization in adaptive streaming

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8904184B2 (en) * 2008-12-10 2014-12-02 At&T Intellectual Property I, Lp Certification of authenticity of media signals
CN101534433B (zh) * 2009-04-22 2011-06-22 北京航空航天大学 流媒体加密方法
CN102843335B (zh) * 2011-06-20 2015-09-09 华为技术有限公司 流媒体内容的处理方法和设备
US9313544B2 (en) * 2013-02-14 2016-04-12 The Nielsen Company (Us), Llc Methods and apparatus to measure exposure to streaming media
CN103873461B (zh) * 2014-02-14 2015-09-23 中国南方电网有限责任公司 基于iec62351的goose报文的安全交互方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104255009A (zh) * 2012-04-25 2014-12-31 华为技术有限公司 用于自适应流媒体的片段完整性和真实性的系统和方法
US20140096271A1 (en) * 2012-09-28 2014-04-03 Futurewei Technologies, Inc. Segment Authentication for Dynamic Adaptive Streaming
US20140344575A1 (en) * 2013-05-14 2014-11-20 Morega Systems Inc. Client proxy for key exchange in http live streaming
US20150033023A1 (en) * 2013-07-25 2015-01-29 Adobe Systems Incorporated Preventing playback of streaming video if ads are removed
US20150121484A1 (en) * 2013-10-28 2015-04-30 Futurewei Technologies Inc. System and method for signaling and verifying url signatures for both url authentication and url-based content access authorization in adaptive streaming

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113840162A (zh) * 2021-09-27 2021-12-24 中通服创立信息科技有限责任公司 一种iptv视频文件防篡改方法
CN113840162B (zh) * 2021-09-27 2023-07-25 中通服创立信息科技有限责任公司 一种iptv视频文件防篡改方法
CN116319112A (zh) * 2023-05-24 2023-06-23 中国人民解放军军事科学院系统工程研究院 一种报文完整性验证方法及系统
CN116319112B (zh) * 2023-05-24 2023-09-22 中国人民解放军军事科学院系统工程研究院 一种报文完整性验证方法及系统

Also Published As

Publication number Publication date
CN107404379A (zh) 2017-11-28

Similar Documents

Publication Publication Date Title
WO2017198069A1 (zh) 一种流媒体文件的处理方法及装置
US10447674B2 (en) Key exchange through partially trusted third party
US20190222583A1 (en) Signed envelope encryption
US9553892B2 (en) Selective modification of encrypted application layer data in a transparent security gateway
US9026782B2 (en) Token-based entitlement verification for streaming media decryption
CN108259507B (zh) 用于自适应流媒体的片段完整性和真实性的系统和方法
US11824853B2 (en) Mutual secure communications
US10230695B2 (en) Distribution of secure data with entitlement enforcement
WO2018001193A1 (zh) 一种交互式网络电视频道安全播放的方法、装置和系统
WO2018076183A1 (zh) 一种传输数据的方法、装置和系统
CN111556340B (zh) 一种安全的跨平台视频流播放方法
US20140281556A1 (en) Media presentation description verification
WO2016150169A1 (zh) 一种安全通信方法、网关、网络侧服务器及系统
US20170171166A1 (en) Anti-hotlinking method and electronic device
WO2010120261A1 (en) Method for secure transfer of multiple small messages
CN108462566A (zh) 一种多媒体文件加密方法及系统
US9825942B2 (en) System and method of authenticating a live video stream
WO2018166333A1 (zh) 一种内容验证方法及设备
US20130024543A1 (en) Methods for generating multiple responses to a single request message and devices thereof
WO2012175021A1 (zh) 流媒体内容的处理方法和设备
CN114189706B (zh) 一种媒体播放方法、系统、装置、计算机设备及存储介质
US20220191042A1 (en) Secure Transport of Content Via Content Delivery Service
Ashraf Extending the Authentication Mechanism in IP Multimedia Subsystems for Universal Mobile Telecommunication system
Muthuselvi et al. Enhancing Authentication Protocol from Unauthorized Access

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17798632

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 17798632

Country of ref document: EP

Kind code of ref document: A1