WO2018120998A1 - 机顶盒与服务器的交互方法及系统 - Google Patents

机顶盒与服务器的交互方法及系统 Download PDF

Info

Publication number
WO2018120998A1
WO2018120998A1 PCT/CN2017/106328 CN2017106328W WO2018120998A1 WO 2018120998 A1 WO2018120998 A1 WO 2018120998A1 CN 2017106328 W CN2017106328 W CN 2017106328W WO 2018120998 A1 WO2018120998 A1 WO 2018120998A1
Authority
WO
WIPO (PCT)
Prior art keywords
top box
server
url
set top
encryption
Prior art date
Application number
PCT/CN2017/106328
Other languages
English (en)
French (fr)
Inventor
华琛
Original Assignee
深圳市九洲电器有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市九洲电器有限公司 filed Critical 深圳市九洲电器有限公司
Publication of WO2018120998A1 publication Critical patent/WO2018120998A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H04L9/3249—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures using RSA or related signature schemes, e.g. Rabin scheme
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
    • H04N21/258—Client or end-user data management, e.g. managing client capabilities, user preferences or demographics, processing of multiple end-users preferences to derive collaborative data
    • H04N21/25866—Management of end-user data
    • H04N21/25875—Management of end-user data involving end-user authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/60—Network structure or processes for video distribution between server and client or between remote clients; Control signalling between clients, server and network components; Transmission of management data between server and client, e.g. sending from server to client commands for recording incoming content stream; Communication details between server and client 
    • H04N21/63—Control signaling related to video distribution between client, server and network components; Network processes for video distribution between server and clients or between remote clients, e.g. transmitting basic layer and enhancement layers over different transmission paths, setting up a peer-to-peer communication via Internet between remote STB's; Communication protocols; Addressing
    • H04N21/633—Control signals issued by server directed to the network components or client
    • H04N21/6332—Control signals issued by server directed to the network components or client directed to client
    • H04N21/6334—Control signals issued by server directed to the network components or client directed to client for authorisation, e.g. by transmitting a key
    • H04N21/63345—Control signals issued by server directed to the network components or client directed to client for authorisation, e.g. by transmitting a key by transmitting keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/80—Generation or processing of content or additional data by content creator independently of the distribution process; Content per se
    • H04N21/85—Assembly of content; Generation of multimedia applications
    • H04N21/858—Linking data to content, e.g. by linking an URL to a video object, by creating a hotspot
    • H04N21/8586—Linking data to content, e.g. by linking an URL to a video object, by creating a hotspot by using a URL

Definitions

  • the present invention relates to the field of digital television, and in particular, to a method and system for interacting between a set top box and a server.
  • HTTP Hyper Text Transfer Protocol
  • the HTTP protocol cannot encrypt the transmission content, the security is very low, and only the communication is performed through the HTTP channel.
  • the data is easily intercepted without being encrypted, and the related data is also easily leaked, which makes the security of the communication between the set top box and the server impossible. Ensure that there are data security risks.
  • a method for interacting between a set top box and a server provided by the present invention includes the following steps:
  • S10 sending, by the set top box, an authentication request to the server, where the authentication request carries a string of the scrambled local physical address;
  • S20 receiving a string by the server and performing descrambling, obtaining a physical address of the set top box and querying a preset database, if the database includes the physical address of the set top box, returning a random value to the set top box, and recording a random value;
  • S30 obtaining, by the set-top box, the random value and using as a key, performing a hash encryption operation on the set-top box serial number to obtain an encryption result, and submitting the encryption result to the server;
  • S40 The server reads the set-top box serial number in the preset server and performs a hash encryption operation by using a random value, and obtains the encryption result and compares the encryption result sent by the set-top box. If the two are consistent, the set-top box authentication is legal, otherwise the authentication is not Legal
  • S50 If the set-top box authentication is legal, the server writes the successfully logged-in identifier in the session, and obtains the sessionlD of the session, constructs the URL encryption according to the service type, and sends the URL to the set-top box, and the URL After with sessionlD;
  • S60 decrypting after receiving the URL in the set top box, parsing the URL to obtain sessionlD, according to sessionl
  • the random value is synthesized by a physical address of the set top box and another random value.
  • the step is configured to be encrypted according to the service type and sent to the set top box, and the encrypted data sent to the set top box is as follows: RSA (SHA256(URL)+MAC)+RSA(URL)
  • RSA is an RSA encryption algorithm
  • SHA256 is a secure hash algorithm with a hash value of 256 bits.
  • MAC is the physical address.
  • the present invention provides an interaction system between a set top box and a server, including:
  • an authentication request sending module configured to send, by the set top box, an authentication request to the server, where the authentication request carries a string of the local physical address of the scrambled local device
  • a random value returning module controlling to receive a string by the server and performing descrambling, obtaining a physical address of the set top box and querying a preset database, and if the database contains the physical address of the set top box, returning a random value to the set top box, and Record random values;
  • a serial number encryption module controlling the set-top box to obtain the random value and using the hash key to perform a hash encryption operation on the set-top box serial number to obtain an encryption result, and submit the encryption result to the server;
  • the encryption result comparison module controls the serial number of the set top box in the preset server to be read by the server and performs hash encryption operation by using a random value, and the encrypted result is compared with the encrypted result sent by the set top box, and if the two are consistent, the set top box is authenticated. Legal, otherwise the certification is illegal;
  • the URL encryption sending module if the set-top box authentication is legal, the server writes the successfully logged identifier in the session, and obtains the sessionlD of the session, constructs the URL encryption according to the service type, and sends the URL to the set-top box, and the URL is followed by Have sessionlD;
  • the data communication module decrypts after receiving the URL in the set top box, parses the URL to obtain session1D, and requests corresponding service data according to session1D.
  • the random value is synthesized by a physical address of the set top box and another random value.
  • the encrypted data sent by the URL encryption sending module to the set top box is as follows: RSA (SHA256 (URL) + MAC) + RSA (URL);
  • RSA is an RSA encryption algorithm
  • SHA256 is a secure hash algorithm with a hash value of 256 bits.
  • MAC is the physical address.
  • the interaction method and system of the set top box and the server of the present invention adopts an encrypted physical address for identity authentication, and then the data is transmitted after the identity authentication is legal, and the data transmission is sent by using an encrypted URL, and the set top box receives the URL decryption and parsing.
  • the corresponding session data is obtained from the server, so that the communication between the set-top box and the server is first encrypted and then communicated by encryption, so that the transmission content can be encrypted, and the security is greatly improved. It is easy to be intercepted and is not easy to leak, which effectively ensures the security of the communication between the set-top box and the server, and avoids data hidden dangers.
  • FIG. 1 is a flow chart of a method for interacting a set top box and a server in an embodiment
  • FIG. 2 is a structural diagram of an interaction system between a set top box and a server in an embodiment.
  • the HTTPS protocol the security version of the hypertext transfer protocol, adds an encryption module based on HTTP, and can encrypt and transmit data, identity authentication, etc., and has higher security.
  • many of the set-top boxes do not support the HTTPS protocol, and do not support the data encryption transmission mode of the HTTPS protocol.
  • the method of the present invention solves the data encryption transmission mode that does not support the HTTPS protocol set-top box.
  • FIG. 1 is a flowchart of a method for interacting a set top box and a server in an embodiment.
  • the method for interacting the set top box and the server includes the following steps: [0030] S10: sending, by the set top box, an authentication request to the server, where the authentication request carries the scrambled local physical address (M
  • the identity authentication needs to be performed first, and the authentication is legal to perform data communication.
  • the set-top box first sends an authentication request to the server, and the authentication request carries the scrambled local physical address to ensure the uniqueness of the authentication.
  • S20 The string is received by the server and descrambled, the physical address of the set top box is obtained, and the preset database is queried. If the physical address of the set top box is included in the database, a random value is returned to the set top box, and a random value is recorded.
  • the server receiver top box sends an authentication request to perform an authentication operation on the set top box, and the descrambling authentication request obtains the set top box physical address, and then performs a comparison by querying a preset database of the storage set top box physical address, if the database includes the organic set top box The physical address returns a random value to the set-top box. The random value is used for subsequent encryption operations.
  • the random value is synthesized by the physical address of the set top box and another random value. That is, only the physical address of the set-top box can be obtained, and a random value can be generated to prevent the vulnerability from being credified.
  • S30 The set value is obtained by the set top box and used as a key to perform a hash encryption operation on the set top box serial number (sn) to obtain an encryption result, and the encryption result is submitted to the server.
  • the set top box acquires and uses the hash encryption operation of the serial number of the set top box, and obtains the encrypted result and sends the result to the server for further comparison by the server.
  • S40 The server reads the set-top box serial number in the preset server and performs a hash encryption operation using a random value, and obtains an encryption result and compares the encrypted result sent by the set-top box. If the two are consistent, the set-top box authentication is legal, otherwise the authentication is not legitimate.
  • the server queries the serial number of the set top box in the preset database and uses the same random value to perform the same hash encryption operation, and compares the encrypted result sent by the set top box. If the agreement is consistent, the authentication is legal. The set-top box identity authentication is passed; otherwise it is an illegal identity authentication.
  • S50 If the set-top box authentication is legal, the server writes the successfully logged identifier in the session (session control), and obtains the sessionlD of the session, constructs the URL encryption according to the service type, and sends the URL to the set-top box, after the URL With sessionID. [0040] After the set-top box identity authentication is passed, the set-top box communicates with the server, and the server writes the successfully-logged identifier in the current session (the login succeeds after the identity authentication is passed), and the peer acquires the session. The sessionID, sessionID is added after the URL and sent to the set-top box.
  • the constructed URL is encrypted by the server and sent to the set top box, and the encrypted data sent to the set top box is as follows: RSA (SHA256(URL)+MAC) + RSA(URL), where RSA is RS A encrypted Algorithm, SHA256 is a secure hash algorithm with a hash value of 256 bits, and the MAC is a physical address.
  • the set-top box can obtain the session ID by parsing the URL, obtain the data through the sessionID, and communicate with the server, so that even if the set-top box does not support the HTTPS protocol, the method of the present invention can adopt the HTTPS-like method.
  • the communication is performed by the encryption method of the present invention, so that the transmission content can be encrypted, the security is greatly improved, and the encryption is not easily intercepted and is not easy to be leaked, thereby effectively ensuring the security of the communication between the set top box and the server, and avoiding data hidden dangers. .
  • the interaction method between the set top box and the server is performed by using an encrypted physical address to perform identity authentication, and then the data is transmitted by using an encrypted URL after the identity authentication is legalized, and the set top box receives the URL decryption and parsing.
  • the sessionID obtains the corresponding data from the server
  • the communication between the set-top box and the server is first encrypted and then communicated by encryption, so that the transmission content can be encrypted, the security is greatly improved, and the encryption is not easily intercepted. It is not easy to leak, which effectively ensures the security of the communication between the set-top box and the server, and avoids data hidden dangers.
  • the present invention further provides an interaction system between a set top box and a server.
  • the system includes:
  • the authentication request sending module 100 controls to send an authentication request to the server by the set top box, and the authentication request carries a string of the scrambled local physical address (MAC).
  • MAC scrambled local physical address
  • the authentication request sending module 100 controls the set top box to first issue an authentication request to the server, and the authentication request carries the scrambled local physical address to ensure the uniqueness of the authentication.
  • the random value returning module 200 controls the receiving of the character string by the server and performing descrambling to acquire the object of the set top box.
  • the address is queried and the default database is queried. If the database contains the physical address of the set-top box, a random value is returned to the set-top box, and a random value is recorded.
  • the random value returning module 200 controls the authentication request sent by the server receiver top box to perform an authentication operation on the set top box, and the descrambling authentication request obtains the physical address of the set top box, and then compares the database by querying the preset physical address of the set top box, if The physical address of the organic set-top box in the database returns a random value to the set-top box. Random values are used for subsequent cryptographic operations.
  • the random value is synthesized by the physical address of the set top box and another random value. That is, only the physical address of the set-top box can be obtained, and a random value can be generated to prevent the vulnerability from being credified.
  • the serial number encryption module 300 controls the set-top box to acquire the random value and uses the hash key to perform a hash encryption operation on the set-top box serial number (sn) to obtain an encrypted result, and submits the encrypted result to the server.
  • the serial number encryption module 300 controls the set top box to acquire and use the hash encryption operation on the serial number of the set top box, and obtains the encrypted result and sends it to the server for further comparison by the server.
  • the encryption result comparison module 400 controls the server to read the set top box serial number in the preset server and performs hash encryption operation by using a random value, and obtains the encryption result and compares the encryption result sent by the set top box, if the two are consistent, the set top box
  • the authentication is legal, otherwise the authentication is illegal.
  • the server queries the serial number of the set top box in the preset database and uses the same random value to perform the same hash encryption operation, and compares the encrypted result sent by the set top box. If the agreement is the same, the authentication is legal. The set-top box identity authentication is passed; otherwise it is an illegal identity authentication.
  • the URL encryption sending module 500 if the set-top box authentication is legal, the server writes the successfully logged identifier in the session (session control), and obtains the sessionlD of the session, and constructs the URL encryption according to the service type and sends the encrypted Set-top box, with URL followed by sessionID.
  • the set-top box After the set-top box identity authentication is passed, the set-top box communicates with the server, and the URL encryption sending module 500 controls the identifier that the server successfully writes in the current session (the login succeeds after the identity authentication is passed), Get session1D to this session, sessionlD is added after the URL, encrypted and sent to the set-top box.
  • the encrypted data sent by the URL encryption sending module 500 to the set top box is as follows: RSA (SHA2) 56 (URL) + MAC) + RSA (URL), where RSA is an RSA encryption algorithm, SHA256 is a secure hash algorithm with a hash value of 256 bits, and MAC is a physical address.
  • the data communication module 600 decrypts the URL after the set top box receives the URL, parses the URL to obtain the sessionID, and requests the corresponding service data according to the sessionID.
  • the URL encryption sending module 500 can obtain the session ID by parsing the URL, obtain the data through the sessionID, and perform data communication with the server, so that even if the set top box does not support the HTTPS protocol, the system of the present invention is adopted.
  • the method of HTTPS can be used to communicate through the encryption method of the present invention, so that the transmission content can be encrypted, the security is greatly improved, the encryption is not easily intercepted and the leakage is not easy, and the security of the communication between the set top box and the server is effectively ensured. , to avoid data hidden dangers.
  • the interaction system between the set-top box and the server performs identity authentication by encrypting a physical address, and then performs data transmission after the identity authentication is legal, and the data transmission is sent by using an encrypted URL, and the set-top box receives the URL decryption and parsing, and After the sessionID obtains the corresponding data from the server, the communication between the set-top box and the server is first encrypted and then communicated by encryption, so that the transmission content can be encrypted, the security is greatly improved, and the encryption is not easily intercepted. It is not easy to leak, which effectively ensures the security of the communication between the set-top box and the server, and avoids data hidden dangers.
  • the interaction method and system of the set top box and the server of the present invention use the method of encrypting the physical address for identity authentication, and then the data is transmitted after the identity authentication is legal, and the data transmission is sent by using an encrypted URL, and the set top box receives the URL decryption and parsing.
  • the corresponding session data is obtained from the server, so that the communication between the set-top box and the server is first encrypted and then communicated by encryption, so that the transmission content can be encrypted, and the security is greatly improved. It is easy to be intercepted and is not easy to leak, which effectively ensures the security of the communication between the set-top box and the server, and avoids data hidden dangers.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Multimedia (AREA)
  • Databases & Information Systems (AREA)
  • Computer Graphics (AREA)
  • Computer And Data Communications (AREA)
  • Storage Device Security (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本方案涉及一种机顶盒与服务器的交互方法及系统，采用加密物理地址的方式进行身份认证，身份认证合法后再进行数据的传输，数据传输以加密的URL方式发送，机顶盒接收到URL解密解析后，由其后的sessionID从服务器上获取相应的数据，这样机顶盒与服务器的通信，先经过加密身份认证，再通过加密方式进行通信，从而能够对传输内容进行加密，安全性大大提高，经过加密不容易被拦截也不容易泄露，有效保证了机顶盒与服务器通信的安全性，避免了数据隐患。

Description

机顶盒与服务器的交互方法及系统 技术领域
[0001] 本发明涉及数字电视领域， 尤其涉及一种机顶盒与服务器的交互方法及系统。
背景技术
[0002] 目前， 机顶盒与服务器之间的通信主要是通过 HTTP (超文本传输协议） 通道 。 但是， HTTP协议无法对传输内容进行加密， 安全性很低， 仅通过 HTTP通道 进行通信， 数据没有经过加密很容易被拦截， 相关数据也会容易泄露， 这就导 致机顶盒与服务器通信的安全性无法保证， 存在数据安全隐患。
技术问题
[0003] 有鉴于此， 有必要针对上述机顶盒与服务器之间通过 HTTP通道进行通信， 无 法保证安全性的问题， 提供一种机顶盒与服务器的交互方法及系统。
问题的解决方案
技术解决方案
[0004] 本发明提供的一种机顶盒与服务器的交互方法， 包括如下步骤：
[0005] S10:由机顶盒向服务器发出认证请求， 认证请求携带加扰的本机物理地址的字 符串；
[0006] S20: 由服务器接收字符串并进行解扰， 获取机顶盒的物理地址并査询预设数 据库， 若数据库中包含该机顶盒的物理地址， 则向机顶盒返回一个随机值， 并 记录随机值；
[0007] S30: 由机顶盒获取该随机值并作为密钥， 对机顶盒序列号进行哈希加密运算 得到加密结果， 将加密结果提交到服务器；
[0008] S40: 由服务器读取预设服务器中机顶盒序列号并采用随机值进行哈希加密运 算， 得到加密结果与机顶盒发送的加密结果进行比较， 若两者一致则机顶盒认 证合法， 否则认证不合法；
[0009] S50: 若机顶盒认证合法， 则由服务器在本次 session中写入成功登陆的标识， 并获取此次会话的 sessionlD, 根据业务类型构造 URL加密后发送给机顶盒， URL 后带有 sessionlD;
[0010] S60: 在机顶盒接收到 URL后进行解密， 解析 URL得到 sessionlD, 根据 sessionl
D请求相应的业务数据。
[0011] 在其中的一个实施方式中， 所述随机值由机顶盒的物理地址和另一随机值共同 合成。
[0012] 在其中的一个实施方式中， 所述步骤根据业务类型构造 URL加密后发送给机顶 盒， 发送到机顶盒的加密数据如下： RSA (SHA256(URL)+MAC) +RSA(URL)
[0013] 其中， RSA为 RSA加密算法， SHA256为哈希值大小为 256位的安全哈希算法
， MAC为物理地址。
[0014] 本发明提供的一种机顶盒与服务器的交互系统， 包括：
[0015] 认证请求发送模块， 控制由机顶盒向服务器发出认证请求， 认证请求携带加扰 的本机物理地址的字符串；
[0016] 随机值返回模块， 控制由服务器接收字符串并进行解扰， 获取机顶盒的物理地 址并査询预设数据库， 若数据库中包含该机顶盒的物理地址， 则向机顶盒返回 一个随机值， 并记录随机值；
[0017] 序列号加密模块， 控制由机顶盒获取该随机值并作为密钥， 对机顶盒序列号进 行哈希加密运算得到加密结果， 将加密结果提交到服务器；
[0018] 加密结果比对模块， 控制由服务器读取预设服务器中机顶盒序列号并采用随机 值进行哈希加密运算， 得到加密结果与机顶盒发送的加密结果进行比较， 若两 者一致则机顶盒认证合法， 否则认证不合法；
[0019] URL加密发送模块， 若机顶盒认证合法， 则由服务器在本次 session中写入成功 登陆的标识， 并获取此次会话的 sessionlD, 根据业务类型构造 URL加密后发送给 机顶盒， URL后带有 sessionlD;
[0020] 数据通信模块， 在机顶盒接收到 URL后进行解密， 解析 URL得到 sessionlD, 根 据 sessionlD请求相应的业务数据。
[0021] 在其中的一个实施方式中， 所述随机值由机顶盒的物理地址和另一随机值共同 合成。 [0022] 在其中的一个实施方式中， 所述 URL加密发送模块发送到机顶盒的加密数据如 下： RSA (SHA256(URL)+MAC) +RSA(URL);
[0023] 其中， RSA为 RSA加密算法， SHA256为哈希值大小为 256位的安全哈希算法
， MAC为物理地址。
发明的有益效果
有益效果
[0024] 本发明机顶盒与服务器的交互方法及系统， 采用加密物理地址的方式进行身份 认证， 身份认证合法后再进行数据的传输， 数据传输以加密的 URL方式发送， 机顶盒接收到 URL解密解析后， 由其后的 sessionID从服务器上获取相应的数据， 这样机顶盒与服务器的通信， 先经过加密身份认证， 再通过加密方式进行通信 ， 从而能够对传输内容进行加密， 安全性大大提高， 经过加密不容易被拦截也 不容易泄露， 有效保证了机顶盒与服务器通信的安全性， 避免了数据隐患。 对附图的简要说明
附图说明
[0025] 图 1是一个实施例中的机顶盒与服务器的交互方法的流程图；
[0026] 图 2是一个实施例中的机顶盒与服务器的交互系统的结构图。
本发明的实施方式
[0027] 为了使本发明的目的、 技术方案及优点更加清楚明白， 以下结合附图及实施例 ， 对本发明进行进一步详细说明。 应当理解， 此处所描述的具体实施例仅用以 解释本发明， 并不用于限定本发明。
[0028] HTTPS协议， 安全版超文本传输协议， 是在 HTTP的基础上增加了加密模块， 能够对数据进行加密传输、 身份认证等， 具有更高的安全性。 但是目前机顶盒 很多不支持 HTTPS协议， 不支持 HTTPS协议的数据加密传输方式， 本发明方法 解决不支持 HTTPS协议机顶盒的数据加密传输方式。
[0029] 图 1是一个实施例中的机顶盒与服务器的交互方法的流程图， 如图 1所示， 该机 顶盒与服务器的交互方法包括如下步骤： [0030] S10:由机顶盒向服务器发出认证请求， 认证请求携带加扰的本机物理地址 （M
AC) 的字符串。
[0031] 在机顶盒与服务器进行数据通信之前， 需要先进行身份认证， 认证合法才能进 行数据通信。 由机顶盒首先向服务器发出认证请求， 认证请求携带加扰的本机 物理地址， 以保证认证的唯一性。
[0032] S20: 由服务器接收字符串并进行解扰， 获取机顶盒的物理地址并査询预设数 据库， 若数据库中包含该机顶盒的物理地址， 则向机顶盒返回一个随机值， 并 记录随机值。
[0033] 服务器接收机顶盒发送的认证请求来对机顶盒进行认证操作， 解扰认证请求得 到机顶盒物理地址， 然后通过査询预先设置的存储机顶盒物理地址的数据库进 行比对， 若数据库中包含有机顶盒的物理地址则向机顶盒返回一个随机值。 随 机值用来后续的加密操作。
[0034] 进一步的， 为保证认证的安全性和对应性， 随机值由机顶盒的物理地址和另一 随机值共同合成。 即在只有获取了机顶盒物理地址的前提下， 才能产生随机值 ， 防止认证出现漏洞。
[0035] S30: 由机顶盒获取该随机值并作为密钥， 对机顶盒序列号 （sn) 进行哈希加 密运算得到加密结果， 将加密结果提交到服务器。
[0036] 随机值产生后， 机顶盒获取并用来对机顶盒的序列号进行哈希加密运算， 得到 加密结果发送到服务器， 由服务器进行进一步的比对。
[0037] S40: 由服务器读取预设服务器中机顶盒序列号并采用随机值进行哈希加密运 算， 得到加密结果与机顶盒发送的加密结果进行比较， 若两者一致则机顶盒认 证合法， 否则认证不合法。
[0038] 在服务器， 由服务器査询读取预设数据库中机顶盒的序列号并同样采用同一随 机值进行同样的哈希加密运算， 与机顶盒发送的加密结果进行比对， 若一致则 认证合法， 机顶盒身份认证通过； 否则就属于不合法的身份认证。
[0039] S50: 若机顶盒认证合法， 则由服务器在本次 session (会话控制） 中写入成功 登陆的标识， 并获取此次会话的 sessionlD , 根据业务类型构造 URL加密后发送给 机顶盒， URL后带有 sessionID。 [0040] 机顶盒身份认证通过后， 幵始进行机顶盒与服务器的通信， 由服务器在本次的 session中写入成功登陆的标识 （身份认证通过后即登陆成功） ， 同吋获取到此次 会话的 sessionID, sessionID加在 URL后面， 一同发送给机顶盒。
[0041] 进一步的， 由服务器对构造的 URL的进行加密后发送到机顶盒， 发送到机顶盒 的加密数据如下： RSA (SHA256(URL)+MAC) +RSA(URL)， 其中， RSA为 RS A加密算法， SHA256为哈希值大小为 256位的安全哈希算法， MAC为物理地址
[0042] S60: 在机顶盒接收到 URL后进行解密， 解析 URL得到 sessionID, 根据 sessionl
D请求相应的业务数据。
[0043] 服务器下发 URL后， 机顶盒即可通过解析 URL得到 sessionID, 通过 sessionID来 获取数据， 与服务器进行数据的通信， 这样即便机顶盒不支持 HTTPS协议， 也 通过本发明的方法能够采用类似 HTTPS的方式， 通过本发明的加密方式进行通 信， 从而能够对传输内容进行加密， 安全性大大提高， 经过加密不容易被拦截 也不容易泄露， 有效保证了机顶盒与服务器通信的安全性， 避免了数据隐患。
[0044] 该机顶盒与服务器的交互方法， 采用加密物理地址的方式进行身份认证， 身份 认证合法后再进行数据的传输， 数据传输以加密的 URL方式发送， 机顶盒接收 到 URL解密解析后， 由其后的 sessionID从服务器上获取相应的数据， 这样机顶盒 与服务器的通信， 先经过加密身份认证， 再通过加密方式进行通信， 从而能够 对传输内容进行加密， 安全性大大提高， 经过加密不容易被拦截也不容易泄露 ， 有效保证了机顶盒与服务器通信的安全性， 避免了数据隐患。
[0045] 同吋， 本发明还提供一种机顶盒与服务器的交互系统， 如图 2所示， 该系统包 括：
[0046] 认证请求发送模块 100， 控制由机顶盒向服务器发出认证请求， 认证请求携带 加扰的本机物理地址 （MAC) 的字符串。
[0047] 在机顶盒与服务器进行数据通信之前， 需要先进行身份认证， 认证合法才能进 行数据通信。 认证请求发送模块 100控制由机顶盒首先向服务器发出认证请求， 认证请求携带加扰的本机物理地址， 以保证认证的唯一性。
[0048] 随机值返回模块 200， 控制由服务器接收字符串并进行解扰， 获取机顶盒的物 理地址并査询预设数据库， 若数据库中包含该机顶盒的物理地址， 则向机顶盒 返回一个随机值， 并记录随机值。
[0049] 随机值返回模块 200控制服务器接收机顶盒发送的认证请求来对机顶盒进行认 证操作， 解扰认证请求得到机顶盒物理地址， 然后通过査询预先设置的存储机 顶盒物理地址的数据库进行比对， 若数据库中包含有机顶盒的物理地址则向机 顶盒返回一个随机值。 随机值用来后续的加密操作。
[0050] 进一步的， 为保证认证的安全性和对应性， 随机值由机顶盒的物理地址和另一 随机值共同合成。 即在只有获取了机顶盒物理地址的前提下， 才能产生随机值 ， 防止认证出现漏洞。
[0051] 序列号加密模块 300， 控制由机顶盒获取该随机值并作为密钥， 对机顶盒序列 号 （sn) 进行哈希加密运算得到加密结果， 将加密结果提交到服务器。
[0052] 随机值产生后， 序列号加密模块 300控制机顶盒获取并用来对机顶盒的序列号 进行哈希加密运算， 得到加密结果发送到服务器， 由服务器进行进一步的比对
[0053] 加密结果比对模块 400， 控制由服务器读取预设服务器中机顶盒序列号并采用 随机值进行哈希加密运算， 得到加密结果与机顶盒发送的加密结果进行比较， 若两者一致则机顶盒认证合法， 否则认证不合法。
[0054] 在服务器， 由服务器査询读取预设数据库中机顶盒的序列号并同样采用同一随 机值进行同样的哈希加密运算， 与机顶盒发送的加密结果进行比对， 若一致则 认证合法， 机顶盒身份认证通过； 否则就属于不合法的身份认证。
[0055] URL加密发送模块 500， 若机顶盒认证合法， 则由服务器在本次 session (会话 控制） 中写入成功登陆的标识， 并获取此次会话的 sessionlD , 根据业务类型构造 URL加密后发送给机顶盒， URL后带有 sessionID。
[0056] 机顶盒身份认证通过后， 幵始进行机顶盒与服务器的通信， URL加密发送模块 500控制由服务器在本次的 session中写入成功登陆的标识 （身份认证通过后即登 陆成功） ， 同吋获取到此次会话的 sessionlD , sessionlD加在 URL后面， 加密后一 同发送给机顶盒。
[0057] 进一步的， URL加密发送模块 500发送到机顶盒的加密数据如下： RSA (SHA2 56(URL)+MAC) +RSA(URL)， 其中， RSA为 RSA加密算法， SHA256为哈希值 大小为 256位的安全哈希算法， MAC为物理地址。
[0058] 数据通信模块 600， 在机顶盒接收到 URL后进行解密， 解析 URL得到 sessionID ， 根据 sessionID请求相应的业务数据。
[0059] 服务器下发 URL后， URL加密发送模块 500即可通过解析 URL得到 sessionID, 通过 sessionID来获取数据， 与服务器进行数据的通信， 这样即便机顶盒不支持 H TTPS协议， 也通过本发明的系统能够采用类似 HTTPS的方式， 通过本发明的加 密方式进行通信， 从而能够对传输内容进行加密， 安全性大大提高， 经过加密 不容易被拦截也不容易泄露， 有效保证了机顶盒与服务器通信的安全性， 避免 了数据隐患。
[0060] 该机顶盒与服务器的交互系统， 采用加密物理地址的方式进行身份认证， 身份 认证合法后再进行数据的传输， 数据传输以加密的 URL方式发送， 机顶盒接收 到 URL解密解析后， 由其后的 sessionID从服务器上获取相应的数据， 这样机顶盒 与服务器的通信， 先经过加密身份认证， 再通过加密方式进行通信， 从而能够 对传输内容进行加密， 安全性大大提高， 经过加密不容易被拦截也不容易泄露 ， 有效保证了机顶盒与服务器通信的安全性， 避免了数据隐患。
[0061] 本发明机顶盒与服务器的交互方法及系统， 采用加密物理地址的方式进行身份 认证， 身份认证合法后再进行数据的传输， 数据传输以加密的 URL方式发送， 机顶盒接收到 URL解密解析后， 由其后的 sessionID从服务器上获取相应的数据， 这样机顶盒与服务器的通信， 先经过加密身份认证， 再通过加密方式进行通信 ， 从而能够对传输内容进行加密， 安全性大大提高， 经过加密不容易被拦截也 不容易泄露， 有效保证了机顶盒与服务器通信的安全性， 避免了数据隐患。
[0062] 以上仅为本发明的较佳实施例而已， 并不用以限制本发明， 凡在本发明的精神 和原则之内所作的任何修改、 等同替换和改进等， 均应包含在本发明的保护范 围之内。

Claims

权利要求书
[权利要求 1] 一种机顶盒与服务器的交互方法， 其特征在于， 包括如下步骤：
S10:由机顶盒向服务器发出认证请求， 认证请求携带加扰的本机物理 地址的字符串；
S20: 由服务器接收字符串并进行解扰， 获取机顶盒的物理地址并査 询预设数据库， 若数据库中包含该机顶盒的物理地址， 则向机顶盒返 回一个随机值， 并记录随机值；
S30: 由机顶盒获取该随机值并作为密钥， 对机顶盒序列号进行哈希 加密运算得到加密结果， 将加密结果提交到服务器；
S40: 由服务器读取预设服务器中机顶盒序列号并采用随机值进行哈 希加密运算， 得到加密结果与机顶盒发送的加密结果进行比较， 若两 者一致则机顶盒认证合法， 否则认证不合法；
S50: 若机顶盒认证合法， 贝 1油服务器在本次 session中写入成功登陆 的标识， 并获取此次会话的 sessionID, 根据业务类型构造 URL加密后 发送给机顶盒， URL后带有 sessionID;
S60: 在机顶盒接收到 URL后进行解密， 解析 URL得到 sessionID, 根 据 sessionID请求相应的业务数据。
[权利要求 2] 根据权利要求 1所述的机顶盒与服务器的交互方法， 其特征在于， 所 述随机值由机顶盒的物理地址和另一随机值共同合成。
[权利要求 3] 根据权利要求 2所述的机顶盒与服务器的交互方法， 其特征在于， 所 述步骤根据业务类型构造 URL加密后发送给机顶盒， 发送到机顶盒的 加密数据如下： RSA (SHA256(URL)+MAC) +RSA(URL);
其中， RSA为 RSA加密算法， SHA256为哈希值大小为 256位的安全 哈希算法， MAC为物理地址。
[权利要求 4] 一种机顶盒与服务器的交互系统， 其特征在于， 包括：
认证请求发送模块， 控制由机顶盒向服务器发出认证请求， 认证请求 携带加扰的本机物理地址的字符串；
随机值返回模块， 控制由服务器接收字符串并进行解扰， 获取机顶盒 的物理地址并査询预设数据库， 若数据库中包含该机顶盒的物理地址 ， 则向机顶盒返回一个随机值， 并记录随机值； 序列号加密模块， 控制由机顶盒获取该随机值并作为密钥， 对机顶盒 序列号进行哈希加密运算得到加密结果， 将加密结果提交到服务器； 加密结果比对模块， 控制由服务器读取预设服务器中机顶盒序列号并 采用随机值进行哈希加密运算， 得到加密结果与机顶盒发送的加密结 果进行比较， 若两者一致则机顶盒认证合法， 否则认证不合法； URL加密发送模块， 若机顶盒认证合法， 则由服务器在本次 session中 写入成功登陆的标识， 并获取此次会话的 sessionID, 根据业务类型构 造 URL加密后发送给机顶盒， URL后带有 sessionID;
数据通信模块， 在机顶盒接收到 URL后进行解密， 解析 URL得到 sessi onID， 根据 sessionID请求相应的业务数据。
[权利要求 5] 根据权利要求 4所述的机顶盒与服务器的交互系统， 其特征在于， 所 述随机值由机顶盒的物理地址和另一随机值共同合成。
[权利要求 6] 根据权利要求 5所述的机顶盒与服务器的交互系统， 其特征在于， 所 述 URL加密发送模块发送到机顶盒的加密数据如下： RSA (SHA256( URL)+MAC) +RSA(URL);
其中， RSA为 RSA加密算法， SHA256为哈希值大小为 256位的安全 哈希算法， MAC为物理地址。
PCT/CN2017/106328 2016-12-27 2017-10-16 机顶盒与服务器的交互方法及系统 WO2018120998A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611229372.7 2016-12-27
CN201611229372.7A CN106658093B (zh) 2016-12-27 2016-12-27 机顶盒与服务器的交互方法及系统

Publications (1)

Publication Number Publication Date
WO2018120998A1 true WO2018120998A1 (zh) 2018-07-05

Family

ID=58832845

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/106328 WO2018120998A1 (zh) 2016-12-27 2017-10-16 机顶盒与服务器的交互方法及系统

Country Status (2)

Country Link
CN (1) CN106658093B (zh)
WO (1) WO2018120998A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11421228B2 (en) 2018-03-15 2022-08-23 KSQ Therapeutics, Inc. Gene-regulating compositions and methods for improved immunotherapy

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106658093B (zh) * 2016-12-27 2019-07-09 深圳市九洲电器有限公司 机顶盒与服务器的交互方法及系统
CN108512824B (zh) * 2018-01-20 2020-10-16 福建省数字福建云计算运营有限公司 一种家庭云端文件的管理方法及移动终端
CN108259609B (zh) * 2018-01-20 2020-10-16 福建省数字福建云计算运营有限公司 一种家庭云端数据的管理方法及云服务器
CN110061967B (zh) * 2019-03-15 2022-02-22 平安科技（深圳）有限公司 业务数据提供方法、装置、设备及计算机可读存储介质
CN110891187A (zh) * 2019-11-30 2020-03-17 广西广播电视信息网络股份有限公司 一种家庭智能终端的节目授权控制方法
CN111510764B (zh) * 2020-04-15 2022-06-17 青岛海信宽带多媒体技术有限公司 一种家庭智能机顶盒的控制显示方法及显示设备
CN112203050B (zh) * 2020-09-30 2022-09-06 普联技术有限公司 一种视频续传的方法及装置
CN118509665A (zh) * 2024-07-19 2024-08-16 浙江大华技术股份有限公司 视频续传方法、装置、计算机设备和存储介质

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101184204A (zh) * 2007-12-25 2008-05-21 天柏宽带网络科技（北京）有限公司 一种互动电视业务中认证方法
CN103067333A (zh) * 2011-10-18 2013-04-24 华为终端有限公司 验证机顶盒接入身份的方法和认证服务器
US20130219178A1 (en) * 2012-02-17 2013-08-22 Christopher Peter Xiques Media Player Security for Full Length Episodes
CN105119891A (zh) * 2015-07-15 2015-12-02 华数传媒网络有限公司 一种数据交互方法、机顶盒和服务器
CN105577616A (zh) * 2014-10-15 2016-05-11 中国电信股份有限公司 一种终端接入的认证方法、系统及业务管理服务器
CN105933119A (zh) * 2015-12-24 2016-09-07 中国银联股份有限公司 一种认证方法及设备
CN106658093A (zh) * 2016-12-27 2017-05-10 深圳市九洲电器有限公司 机顶盒与服务器的交互方法及系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1567294A (zh) * 2003-06-14 2005-01-19 华为技术有限公司 一种对用户进行认证的方法
CN1684411B (zh) * 2004-04-13 2010-04-28 华为技术有限公司 一种验证移动终端用户合法性的方法
WO2009028060A1 (ja) * 2007-08-29 2009-03-05 Mitsubishi Electric Corporation 認証システム及び認証装置及び端末装置及びｉｃカード及びプログラム
US8555367B2 (en) * 2008-03-12 2013-10-08 Yahoo! Inc. Method and system for securely streaming content
CN105656862B (zh) * 2014-11-21 2019-09-03 航天恒星科技有限公司 认证方法及装置
CN104378379B (zh) * 2014-11-26 2018-10-16 北京奇艺世纪科技有限公司 一种数字内容加密传输方法、设备和系统

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101184204A (zh) * 2007-12-25 2008-05-21 天柏宽带网络科技（北京）有限公司 一种互动电视业务中认证方法
CN103067333A (zh) * 2011-10-18 2013-04-24 华为终端有限公司 验证机顶盒接入身份的方法和认证服务器
US20130219178A1 (en) * 2012-02-17 2013-08-22 Christopher Peter Xiques Media Player Security for Full Length Episodes
CN105577616A (zh) * 2014-10-15 2016-05-11 中国电信股份有限公司 一种终端接入的认证方法、系统及业务管理服务器
CN105119891A (zh) * 2015-07-15 2015-12-02 华数传媒网络有限公司 一种数据交互方法、机顶盒和服务器
CN105933119A (zh) * 2015-12-24 2016-09-07 中国银联股份有限公司 一种认证方法及设备
CN106658093A (zh) * 2016-12-27 2017-05-10 深圳市九洲电器有限公司 机顶盒与服务器的交互方法及系统

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11421228B2 (en) 2018-03-15 2022-08-23 KSQ Therapeutics, Inc. Gene-regulating compositions and methods for improved immunotherapy
US11608500B2 (en) 2018-03-15 2023-03-21 KSQ Therapeutics, Inc. Gene-regulating compositions and methods for improved immunotherapy

Also Published As

Publication number Publication date
CN106658093B (zh) 2019-07-09
CN106658093A (zh) 2017-05-10

Similar Documents

Publication Publication Date Title
WO2018120998A1 (zh) 机顶盒与服务器的交互方法及系统
WO2017215514A1 (zh) 音视频的加密播放方法及其系统
CN109088889B (zh) 一种ssl加解密方法、系统及计算机可读存储介质
US8832727B2 (en) Method and authentication server for verifying access identity of set-top box
CN101431415B (zh) 一种双向认证的方法
TWI510066B (zh) 用於安全串流媒體內容之系統和方法
CN108494811B (zh) 数据传输安全认证方法及装置
CN107707504B (zh) 一种流媒体的播放方法、系统以及服务器和客户端
JP4519935B2 (ja) 情報通信方法、通信端末装置および情報通信システム
CN101977190B (zh) 数字内容加密传送方法以及服务器端
CN108881205B (zh) 一种hls流媒体的安全播放系统及播放方法
CN109547198B (zh) 网络传输视频文件的系统
CN108809633B (zh) 一种身份认证的方法、装置及系统
WO2008069472A1 (en) Method and apparatus for transmitting data using authentication
JP2005102163A (ja) 機器認証システム、機器認証サーバ、端末機器、機器認証方法、機器認証プログラム、及び記憶媒体
KR20090061915A (ko) 일회용 패스워드를 이용한 신뢰성 있는 통신 시스템 및방법
CN102882830B (zh) 媒体资源访问控制方法和设备
US20170317836A1 (en) Service Processing Method and Apparatus
US20130019092A1 (en) System to Embed Enhanced Security / Privacy Functions Into a User Client
JP2024501326A (ja) アクセス制御方法、装置、ネットワーク側機器、端末及びブロックチェーンノード
US20220171832A1 (en) Scalable key management for encrypting digital rights management authorization tokens
CN103237011A (zh) 数字内容加密传送方法以及服务器端
CN107919958B (zh) 一种数据加密的处理方法、装置及设备
CN102843335B (zh) 流媒体内容的处理方法和设备
CN112769783B (zh) 数据传输方法及云服务器、接收端和发送端

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17886751

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 15/10/2019)

122 Ep: pct application non-entry in european phase

Ref document number: 17886751

Country of ref document: EP

Kind code of ref document: A1