WO2019001083A1 - 一种视频流地址鉴权方法及装置 - Google Patents

一种视频流地址鉴权方法及装置 Download PDF

Info

Publication number
WO2019001083A1
WO2019001083A1 PCT/CN2018/082509 CN2018082509W WO2019001083A1 WO 2019001083 A1 WO2019001083 A1 WO 2019001083A1 CN 2018082509 W CN2018082509 W CN 2018082509W WO 2019001083 A1 WO2019001083 A1 WO 2019001083A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
video stream
target
room
hash
Prior art date
Application number
PCT/CN2018/082509
Other languages
English (en)
French (fr)
Inventor
周志刚
张文明
陈少杰
Original Assignee
武汉斗鱼网络科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 武汉斗鱼网络科技有限公司 filed Critical 武汉斗鱼网络科技有限公司
Publication of WO2019001083A1 publication Critical patent/WO2019001083A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/60—Network streaming of media packets
    • H04L65/61—Network streaming of media packets for supporting one-way streaming services, e.g. Internet radio
    • H04L65/612—Network streaming of media packets for supporting one-way streaming services, e.g. Internet radio for unicast
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions

Definitions

  • the present invention relates to the field of network live broadcasting, and in particular, to a video stream address authentication method and apparatus.
  • the live webcast uses the Internet and streaming media technology for live video broadcast.
  • the video content provider has the video stream address obtained by the third-party platform, so that the video can be directly viewed without the live broadcast website, that is, the video broadcast of the live broadcast website is bypassed.
  • Video playback provided by the device. This reduces the traffic to the website for video sites.
  • the embodiment of the invention solves the technical problem that the security of the existing video stream address authentication is low by providing a video stream address authentication method and device.
  • the embodiment of the present invention provides a video stream address authentication method, which is applied to a client corresponding to a live broadcast platform, where the method includes:
  • M authentication elements are read, the authentication element is related to the current state of the client or the target room, and M is a positive integer ;
  • the reading the M authentication elements includes:
  • the first authentication element is a room ID of the target room
  • determining, from the N hash functions, a target that matches the first authentication element of the M authentication elements The Greek function, including:
  • the hash function corresponding to the room number category to which the room ID of the target room belongs is determined as the target hash function based on the correspondence between the P room number categories and the N hash functions.
  • the first authentication element is a room ID of the target room
  • determining, from the N hash functions, a target that matches the first authentication element of the M authentication elements The Greek function, including:
  • the polymorphic hash function interface is instantiated based on the MD5 class
  • the polymorphic hash function interface is instantiated based on the CRC32 class.
  • the token is obtained from the video streaming server, and the determined from the K encryption functions is The target encryption function matching the second authentication element among the M authentication elements, including:
  • the encryption function matched by the token category of the token acquired from the video streaming server when logging in to the live broadcast platform Determined as the target encryption function.
  • the token is obtained from the video streaming server, and the determined from the K encryption functions is The target encryption function matching the second authentication element among the M authentication elements, including:
  • the polymorphic encryption function interface is instantiated based on the AES class, otherwise the polymorphic encryption function interface is instantiated based on the TEA class.
  • the calling the target hash function to calculate a hash value corresponding to the M authentication elements including:
  • the embodiment of the present invention provides a video stream address authentication device, which is applied to a client corresponding to a live broadcast platform, where the device includes:
  • a reading unit configured to read M authentication elements, the authentication element and the current state of the client or the target room if receiving a live video viewing instruction for a target room on the live platform
  • M is a positive integer
  • a first determining unit configured to determine, by using a polymorphic hash function interface, a target hash function matching the first authentication element of the M authentication elements from the N hash functions, where N is greater than 1.
  • a hash value calculation unit configured to invoke the target hash function to calculate a hash value corresponding to the M authentication elements
  • a second determining unit configured to determine, by using a polymorphic encryption function interface, a target encryption function that matches a second one of the M authentication elements from the K encryption functions, where K is an integer greater than one;
  • An encryption calculation unit configured to invoke the target encryption function to encrypt the hash value based on a random key delivered by the video stream server to obtain a video stream address authentication value
  • a request sending unit configured to send, to the video stream server, a video stream address request that carries the video stream address authentication value and the M authentication elements, where the video stream address request is used for the video stream
  • the server requests the video stream address of the live video of the target room.
  • the reading unit is specifically configured to:
  • the hash value calculation unit includes:
  • a room number type determining subunit configured to determine a room number category of the target room according to a room ID of the target room, wherein there is a correspondence relationship between the P room number categories and the N hash functions, P is an integer greater than one;
  • a first determining subunit configured to determine, according to a correspondence between the P room number categories and the N hash functions, a hash function corresponding to a room number category to which the room ID of the target room belongs Is the target hash function.
  • the hash value calculation unit includes:
  • a room number parity judgment subunit configured to determine a parity of a room ID of the target room
  • a first instantiating subunit configured to instantiate the polymorphic hash function interface based on the MD5 class if it is determined that the room ID of the target room is an even number
  • a second instantiating subunit configured to instantiate the polymorphic hash function interface based on the CRC32 class if it is determined that the room ID of the target room is an odd number.
  • the second determining unit 204 includes:
  • a token class obtaining sub-unit configured to determine a token class of a token obtained from the video stream server when logging in to the live broadcast platform, wherein there are Q token categories and the K encryption functions
  • Q is an integer greater than one
  • a second determining subunit configured to acquire a token from the video streaming server when logging in to the live broadcast platform according to the correspondence between the Q token categories and the K encryption functions
  • the encryption function matched by the card type is judged as the target encryption function.
  • the second determining unit 204 includes:
  • a high-level identification sub-unit configured to identify a highest bit of the token obtained from the video streaming server when the client logs in to the live broadcast platform
  • a third instantiating subunit configured to instantiate the polymorphic encryption function interface based on the AES class if the highest bit of the token is 0, otherwise, instantiate the polymorphic encryption function interface based on the TEA class.
  • the encryption calculation unit is specifically configured to:
  • an embodiment of the present invention provides a computer readable storage medium having stored thereon a computer program, the program being executed by a processor to implement the steps of any one of the first aspects.
  • an embodiment of the present invention provides a computer device, including a memory, a processor, and a computer program stored on the memory and operable on the processor, where the processor implements the first aspect The steps described in any of the embodiments.
  • a polymorphic hash function interface and a polymorphic encryption function interface are set, and a target hash function matching the first authentication element of the M authentication elements is called to calculate a hash value of the M authentication elements;
  • the target hash function matched by the second authentication element among the authentication elements is used to encrypt the hash value of the M authentication elements based on the random key delivered by the video stream server to obtain the video stream address of the video stream server.
  • Authentication value Therefore, different hash functions are used under different authentication elements to calculate the HASH value and use different encryption algorithms to encrypt the HASH value.
  • the code is inversely statically analyzed, it is impossible to determine the function that is specifically called by the polymorphic function interface. In the case of reverse dynamic debugging, the complexity of debugging is also increased. This further enhances the security of video stream authentication.
  • FIG. 1 is a flowchart of a video stream address authentication method according to an embodiment of the present invention
  • FIG. 2 is a schematic structural diagram of a video stream address authentication apparatus according to an embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of a computer readable storage medium according to an embodiment of the present disclosure
  • FIG. 4 is a schematic structural diagram of a computer device according to an embodiment of the present invention.
  • the embodiment of the invention solves the technical problem that the security of the existing video stream address authentication is low by providing a video stream address authentication method and device.
  • the polymorphic hash function interface and the polymorphic encryption function interface are set, and different hash functions are used to calculate the HASH value and different encryption algorithms for encryption under different authentication elements.
  • different hash functions are used to calculate the HASH value and different encryption algorithms for encryption under different authentication elements.
  • a video stream address authentication method provided by an embodiment of the present invention is applied to a client of a live broadcast platform.
  • the video stream address authentication method provided in this embodiment includes:
  • the live video viewing instruction may be an instruction generated when the viewer clicks into the target room.
  • the target room may be any room on the live broadcast platform where the live video is being broadcasted, and is determined based on the click-through operation of the viewer.
  • the method includes: reading a token (Token) obtained by the client from the video streaming server when logging in to the live broadcast platform; and reading the current system time of the client; and Read the room ID (RoomId) of the target room; and read the current IP address of the client; and read the unique ID of the device of the client.
  • a token Token
  • RoomId room ID
  • the current state of the client is: the current system time of the client, the current IP address of the client, the unique ID of the device of the client, and the video from the client when logging in to the live platform.
  • the token obtained by the streaming server.
  • Execution S102 determining, by the polymorphic hash function interface, a target hash function matching the first authentication element of the M authentication elements from the N hash functions, where N is an integer greater than 1.
  • N hash (HASH) functions include: MD5 (Message Digest Algorithm 5, Information-Abstract Algorithm Fifth Edition) and SHA-1 (Secure Hash Algorithm 1, Secure Hash Algorithm First Edition). Any two or three of CRC32 (Cyclic Redundancy Check 32) are available. There may be other higher or lower hash algorithms, or hash algorithms that are different from the above three hash algorithms.
  • a polymorphic hash function interface is set, so that different hash functions are called as the target hash function according to different points of the first authentication element.
  • the specific implementation is as follows:
  • the polymorphic hash function interface is represented as follows:
  • the base class of the hash function is defined, and an abstract interface CalcHashData is defined in the base class of the hash function. Then define a different hash function class to implement the abstract interface CalcHashData, thus achieving polymorphism of the polymorphic hash function interface.
  • the first authentication element may be a room ID of the target room.
  • the first authentication element may also be other identification information related to the target room or the client, for example, the current IP address of the client, the unique ID of the device of the client, and the client obtains the order from the video streaming server when logging in to the live broadcast platform. brand.
  • the first authentication element is used as the room ID of the target room, so that different hash algorithm instances are created according to different room IDs of the entered room, and the algorithm for calculating the HASH value alone is avoided. Thereby improving the difficulty of its analysis.
  • S102 includes the following steps: S1021 to S1022.
  • S1021 Determine a room number category of the target room according to the room ID of the target room, wherein the client has a correspondence relationship between the P room number categories and the N hash functions, and P is an integer greater than 1.
  • the correspondence between the P room number categories and the N hash functions may be a one-to-one correspondence or a many-to-one correspondence: that is, a plurality of room number categories correspond to one hash. function.
  • two room number categories are provided: an even room number and an odd room number, corresponding to two hash functions.
  • an even room number corresponds to a hash function
  • an odd room number corresponds to another hash function.
  • 10 room number categories are set, which is distinguished by the end of the room number: the room number whose last digit is “0, 1, 2, 3, 4” corresponds to a hash function, and the end is “5”.
  • the room number of 6,7,8,9" corresponds to another hash function.
  • S1022 Determine a hash function corresponding to the room number category to which the room ID of the target room belongs according to the correspondence relationship between the P room number categories and the N hash functions.
  • S102 is specifically: determining a parity of a room ID of the target room; if it is determined that the room ID of the target room is an even number, determining the MD5 function as a target hash function, and instantiating the polymorphic hash based on the MD5 class Function interface; if it is determined that the room ID of the target room is an odd number, the CRC32 function is determined as the target hash function, and the polymorphic hash function interface is instantiated based on the CRC32 class.
  • a hash value calculation interface is used to provide a method for calculating the HASH value of the incoming M authentication elements, and the specific implementation is as follows:
  • the passed parameter char*pData is the authentication element to calculate the HASH value.
  • the incoming parameter IHash*pHashFunc is a pointer to the base class of the incoming hash function, pointing to the target hash function determined in S102, instead of Only one hash function is implemented to calculate the hash value for the incoming data. Therefore, the hash function specifically called in this step is undefined. Only when the program is running, can the specific pointer of which hash function be called through the incoming pointer, thereby realizing the authentication process of the video stream address. The hash value calculation is split into multiple virtual functions to achieve.
  • pHashFunc is an object of class Md5
  • the Md5 function is specifically called
  • pHashFunc is an object of class Crc32
  • the Crc32 function is called. Therefore, when it analyzes its code in reverse static state, it is impossible to determine the specific function of the pHashFunc->CalcHashData call in the hash value calculation interface CalcHash.
  • the specific functions called due to the different objects of the specific pHashFunc are different, which increases the complexity of debugging.
  • the target hash function determined in S102 is an MD5 function
  • the MD5 function is used to implement the polymorphic hash function interface, and the hash value is calculated by the MD5 function, and the implementation method is as follows:
  • the MD5 function implements this polymorphic hash function interface, defines an Md5 class to inherit from the base class IHash, and implements the abstract interface CalcHashData.
  • the specific implementation uses the MD5 function to calculate HASH for M authentication elements.
  • the value, pData is the data pointer that needs to be encrypted.
  • the CRC32 function is used to implement the polymorphic hash function interface, and the hash value is calculated by the CRC32 function, and the implementation method is as follows:
  • Class Crc32 public IHash
  • the CRC32 function implements the polymorphic function interface, defines a Crc32 class to inherit from the base class IHash, and implements the abstract interface CalcHashData.
  • the specific implementation uses the Crc32 function to calculate the HASH value of the M authentication elements, pData is Need to calculate the data of the hash value.
  • the target hash function is other hash functions such as SHA-1.
  • the calculated HASH value is difficult to be analyzed by reverse debugging. For the simplicity of the specification, this There is no longer an example of how other hash functions such as SHA-1 implement multiple hash functions.
  • S104 Determine, by using a multi-state encryption function interface, a target encryption function that matches a second authentication element among the M authentication elements, where K is an integer greater than 1.
  • step S104 a polymorphic encryption function interface is provided, so that different encryption functions are called according to different points of the second authentication element.
  • the polymorphic encryption function interface is expressed as follows:
  • the polymorphic encryption function interface defines a base class of an encryption function, and an abstract interface EncodeData is defined in the base class. Define different encryption function classes to implement this abstract interface EncodeData.
  • the second authentication element may be a token obtained by the client from the video stream server when the client logs in to the live broadcast platform.
  • the second authentication element may also be other identification information related to the target room or the client, such as the current IP address of the client, the unique ID of the device of the client, and the room ID of the target room.
  • the second authentication element is a token obtained from the video stream server, so that different encryption algorithm instances are created according to different acquired tokens, thereby avoiding the use of a single encryption function, thereby improving its The difficulty of the analysis.
  • S104 includes the following steps: S1041 ⁇ S1042:
  • S1041 Determine a token category of a live broadcast platform where the client logs in to the live video, where the client has a correspondence between the Q token categories and the K encryption functions.
  • the correspondence between the Q token classes and the N Q encryption functions may be a one-to-one correspondence or a many-to-one correspondence: that is, multiple room numbers correspond to one encryption. function.
  • two token categories are set: the highest bit is not 0 and the highest bit is 0, corresponding to two encryption functions: the Token highest bit is not 0, and the token corresponds to an encryption function.
  • the highest bit of Token is 0 for another encryption function.
  • S1042 Determine, according to a correspondence relationship between the Q token categories and the K encryption functions, an encryption function matched by the token category as a target encryption function.
  • S104 is specifically: identifying the highest bit of the token obtained from the video stream server when the client logs in to the live broadcast platform; if the highest bit of the token is 0, instantiating the polymorphic encryption function interface based on the AES class Otherwise, the polymorphic encryption function interface is instantiated based on the TEA class.
  • S105 Call the target encryption function, and encrypt the HASH value based on the random key sent by the video stream server to obtain the video stream address authentication value.
  • an encryption calculation interface (EncodeData) is called to encrypt the hash value calculated in S103. Then write an encryption computing interface to provide external encryption calculation methods, the specific implementation is as follows:
  • the EncodeData interface provides encryption of the incoming hash value, where the passed parameter char*pData is the hash value to be encrypted.
  • the incoming parameter IEncode*pEncodeFunc is a pointer to the base class of the incoming encryption algorithm.
  • the specific call to pEncodeFunc->EncodeData in this function is not sure which code to call to which encryption function, only when the program runs.
  • pointer of the encryption class is pEncodeFunc, it is possible to specifically know which encryption function is called, thereby realizing the splitting of the encryption calculation into multiple virtual functions.
  • pEncodeFunc->EncodeData calls the encryption function in class AES: AES function
  • pEncodeFunc is an object of class TEA
  • pEncodeFunc->EncodeData call is in class TEA Encryption function: TEA function. Therefore, when the code is analyzed in reverse static, it is impossible to determine the specific encryption function called by pEncodeFunc->EncodeData in the interface EncodeData. At the same time, even in the case of reverse dynamic debugging, the specific encryption function called due to the different objects of the specific pEncodeFunc is different, which increases the complexity of debugging.
  • the target encryption function determined in S105 is an AES function
  • the AES function is called in S105 to implement the polymorphic encryption function interface, thereby calling the AES function pair S103.
  • the calculated hash value is encrypted, and the implementation method is as follows:
  • Class TEA public IEncode
  • the AES function implements this polymorphic encryption function interface, defines an AES class to inherit the base class IEncode of the encryption function, and implements the abstract interface EncodeData.
  • the specific implementation is the hash value calculated by SES using the AES function.
  • Encryption, pData is the data that needs to be encrypted.
  • the random key is a random number that is sent by the video stream server for encrypting data that the client needs to report to the video stream service.
  • S106 Send a video stream address request carrying a video stream address authentication value and M authentication elements to the video stream server, where the video stream address request is used to request a video stream address of the live video of the target room from the video stream server.
  • the data calculation result (video stream address authentication value) and the M authentication elements are carried in the request and reported to the video stream server, and the video stream server is also based on the reported M authentication elements, based on the same as in the client.
  • the technical means calculates the video stream address authentication value on the server side.
  • the video stream server compares the calculated video stream address authentication value with the video stream address authentication value reported by the client. If the comparison result is inconsistent, it indicates that the client is a forged client, and the client is rejected.
  • an embodiment of the present invention provides a video stream address authentication apparatus, which is applied to a client corresponding to a live broadcast platform.
  • the video stream address authentication apparatus includes:
  • the reading unit 201 is configured to: if the live video viewing instruction for the target room on the live platform is received, read M authentication elements, the authentication element and the current state of the client or the target Room related, M is a positive integer;
  • the first determining unit 202 is configured to determine, from the N hash functions, a target hash function that matches the first authentication element of the M authentication elements by using a polymorphic hash function interface, where N is greater than 1. Integer
  • a hash value calculation unit 203 configured to invoke the target hash function to calculate a hash value corresponding to the M authentication elements
  • a second determining unit 204 configured to determine, by using a polymorphic encryption function interface, a target encryption function that matches a second one of the M authentication elements from the K encryption functions, where K is an integer greater than one;
  • the encryption calculation unit 205 is configured to invoke the target encryption function to encrypt the hash value based on a random key delivered by the video stream server to obtain a video stream address authentication value;
  • the request sending unit 206 is configured to send, to the video stream server, a video stream address request that carries the video stream address authentication value and the M authentication elements, where the video stream address request is used for the video
  • the streaming server requests the video stream address of the live video of the target room.
  • the reading unit 201 is specifically configured to:
  • the hash value calculation unit 203 includes:
  • a room number type determining subunit configured to determine a room number category of the target room according to a room ID of the target room, wherein there is a correspondence relationship between the P room number categories and the N hash functions, P is an integer greater than one;
  • a first determining subunit configured to determine, according to a correspondence between the P room number categories and the N hash functions, a hash function corresponding to a room number category to which the room ID of the target room belongs Is the target hash function.
  • the hash value calculation unit 203 includes:
  • a room number parity judgment subunit configured to determine a parity of a room ID of the target room
  • a first instantiating subunit configured to instantiate the polymorphic hash function interface based on the MD5 class if it is determined that the room ID of the target room is an even number
  • a second instantiating subunit configured to instantiate the polymorphic hash function interface based on the CRC32 class if it is determined that the room ID of the target room is an odd number.
  • the second determining unit 204 includes:
  • a token class obtaining sub-unit configured to determine a token class of a token obtained from the video stream server when logging in to the live broadcast platform, wherein there are Q token categories and the K encryption functions
  • Q is an integer greater than one
  • a second determining subunit configured to acquire a token from the video streaming server when logging in to the live broadcast platform according to the correspondence between the Q token categories and the K encryption functions
  • the encryption function matched by the card type is judged as the target encryption function.
  • the second determining unit 204 includes:
  • a high-level identification sub-unit configured to identify a highest bit of the token obtained from the video streaming server when the client logs in to the live broadcast platform
  • a third instantiating subunit configured to instantiate the polymorphic encryption function interface based on the AES class if the highest bit of the token is 0, otherwise, instantiate the polymorphic encryption function interface based on the TEA class.
  • the encryption calculation unit 205 is specifically configured to:
  • an embodiment of the present invention provides a computer readable storage medium 301.
  • a computer program 302 is stored thereon, and the program 302 is implemented by a processor to implement the video stream address authentication method. The steps described in any of the examples.
  • an embodiment of the present invention provides a computer device 400, including a memory 410, a processor 430, and a computer program 420 stored on the memory 410 and executable on the processor 430, as shown in FIG.
  • the processor 430 executes the program 420, the steps described in any one of the foregoing embodiments of the video stream address authentication method are implemented.
  • the above-mentioned device, the storage medium, and the computer device are used to implement the video stream address authentication method in the embodiment of the present invention. Therefore, the video stream address authentication method described in the embodiment of the present invention is applicable to the prior art. A person can understand the specific implementation of the device, the storage medium, and the computer device, and various changes thereof. Therefore, how to implement the video stream address authentication method in the embodiment of the present invention for the device, the storage medium, and the computer device is not described in detail herein. .
  • the apparatus, the storage medium, and the computer used by the person skilled in the art to implement the video stream address authentication method in the embodiments of the present invention are all within the scope of the present invention.
  • a polymorphic hash function interface and a polymorphic encryption function interface are set, and a target hash function matching the first authentication element of the M authentication elements is called to calculate a hash value of the M authentication elements;
  • the target hash function matched by the second authentication element among the authentication elements is used to encrypt the hash value of the M authentication elements based on the random key delivered by the video stream server to obtain the video stream address of the video stream server.
  • Authentication value Therefore, different hash functions are used under different authentication elements to calculate the HASH value and use different encryption algorithms to encrypt the HASH value.
  • the code is inversely statically analyzed, it is impossible to determine the function that is specifically called by the polymorphic function interface. In the case of reverse dynamic debugging, the complexity of debugging is also increased. This further enhances the security of video stream authentication.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Power Engineering (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Two-Way Televisions, Distribution Of Moving Picture Or The Like (AREA)

Abstract

本发明公开了一种视频流地址鉴权方法，包括：如果接收到对直播平台上的目标房间的直播视频观看指令，读取M个鉴权要素，鉴权要素与客户端当前的状态或目标房间相关；通过多态哈希函数接口，从N个哈希函数中确定出与M个鉴权要素中第一鉴权要素匹配的目标哈希函数；调用目标哈希函数，以计算M个鉴权要素的哈希值；通过多态加密函数接口，从K个加密函数中确定出与M个鉴权要素中第二鉴权要素匹配的目标加密函数；调用目标加密函数，以基于视频流服务器下发的随机密钥对M个鉴权要素的哈希值加密，以得到视频流地址鉴权值；向视频流服务器发送携带有视频流地址鉴权值的请求。本发明解决了视频流地址鉴权的安全性较低的技术问题。

Description

一种视频流地址鉴权方法及装置 技术领域
本发明涉及网络直播领域，尤其涉及一种视频流地址鉴权方法及装置。
背景技术
目前，网络直播是利用互联网及流媒体技术进行视频直播，然而视频内容的提供方存在视频流地址被第三方平台获取，从而可以不通过直播网站直接观看视频，即绕过了直播网站的视频播放器提供的视频播放。从而对于视频网站减少了网站的流量。
目前存在一些黑客通过逆向调试分析直播平台的视频流地址的鉴权函数，从而可以破解出如何生成视频流地址的函数，最终则绕过了平台的检测，以能够不通过直播网站直接观看视频，可见，现有视频流地址鉴权的安全性较低。
发明内容
本发明实施例通过提供一种视频流地址鉴权方法及装置，解决了现有视频流地址鉴权的安全性较低的技术问题。
第一方面，本发明实施例提供一种视频流地址鉴权方法，应用于直播平台对应的客户端，所述方法包括：
如果接收到对所述直播平台上的目标房间的直播视频观看指令，读取M个鉴权要素，所述鉴权要素与所述客户端当前的状态或所述目标房间相关，M为正整数；
通过多态哈希函数接口，从N个哈希函数中确定出与所述M个鉴权要素中第一鉴权要素匹配的目标哈希函数，N为大于1的整数；
调用所述目标哈希函数，以计算出与所述M个鉴权要素对应的哈希值；
通过多态加密函数接口，从K个加密函数中确定出与所述M个鉴权要素中第二鉴权要素匹配的目标加密函数，K为大于1的整数；
调用所述目标加密函数，以基于视频流服务器下发的随机密钥对所述哈希值加密，以得到视频流地址鉴权值；
向所述视频流服务器发送携带有所述视频流地址鉴权值和所述M个鉴权要素的视频流地址请求，所述视频流地址请求用于从所述视频流服务器请求所述目标房间的直播视频的视频流地址。
可选的，所述读取M个鉴权要素，包括：
读取所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌；和；
读取所述客户端当前的系统时间；和
读取所述目标房间的房间ID；和
读取所述客户端当前的IP地址；和
读取所述客户端的设备唯一ID。
可选的，如果所述第一鉴权要素为所述目标房间的房间ID，所述从N个哈希函数中确定出与所述M个鉴权要素中第一鉴权要素匹配的目标哈希函数，包括：
根据所述目标房间的房间ID判断出所述目标房间的房间号类别，其中，存在P个房间号类别与所述N个哈希函数之间的对应关系，P为大于1的整数；
根据所述P个房间号类别与所述N个哈希函数之间的对应关系，将所述目标房间的房间ID所属的房间号类别对应的哈希函数，判断为所述目标哈希函数。
可选的，如果所述第一鉴权要素为所述目标房间的房间ID，所述从N个哈希函数中确定出与所述M个鉴权要素中第一鉴权要素匹配的目标哈希函数，包括：
判断所述目标房间的房间ID的奇偶性；
如果判断出所述目标房间的房间ID为偶数，基于MD5类实例化所述多态哈希函数接口；
如果判断出所述目标房间的房间ID为奇数，基于CRC32类实例化所述多态哈希函数接口。
可选的，如果所述第二鉴权要素为所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌，所述从K个加密函数中确定出与所述M个鉴权要素中第二鉴权要素匹配的目标加密函数，包括：
判断出本次登陆所述直播平台时从所述视频流服务器所获取令牌的令牌类别，其中，存在Q个令牌类别与所述K个加密函数之间的对应关系，Q为大于1的整数；
根据所述Q个令牌类别与所述K个加密函数之间的对应关系，将本次登陆所述直播平台时从所述视频流服务器所获取令牌的令牌类别所匹配的加密函数，判断为目标加密函数。
可选的，如果所述第二鉴权要素为所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌，所述从K个加密函数中确定出与所述M个鉴权要素中第二鉴权要素匹配的目标加密函数，包括：
识别出所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌的最高位；
如果所述令牌的最高位为0，基于AES类实例化所述多态加密函数接口，否则，基于TEA类实例化所述多态加密函数接口。
可选的，所述调用所述目标哈希函数，以计算出与所述M个鉴权要素对应的哈希值，包括：
将所述客户端本次登陆所述直播平台时从所述视频流服务器所获取令牌、所述客户端当前的系统时间、所述目标房间的房间ID、所述客户端当前的IP地址、以及所述客户端的设备唯一ID依次经过所述目标哈希函数处理，以得出各个鉴权要素对应的哈希值。
第二方面，本发明实施例提供了一种视频流地址鉴权装置，应用于直播平台对应的客户端，所述装置包括：
读取单元，用于如果接收到对所述直播平台上的目标房间的直播视频观看指令，读取M个鉴权要素，所述鉴权要素与所述客户端当前的状态或所述目标房间相关，M为正整数；
第一确定单元，用于通过多态哈希函数接口，从N个哈希函数中确定出与所述M个鉴权要素中第一鉴权要素匹配的目标哈希函数，N为大于1的整数；
哈希值计算单元，用于调用所述目标哈希函数，以计算出与所述M个鉴权要素对应的哈希值；
第二确定单元，用于通过多态加密函数接口，从K个加密函数中确定出与所述M个鉴权要素中第二鉴权要素匹配的目标加密函数，K为大于1的整数；
加密计算单元，用于调用所述目标加密函数，以基于视频流服务器下发的随机密钥对所述哈希值加密，以得到视频流地址鉴权值；
请求发送单元，用于向所述视频流服务器发送携带有所述视频流地址鉴权值和所述M个鉴权要素的视频流地址请求，所述视频流地址请求用于从所述视频流服务器请求所述目标房间的直播视频的视频流地址。
可选的，所述读取单元，具体用于：
读取所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌；和；
读取所述客户端当前的系统时间；和
读取所述目标房间的房间ID；和
读取所述客户端当前的IP地址；和
读取所述客户端的设备唯一ID。
可选的，如果所述第一鉴权要素为所述目标房间的房间ID，所述哈希值计算单元包括：
房间号类型判断子单元，用于根据所述目标房间的房间ID判断出所述目标房间的房间号类别，其中，存在P个房间号类别与所述N个哈希函数之间的对应关系，P为大于1的整数；
第一判断子单元，用于根据所述P个房间号类别与所述N个哈希函数之间的对应关系，将所述目标房间的房间ID所属的房间号类别对应的哈希函数，判断为所述目标哈希函数。
可选的，如果所述第一鉴权要素为所述目标房间的房间ID，所述哈希值计算单元包括：
房间号奇偶性判断子单元，用于判断所述目标房间的房间ID的奇偶性；
第一实例化子单元，用于如果判断出所述目标房间的房间ID为偶数，基于MD5类实例化所述多态哈希函数接口；
第二实例化子单元，用于如果判断出所述目标房间的房间ID为奇数，基于CRC32类实例化所述多态哈希函数接口。
可选的，如果所述第二鉴权要素为所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌，所述第二确定单元204，包括：
令牌类别获取子单元，用于判断出本次登陆所述直播平台时从所述视频流服务器所获取令牌的令牌类别，其中，存在Q个令牌类别与所述K个加密函数之间的对应关系，Q为大于1的整数；
第二判断子单元，用于根据所述Q个令牌类别与所述K个加密函数之间的对应关系，将本次登陆所述直播平台时从所述视频流服务器所获取令牌的令牌类别所匹配的加密函数，判断为目标加密函数。
可选的，如果所述第二鉴权要素为所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌，所述第二确定单元204，包括：
高位识别子单元，用于识别出所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌的最高位；
第三实例化子单元，用于如果所述令牌的最高位为0，基于AES类实例化所述多态加密函数接口，否则，基于TEA类实例化所述多态加密函数接口。
可选的，所述加密计算单元，具体用于：
将所述客户端本次登陆所述直播平台时从所述视频流服务器所获取令牌、所述客户端当前的系统时间、所述目标房间的房间ID、所述客户端当前的IP地址、以及所述客户端的设备唯一ID依次经过所述目标哈希函数处理，以得出各个鉴权要素对应的哈希值。
第三方面，本发明实施例提供了一种计算机可读存储介质，其上存储有计算机程序，该程序被处理器执行时实现第一方面任一实施方式所述的步骤。
第四方面，本发明实施例提供了一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现第一方面中任一实施方式所述的步骤。
本发明实施例中提供的一个或多个技术方案，至少具有如下技术效果或优 点：
设置了多态哈希函数接口和多态加密函数接口，调用与M个鉴权要素中第一鉴权要素匹配的目标哈希函数，以计算M个鉴权要素的哈希值；调用与M个鉴权要素中第二鉴权要素匹配的目标哈希函数，以基于视频流服务器下发的随机密钥对M个鉴权要素的哈希值加密，以得到给视频流服务器的视频流地址鉴权值。从而在不同鉴权要素下会使用不同的哈希函数来计算HASH值和使用不同的加密算法来进行对HASH值的加密。从而，在逆向静态分析其代码时，是无法确定多态的函数接口具体调用的函数。在逆向动态调试时，也会增加调试的复杂度。从而进一步加强了视频流鉴权值得安全性。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作一简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的视频流地址鉴权方法的流程图；
图2为本发明实施例提供的视频流地址鉴权装置的结构示意图；
图3为本发明实施例提供的计算机可读存储介质的结构示意图；
图4为本发明实施例提供的计算机设备的结构示意图。
具体实施方式
本发明实施例通过提供一种视频流地址鉴权方法及装置，解决了现有视频流地址鉴权的安全性较低的技术问题。
为了解决上述技术问题，本发明实施例提供的技术方案，总体思路如下：
设置多态哈希函数接口和多态加密函数接口，在不同鉴权要素下会使用不同的哈希函数来计算HASH值和不同的加密算法来进行加密。从而，在逆向静态分析其代码时，是无法确定多态的函数接口具体调用的函数。在逆向动态调试时，也会增加调试的复杂度。从而进一步加强了视频流鉴权值得安全性。
为了更好的理解上述技术方案，下面将结合说明书附图以及具体的实施方 式对上述技术方案进行详细的说明。
本发明实施例提供的一种视频流地址鉴权方法，应用于直播平台的客户端。
参考图1所示，本实施例提供的视频流地址鉴权方法包括：
执行S101：如果接收到对直播平台上目标房间的直播视频观看指令，读取当前的M个鉴权要素，鉴权要素与客户端当前的状态或目标房间相关，M为正整数。
需要说明的是，在本实施例中，直播视频观看指令可以为观众对目标房间进行点击进入时产生的指令。
本实施例中，目标房间可以为直播平台上任一正在进行网络视频直播的房间，基于观众的点击进入操作确定。
具体的，在读取M个鉴权要素的步骤中，包括：读取客户端本次登陆直播平台时从视频流服务器所获取令牌(Token)；和读取客户端当前的系统时间；和读取目标房间的房间ID(RoomId)；和读取客户端当前的IP地址；和读取客户端的设备唯一ID。
读取的M个鉴权要素中，与客户端当前的状态相关的为：客户端当前的系统时间、客户端当前的IP地址、客户端的设备唯一ID、客户端本次登陆直播平台时从视频流服务器所获取令牌。与目标直播房间相关为目标直播房间的房间ID()
执行S102：通过多态哈希函数接口，从N个哈希函数中确定出与M个鉴权要素中第一鉴权要素匹配的目标哈希函数，N为大于1的整数。
在具体实施过程中，N个哈希(HASH)函数包括：MD5(Message Digest Algorithm 5，信息-摘要算法第五版)和SHA-1(Secure Hash Algorithm 1，安全散列算法第一版)。CRC32(Cyclic Redundancy Check 32，循环冗余校验)中的任意两种或三种均有。还可以有其他更高版本或更低版本的哈希算法，或者与上述三种哈希算法均不相同的哈希算法。
在步骤S102的具体实施流程中，设置有多态哈希函数接口，从而依据每次第一鉴权要素的不同点而调用不同的哈希函数为目标哈希函数。具体实现如下：
该多态哈希函数接口表示如下：
Class IHash
{
virtual char*CalcHashData(char*pData)＝0；
}
其中，定义有哈希函数的基类，哈希函数的基类中定义了一个抽象接口CalcHashData。然后定义具体不同的哈希函数类来实现这个抽象接口CalcHashData，从而实现多态哈希函数接口的多态性。
具体的，第一鉴权要素可以为目标房间的房间ID。第一鉴权要素也可以为其他与目标房间或客户端相关的标识信息，比如，客户端当前的IP地址、客户端的设备唯一ID，客户端本次登陆直播平台时从视频流服务器所获取令牌。
下面，给出以第一鉴权要素为目标房间的房间ID为例的实施例，从而依据所进入房间的房间ID的不同来创建不同的哈希算法实例，避免使用单一计算HASH值的算法，从而提高其分析的难度。
在本实施例中，S102包括如下步骤：S1021～S1022。
S1021、根据目标房间的房间ID判断出目标房间的房间号类别，其中，客户端中存在P个房间号类别与N个哈希函数之间的对应关系，P为大于1的整数。
在本实施例中，P个房间号类别与N个哈希函数之间的对应关系，可以为一一对应关系，也可以为多对一的对应关系：即多种房间号类别对应一个哈希函数。
在一具体实施方式中，设置有2个房间号类别：偶数房间号与奇数房间号，对应两个哈希函数。比如：偶数房间号对应一种哈希函数，奇数房间号对应另一种哈希函数。
在一具体实施方式中，设置有10个房间号类别，以房间号末尾为区别：末位为“0，1，2，3，4”的房间号对应一种哈希函数，末尾为“5，6，7，8，9”的房间号对应另一种哈希函数。
S1022、根据P个房间号类别与N个哈希函数之间的对应关系，将目标房间的房间ID所属的房间号类别对应的哈希函数，判断为目标哈希函数。
在一实施例中，S102具体为：判断目标房间的房间ID的奇偶性；如果判断出目标房间的房间ID为偶数，将MD5函数判断为目标哈希函数，基于MD5 类实例化多态哈希函数接口；如果判断出目标房间的房间ID为奇数，将CRC32函数判断为目标哈希函数，基于CRC32类实例化多态哈希函数接口。
针对如上设置有2个房间号类别：偶数房间号与奇数房间号，本实施例给出S102的一种具体实施方式为：当Roomid％2＝＝0，即表征房间ID(Roomid)为偶数，则IHash*pHashFunc＝new MD5，使用MD5类来实例化多态哈希函数接口，使得后续会调用MD5函数来计算各个鉴权要素的HASH值。当Roomid％2＝＝1，即是Roomid为奇数时，则IHash*pHashFunc＝new CRC32；使用CRC32类来实例化多态哈希函数接口，使得后续计算会调用CRC32函数来计算HASH值。
S103、调用目标哈希函数，以计算出与M个鉴权要素对应的HASH值。
在S103中，通过哈希值计算接口来提供对传入的M个鉴权要素进行HASH值的计算方法，具体实现如下：
Char*CalcHash(IHash*pHashFunc，char*pData)；
{
Return pHashFunc-＞CalcHashData(pData)；
}
传入的参数char*pData是具体要计算HASH值的鉴权要素，传入的参数IHash*pHashFunc是传入的哈希函数的基类的指针，指向S102中确定的目标哈希函数，而不是只实现一种哈希函数来对传入的数据计算Hash值。从而，在本步骤中具体调用的哈希函数是不确定，只有程序运行时，通过传入的指针才能具体知道是调用的哪一个哈希函数，从而实现了将视频流地址的鉴权过程的哈希值计算拆分成多个虚函数去实现。
例如，如果pHashFunc是类Md5的对象，则具体调用Md5函数，而如果 pHashFunc是类Crc32的对象，则调用的则Crc32函数。因此，其在逆向静态分析其代码时，是无法确定哈希值计算接口CalcHash中pHashFunc-＞CalcHashData调用的具体函数。同时，即使是在逆向动态调试时，也会由于具体的pHashFunc所属对象的不同而调用的具体函数是不同的，增加了调试的复杂度。
具体的，如果S102中确定的目标哈希函数为MD5函数，则使用MD5函数来实现此多态哈希函数接口，通过MD5函数计算出Hash值，实现方法如下：
Class Md5：public IHash
{
char*CalcHashData(char*pData)
{
MD5Result＝MD5.create(pData)；
Return MD5Result；
}
}
其中，MD5函数来实现此多态哈希函数接口中，定义了一个Md5类继承于基类IHash，并实现抽象接口CalcHashData，具体实现则是使用MD5函数来对M个鉴权要素进行计算出HASH值，pData为需要加密的数据指针。
如果S102中确定的目标哈希函数为CRC32函数，则使用CRC32函数来实现多态哈希函数接口，通过CRC32函数计算出Hash值，实现方法如下：
Class Crc32：public IHash
{
char*CalcHashData(char*pData)
{
Crc32Result＝crc32.create(pData)；
Return Crc32Result；
}
}
其中，CRC32函数来实现多态希函数接口中，定义了一个Crc32类继承于基类IHash，并实现抽象接口CalcHashData，具体实现则是使用Crc32函数计算出M个鉴权要素的HASH值，pData为需要计算哈希值的数据。
同样，还可以确定出目标哈希函数为SHA-1等其他的哈希函数，基于哈希函数接口的多态性，实现了计算的HASH值很难被逆向调试分析，为了说明书的简洁，此处不再对其他的哈希函数如SHA-1如何实现多台哈希函数进行一一举例。
S104、通过多态加密函数接口，从K个加密函数中确定出与M个鉴权要素中第二鉴权要素匹配的目标加密函数，K为大于1的整数。
在步骤S104的具体实施流程中，设置有多态加密函数接口，从而依据每次第二鉴权要素的不同点而调用不同的加密函数。
该多态加密函数接口表示如下：
Class IEncode
{
virtual void EncodeData(char*pData，char*Key)＝0；
}
其中，该多态加密函数接口中定义有一个加密函数的基类，该基类中定义了一个抽象接口EncodeData。定义不同的加密函数类来实现这个抽象接口EncodeData。
具体的，第二鉴权要素可以为客户端本次登陆直播平台时，从视频流服务器所获取令牌。第二鉴权要素也可以为其他与目标房间或客户端相关的标识信息，比如，客户端当前的IP地址、客户端的设备唯一ID，目标房间的房间ID。
下面，给出以第二鉴权要素为从视频流服务器所获取令牌为例的实施例，从而依据所获取令牌不同来创建不同的加密算法实例，避免使用单一的加密函数，从而提高其分析的难度。
在本实施例中，S104包括如下步骤：S1041～S1042：
S1041、判断出客户端登陆直播视频所在的直播平台的令牌类别，其中，客户端中存在Q个令牌类别与K个加密函数之间的对应关系。
在本实施例中，Q个令牌类别与N个Q个加密函数之间的对应关系，具体可以为一一对应关系，也可以为多对一的对应关系：即多种房间号对应一个加密函数。
在一举例的实施方式中，设置有2个令牌类别：最高位为不为0与最高位为为0，对应两个加密函数：Token最高位为不为0的令牌对应一种加密函数，Token最高位为0对应另一种加密函数。
S1042、根据Q个令牌类别与K个加密函数之间的对应关系，将令牌类别所匹配的加密函数，判断为目标加密函数。
在一实施例中，S104具体为：识别出客户端登陆直播平台时，从视频流服务器所获取令牌的最高位；如果令牌的最高位为0，基于AES类实例化多态加密函数接口，否则，基于TEA类实例化多态加密函数接口。
具体的，当Token的最高位为0时，IEncode*pEncodeFunc＝new AES，表示使用AES类实例化多态加密函数接口，使得后续调用AES函数来执行加密；而相反的，如果Token的最高位为不为0，则IEncode*pEncodeFunc＝new TEA，表示使用TEA类实例化加密函数接口，使得后续调用TEA函数来执行加密。
S105、调用目标加密函数，基于视频流服务器下发的随机密钥对HASH值加密，以得到视频流地址鉴权值。
在S105中，会调用到加密计算接口(EncodeData)来对S103计算出的哈希值进行加密。那么编写加密计算接口以对外提供加密计算的方法，具体实现如下：
Char*EncodeData(IEncode*pEncodeFunc，char*pData，char*pKey)；
{
pEncodeFunc-＞EncodeData(pData，pKey)；
}
其中，EncodeData接口来提供对传入的哈希值进行加密，其中，传入的参数char*pData为要加密的哈希值。
其中，传入的参数IEncode*pEncodeFunc是传入的加密算法的基类的指针，在此函数中具体调用的pEncodeFunc-＞EncodeData是不确定具体会调用到哪一个加密函数的代码，只有程序运行时，通过pEncodeFunc是哪一个加密类的指针才能具体知道是调用的哪一个加密函数，从而实现了将加密计算拆分成多个虚函数去实现。
具体来讲，如果pEncodeFunc是AES类的对象，那么pEncodeFunc-＞EncodeData调用的是类AES中的加密函数：AES函数，而如果pEncodeFunc是类TEA的对象，则pEncodeFunc-＞EncodeData调用是类TEA中的加密函数：TEA函数。因此，在逆向静态分析其代码时，是无法确定接口EncodeData中pEncodeFunc-＞EncodeData调用的具体加密函数。同时，即使是在逆向动态调试时，也会由于具体的pEncodeFunc所属对象的不同而调用的具体加密函数是不同的，增加了调试的复杂度。
具体的，如果S105中确定的目标加密函数为AES函数，在基于AES类实例化多态加密函数接口之后，在S105中调用AES函数来实现此多态加密函数接口，从而调用该AES函数对S103计算出的哈希值进行加密，实现方法如下：
Class TEA：public IEncode
{
void EncodeData(char*pData，char*Key)
{
TEA.encode(pData，Key)；
}
}
其中，AES函数来实现此多态加密函数接口中，定义了一个AES类继承于加密函数的基类IEncode，并实现抽象接口EncodeData，具体实现则是使用AES函数来对S102计算出的哈希值加密，pData为需要加密的数据。
同样的方式还可以实现DES等其他加密函数，在此不进行一一举例说明。
需要说明的是，随机密钥是视频流服务器下发的用于加密客户端需要向视频流服务上报的数据的随机数。
S106、向视频流服务器发送携带有视频流地址鉴权值和M个鉴权要素的视频流地址请求，视频流地址请求用于从视频流服务器请求目标房间的直播视频的视频流地址。
将数据计算结果(视频流地址鉴权值)和M个鉴权要素携带在请求中并上报到视频流服务器，视频流服务器也会基于上报的M个鉴权要素，基于与客户端中相同的技术手段计算服务器侧的视频流地址鉴权值。视频流服务器将自身计算的视频流地址鉴权值与客户端上报的视频流地址鉴权值进行比较，如果比较结果为不一致，则表明该客户端是一个伪造的客户端，则拒绝该客户端 的请求，如果比较结果为一致，则客户端接收到视频流服务器下发的视频流地址，使客户端基于视频流地址播放目标房间的视频直播。
基于同一发明构思，本发明实施例提供了一种视频流地址鉴权装置，应用于直播平台对应的客户端，参考图2所示，所述视频流地址鉴权装置包括：
读取单元201，用于如果接收到对所述直播平台上的目标房间的直播视频观看指令，读取M个鉴权要素，所述鉴权要素与所述客户端当前的状态或所述目标房间相关，M为正整数；
第一确定单元202，用于通过多态哈希函数接口，从N个哈希函数中确定出与所述M个鉴权要素中第一鉴权要素匹配的目标哈希函数，N为大于1的整数；
哈希值计算单元203，用于调用所述目标哈希函数，以计算出与所述M个鉴权要素对应的哈希值；
第二确定单元204，用于通过多态加密函数接口，从K个加密函数中确定出与所述M个鉴权要素中第二鉴权要素匹配的目标加密函数，K为大于1的整数；
加密计算单元205，用于调用所述目标加密函数，以基于视频流服务器下发的随机密钥对所述哈希值加密，以得到视频流地址鉴权值；
请求发送单元206，用于向所述视频流服务器发送携带有所述视频流地址鉴权值和所述M个鉴权要素的视频流地址请求，所述视频流地址请求用于从所述视频流服务器请求所述目标房间的直播视频的视频流地址。
可选的，所述读取单元201，具体用于：
读取所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌；和；
读取所述客户端当前的系统时间；和
读取所述目标房间的房间ID；和
读取所述客户端当前的IP地址；和
读取所述客户端的设备唯一ID。
可选的，如果所述第一鉴权要素为所述目标房间的房间ID，所述哈希值计算单元203包括：
房间号类型判断子单元，用于根据所述目标房间的房间ID判断出所述目标房间的房间号类别，其中，存在P个房间号类别与所述N个哈希函数之间的对应关系，P为大于1的整数；
第一判断子单元，用于根据所述P个房间号类别与所述N个哈希函数之间的对应关系，将所述目标房间的房间ID所属的房间号类别对应的哈希函数，判断为所述目标哈希函数。
可选的，如果所述第一鉴权要素为所述目标房间的房间ID，所述哈希值计算单元203包括：
房间号奇偶性判断子单元，用于判断所述目标房间的房间ID的奇偶性；
第一实例化子单元，用于如果判断出所述目标房间的房间ID为偶数，基于MD5类实例化所述多态哈希函数接口；
第二实例化子单元，用于如果判断出所述目标房间的房间ID为奇数，基于CRC32类实例化所述多态哈希函数接口。
可选的，如果所述第二鉴权要素为所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌，所述第二确定单元204，包括：
令牌类别获取子单元，用于判断出本次登陆所述直播平台时从所述视频流服务器所获取令牌的令牌类别，其中，存在Q个令牌类别与所述K个加密函数之间的对应关系，Q为大于1的整数；
第二判断子单元，用于根据所述Q个令牌类别与所述K个加密函数之间的对应关系，将本次登陆所述直播平台时从所述视频流服务器所获取令牌的令牌类别所匹配的加密函数，判断为目标加密函数。
可选的，如果所述第二鉴权要素为所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌，所述第二确定单元204，包括：
高位识别子单元，用于识别出所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌的最高位；
第三实例化子单元，用于如果所述令牌的最高位为0，基于AES类实例化所述多态加密函数接口，否则，基于TEA类实例化所述多态加密函数接口。
可选的，所述加密计算单元205，具体用于：
将所述客户端本次登陆所述直播平台时从所述视频流服务器所获取令牌、所述客户端当前的系统时间、所述目标房间的房间ID、所述客户端当前的IP地址、以及所述客户端的设备唯一ID依次经过所述目标哈希函数处理，以得出各个鉴权要素对应的哈希值。
基于同一发明构思，本发明实施例提供了一种计算机可读存储介质301，参考图3所示，其上存储有计算机程序302，该程序302被处理器执行时实现前述视频流地址鉴权方法实施例中任一个实施例所述的步骤。
基于同一发明构思，本发明实施例提供了一种计算机设备400，参考图4所示，包括存储器410、处理器430及存储在存储器410上并可在处理器430上运行的计算机程序420，所述处理器430执行所述程序420时实现前述视频流地址鉴权方法实施例中任一个实施例所述的步骤。
由于上述所介绍的装置、存储介质及计算机设备为实施本发明实施例中视频流地址鉴权方法所采用，故而基于本发明实施例中所介绍的前述视频流地址鉴权方法，本领域所属技术人员能够了解装置、存储介质及计算机设备的具体实施方式以及其各种变化形式，所以在此对于装置、存储介质及计算机设备如何实现本发明实施例中的视频流地址鉴权方法不再详细介绍。只要本领域所属技术人员实施本发明实施例中视频流地址鉴权方法所采用的装置、存储介质及计算机，都属于本发明所欲保护的范围。
上述实施例中的技术方案，至少具有如下的技术效果或优点：
设置了多态哈希函数接口和多态加密函数接口，调用与M个鉴权要素中第一鉴权要素匹配的目标哈希函数，以计算M个鉴权要素的哈希值；调用与M个鉴权要素中第二鉴权要素匹配的目标哈希函数，以基于视频流服务器下发的随机密钥对M个鉴权要素的哈希值加密，以得到给视频流服务器的视频流地址鉴权值。从而在不同鉴权要素下会使用不同的哈希函数来计算HASH值和使用不同的加密算法来进行对HASH值的加密。从而，在逆向静态分析其代码时，是无法确定多态的函数接口具体调用的函数。在逆向动态调试时，也会增加调试的复杂度。从而进一步加强了视频流鉴权值得安全性。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (10)

  1. 一种视频流地址鉴权方法，应用于直播平台对应的客户端，其特征在于，所述方法包括：
    如果接收到对所述直播平台上的目标房间的直播视频观看指令，读取M个鉴权要素，所述鉴权要素与所述客户端当前的状态或所述目标房间相关，M为正整数；
    通过多态哈希函数接口，从N个哈希函数中确定出与所述M个鉴权要素中第一鉴权要素匹配的目标哈希函数，N为大于1的整数；
    调用所述目标哈希函数，以计算出与所述M个鉴权要素对应的哈希值；
    通过多态加密函数接口，从K个加密函数中确定出与所述M个鉴权要素中第二鉴权要素匹配的目标加密函数，K为大于1的整数；
    调用所述目标加密函数，以基于视频流服务器下发的随机密钥对所述哈希值加密，以得到视频流地址鉴权值；
    向所述视频流服务器发送携带有所述视频流地址鉴权值和所述M个鉴权要素的视频流地址请求，所述视频流地址请求用于从所述视频流服务器请求所述目标房间的直播视频的视频流地址。
  2. 如权利要求1所述的视频流地址鉴权方法，其特征在于，所述读取M个鉴权要素，包括：
    读取所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌；和
    读取所述客户端当前的系统时间；和
    读取所述目标房间的房间ID；和
    读取所述客户端当前的IP地址；和
    读取所述客户端的设备唯一ID；和。
  3. 如权利要求2所述的视频流地址鉴权方法，其特征在于，如果所述第一鉴权要素为所述目标房间的房间ID，所述从N个哈希函数中确定出与所述M个鉴权要素中第一鉴权要素匹配的目标哈希函数，包括：
    根据所述目标房间的房间ID判断出所述目标房间的房间号类别，其中，存在P个房间号类别与所述N个哈希函数之间的对应关系，P为大于1的整数；
    根据所述P个房间号类别与所述N个哈希函数之间的对应关系，将所述目标房间的房间ID所属的房间号类别对应的哈希函数，判断为所述目标哈希函数。
  4. 如权利要求2所述的视频流地址鉴权方法，其特征在于，如果所述第一鉴权要素为所述目标房间的房间ID，所述从N个哈希函数中确定出与所述M个鉴权要素中第一鉴权要素匹配的目标哈希函数，包括：
    判断所述目标房间的房间ID的奇偶性；
    如果判断出所述目标房间的房间ID为偶数，基于MD5类实例化所述多态哈希函数接口；
    如果判断出所述目标房间的房间ID为奇数，基于CRC32类实例化所述多态哈希函数接口。
  5. 如权利要求2所述的视频流地址鉴权方法，其特征在于，如果所述第二鉴权要素为所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌，所述从K个加密函数中确定出与所述M个鉴权要素中第二鉴权要素匹配的目标加密函数，包括：
    判断出本次登陆所述直播平台时从所述视频流服务器所获取令牌的令牌类别，其中，存在Q个令牌类别与所述K个加密函数之间的对应关系，Q为大于1的整数；
    根据所述Q个令牌类别与所述K个加密函数之间的对应关系，将本次登陆所述直播平台时从所述视频流服务器所获取令牌的令牌类别所匹配的加密函数，判断为目标加密函数。
  6. 如权利要求2所述的视频流地址鉴权方法，其特征在于，如果所述第二鉴权要素为所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌，所述从K个加密函数中确定出与所述M个鉴权要素中第二鉴权要素匹配的目标加密函数，包括：
    识别出所述客户端本次登陆所述直播平台时，从所述视频流服务器所获取令牌的最高位；
    如果所述令牌的最高位为0，基于AES类实例化所述多态加密函数接口，否则，基于TEA类实例化所述多态加密函数接口。
  7. 如权利要求2所述的视频流地址鉴权方法，其特征在于，所述调用所述目标哈希函数，以计算出与所述M个鉴权要素对应的哈希值，包括：
    将所述客户端本次登陆所述直播平台时从所述视频流服务器所获取令牌、所述客户端当前的系统时间、所述目标房间的房间ID、所述客户端当前的IP地址、以及所述客户端的设备唯一ID依次经过所述目标哈希函数处理，以得出各个鉴权要素对应的哈希值。
  8. 一种视频流地址鉴权装置，应用于直播平台对应的客户端，所述装置包括：
    读取单元，用于如果接收到对所述直播平台上的目标房间的直播视频观看指令，读取M个鉴权要素，所述鉴权要素与所述客户端当前的状态或所述目标房间相关，M为正整数；
    第一确定单元，用于通过多态哈希函数接口，从N个哈希函数中确定出与所述M个鉴权要素中第一鉴权要素匹配的目标哈希函数，N为大于1的整数；
    哈希值计算单元，用于调用所述目标哈希函数，以计算出与所述M个鉴权要素对应的哈希值；
    第二确定单元，用于通过多态加密函数接口，从K个加密函数中确定出与所述M个鉴权要素中第二鉴权要素匹配的目标加密函数，K为大于1的整数；
    加密计算单元，用于调用所述目标加密函数，以基于视频流服务器下发的随机密钥对所述哈希值加密，以得到视频流地址鉴权值；
    请求发送单元，用于向所述视频流服务器发送携带有所述视频流地址鉴权值和所述M个鉴权要素的视频流地址请求，所述视频流地址请求用于从所述视频流服务器请求所述目标房间的直播视频的视频流地址。
  9. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，该程序被处理器执行时实现权利要求1-7中任一项所述的步骤。
  10. 一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，其特征在于，所述处理器执行所述程序时实现权利要求1-7中任一项所述的步骤。
PCT/CN2018/082509 2017-06-30 2018-04-10 一种视频流地址鉴权方法及装置 WO2019001083A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710525697.8A CN107465660B (zh) 2017-06-30 2017-06-30 一种视频流地址鉴权方法及装置
CN201710525697.8 2017-06-30

Publications (1)

Publication Number Publication Date
WO2019001083A1 true WO2019001083A1 (zh) 2019-01-03

Family

ID=60546470

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/082509 WO2019001083A1 (zh) 2017-06-30 2018-04-10 一种视频流地址鉴权方法及装置

Country Status (2)

Country Link
CN (1) CN107465660B (zh)
WO (1) WO2019001083A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114866799A (zh) * 2022-05-11 2022-08-05 北京奇艺世纪科技有限公司 一种服务器调度方法及装置

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107465660B (zh) * 2017-06-30 2019-11-15 武汉斗鱼网络科技有限公司 一种视频流地址鉴权方法及装置
CN108307211B (zh) * 2018-01-05 2020-02-07 武汉斗鱼网络科技有限公司 一种视频流地址鉴权方法、存储介质、设备及系统
CN108307246B (zh) * 2018-01-09 2020-02-07 武汉斗鱼网络科技有限公司 一种计算直播间人气的方法、存储介质、设备及系统
CN108206961B (zh) * 2018-01-12 2020-02-07 武汉斗鱼网络科技有限公司 一种计算直播平台人气的方法及相关设备
CN109525568B (zh) * 2018-11-02 2021-02-12 广州酷狗计算机科技有限公司 歌曲点播方法及装置
CN113507483B (zh) * 2021-07-27 2023-04-18 平安国际智慧城市科技股份有限公司 即时通讯方法、装置、服务器及存储介质
CN116841750B (zh) * 2023-08-29 2023-12-12 恒辉信达技术有限公司 集成加密算法的边缘计算设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102882830A (zh) * 2011-07-11 2013-01-16 华为终端有限公司 媒体资源访问控制方法和设备
US20130142331A1 (en) * 2011-12-02 2013-06-06 Adobe Systems Incorporated Binding of protected video content to video player with encryption key
US20140304515A1 (en) * 2008-01-30 2014-10-09 Kenneth Edward Feuerman Content integrity and incremental security
CN104602015A (zh) * 2014-12-31 2015-05-06 西安蒜泥电子科技有限责任公司 一种实时视频监控加密认证方法
CN107465660A (zh) * 2017-06-30 2017-12-12 武汉斗鱼网络科技有限公司 一种视频流地址鉴权方法及装置

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100781528B1 (ko) * 2006-06-29 2007-12-03 삼성전자주식회사 무결성을 보장하는 비디오 스트림을 제공하는 장치 및 그방법

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140304515A1 (en) * 2008-01-30 2014-10-09 Kenneth Edward Feuerman Content integrity and incremental security
CN102882830A (zh) * 2011-07-11 2013-01-16 华为终端有限公司 媒体资源访问控制方法和设备
US20130142331A1 (en) * 2011-12-02 2013-06-06 Adobe Systems Incorporated Binding of protected video content to video player with encryption key
CN104602015A (zh) * 2014-12-31 2015-05-06 西安蒜泥电子科技有限责任公司 一种实时视频监控加密认证方法
CN107465660A (zh) * 2017-06-30 2017-12-12 武汉斗鱼网络科技有限公司 一种视频流地址鉴权方法及装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114866799A (zh) * 2022-05-11 2022-08-05 北京奇艺世纪科技有限公司 一种服务器调度方法及装置
CN114866799B (zh) * 2022-05-11 2024-04-05 北京奇艺世纪科技有限公司 一种服务器调度方法及装置

Also Published As

Publication number Publication date
CN107465660A (zh) 2017-12-12
CN107465660B (zh) 2019-11-15

Similar Documents

Publication Publication Date Title
WO2019001083A1 (zh) 一种视频流地址鉴权方法及装置
US20210192551A1 (en) Using hashed media identifiers to determine audience measurement data including demographic data from third party providers
CN110401677B (zh) 数字版权密钥的获取方法、装置、存储介质及电子设备
WO2019134303A1 (zh) 直播间人气处理方法、装置、服务器及存储介质
CN112823503B (zh) 一种数据访问方法、数据访问装置及移动终端
CN110011950B (zh) 一种视频流地址的鉴权方法及装置
WO2019041627A1 (zh) 一种视频流地址检测方法、装置、服务器及计算机可读介质
CN108184146B (zh) 一种计算直播平台人气的方法及相关设备
WO2019001084A1 (zh) 一种视频流地址鉴权方法及装置
CN114338247A (zh) 数据传输方法和装置、电子设备、存储介质和程序产品
CN116938449A (zh) 防止欺诈的计算机实现的方法、存储介质、设备及系统
CN108206961B (zh) 一种计算直播平台人气的方法及相关设备
CN108235067B (zh) 一种视频流地址的鉴权方法及装置
US11695546B2 (en) Decoupled custom event system based on ephemeral tokens for enabling secure custom services on a digital audio stream
WO2018176531A1 (zh) 一种视频请求、视频播放方法及装置
US20230421544A1 (en) Preventing fraud in aggregated network measurements
JP2022522400A (ja) 複数の集約サーバを使用してデータ操作を防止すること
CN114640524B (zh) 用于处理交易重放攻击的方法、装置、设备及介质
CN110012319B (zh) 一种视频流地址的鉴权方法及装置
CN112733166A (zh) license认证授权功能的实现方法及系统
CN114698408A (zh) 多接收方安全通信
KR102562178B1 (ko) 통신 네트워크 측정치의 데이터 조작 방지 및 사용자 프라이버시 보호
CN113824693B (zh) 多媒体数据分享方法、装置、系统、电子设备和存储介质
CN111565178B (zh) 业务信息下发方法、装置、服务器、客户端及存储介质
WO2019136846A1 (zh) 弹幕发送间隔控制方法、存储介质、电子设备及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18823050

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18823050

Country of ref document: EP

Kind code of ref document: A1