WO2020093212A1 - 一种视频数据传输系统、方法及装置 - Google Patents

一种视频数据传输系统、方法及装置 Download PDF

Info

Publication number
WO2020093212A1
WO2020093212A1 PCT/CN2018/114012 CN2018114012W WO2020093212A1 WO 2020093212 A1 WO2020093212 A1 WO 2020093212A1 CN 2018114012 W CN2018114012 W CN 2018114012W WO 2020093212 A1 WO2020093212 A1 WO 2020093212A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
nvr
ipc
master station
random number
Prior art date
Application number
PCT/CN2018/114012
Other languages
English (en)
French (fr)
Inventor
刘鹏
刘松
杨顺
陈浩
王晓耘
Original Assignee
华北电力大学扬中智能电气研究中心
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华北电力大学扬中智能电气研究中心 filed Critical 华北电力大学扬中智能电气研究中心
Priority to PCT/CN2018/114012 priority Critical patent/WO2020093212A1/zh
Priority to JP2021523603A priority patent/JP7208383B2/ja
Publication of WO2020093212A1 publication Critical patent/WO2020093212A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N7/00—Television systems
    • H04N7/18—Closed-circuit television [CCTV] systems, i.e. systems in which the video signal is not broadcast

Definitions

  • the invention mainly relates to the technical field of network security, in particular to a video data transmission system, method and device.
  • Video conferencing is widely used for its fast and real-time characteristics.
  • these video services are vulnerable to man-made attacks in open network environments, such as data interception, information theft, data tampering, and data addition.
  • the security requirements for video content are higher. How to ensure the security of content is one of the current research focuses in the multimedia field.
  • the first method is to use authentication or permission division for users to prevent illegal users from accessing the stored video.
  • a special security channel is often used to ensure the security of video transmission.
  • this method has certain shortcomings. For example, if the authentication process is too strict, or the permission division is too complicated, it will reduce the user's convenience and greatly reduce the user experience. Being attacked, and the establishment of a special secure channel is mostly suitable for local area networks, with unity, for the wide area network, the establishment of a dedicated secure channel is complex and not feasible.
  • the second is to directly encrypt the video content itself. Treat the video as ordinary text, encrypt all the video files stored locally, or send the video data to the encryption module through the bus to encrypt all the videos. This method makes too much encrypted data, the video user experience is reduced, and it is difficult to encrypt the transmitted video.
  • Embodiments of the present invention provide a video data transmission system, method, and device to solve the problem of low security performance of video data transmission in the prior art.
  • An embodiment of the present invention provides a video data transmission system.
  • the system includes a network hard disk recorder NVR, a master station, and at least one network camera IPC, where:
  • the IPC is used to receive a control command sent by the NVR. If the control command is to control the IPC to collect video data, the IPC collects the video data and uses the saved first key to perform the video data Encrypt, send the encrypted video data to NVR;
  • the NVR is used to send a control command to the IPC, receive the encrypted video data sent by the IPC, send a request to obtain a first key to the master station, receive the encrypted first key sent by the master station, and save it by itself
  • the second key decrypts the encrypted first key to obtain the first key, and uses the first key to decrypt the encrypted video data;
  • the master station is used to receive a request sent by the NVR to obtain the first key, use the second key of the NVR to encrypt the first key of the IPC held by itself, and send the encrypted first key to NVR.
  • the NVR is used for encrypting the control command to be transmitted using the second key saved by itself, and sending the encrypted control command to the master station, and receiving the control command encrypted by the first key sent by the master station , Send the control command encrypted with the first key to the IPC;
  • the master station is configured to receive the encrypted control command sent by the NVR, use the second key of the NVR saved by itself to decrypt the encrypted control command, and use the first password of the IPC saved by itself The key encrypts the decrypted control command and sends it to the NVR;
  • the IPC is used to receive the control command encrypted with the first key.
  • the master station is further configured to receive the first serial number of the first embedded security control chip ESAM built in the IPC sent by the IPC, and generate the first serial number according to the first serial number and the preset first algorithm Two random numbers and first verification information, send the second random number to the IPC; receive the second verification information sent by the IPC, determine whether the first verification information and the second verification information are consistent, if they are consistent , Sending the first prompt message that the authentication is passed to the IPC;
  • the IPC is also used to send the first serial number of the first ESAM built in the IPC to the master station, receive the second random number sent by the master station, and according to the second random number and the preset second
  • the algorithm generates second verification information, sends the second verification information to the master station, and receives the first prompt information sent by the master station.
  • the IPC is also used to generate a first random number using the first ESAM according to the first prompt information, and generate a first key according to the first random number and the first serial number and Save; send its own identification information, the first random number and the first serial number to the master station;
  • the master station is further configured to receive the IPC identification information, the first random number, and the first serial number sent by the IPC, and generate the IPC number of the identification information according to the first random number and the first serial number One key and save it.
  • the master station is further configured to receive the second serial number of the second ESAM built in the NVR sent by the NVR, and generate a third random number and a third random number according to the second serial number and a preset first algorithm Three verification information, sending the third random number to the NVR; receiving the fourth verification information sent by the NVR, judging whether the third verification information and the fourth verification information are consistent, if they are consistent, to the NVR Send the second prompt message of passing authentication;
  • the NVR is also used to send the second sequence number of the second ESAM built in the NVR to the master station, receive the third random number sent by the master station, and according to the third random number and the preset second
  • the algorithm generates fourth verification information, sends the fourth verification information to the master station, and receives second prompt information sent by the master station.
  • the NVR is also used to generate a fourth random number using the second ESAM according to the second prompt information, and generate a second key according to the fourth random number and the second serial number and Save; send its own identification information, the fourth random number and the second serial number to the master station;
  • the master station is further configured to receive the identification information of the NVR, the fourth random number, and the second serial number sent by the NVR, and generate the first NVR of the identification information according to the fourth random number and the second serial number. Save the second key.
  • An embodiment of the present invention provides a video data transmission method, which is applied to IPC.
  • the method includes:
  • control command is to control the IPC to collect video data
  • the IPC collects video data
  • the stored first key is used to encrypt the video data, and the encrypted video data is sent to the NVR.
  • the process of saving the first key includes:
  • a first random number is generated using the first ESAM built in itself, and a first key is generated and saved according to the first random number and the first serial number of the first ESAM;
  • the authentication process of the IPC by the master station includes:
  • the first prompt information is sent when the master station judges that the first verification information and the second verification information are consistent.
  • An embodiment of the present invention provides a video data transmission method, which is applied to an NVR.
  • the method includes:
  • NVR sends control commands to IPC
  • the NVR sending a control command to the IPC includes:
  • the process of saving the second key includes:
  • a second random number built in itself is used to generate a fourth random number, and a second key is generated and saved according to the fourth random number and the second serial number of the second ESAM;
  • the authentication process of the NVR by the master station includes:
  • the second prompt information is sent when the master station judges that the third verification information and the fourth verification information are consistent.
  • An embodiment of the present invention provides a video data transmission method, which is applied to a master station.
  • the method includes:
  • the second key of the NVR is used to encrypt the first key of the IPC saved by itself, and the encrypted first key is sent to the NVR.
  • the method further includes:
  • the method further includes:
  • the method further includes:
  • the method further includes:
  • the method further includes:
  • An embodiment of the present invention provides a video data transmission device, which is applied to an IPC.
  • the device includes:
  • the first receiving module is used to receive control commands sent by the NVR;
  • a collection module configured to collect video data if the control command is to control the IPC to collect video data
  • the first sending module is configured to encrypt the video data by using the saved first key, and send the encrypted video data to the NVR.
  • the device further includes:
  • the first saving module is used to receive the first prompt message sent by the master station to pass the IPC authentication; according to the first prompt message, the first ESAM built in itself is used to generate a first random number, according to the The first random number and the first serial number of the first ESAM generate a first key and save it; and send its own identification information, the first random number and the first serial number to the master station.
  • the device further includes:
  • the first authentication module is used to send the first serial number of the first ESAM built in the IPC to the master station, so that the master station generates a second random number and First verification information; receiving the second random number sent by the master station, generating second verification information according to the second random number and a preset second algorithm; sending the second verification information to the master station, so that the master station Judging whether the first verification information and the second verification information are consistent; receiving the first prompt information sent by the master station, the first prompt information judging the first verification information and the second verification information for the master station Sent when they match.
  • a video data transmission device is applied to an NVR.
  • the device includes:
  • the second sending module is used for the NVR to send control commands to the IPC;
  • the second receiving module is used to receive the encrypted video data sent by the IPC and send a request to obtain the first key to the master station;
  • the first decryption module is used to receive the encrypted first key sent by the master station, and decrypt the encrypted first key by using the second key saved by itself to obtain the first key;
  • the second decryption module is used to decrypt the encrypted video data using the first key.
  • the second sending module is specifically configured to encrypt the control command to be transmitted using the second key saved by itself; send the encrypted control command to the master station, so that the master station uses the The second key of the NVR decrypts the encrypted control command, and uses the first key of the IPC saved by itself to encrypt the decrypted control command; receives the control encrypted by the first key sent by the master station Command to send the control command encrypted with the first key to the IPC.
  • the device further includes:
  • the second saving module is used to receive the second prompt message sent by the master station to pass the NVR authentication; according to the second prompt message, a second random number built in itself is used to generate a fourth random number, according to the fourth The random number and the second serial number of the second ESAM generate a second key and save it; and send its own identification information, the fourth random number and the second serial number to the master station.
  • the device further includes:
  • the second authentication module is used to send the second sequence number of the second ESAM built in the NVR to the main station, so that the main station generates a third random number and Third verification information; receiving the third random number sent by the master station, generating fourth verification information according to the third random number and the preset second algorithm; sending the fourth verification information to the master station, so that the master station Judging whether the third verification information and the fourth verification information are consistent; receiving second prompt information sent by the master station, the second prompt information judging the third verification information and the fourth verification information for the master station Sent when they match.
  • An embodiment of the present invention provides a video data transmission device, which is applied to a master station, and the device includes:
  • a third receiving module configured to receive a request sent by the NVR to obtain the first key
  • the third sending module is configured to use the second key of the NVR to encrypt the first key of the IPC held by itself, and send the encrypted first key to the NVR.
  • the device further includes:
  • the fourth sending module is configured to receive the encrypted control command sent by the NVR, use the second key of the NVR saved by itself to decrypt the encrypted control command, and use the first password of the IPC saved by itself The key encrypts the decrypted control command and sends it to the NVR.
  • the device further includes:
  • a third authentication module configured to receive the first serial number of the first ESAM built in the IPC sent by the IPC, and generate a second random number and first verification information according to the first serial number and a preset first algorithm; Sending the second random number to the IPC, so that the IPC generates second verification information according to the second random number and a preset second algorithm; receiving the second verification information sent by the IPC, and determining Whether the first verification information and the second verification information are consistent; if they are consistent, send a first prompt message that the certification is passed to the IPC.
  • the device further includes:
  • a first generating module configured to receive the IPC identification information, the first random number and the first serial number sent by the IPC, and generate the first IPC of the identification information according to the first random number and the first serial number Key and save.
  • the device further includes:
  • a fourth authentication module configured to receive the second serial number of the second ESAM built in the NVR sent by the NVR, and generate a third random number and third verification information according to the second serial number and a preset first algorithm; Sending the third random number to the NVR, so that the NVR generates fourth verification information according to the third random number and a preset second algorithm; receiving the fourth verification information sent by the NVR, and determining Whether the third verification information and the fourth verification information are consistent; if they are consistent, send a second prompt message that passes the authentication to the NVR.
  • the device further includes:
  • a second generating module configured to receive the NVR identification information, the fourth random number and the second serial number sent by the NVR, and generate the second NVR of the identification information according to the fourth random number and the second serial number Key and save.
  • An embodiment of the present invention provides a video data transmission system, method, and device.
  • the system includes: a network hard disk recorder NVR, a master station, and at least one network camera IPC, where: the IPC is used to receive control commands sent by the NVR If the control command is to control the IPC to collect video data, the IPC collects video data and encrypts the video data using the stored first key, and sends the encrypted video data to the NVR;
  • the NVR is used to send a control command to the IPC, receive the encrypted video data sent by the IPC, send a request to obtain a first key to the master station, receive the encrypted first key sent by the master station, and save it by itself
  • the second key decrypts the encrypted first key to obtain the first key, and uses the first key to decrypt the encrypted video data;
  • the master station is used to receive the NVR
  • the request to obtain the first key uses the second key of the NVR to encrypt the first key of the IPC held by itself, and sends the encrypted first
  • the video to be transmitted is encrypted by IPC using its own first key, and then the encrypted video data is transmitted to the NVR, and the NVR needs to request the master station to obtain the first key to decrypt the video data. , Improve the security of video data transmission.
  • FIG. 1 is a schematic structural diagram of a video data transmission system according to an embodiment of the present invention.
  • FIG. 2 is a schematic diagram of information interaction between devices when an NVR sends a control command to an IPC according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of the process of the NVR and IPC authentication method provided by the master station according to an embodiment of the present invention
  • FIG. 4 is a schematic process diagram of a video data transmission method according to Embodiment 7 of the present invention.
  • FIG. 5 is a schematic process diagram of a video data transmission method according to Embodiment 8 of the present invention.
  • FIG. 6 is a schematic process diagram of a video data transmission method according to Embodiment 9 of the present invention.
  • FIG. 7 is a schematic diagram of data interaction between devices when an IPC provides video data to an NVR according to an embodiment of the present invention
  • FIG. 8 is a schematic structural diagram of a video data transmission device according to Embodiment 10 of the present invention.
  • FIG. 9 is a schematic structural diagram of a video data transmission device according to Embodiment 11 of the present invention.
  • FIG. 10 is a schematic structural diagram of a video data transmission device according to Embodiment 12 of the present invention.
  • FIG. 1 is a schematic structural diagram of a video data transmission system according to an embodiment of the present invention.
  • the system includes: a network hard disk recorder NVR, a master station, and at least one network camera IPC, where:
  • the IPC is used to receive a control command sent by the NVR. If the control command is to control the IPC to collect video data, the IPC collects the video data and uses the saved first key to perform the video data Encrypt, send the encrypted video data to NVR;
  • the NVR is used to send a control command to the IPC, receive the encrypted video data sent by the IPC, send a request to obtain a first key to the master station, receive the encrypted first key sent by the master station, and save it by itself
  • the second key decrypts the encrypted first key to obtain the first key, and uses the first key to decrypt the encrypted video data;
  • the master station is used to receive a request sent by the NVR to obtain the first key, use the second key of the NVR to encrypt the first key of the IPC held by itself, and send the encrypted first key to NVR.
  • both the IPC and the NVR locally store their own keys, and in order to enable the master station to receive the encrypted data For decryption, the key of the IPC and NVR is also stored in the master station.
  • the master station needs to authenticate the NVR and IPC.
  • the NVR and IPC terminals are embedded with ESAM.
  • the ESAM can not only be used for identity authentication, but also has a small size and is suitable for various cameras for installation and communication. Only after the authentication is passed can the data exchange and video data collection and transmission be carried out between the main station, NVR and IPC.
  • the NVR first sends a control command to the IPC.
  • the control command may be a control operation for the IPC, such as controlling the IPC to be turned on and off, controlling the IPC to change the monitoring area, and so on.
  • the IPC receives the control command sent by the NVR, and performs the corresponding operation according to the control command. If the control command is to collect video data in the surveillance area, IPC starts to collect video data, and in order to prevent the video data from being intercepted during transmission and leaking video content, IPC will encrypt the video data to be transmitted. During the encryption process, the IPC uses the first key saved by itself to encrypt the collected video data, and sends the encrypted video data to the NVR for storage and management.
  • the NVR After the NVR receives the encrypted video data, because the video data is encrypted by the IPC using its own first key, the NVR can only decrypt it through the IPC's first key, and the NVR does not save the IPC's The first key, at this time, a request to obtain the first key needs to be sent to the master station.
  • the master station Since the master station stores the keys of each IPC and NVR connected to it, when the master station receives the request for obtaining the first key sent by the NVR, in order to ensure that the key will not be intercepted and obtained by others, it first uses its own The stored second key of the NVR encrypts the first key, and sends the encrypted first key to the NVR.
  • the NVR After receiving the encrypted first key, the NVR decrypts it with the second key saved by itself to obtain the plain text of the first key, and then uses the first key to encrypt the received encrypted key. Decrypt video data.
  • the video to be transmitted is encrypted by using its own first key through IPC, and then the encrypted video data is transmitted to the NVR, and the NVR needs to request the first key to obtain the first key to the video data
  • Decryption improves the security of video data transmission.
  • the NVR is used for encrypting the control command to be transmitted using the second key saved by itself, and sending the encrypted control command to the master station, receiving the control command encrypted by the first key sent by the master station, The control command encrypted with the first key is sent to the IPC;
  • the master station is configured to receive the encrypted control command sent by the NVR, use the second key of the NVR saved by itself to decrypt the encrypted control command, and use the first password of the IPC saved by itself The key encrypts the decrypted control command and sends it to the NVR;
  • the IPC is used to receive the control command encrypted with the first key.
  • the control commands sent by the NVR are encrypted control commands. Because the control command is set for the IPC connected to the NVR, the IPC needs to be decrypted to execute when it receives the control command. Therefore, in order to ensure that the IPC can decrypt the control command with its own first key, the control command should be encrypted by the IPC's first key. Therefore, the NVR needs to first send the control command encrypted with the second key saved by itself to the master station, and the master station uses the first key of the IPC to encrypt the control command.
  • the master station After receiving the control command encrypted with the second key of NVR, the master station decrypts it using the second key saved by itself, and uses the first key of IPC to encrypt the decrypted control command again.
  • the control command encrypted with the first key is sent to the NVR, and the NVR sends the control command to the IPC.
  • FIG. 2 is a schematic diagram of information interaction between devices when the NVR sends a control command to the IPC, including the following steps:
  • Step 1 The NVR receives control commands.
  • the control command is manually input, and may include turning on or off an IPC connected to it, or notifying the IPC to collect video, or notifying the IPC to rotate at an angle to change the monitoring area, and so on.
  • Step 2 The NVR uses the second key saved by itself to encrypt the control command, and sends the encrypted control command to the master station.
  • Step 3 After receiving the encrypted control command, the master station uses the second key of the NVR saved by itself to decrypt it first, and uses the first key of the IPC saved by itself to perform the decrypted control command Encrypt and send to NVR.
  • the NVR when the NVR sends the encrypted control command to the main station, it may carry the identification information of the IPC of the executor of the control command.
  • the main station When the main station receives the control command, it may select the corresponding IPC first password according to the identification information Key, use the selected first key to encrypt the decrypted control command.
  • Step 4 The NVR receives the control command encrypted by the IPC first key, and sends the control command to the IPC.
  • the master station is further configured to receive the first serial number of the first embedded security control chip ESAM embedded in the IPC sent by the IPC, and generate a second random number according to the first serial number and a preset first algorithm And the first verification information, send the second random number to the IPC; receive the second verification information sent by the IPC, determine whether the first verification information and the second verification information are consistent, if they are consistent, submit to The IPC sends the first prompt message that the authentication is passed;
  • the IPC is also used to send the first serial number of the first ESAM built in the IPC to the master station, receive the second random number sent by the master station, and according to the second random number and the preset second
  • the algorithm generates second verification information, sends the second verification information to the master station, and receives the first prompt information sent by the master station.
  • the main station needs to authenticate the IPC that needs to be accessed. Only after the main station passes the authentication of the IPC does the IPC connect Input, video data collection and transmission.
  • an embedded security control chip ESAM is built into each IPC.
  • Each ESAM has a unique serial number, which can represent a unique IPC.
  • IPC first reads the first serial number of its first ESAM and sends the first serial number to the master station. Specifically, IPC can send a request to read the first serial number to the first ESAM. After receiving the request, the first ESAM returns its first serial number to the IPC.
  • the master station After receiving the first serial number, the master station generates a second random number and first verification information using a preset first algorithm according to the first serial number.
  • the preset algorithm may be a symmetric encryption and decryption algorithm, an asymmetric encryption and decryption algorithm, a hash algorithm, etc. included in the national encryption algorithm.
  • a hash algorithm may be used to generate a second random number and first verification information according to the first sequence number
  • the first verification information may be a key generated according to a preset algorithm and the first serial number.
  • the second random number may be an 8-byte random number.
  • the IPC After receiving the second random number, the IPC calculates the second verification information according to the second random number through the first ESAM built in itself. Specifically, a second algorithm corresponding to the first algorithm is also pre-stored in the first ESAM, and the second algorithm can calculate the second verification information by using the received second random number. The IPC sends the second verification information to the master station.
  • the master station After receiving the second verification information sent by the IPC, the master station compares the second verification information with the previously generated first verification information. If they are consistent, it is considered that the IPC has passed the identity authentication and sends the IPC the authentication. The first prompt message.
  • the IPC is authenticated by the master station to ensure that the source of the video data is the location that the user wants to access or monitor.
  • the IPC is also used to generate a first random number using the first ESAM according to the first prompt information, and generate and save a first key according to the first random number and the first serial number; and Send its own identification information, the first random number and the first serial number to the master station;
  • the master station is further configured to receive the IPC identification information, the first random number, and the first serial number sent by the IPC, and generate the IPC number of the identification information according to the first random number and the first serial number. One key and save it.
  • the first ESAM built in itself is used to generate the first key.
  • the first ESAM stores an encryption algorithm in advance, and the encryption algorithm may first generate a first random number according to the first serial number of the first ESAM, and the first random number may be a 4-byte random number. After generating the first random number, according to the first random number and the first serial number, a preset encryption algorithm is used to generate and save the first key.
  • the master station After passing the IPC authentication, the master station will generate the first key of the IPC.
  • the IPC In order to ensure that the key generated by the master station is the first key for the IPC, the IPC first needs to send its own identification information, first random number, and first serial number to the master station, and the master station receives the IPC After the identification information, the first random number, and the first serial number, the first key of the IPC of the identification information is generated and stored according to the first random number and the first serial number.
  • the encryption algorithm stored by the master station needs to correspond to the encryption algorithm of the first ESAM.
  • the master station uses the encryption algorithm to generate the first key of the IPC of the identification information according to the first random number and the first serial number.
  • the identification information is a unique identification of the IPC, for example, it may be the IP address of the IPC.
  • the first key on the IPC end by generating the first key on the IPC end, it is ensured that the video data can be encrypted and transmitted, and the first key of the IPC is also generated correspondingly on the master station, which ensures that after receiving the encrypted video data, It is decrypted by the first key generated by the master station to achieve the purpose of viewing or operation.
  • the master station is further configured to receive the second serial number of the second ESAM built in the NVR sent by the NVR, and generate a third random number and third verification information according to the second serial number and a preset first algorithm , Sending the third random number to the NVR; receiving the fourth verification information sent by the NVR, judging whether the third verification information and the fourth verification information are consistent, and if they are consistent, sending an authentication pass to the NVR The second prompt message;
  • the NVR is also used to send the second sequence number of the second ESAM built in the NVR to the master station, receive the third random number sent by the master station, and according to the third random number and the preset second
  • the algorithm generates fourth verification information, sends the fourth verification information to the master station, and receives second prompt information sent by the master station.
  • the master station In order to prevent the content of video data from being obtained by illegal persons, the master station needs to authenticate the NVR that stores and manages the video data. Only after the master station has authenticated the NVR will the NVR be allowed to access it for video data storage and management .
  • an embedded security control chip ESAM is built into each NVR.
  • Each ESAM has a unique serial number, which can represent a unique NVR.
  • the NVR first reads the second serial number of its second ESAM and sends the second serial number to the master station. Specifically, the NVR can send a request to read the second serial number to the second ESAM, After receiving the request, the second ESAM returns its second serial number to the NVR.
  • the master station After receiving the second serial number, the master station generates a third random number and third verification information using a preset first algorithm according to the second serial number.
  • the preset algorithm may be a symmetric encryption and decryption algorithm, an asymmetric encryption and decryption algorithm, a hash algorithm, etc. included in the national encryption algorithm.
  • a hash algorithm may be used to generate a third random number and third verification information according to the second sequence number
  • the third verification information may be a key generated according to a preset algorithm and a second serial number.
  • the third random number may be an 8-byte random number.
  • the NVR After receiving the third random number, the NVR calculates fourth verification information according to the third random number through the second ESAM built in itself. Specifically, a second algorithm corresponding to the first algorithm is also pre-stored in the second ESAM, and the second algorithm can calculate the fourth verification information by using the received third random number. The NVR sends the fourth verification information to the master station.
  • the master station After receiving the fourth verification information sent by the NVR, the master station compares the fourth verification information with the previously generated third verification information. If they are consistent, it is considered that the identity verification of the NVR has passed, and the verification verification is sent to the NVR. The second prompt message.
  • the identity verification of the NVR is performed by the master station to prevent the content of the video data from being obtained by illegal persons.
  • the NVR is also used to generate a fourth random number by using the second ESAM according to the second prompt information, and generate and save a second key according to the fourth random number and the second serial number; and Send its own identification information, the fourth random number and the second serial number to the master station;
  • the master station is further configured to receive the identification information of the NVR, the fourth random number, and the second serial number sent by the NVR, and generate the first NVR of the identification information according to the fourth random number and the second serial number. Save the second key.
  • the second ESAM built in itself is used to generate the second key.
  • the second ESAM stores an encryption algorithm in advance, and the encryption algorithm may first generate a fourth random number according to the second serial number of the second ESAM, and the fourth random number may also be a 4-byte random number. After generating the fourth random number, according to the fourth random number and the second serial number, a second encryption key is generated and stored using a preset encryption algorithm.
  • the master station After passing the authentication of the NVR, the master station generates a second key of the NVR in order to decrypt the encrypted data sent by the NVR.
  • the NVR first needs to send its own identification information, fourth random number, and second serial number to the master station, and the master station receives the NVR After the identification information, the fourth random number and the second serial number, generate and store the second key of the NVR of the identification information according to the fourth random number and the second serial number.
  • the encryption algorithm stored by the master station needs to correspond to the encryption algorithm of the second ESAM.
  • the master station uses the encryption algorithm to generate the second key of the NVR of the identification information according to the fourth random number and the second serial number.
  • the identification information is a unique identification of the NVR, such as the IP address of the NVR.
  • the same second key is generated by both the NVR and the master station, so that the two can use the encrypted data for interaction when performing data interaction, reducing the risk of interception of interactive data.
  • the process includes the following steps:
  • Step 1 IPC reads the serial number of its own ESAM and sends it to the master station.
  • the same NVR can also be authenticated through this process. Specifically, the NVR also reads its own ESAM serial number and sends its own ESAM serial number to the master station.
  • Step 2 The master station receives the IPC ESAM sequence number, generates a second random number and first verification information according to the sequence number and the preset first algorithm, and sends the random number to the corresponding IPC.
  • the master station may generate the third random number and the third verification information by using the preset first algorithm through the ESAM serial number of the NVR.
  • Step 3 The IPC receives the second random number, uses the preset second algorithm to generate corresponding second verification information according to the second random number, and sends it to the master station.
  • the NVR receives the third random number, generates the fourth verification information according to the third random number and also uses a preset second algorithm, and sends the fourth verification information to the master station.
  • Step 4 The master station receives the second verification information sent by the IPC, compares the second verification information with the first verification information, and if they are consistent, sends the IPC the first prompt message that the IPC certification passes.
  • the master station will also receive the fourth verification information sent by the NVR, and compare the fourth verification information with the third verification information, if the comparison result is consistent, then send the second NVR-certified second to the NVR Prompt information.
  • FIG. 4 is a schematic process diagram of a video data transmission method according to an embodiment of the present invention. The process includes:
  • S403 Use the saved first key to encrypt the video data, and send the encrypted video data to the NVR.
  • the process of saving the first key includes:
  • a first random number is generated using the first ESAM built in itself, and a first key is generated and saved according to the first random number and the first serial number of the first ESAM;
  • the authentication process of the IPC by the master station includes:
  • the first prompt information is sent when the master station judges that the first verification information and the second verification information are consistent.
  • the IPC Based on the video data transmission method shown in FIG. 4, after receiving the control command sent by the NVR, the IPC performs corresponding operations according to the control command. If the control command is to collect video data in the surveillance area, IPC starts to collect video data, and in order to prevent the video data from being intercepted during transmission and leaking video content, IPC will encrypt the video data to be transmitted. During the encryption process, the IPC uses the first key saved by itself to encrypt the collected video data, and sends the encrypted video data to the NVR for storage and management.
  • each IPC when the IPC saves the first key locally, it will first authenticate the IPC through the master station.
  • an embedded security control chip ESAM is built into each IPC.
  • Each ESAM has a unique serial number, which can represent a unique IPC.
  • IPC first reads the first serial number of its first ESAM and sends the first serial number to the master station. Specifically, IPC can send a request to read the first serial number to the first ESAM. After receiving the request, the first ESAM returns its first serial number to the IPC.
  • the master station After receiving the first serial number, the master station generates a second random number and first verification information using a preset first algorithm according to the first serial number, and sends the second random number to the IPC.
  • the IPC calculates the second verification information according to the second random number through the first ESAM built in itself. Specifically, a second algorithm corresponding to the first algorithm is also pre-stored in the first ESAM, and the second algorithm can calculate the second verification information by using the received second random number.
  • the IPC sends the second verification information to the main station, and the main station compares the second verification information with the previously generated first verification information. If they are consistent, the IPC is considered to have passed the identity verification and the IPC will receive The first prompt message to the master station that the IPC certification passed.
  • the first ESAM built in itself is used to generate the first key.
  • the first ESAM stores an encryption algorithm in advance, and the encryption algorithm may first generate a first random number according to the first serial number of the first ESAM, and the first random number may be a 4-byte random number.
  • the first key is used to encrypt the video data to be transmitted to ensure the security of the video data transmission.
  • FIG. 5 is a schematic process diagram of a video data transmission method according to an embodiment of the present invention. The process includes:
  • S502 Receive the encrypted video data sent by the IPC, and send a request to obtain the first key to the master station;
  • S503 Receive the encrypted first key sent by the master station, and decrypt the encrypted first key by using the second key saved by itself to obtain the first key;
  • S504 Use the first key to decrypt the encrypted video data.
  • the NVR sending a control command to the IPC includes:
  • the process of saving the second key includes:
  • a second random number built in itself is used to generate a fourth random number, and a second key is generated and saved according to the fourth random number and the second serial number of the second ESAM;
  • the authentication process of the NVR by the master station includes:
  • the second prompt information is sent when the master station judges that the third verification information and the fourth verification information are consistent.
  • the NVR In order to complete the video data collection, the NVR first sends control commands to the IPC, and in order to prevent the control commands sent by the NVR from being intercepted and modified, so that the wrong IPC is started or video data from non-designated locations is collected, the control commands are encrypted.
  • the control command is set for the IPC connected to the NVR
  • the IPC needs to be decrypted to execute when the control command is received. Therefore, in order to ensure that the IPC can decrypt the control command with its own first key, the control command should be encrypted by the IPC's first key. Therefore, the NVR needs to first send the control command encrypted with the second key saved by itself to the master station, and the master station decrypts it using the second key saved by itself, and uses the first key of IPC to decrypt the decrypted
  • the control command is encrypted again and sent to the NVR.
  • the NVR receives the control command encrypted with the IPC first key and sends it to the IPC.
  • the IPC After receiving the control command, the IPC collects video data, encrypts the video data using its own first key, and sends the encrypted video data to the NVR.
  • the NVR After the NVR receives the encrypted video data, because the video data is encrypted by the IPC using its own first key, the NVR can only decrypt it through the IPC's first key, and the NVR does not save the IPC's The first key, at this time, a request to obtain the first key needs to be sent to the master station.
  • the master station Since the master station stores the keys of each IPC and NVR connected to it, when the master station receives the request for obtaining the first key sent by the NVR, in order to ensure that the key will not be intercepted and obtained by others, it first uses its own The stored second key of the NVR encrypts the first key, and sends the encrypted first key to the NVR.
  • the NVR After receiving the encrypted first key, the NVR decrypts it with the second key saved by itself to obtain the plain text of the first key, and then uses the first key to encrypt the received encrypted key. Decrypt video data.
  • the NVR when the NVR saves the second key locally, it will first authenticate the NVR through the master station.
  • an embedded security control chip ESAM is built into each NVR.
  • Each ESAM has a unique serial number, which can represent a unique NVR.
  • the NVR first reads the second serial number of its second ESAM and sends the second serial number to the master station. Specifically, the NVR can send a request to read the second serial number to the second ESAM, After receiving the request, the second ESAM returns its second serial number to the NVR.
  • the master station After receiving the second serial number, the master station generates a third random number and third verification information using a preset first algorithm according to the second serial number, and sends the third random number to the NVR.
  • the NVR calculates fourth verification information according to the third random number through the second ESAM built in itself. Specifically, a second algorithm corresponding to the first algorithm is also pre-stored in the second ESAM, and the second algorithm can calculate the fourth verification information by using the received third random number.
  • the NVR sends the fourth verification information to the main station, and the main station compares the fourth verification information with the previously generated third verification information. Go to the second prompt message that the NVR has passed the NVR authentication.
  • the second ESAM built in itself is used to generate the second key.
  • the second ESAM stores an encryption algorithm in advance, and the encryption algorithm may first generate a fourth random number according to the second serial number of the second ESAM, and the fourth random number may also be a 4-byte random number.
  • the encryption algorithm may first generate a fourth random number according to the second serial number of the second ESAM, and the fourth random number may also be a 4-byte random number.
  • a second encryption key is generated and stored using a preset encryption algorithm. In the subsequent data interaction, the second key is used to encrypt the data to be transmitted to ensure the security of data transmission.
  • FIG. 6 is a schematic process diagram of a video data transmission method according to an embodiment of the present invention. The process includes:
  • S601 Receive a request sent by the NVR to obtain the first key
  • S602 Use the second key of the NVR to encrypt the first key of the IPC saved by itself, and send the encrypted first key to the NVR.
  • the method further includes:
  • the method further includes:
  • the method further includes:
  • the method further includes:
  • the method further includes:
  • the master station In order to prevent illegal people from accessing the video data transmission system, the master station needs to authenticate the NVR and IPC.
  • the master station when authenticating the IPC, the master station first receives the first serial number of its first ESAM sent by the IPC, and generates a second random number and a first random number according to the first serial number using a preset first algorithm verify message.
  • the preset algorithm may be a symmetric encryption and decryption algorithm, an asymmetric encryption and decryption algorithm, a hash algorithm, etc. included in the national encryption algorithm.
  • a hash algorithm may be used to generate a second random number and first verification information according to the first sequence number
  • the first verification information may be a key generated according to a preset algorithm and the first serial number.
  • the second random number may be an 8-byte random number.
  • the master station receives the second verification information, and compares the second verification information with the previously generated first verification information. If they are consistent, the IPC is considered to have passed the identity authentication, and the IPC is sent a first prompt to pass the authentication information.
  • the master station when authenticating the NVR, the master station first receives the second serial number of its own second ESAM sent by the NVR, and generates a third random number and a third using a preset first algorithm according to the second serial number verify message.
  • the preset algorithm may be a symmetric encryption and decryption algorithm, an asymmetric encryption and decryption algorithm, a hash algorithm, etc. included in the national encryption algorithm.
  • a hash algorithm may be used to generate a third random number and third verification information according to the second sequence number
  • the third verification information may be a key generated according to a preset algorithm and a second serial number.
  • the third random number may be an 8-byte random number.
  • the master station receives the fourth verification information, and compares the fourth verification information with the previously generated third verification information. If they are consistent, it is considered that the identity verification of the NVR is passed, and a second prompt of the verification is sent to the NVR information.
  • the master station After the master station passes the NVR and IPC certification, in order to ensure that the data exchange between the NVR, the master station and the IPC is not obtained by others, the master station will also generate the IPC and NVR keys accordingly.
  • the IPC first needs to send its own identification information, first random number, and first serial number to the master station, and the master station receives After the identification information, the first random number, and the first serial number of the IPC, the first key of the IPC of the identification information is generated and stored according to the first random number and the first serial number.
  • the process of storing the second key of the NVR in the same manner by the master station will not be described in detail.
  • the master station After the master station saves the IPC and NVR keys, it will process the control commands to be transmitted together with the NVR. Specifically, the master station receives the control command encrypted by the NVR second key sent by the NVR, decrypts it using the second key saved by itself, and encrypts the decrypted control command again using the first key of the IPC , The control command encrypted with the first key is sent to the NVR, and the NVR sends the control command to the IPC.
  • the NVR When the NVR needs to decrypt the received encrypted video data, according to the received request for obtaining the first key sent by the NVR, in order to ensure that the key will not be intercepted and obtained by others, the NVR stored by itself is used first. Encrypts the first key and sends the encrypted first key to the NVR.
  • Step 1 The IPC uses the first key stored by itself to encrypt the video data to be transmitted, and sends the encrypted video data to the NVR.
  • Step 2 The NVR receives the encrypted video data and sends a request to obtain the first IPC key to the master station.
  • Step 3 The master station uses the second key of the NVR to encrypt the first key of the IPC, and sends the encrypted first key to the NVR.
  • Step 4 The NVR receives the encrypted first key, decrypts it with its own second key, and decrypts the received video data using the decrypted first key.
  • FIG. 8 is a schematic structural diagram of a video data transmission device according to an embodiment of the present invention.
  • the device includes:
  • the first receiving module 801 is configured to receive the control command sent by the NVR;
  • the collection module 802 is configured to collect video data if the control command is to control the IPC to collect video data;
  • the first sending module 803 is configured to encrypt the video data by using the saved first key, and send the encrypted video data to the NVR.
  • the device further includes:
  • the first saving module 804 is used to receive the first prompt message sent by the master station to pass the IPC authentication; according to the first prompt message, a first random number generated by the built-in first ESAM is used, according to the first A random number and the first serial number of the first ESAM generate a first key and save it; and send its own identification information, the first random number and the first serial number to the master station.
  • the device further includes:
  • the first authentication module 805 is configured to send the first sequence number of the first ESAM built in the IPC to the main station, so that the main station generates a second random number according to the first sequence number and a preset first algorithm And the first verification information; receive the second random number sent by the master station, generate second verification information according to the second random number and a preset second algorithm; send the second verification information to the master station, so that the master The station judges whether the first verification information and the second verification information are consistent; receives the first prompt information sent by the master station, the first prompt information judges the first verification information and the second verification for the master station Sent when the information is consistent.
  • embodiments of the present invention provide a video data transmission device, which is applied to an NVR.
  • 9 is a schematic structural diagram of a video data transmission device according to an embodiment of the present invention.
  • the device includes:
  • the second sending module 901 is used for the NVR to send control commands to the IPC;
  • the second receiving module 902 is configured to receive the encrypted video data sent by the IPC, and send a request for acquiring the first key to the master station;
  • the first decryption module 903 is configured to receive the encrypted first key sent by the master station, and decrypt the encrypted first key by using the second key saved by itself to obtain the first key;
  • the second decryption module 904 is used to decrypt the encrypted video data using the first key.
  • the second sending module 901 is specifically configured to encrypt the control command to be transmitted using the second key saved by itself; send the encrypted control command to the master station, so that the master station uses the The second key of the NVR decrypts the encrypted control command, and encrypts the decrypted control command by using the first key of the IPC stored by itself; The control command sends the control command encrypted with the first key to the IPC.
  • the device further includes:
  • the second saving module 905 is used to receive the second prompt message sent by the master station to pass the NVR authentication; according to the second prompt message, a second random number built in itself is used to generate a fourth random number, The four random numbers and the second serial number of the second ESAM generate a second key and save it; and send its own identification information, the fourth random number and the second serial number to the master station.
  • the device further includes:
  • the second authentication module 906 is configured to send the second sequence number of the second ESAM built in the NVR to the master station, so that the master station generates a third random number according to the second sequence number and a preset first algorithm And third verification information; receive a third random number sent by the master station, generate fourth verification information according to the third random number and a preset second algorithm; send the fourth verification information to the master station, so that the master The station judges whether the third verification information and the fourth verification information are consistent; receives the second prompt information sent by the master station, and the second prompt information judges the third verification information and the fourth verification for the master station Sent when the information is consistent.
  • FIG. 10 is a schematic structural diagram of a video data transmission device according to an embodiment of the present invention.
  • the device includes:
  • the third receiving module 1001 is configured to receive a request sent by the NVR to obtain the first key
  • the third sending module 1002 is configured to use the second key of the NVR to encrypt the first key of the IPC held by itself, and send the encrypted first key to the NVR.
  • the device further includes:
  • the fourth sending module 1003 is configured to receive the encrypted control command sent by the NVR, use the second key of the NVR saved by itself to decrypt the encrypted control command, and use the first IPC saved by itself The key encrypts the decrypted control command and sends it to the NVR.
  • the device further includes:
  • the third authentication module 1004 is configured to receive the first serial number of the first ESAM built in the IPC sent by the IPC, and generate a second random number and first verification information according to the first serial number and a preset first algorithm ; Send the second random number to the IPC, so that the IPC generates second verification information according to the second random number and a preset second algorithm; receive the second verification information sent by the IPC, judge Whether the first verification information and the second verification information are consistent; if they are consistent, send the first prompt message that the certification is passed to the IPC.
  • the device further includes:
  • the first generating module 1005 is configured to receive the IPC identification information, the first random number, and the first serial number sent by the IPC, and generate the IPC third number of the identification information according to the first random number and the first serial number One key and save it.
  • the device further includes:
  • the fourth authentication module 1006 is configured to receive the second serial number of the second ESAM built in the NVR sent by the NVR, and generate a third random number and third verification information according to the second serial number and a preset first algorithm Sending the third random number to the NVR, so that the NVR generates fourth verification information according to the third random number and a preset second algorithm; receiving the fourth verification information sent by the NVR, and determining Whether the third verification information and the fourth verification information are consistent; if they are consistent, send a second prompt message that passes the authentication to the NVR.
  • the device further includes:
  • the second generation module 1007 is configured to receive the identification information, the fourth random number, and the second serial number of the NVR sent by the NVR, and generate the first part of the NVR of the identification information according to the fourth random number and the second serial number. Save the second key.
  • the embodiments of the present invention provide a video data transmission system, method, and device.
  • the system includes: the IPC is used to receive a control command sent by an NVR. If the control command is to control the IPC to perform video data During collection, the IPC collects video data and encrypts the video data using the stored first key, and sends the encrypted video data to the NVR; the NVR is used to send control commands to the IPC and receive IPC
  • the encrypted video data send a request to the master station to obtain the first key, receive the encrypted first key sent by the master station, and use the second key saved by itself to encrypt the encrypted first key Decrypt to obtain the first key, and use the first key to decrypt the encrypted video data; the master station is used to receive the request for obtaining the first key sent by the NVR, and the second key of the NVR is used, Encrypt the first key of the IPC saved by itself, and send the encrypted first key to the NVR.
  • the embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.
  • computer usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can be provided to the processor of a general-purpose computer, special-purpose computer, embedded processing machine, or other programmable data processing device to produce a machine that enables the generation of instructions executed by the processor of the computer or other programmable data processing device
  • These computer program instructions may also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, the instructions The device implements the functions specified in one block or multiple blocks of the flowchart one flow or multiple flows and / or block diagrams.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operating steps are performed on the computer or other programmable device to produce computer-implemented processing, which is executed on the computer or other programmable device
  • the instructions provide steps for implementing the functions specified in one block or multiple blocks of the flowchart one flow or multiple flows and / or block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Multimedia (AREA)
  • Two-Way Televisions, Distribution Of Moving Picture Or The Like (AREA)

Abstract

本发明公开了一种视频数据传输系统、方法及装置，该系统包括：所述IPC用于接收NVR发送的控制命令，如果所述控制命令为控制所述IPC进行视频数据采集时，所述IPC采集视频数据，并采用保存的第一密钥对所述视频数据进行加密，将加密后的视频数据发送给NVR；所述NVR用于向IPC发送控制命令，接收IPC发送的加密后的视频数据，向主站发送获取第一密钥的请求，接收主站发送的加密后的第一密钥，采用自身保存的第二密钥对所述加密后的第一密钥进行解密得到第一密钥，使用所述第一密钥对加密后的视频数据进行解密；所述主站用于接收NVR发送的获取第一密钥的请求，采用NVR的第二密钥，对自身保存的IPC的第一密钥进行加密，将加密后的第一密钥发送给NVR。

Description

一种视频数据传输系统、方法及装置 技术领域
本发明主要涉及网络安全技术领域，尤其涉及一种视频数据传输系统、方法及装置。
背景技术
随着视频编码技术和网络技术的快速发展，视频会议、数字电视、视频聊天、在线影视、视频监控等已经逐渐成为人们日常生活中的一部分。视频会议以其快速实时的特点得到广泛应用，然而，这些视频服务在开放网络环境中很容易受人为的攻击，如数据拦截、信息窃取、数据篡改和数据添加等。而对政府、企业和军事、安防监控等领域，对视频内容的安全要求更高，如何保证内容的安全性是当前多媒体领域研究的重点之一。
目前在解决上述问题的时候，常采用以下技术方案：
第一种，对用户采用认证或者权限划分的方式，防止非法用户访问存储中的视频，在传输方面，多采用建立专门的安全通道保证视频传输的安全性。但是这种方式存在一定的缺陷，例如，如果认证过程过于严格，或者权限划分过于复杂则会降低用户使用的方便性，极大降低用户体验，相反，如果认证比较简单，则容易出现漏洞，从而被攻击，而且建立专门的安全通道多适用于局域网，具有单一性，对于广域网来说，构建专门的安全通道是复杂的，不可行的。
第二种，直接对视频内容本身进行加密。将视频视为普通文本，对存储在本地的视频文件全部加密，或者将视频数据通过总线发送给加密模块，对视频进行全部加密。这种方式使得加密数据太多，视频用户体验降低，而且难以针对传输中的视频进行加密。
因此，如何保证视频数据传输的安全性，提高视频用户体验是一个亟需解决的问题。
发明内容
本发明实施例提供了一种视频数据传输系统、方法及装置，用以解决现有技术中视频数据传输的安全性能低的问题。
本发明实施例提供了一种视频数据传输系统，所述系统包括网络硬盘录像机NVR、主站和至少一个网络摄像机IPC，其中：
所述IPC，用于接收NVR发送的控制命令，如果所述控制命令为控制所述IPC进行视频数据采集时，所述IPC采集视频数据，并采用保存的第一密钥对所述视频数据进行加密，将加密后的视频数据发送给NVR；
所述NVR，用于向IPC发送控制命令，接收IPC发送的加密后的视频数据，向主站发送获取第一密钥的请求，接收主站发送的加密后的第一密钥，采用自身保存的第二密钥对所述加密后的第一密钥进行解密得到第一密钥，使用所述第一密钥对加密后的视频数据进行解密；
所述主站，用于接收NVR发送的获取第一密钥的请求，采用NVR的第二密钥，对自身保存的IPC的第一密钥进行加密，将加密后的第一密钥发送给NVR。
进一步地，所述NVR，用于采用自身保存的第二密钥对待传输的控制命令加密，并将加密后的控制命令发送给主站，接收主站发送的采用第一密钥加密的控制命令，将所述采用第一密钥加密的控制命令发送给IPC；
所述主站，用于接收NVR发送的加密后的控制命令，采用自身保存的所述NVR的第二密钥对所述加密后的控制命令进行解密，并采用自身保存的IPC的第一密钥对解密后的控制命令进行加密，并发送给NVR；
所述IPC，用于接收采用第一密钥加密的控制命令。
进一步地，所述主站，还用于接收IPC发送的所述IPC内置的第一嵌入式安全控制芯片ESAM的第一序列号，根据所述第一序列号及预设的第一算法生成第二随机数和第一验证信息，将所述第二随机数发送给所述IPC；接收所述IPC发送的第二验证信息，判断所述第一验证信息和第二验证信息是否一致，如果一致，向所述IPC发送认证通过的第一提示信息；
所述IPC，还用于向主站发送所述IPC内置的第一ESAM的第一序列号，接收所述主站发送的第二随机数，根据所述第二随机数及预设的第二算法生成第二验证信息，将所述第二验证信息发送给所述主站，接收所述主站发送的第一提示信息。
进一步地，所述IPC，还用于根据所述第一提示信息，采用所述第一ESAM生成第一随机数，根据所述第一随机数及所述第一序列号生成第一密钥并保存；并将自身的标识信息、所述第一随机数和第一序列号发送给主站；
所述主站，还用于接收IPC发送的所述IPC的标识信息、第一随机数和第一序列号，根据所述第一随机数和第一序列号生成所述标识信息的IPC的第一密钥并保存。
进一步地，所述主站，还用于接收NVR发送的所述NVR内置的第二ESAM的第二序列号，根据所述第二序列号及预设的第一算法生成第三随机数和第三验证信息，将所述第三随机数发送给所述NVR；接收所述NVR发送的第四验证信息，判断所述第三验证信息和第四验证信息是否一致，如果一致，向所述NVR发送认证通过的第二提示信息；
所述NVR，还用于向主站发送所述NVR内置的第二ESAM的第二序列号，接收所述主站发送的第三随机数，根据所述第三随机数及预设的第二算法生成第四验证信息，将所述第四验证信息发送给所述主站，接收所述主站发送的第二提示信息。
进一步地，所述NVR，还用于根据所述第二提示信息，采用所述第二ESAM生成第四随机数，根据所述第四随机数及所述第二序列号生成第二密钥并保存；并将自身的标识信息、所述第四随机数和第二序列号发送给主站；
所述主站，还用于接收NVR发送的所述NVR的标识信息、第四随机数和第二序列号，根据所述第四随机数和第二序列号生成所述标识信息的NVR的第二密钥并保存。
本发明实施例提供一种视频数据传输方法，应用于IPC，所述方法包括：
接收NVR发送的控制命令；
如果所述控制命令为控制所述IPC进行视频数据采集时，所述IPC采集视频数据；
采用保存的第一密钥对所述视频数据进行加密，将加密后的视频数据发送给NVR。
进一步地，保存第一密钥的过程包括：
接收主站发送的对所述IPC认证通过的第一提示信息；
根据所述第一提示信息，采用自身内置的第一ESAM生成第一随机数，根据所述第一随机数及第一ESAM的第一序列号生成第一密钥并保存；
并将自身的标识信息、所述第一随机数和第一序列号发送给主站。
进一步地，主站对所述IPC的认证过程包括：
向主站发送所述IPC内置的第一ESAM的第一序列号，使所述主站根据所述第一序列号及预设的第一算法生成第二随机数和第一验证信息；
接收主站发送的第二随机数，根据所述第二随机数及预设的第二算法生成第二验证信息；
将所述第二验证信息发送给主站，使主站判断所述第一验证信息和第二验证信息是否一致；
接收所述主站发送的第一提示信息，所述第一提示信息为主站判断所述第一验证信息和所述第二验证信息一致时发送的。
本发明实施例提供一种视频数据传输方法，应用于NVR，所述方法包括：
NVR向IPC发送控制命令；
接收IPC发送的加密后的视频数据，向主站发送获取第一密钥的请求；
接收主站发送的加密后的第一密钥，采用自身保存的第二密钥对所述加密后的第一密钥进行解密得到第一密钥；
使用所述第一密钥对加密后的视频数据进行解密。
进一步地，所述NVR向IPC发送控制命令包括：
采用自身保存的第二密钥对待传输的控制命令加密；
将加密后的控制命令发送给主站，使所述主站采用自身保存的所述NVR的第二密钥对所述加密后的控制命令进行解密，并采用自身保存的IPC的第一密钥对解密后的控制命 令进行加密；
接收主站发送的采用第一密钥加密的控制命令，将所述采用第一密钥加密的控制命令发送给IPC。
进一步地，保存第二密钥的过程包括：
接收主站发送的对所述NVR认证通过的第二提示信息；
根据所述第二提示信息，采用自身内置的第二ESAM生成第四随机数，根据所述第四随机数及第二ESAM的第二序列号生成第二密钥并保存；
并将自身的标识信息、所述第四随机数和第二序列号发送给主站。
进一步地，主站对所述NVR的认证过程包括：
向主站发送所述NVR内置的第二ESAM的第二序列号，使所述主站根据所述第二序列号及预设的第一算法生成第三随机数和第三验证信息；
接收主站发送的第三随机数，根据所述第三随机数及预设的第二算法生成第四验证信息；
将所述第四验证信息发送给主站，使主站判断所述第三验证信息和第四验证信息是否一致；
接收所述主站发送的第二提示信息，所述第二提示信息为主站判断所述第三验证信息和所述第四验证信息一致时发送的。
本发明实施例提供一种视频数据传输方法，应用于主站，所述方法包括：
接收NVR发送的获取第一密钥的请求；
采用NVR的第二密钥，对自身保存的IPC的第一密钥进行加密，将加密后的第一密钥发送给NVR。
进一步地，所述方法还包括：
接收NVR发送的加密后的控制命令，采用自身保存的所述NVR的第二密钥对所述加密后的控制命令进行解密；
采用自身保存的IPC的第一密钥对解密后的控制命令进行加密，并发送给NVR。
进一步地，所述方法还包括：
接收IPC发送的所述IPC内置的第一ESAM的第一序列号，根据所述第一序列号及预设的第一算法生成第二随机数和第一验证信息；
将所述第二随机数发送给所述IPC，使所述IPC根据所述第二随机数及预设的第二算法生成第二验证信息；
接收所述IPC发送的第二验证信息，判断所述第一验证信息和第二验证信息是否一致；
如果一致，向所述IPC发送认证通过的第一提示信息。
进一步地，所述如果一致，向所述IPC发送认证通过的第一提示信息之后，所述方法 还包括：
接收IPC发送的所述IPC的标识信息、第一随机数和第一序列号，根据所述第一随机数和第一序列号生成所述标识信息的IPC的第一密钥并保存。
进一步地，所述方法还包括：
接收NVR发送的所述NVR内置的第二ESAM的第二序列号，根据所述第二序列号及预设的第一算法生成第三随机数和第三验证信息；
将所述第三随机数发送给所述NVR，使所述NVR根据所述第三随机数及预设的第二算法生成第四验证信息；
接收所述NVR发送的第四验证信息，判断所述第三验证信息和第四验证信息是否一致；
如果一致，向所述NVR发送认证通过的第二提示信息。
进一步地，所述如果一致，向所述NVR发送认证通过的第二提示信息之后，所述方法还包括：
接收NVR发送的所述NVR的标识信息、第四随机数和第二序列号，根据所述第四随机数和第二序列号生成所述标识信息的NVR的第二密钥并保存。
本发明实施例提供一种视频数据传输装置，应用于IPC，所述装置包括：
第一接收模块，用于接收NVR发送的控制命令；
采集模块，用于如果所述控制命令为控制所述IPC进行视频数据采集时，所述IPC采集视频数据；
第一发送模块，用于采用保存的第一密钥对所述视频数据进行加密，将加密后的视频数据发送给NVR。
进一步地，所述装置还包括：
第一保存模块，用于接收主站发送的对所述IPC认证通过的第一提示信息；根据所述第一提示信息，采用所述自身内置的第一ESAM生成第一随机数，根据所述第一随机数及第一ESAM的第一序列号生成第一密钥并保存；并将自身的标识信息、所述第一随机数和第一序列号发送给主站。
进一步地，所述装置还包括：
第一认证模块，用于向主站发送所述IPC内置的第一ESAM的第一序列号，使所述主站根据所述第一序列号及预设的第一算法生成第二随机数和第一验证信息；接收主站发送的第二随机数，根据所述第二随机数及预设的第二算法生成第二验证信息；将所述第二验证信息发送给主站，使主站判断所述第一验证信息和第二验证信息是否一致；接收所述主站发送的第一提示信息，所述第一提示信息为主站判断所述第一验证信息和所述第二验证信息一致时发送的。
本发明实施例一种视频数据传输装置，应用于NVR，所述装置包括：
第二发送模块，用于NVR向IPC发送控制命令；
第二接收模块，用于接收IPC发送的加密后的视频数据，向主站发送获取第一密钥的请求；
第一解密模块，用于接收主站发送的加密后的第一密钥，采用自身保存的第二密钥对所述加密后的第一密钥进行解密得到第一密钥；
第二解密模块，用于使用所述第一密钥对加密后的视频数据进行解密。
进一步地，所述第二发送模块，具体用于采用自身保存的第二密钥对待传输的控制命令加密；将加密后的控制命令发送给主站，使所述主站采用自身保存的所述NVR的第二密钥对所述加密后的控制命令进行解密，并采用自身保存的IPC的第一密钥对解密后的控制命令进行加密；接收主站发送的采用第一密钥加密的控制命令，将所述采用第一密钥加密的控制命令发送给IPC。
进一步地，所述装置还包括：
第二保存模块，用于接收主站发送的对所述NVR认证通过的第二提示信息；根据所述第二提示信息，采用自身内置的第二ESAM生成第四随机数，根据所述第四随机数及第二ESAM的第二序列号生成第二密钥并保存；并将自身的标识信息、所述第四随机数和第二序列号发送给主站。
进一步地，所述装置还包括：
第二认证模块，用于向主站发送所述NVR内置的第二ESAM的第二序列号，使所述主站根据所述第二序列号及预设的第一算法生成第三随机数和第三验证信息；接收主站发送的第三随机数，根据所述第三随机数及预设的第二算法生成第四验证信息；将所述第四验证信息发送给主站，使主站判断所述第三验证信息和第四验证信息是否一致；接收所述主站发送的第二提示信息，所述第二提示信息为主站判断所述第三验证信息和所述第四验证信息一致时发送的。
本发明实施例提供一种视频数据传输装置，应用于主站，所述装置包括：
第三接收模块，用于接收NVR发送的获取第一密钥的请求；
第三发送模块，用于采用NVR的第二密钥，对自身保存的IPC的第一密钥进行加密，将加密后的第一密钥发送给NVR。
进一步地，所述装置还包括：
第四发送模块，用于接收NVR发送的加密后的控制命令，采用自身保存的所述NVR的第二密钥对所述加密后的控制命令进行解密，并采用自身保存的IPC的第一密钥对解密后的控制命令进行加密，并发送给NVR。
进一步地，所述装置还包括：
第三认证模块，用于接收IPC发送的所述IPC内置的第一ESAM的第一序列号，根据所述第一序列号及预设的第一算法生成第二随机数和第一验证信息；将所述第二随机数发送给所述IPC，使所述IPC根据所述第二随机数及预设的第二算法生成第二验证信息；接收所述IPC发送的第二验证信息，判断所述第一验证信息和第二验证信息是否一致；如果一致，向所述IPC发送认证通过的第一提示信息。
进一步地，所述装置还包括：
第一生成模块，用于接收IPC发送的所述IPC的标识信息、第一随机数和第一序列号，根据所述第一随机数和第一序列号生成所述标识信息的IPC的第一密钥并保存。
进一步地，所述装置还包括：
第四认证模块，用于接收NVR发送的所述NVR内置的第二ESAM的第二序列号，根据所述第二序列号及预设的第一算法生成第三随机数和第三验证信息；将所述第三随机数发送给所述NVR，使所述NVR根据所述第三随机数及预设的第二算法生成第四验证信息；接收所述NVR发送的第四验证信息，判断所述第三验证信息和第四验证信息是否一致；如果一致，向所述NVR发送认证通过的第二提示信息。
进一步地，所述装置还包括：
第二生成模块，用于接收NVR发送的所述NVR的标识信息、第四随机数和第二序列号，根据所述第四随机数和第二序列号生成所述标识信息的NVR的第二密钥并保存。
本发明实施例提供了一种视频数据传输系统、方法及装置，所述系统包括：网络硬盘录像机NVR、主站和至少一个网络摄像机IPC，其中：所述IPC，用于接收NVR发送的控制命令，如果所述控制命令为控制所述IPC进行视频数据采集时，所述IPC采集视频数据，并采用保存的第一密钥对所述视频数据进行加密，将加密后的视频数据发送给NVR；所述NVR，用于向IPC发送控制命令，接收IPC发送的加密后的视频数据，向主站发送获取第一密钥的请求，接收主站发送的加密后的第一密钥，采用自身保存的第二密钥对所述加密后的第一密钥进行解密得到第一密钥，使用所述第一密钥对加密后的视频数据进行解密；所述主站，用于接收NVR发送的获取第一密钥的请求，采用NVR的第二密钥，对自身保存的IPC的第一密钥进行加密，将加密后的第一密钥发送给NVR。该系统中，通过IPC采用自身的第一密钥对待传输的视频进行加密，然后将加密后的视频数据传输给NVR，并且NVR需要向主站请求获取第一密钥才能对该视频数据进行解密，提高了视频数据传输的安全性。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的 附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种视频数据传输系统的结构示意图；
图2为本发明实施例提供的NVR向IPC发送控制命令时设备间信息交互的示意图；
图3为本发明实施例提供的主站对NVR和IPC认证方法的过程示意图；
图4为本发明实施例7提供的一种视频数据传输方法的过程示意图；
图5为本发明实施例8提供的一种视频数据传输方法的过程示意图；
图6为本发明实施例9提供的一种视频数据传输方法的过程示意图；
图7为本发明实施例提供的IPC向NVR发送视频数据时设备间进行数据交互的示意图；
图8为本发明实施例10提供的一种视频数据传输装置的结构示意图；
图9为本发明实施例11提供的一种视频数据传输装置的结构示意图；
图10为本发明实施例12提供的一种视频数据传输装置的结构示意图。
具体实施方式
下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
实施例1：
图1为本发明实施例提供的一种视频数据传输系统的结构示意图，该系统包括：网络硬盘录像机NVR、主站和至少一个网络摄像机IPC，其中：
所述IPC，用于接收NVR发送的控制命令，如果所述控制命令为控制所述IPC进行视频数据采集时，所述IPC采集视频数据，并采用保存的第一密钥对所述视频数据进行加密，将加密后的视频数据发送给NVR；
所述NVR，用于向IPC发送控制命令，接收IPC发送的加密后的视频数据，向主站发送获取第一密钥的请求，接收主站发送的加密后的第一密钥，采用自身保存的第二密钥对所述加密后的第一密钥进行解密得到第一密钥，使用所述第一密钥对加密后的视频数据进行解密；
所述主站，用于接收NVR发送的获取第一密钥的请求，采用NVR的第二密钥，对自身保存的IPC的第一密钥进行加密，将加密后的第一密钥发送给NVR。
随着视频编码技术和网络技术的快速发展，视频会议、视频聊天、在线影视等已经成 为人们日常生活中的一部分，而目前这些视频服务在开放的网络环境下容易受人攻击，现有技术在解决此类问题时常对用户采用认证或者权限划分的方式，或者直接对视频内容本身加密，这些方式在实施过程中要么加密效果不好，要么降低用户体验等，均存在一定的问题。
为了解决上述问题，在本发明实施例中，为了保证各设备之间数据交互的安全性，IPC和NVR中均本地保存了自身的密钥，并且为了使主站可以对接收的经过加密的数据进行解密，该主站中也对应保存了该IPC和NVR的密钥。
为了防止非法人员接入该视频数据传输系统，主站需要对NVR和IPC进行身份认证。具体的，NVR和IPC端均嵌入了ESAM，该ESAM不仅可以进行身份认证，而且体积小、适合于各种摄像头进行安装通讯等改进。只有认证通过后，主站、NVR和IPC三者之间才能进行数据交互，进行视频数据采集和传输。
在本发明实施例中，NVR先向IPC发送控制命令，该控制命令可以是对IPC的控制操作，比如控制IPC开启与关闭、控制IPC旋转改变监控区域等。
IPC接收到NVR发送的控制命令，根据该控制命令执行相应的操作。如果该控制命令为对监控区域进行视频数据采集时，IPC开始采集视频数据，并且为了防止视频数据在传输时被截取而泄露视频内容，IPC会对该待传输的视频数据进行加密处理。在加密过程中，IPC使用自身保存的第一密钥，对采集的视频数据进行加密，并将该加密后的视频数据发送给NVR，由NVR来进行存储和管理。
NVR接收到该加密后的视频数据之后，由于该视频数据是IPC使用自身的第一密钥进行加密的，因此NVR只有通过IPC的第一密钥才能解密，而NVR并没有保存有该IPC的第一密钥，此时需要向主站发送获取第一密钥的请求。
由于主站中保存有每个与其连接的IPC和NVR的密钥，主站在接收到该NVR发送的获取第一密钥的请求时，为了保证密钥不会被别人拦截获取，先用自身存储的该NVR的第二密钥对该第一密钥进行加密，将加密后的第一密钥发送给NVR。
NVR接收到该加密后的第一密钥之后，用自身保存的第二密钥对其进行解密，得到该第一密钥的明文，然后通过使用该第一密钥来对接收到的加密的视频数据进行解密。
本发明实施例中，通过IPC采用自身的第一密钥对待传输的视频进行加密，然后将加密后的视频数据传输给NVR，并且NVR需要向主站请求获取第一密钥才能对该视频数据进行解密，提高了视频数据传输的安全性。
实施例2：
为了防止NVR发送的控制命令被截取被修改，从而使得启动错误的IPC或者采集非指定地点的视频数据，在上述实施例的基础上，在本发明实施例中：
所述NVR，用于采用自身保存的第二密钥对待传输的控制命令加密，并将加密后的控 制命令发送给主站，接收主站发送的采用第一密钥加密的控制命令，将所述采用第一密钥加密的控制命令发送给IPC；
所述主站，用于接收NVR发送的加密后的控制命令，采用自身保存的所述NVR的第二密钥对所述加密后的控制命令进行解密，并采用自身保存的IPC的第一密钥对解密后的控制命令进行加密，并发送给NVR；
所述IPC，用于接收采用第一密钥加密的控制命令。
为了防止控制命令在传输的过程中被修改，NVR发送的控制命令为加密后的控制命令。因为该控制命令是针对与该NVR连接的IPC设置的，IPC在接收到该控制命令时需要解密才能执行。所以为了保证IPC能用自身的第一密钥对该控制命令解密，该控制命令应由IPC的第一密钥加密。所以NVR需要先将采用自身保存的第二密钥加密的控制命令发送给主站，由主站采用该IPC的第一密钥对控制命令进行加密。
主站在接收到该采用NVR第二密钥加密的控制命令之后，使用自身保存的第二密钥对其进行解密，并使用IPC的第一密钥对解密后的控制命令进行再次加密，将该采用第一密钥加密的控制命令发送给NVR，由NVR将该控制命令发送给IPC。
具体地，图2为NVR向IPC发送控制命令时设备间信息交互的示意图，包括以下步骤：
步骤1：NVR接收控制命令。
该控制命令为人为输入的，可以包括开启或关闭与其连接的某个IPC，或通知IPC进行视频采集，或通知IPC进行某角度的旋转来改变监控区域等。
步骤2：NVR对该控制命令采用自身保存的第二密钥进行加密，将加密后的控制命令发送给主站。
步骤3：主站接收到该加密后的控制命令后，采用自身保存的该NVR的第二密钥先对其进行解密，并采用自身保存的IPC的第一密钥对解密后的控制命令进行加密，并发送给NVR。
具体的，NVR向主站发送该加密的控制命令时，可以携带该控制命令的执行者IPC的标识信息，当主站接收到该控制命令时，可以根据该标识信息选择对应的IPC第一密钥，使用选择的第一密钥对解密后的控制命令进行加密。
步骤4：NVR接收该由IPC第一密钥加密的控制命令，将该控制命令发送给IPC。
本发明实施例中，通过对待传输的控制命令进行加密，保证了控制命令传输的安全性。
实施例3：
为了保证视频数据的来源准确，在上述各实施例的基础上，在本发明实施例中：
所述主站，还用于接收IPC发送的所述IPC内置的第一嵌入式安全控制芯片ESAM的第一序列号，根据所述第一序列号及预设的第一算法生成第二随机数和第一验证信息，将 所述第二随机数发送给所述IPC；接收所述IPC发送的第二验证信息，判断所述第一验证信息和第二验证信息是否一致，如果一致，向所述IPC发送认证通过的第一提示信息；
所述IPC，还用于向主站发送所述IPC内置的第一ESAM的第一序列号，接收所述主站发送的第二随机数，根据所述第二随机数及预设的第二算法生成第二验证信息，将所述第二验证信息发送给所述主站，接收所述主站发送的第一提示信息。
为了保证视频数据的来源为用户所要监控或访问的位置，在进行视频数据采集之前，需要主站对需要接入的IPC进行身份认证，只有主站对该IPC的认证通过之后才允许该IPC接入，进行视频数据采集和传输。
为了完成身份认证，每个IPC中均内置了嵌入式安全控制芯片ESAM，该每个ESAM具有唯一的序列号，可以代表唯一的IPC。在进行身份认证时，IPC先读取自身第一ESAM的第一序列号，将该第一序列号发送给主站，具体地IPC可以向第一ESAM发送读取其第一序列号的请求，第一ESAM接收到该请求后，将自身的第一序列号返回给IPC。
主站接收到该第一序列号之后，根据该第一序列号，采用预设的第一算法生成第二随机数和第一验证信息。该预设的算法可以是国密算法包括的对称加解密算法、非对称加解密算法、杂凑算法等，例如，可以采用杂凑算法根据第一序列号生成第二随机数和第一验证信息，该第一验证信息可以是根据预设的算法和第一序列号生成的密钥。而为了保证生成的随机数不易被破解，该第二随机数可以是8字节随机数。在生成了第二随机数和第一验证信息时，将该第二随机数发送给IPC。
IPC接收到该第二随机数之后，通过自身内置的第一ESAM根据该第二随机数计算出第二验证信息。具体地，该第一ESAM中也预先保存了与第一算法相对应的第二算法，该第二算法可以通过接收到的第二随机数计算出第二验证信息。IPC将该第二验证信息发送给主站。
主站接收到IPC发送的第二验证信息之后，将该第二验证信息与之前生成的第一验证信息进行一致性对比，如果一致，则认为对该IPC的身份认证通过，向IPC发送认证通过的第一提示信息。
本发明实施例中，通过主站对IPC进行身份认证来保证视频数据的来源是用户所要访问或者监控的位置。
实施例4：
为了保证视频数据可以加密传输，在上述各实施例的基础上，在本发明实施例中：
所述IPC，还用于根据所述第一提示信息，采用所述第一ESAM生成第一随机数，根据所述第一随机数及所述第一序列号生成第一密钥并保存；并将自身的标识信息、所述第一随机数和第一序列号发送给主站；
所述主站，还用于接收IPC发送的所述IPC的标识信息、第一随机数和第一序列号， 根据所述第一随机数和第一序列号生成所述标识信息的IPC的第一密钥并保存。
在IPC接收到主站发送的认证通过的第一提示信息之后，为了保证可以给将要传输的视频数据进行加密，使用自身内置的第一ESAM生成第一密钥。具体地，该第一ESAM预先保存了加密算法，该加密算法可以首先根据第一ESAM的第一序列号生成第一随机数，该第一随机数可以为4字节随机数。在生成第一随机数之后，再根据该第一随机数和第一序列号，采用预设的加密算法生成第一密钥并保存。
主站在对该IPC认证通过之后，会生成该IPC的第一密钥。为了保证主站所生成的密钥为针对该IPC的第一密钥，首先需要该IPC将自身的标识信息、第一随机数和第一序列号发送给主站，主站在接收到该IPC的标识信息、第一随机数和第一序列号之后，根据该第一随机数和第一序列号生成该标识信息的IPC的第一密钥并保存。具体地，为了保证主站生成的密钥与该IPC的第一密钥一致，该主站保存的加密算法需和第一ESAM的加密算法相对应。主站使用该加密算法，根据第一随机数和第一序列号生成该标识信息的IPC的第一密钥，该标识信息为该IPC唯一的标识，例如可以为该IPC的IP地址等。
本发明实施例中，通过在IPC端生成第一密钥，保证了视频数据可以加密传输，并且在主站也对应生成了IPC的第一密钥，保证了在接收加密的视频数据之后，可以通过由主站端生成的第一密钥对其进行解密，以达到观看或者操作的目的。
实施例5：
为了防止视频数据被非法人员获取，在上述各实施例的基础上，在本发明实施例中：
所述主站，还用于接收NVR发送的所述NVR内置的第二ESAM的第二序列号，根据所述第二序列号及预设的第一算法生成第三随机数和第三验证信息，将所述第三随机数发送给所述NVR；接收所述NVR发送的第四验证信息，判断所述第三验证信息和第四验证信息是否一致，如果一致，向所述NVR发送认证通过的第二提示信息；
所述NVR，还用于向主站发送所述NVR内置的第二ESAM的第二序列号，接收所述主站发送的第三随机数，根据所述第三随机数及预设的第二算法生成第四验证信息，将所述第四验证信息发送给所述主站，接收所述主站发送的第二提示信息。
为了防止视频数据的内容被非法人员获取，需要主站对进行视频数据存储和管理的NVR进行身份认证，只有主站对该NVR的认证通过之后才允许该NVR接入来进行视频数据存储和管理。
为了完成身份认证，每个NVR中均内置了嵌入式安全控制芯片ESAM，该每个ESAM具有唯一的序列号，可以代表唯一的NVR。在进行身份认证时，NVR先读取自身第二ESAM的第二序列号，将该第二序列号发送给主站，具体地NVR可以向第二ESAM发送读取其第二序列号的请求，第二ESAM接收到该请求后，将自身的第二序列号返回给NVR。
主站接收到该第二序列号之后，根据该第二序列号，采用预设的第一算法生成第三随 机数和第三验证信息。该预设的算法可以是国密算法包括的对称加解密算法、非对称加解密算法、杂凑算法等，例如，可以采用杂凑算法根据第二序列号生成第三随机数和第三验证信息，该第三验证信息可以是根据预设的算法和第二序列号生成的密钥。而为了保证生成的随机数不易被破解，该第三随机数可以是8字节随机数。在生成了第三随机数和第三验证信息时，将该第三随机数发送给NVR。
NVR接收到该第三随机数之后，通过自身内置的第二ESAM根据该第三随机数计算出第四验证信息。具体地，该第二ESAM中也预先保存了与第一算法相对应的第二算法，该第二算法可以通过接收到的第三随机数计算出第四验证信息。NVR将该第四验证信息发送给主站。
主站接收到NVR发送的第四验证信息之后，将该第四验证信息与之前生成的第三验证信息进行一致性对比，如果一致，则认为对该NVR的身份认证通过，向NVR发送认证通过的第二提示信息。
本发明实施例中，通过主站对NVR进行身份认证来防止视频数据的内容被非法人员获取。
实施例6：
为了保证NVR、主站、IPC三者之间进行数据交互时不被他人获取，在上述各实施例的基础上，在本发明实施例中：
所述NVR，还用于根据所述第二提示信息，采用所述第二ESAM生成第四随机数，根据所述第四随机数及所述第二序列号生成第二密钥并保存；并将自身的标识信息、所述第四随机数和第二序列号发送给主站；
所述主站，还用于接收NVR发送的所述NVR的标识信息、第四随机数和第二序列号，根据所述第四随机数和第二序列号生成所述标识信息的NVR的第二密钥并保存。
在NVR接收到主站发送的认证通过的第二提示信息之后，为了保证可以给将要传输的数据进行加密，使用自身内置的第二ESAM生成第二密钥。具体地，该第二ESAM预先保存了加密算法，该加密算法可以首先根据第二ESAM的第二序列号生成第四随机数，该第四随机数也可以为4字节随机数。在生成第四随机数之后，再根据该第四随机数和第二序列号，采用预设的加密算法生成第二密钥并保存。
主站在对该NVR认证通过之后，为了能解密NVR发送的加密的数据，会生成该NVR的第二密钥。为了保证主站所生成的密钥为针对该NVR的第二密钥，首先需要该NVR将自身的标识信息、第四随机数和第二序列号发送给主站，主站在接收到该NVR的标识信息、第四随机数和第二序列号之后，根据该第四随机数和第二序列号生成该标识信息的NVR的第二密钥并保存。具体地，为了保证主站生成的密钥与该NVR的第二密钥一致，该主站保存的加密算法需和第二ESAM的加密算法相对应。主站使用该加密算法，根据第 四随机数和第二序列号生成该标识信息的NVR的第二密钥，该标识信息为该NVR唯一的标识，例如可以为该NVR的IP地址等。
本发明实施例中，通过NVR和主站均生成相同的第二密钥，使得两者在进行数据交互时能够使用加密后的数据进行交互，降低了交互数据被截取的风险。
下面结合图3，以一个具体的实施例来详细描述主站对IPC、NVR的身份认证过程，该过程包括以下步骤：
步骤1：IPC读取自身的ESAM的序列号，并发送给主站。
同样的NVR也可以通过该过程进行认证。具体的，NVR也读取自身的ESAM的序列号，并将自身的ESAM的序列号也发送给主站。
步骤2：主站接收IPC的ESAM的序列号，根据该序列号及预设的第一算法生成第二随机数和第一验证信息，并将该随机数发送给对应的IPC。
或者，主站也会通过该NVR的ESAM序列号采用预设的第一算法生成第三随机数和第三验证信息。
步骤3：IPC接收该第二随机数，根据该第二随机数采用预设的第二算法生成对应的第二验证信息，并发送给主站。
或者，NVR接收该第三随机数，根据该第三随机数同样采用预设的第二算法生成第四验证信息，将该第四验证信息发送给主站。
步骤4：主站接收该IPC发送的第二验证信息，将该第二验证信息与第一验证信息进行一致性对比，如果一致，向该IPC发送该IPC认证通过的第一提示信息。
同样的，主站也会接收NVR发送的第四验证信息，将该第四验证信息与第三验证信息进行一致性对比，如果对比结果为一致，那么向该NVR发送该NVR认证通过的第二提示信息。
实施例7：
基于相同的技术构思，本发明实施例提供一种视频数据传输方法，应用于IPC。图4为本发明实施例提供的一种视频数据传输方法的过程示意图，该过程包括：
S401：接收NVR发送的控制命令；
S402：如果所述控制命令为控制所述IPC进行视频数据采集时，所述IPC采集视频数据；
S403：采用保存的第一密钥对所述视频数据进行加密，将加密后的视频数据发送给NVR。
进一步地，保存第一密钥的过程包括：
接收主站发送的对所述IPC认证通过的第一提示信息；
根据所述第一提示信息，采用自身内置的第一ESAM生成第一随机数，根据所述第一 随机数及第一ESAM的第一序列号生成第一密钥并保存；
并将自身的标识信息、所述第一随机数和第一序列号发送给主站。
进一步地，主站对所述IPC的认证过程包括：
向主站发送所述IPC内置的第一ESAM的第一序列号，使所述主站根据所述第一序列号及预设的第一算法生成第二随机数和第一验证信息；
接收主站发送的第二随机数，根据所述第二随机数及预设的第二算法生成第二验证信息；
将所述第二验证信息发送给主站，使主站判断所述第一验证信息和第二验证信息是否一致；
接收所述主站发送的第一提示信息，所述第一提示信息为主站判断所述第一验证信息和所述第二验证信息一致时发送的。
基于图4所示的视频数据传输方法，IPC在接收到NVR发送的控制命令后，根据该控制命令执行相应的操作。如果该控制命令为对监控区域进行视频数据采集时，IPC开始采集视频数据，并且为了防止视频数据在传输时被截取而泄露视频内容，IPC会对该待传输的视频数据进行加密处理。在加密过程中，IPC使用自身保存的第一密钥，对采集的视频数据进行加密，并将该加密后的视频数据发送给NVR，由NVR来进行存储和管理。
其中，IPC在本地保存第一密钥时，会先通过主站对该IPC的认证。为了完成身份认证，每个IPC中均内置了嵌入式安全控制芯片ESAM，该每个ESAM具有唯一的序列号，可以代表唯一的IPC。在进行身份认证时，IPC先读取自身第一ESAM的第一序列号，将该第一序列号发送给主站，具体地IPC可以向第一ESAM发送读取其第一序列号的请求，第一ESAM接收到该请求后，将自身的第一序列号返回给IPC。
主站接收到该第一序列号之后，根据该第一序列号，采用预设的第一算法生成第二随机数和第一验证信息，并将该第二随机数发送给IPC。IPC接收到该第二随机数之后，通过自身内置的第一ESAM根据该第二随机数计算出第二验证信息。具体地，该第一ESAM中也预先保存了与第一算法相对应的第二算法，该第二算法可以通过接收到的第二随机数计算出第二验证信息。IPC将该第二验证信息发送给主站，由主站将该第二验证信息与之前生成的第一验证信息进行一致性对比，如果一致，则认为对该IPC的身份认证通过，IPC会接收到主站对该IPC认证通过的第一提示信息。
在IPC接收到主站发送的认证通过的第一提示信息之后，为了保证可以给将要传输的视频数据进行加密，使用自身内置的第一ESAM生成第一密钥。具体地，该第一ESAM预先保存了加密算法，该加密算法可以首先根据第一ESAM的第一序列号生成第一随机数，该第一随机数可以为4字节随机数。在生成第一随机数之后，再根据该第一随机数和第一序列号，采用预设的加密算法生成第一密钥并保存。在后续进行视频数据传输时均采 用该第一密钥对待传输的视频数据进行加密，以保证视频数据传输的安全性。
实施例8：
基于相同的技术构思，本发明实施例提供一种视频数据传输方法，应用于NVR。图5本发明实施例提供的一种视频数据传输方法的过程示意图，该过程包括：
S501：NVR向IPC发送控制命令；
S502：接收IPC发送的加密后的视频数据，向主站发送获取第一密钥的请求；
S503：接收主站发送的加密后的第一密钥，采用自身保存的第二密钥对所述加密后的第一密钥进行解密得到第一密钥；
S504：使用所述第一密钥对加密后的视频数据进行解密。
进一步地，所述NVR向IPC发送控制命令包括：
采用自身保存的第二密钥对待传输的控制命令加密；
将加密后的控制命令发送给主站，使所述主站采用自身保存的所述NVR的第二密钥对所述加密后的控制命令进行解密，并采用自身保存的IPC的第一密钥对解密后的控制命令进行加密；
接收主站发送的采用第一密钥加密的控制命令，将所述采用第一密钥加密的控制命令发送给IPC。
进一步地，保存第二密钥的过程包括：
接收主站发送的对所述NVR认证通过的第二提示信息；
根据所述第二提示信息，采用自身内置的第二ESAM生成第四随机数，根据所述第四随机数及第二ESAM的第二序列号生成第二密钥并保存；
并将自身的标识信息、所述第四随机数和第二序列号发送给主站。
进一步地，主站对所述NVR的认证过程包括：
向主站发送所述NVR内置的第二ESAM的第二序列号，使所述主站根据所述第二序列号及预设的第一算法生成第三随机数和第三验证信息；
接收主站发送的第三随机数，根据所述第三随机数及预设的第二算法生成第四验证信息；
将所述第四验证信息发送给主站，使主站判断所述第三验证信息和第四验证信息是否一致；
接收所述主站发送的第二提示信息，所述第二提示信息为主站判断所述第三验证信息和所述第四验证信息一致时发送的。
为了完成视频数据的采集，NVR先向IPC发送控制命令，并且为了防止NVR发送的控制命令被截取被修改，从而使得启动错误的IPC或者采集非指定地点的视频数据，该控制命令为加密的。
具体地，因为该控制命令是针对与该NVR连接的IPC设置的，IPC在接收到该控制命令时需要解密才能执行。所以为了保证IPC能用自身的第一密钥对该控制命令解密，该控制命令应由IPC的第一密钥加密。所以NVR需要先将采用自身保存的第二密钥加密的控制命令发送给主站，由主站使用自身保存的第二密钥对其进行解密，并使用IPC的第一密钥对解密后的控制命令进行再次加密并发送给NVR。NVR接收该采用IPC第一密钥加密的控制命令，将其发送给IPC。
IPC接收到控制命令之后采集视频数据，并采用自身的第一密钥对该视频数据加密，将加密后的视频数据发送给NVR。
NVR接收到该加密后的视频数据之后，由于该视频数据是IPC使用自身的第一密钥进行加密的，因此NVR只有通过IPC的第一密钥才能解密，而NVR并没有保存有该IPC的第一密钥，此时需要向主站发送获取第一密钥的请求。
由于主站中保存有每个与其连接的IPC和NVR的密钥，主站在接收到该NVR发送的获取第一密钥的请求时，为了保证密钥不会被别人拦截获取，先用自身存储的该NVR的第二密钥对该第一密钥进行加密，将加密后的第一密钥发送给NVR。
NVR接收到该加密后的第一密钥之后，用自身保存的第二密钥对其进行解密，得到该第一密钥的明文，然后通过使用该第一密钥来对接收到的加密的视频数据进行解密。
其中，NVR在本地保存第二密钥时，会先通过主站对该NVR的认证。并且为了完成身份认证，每个NVR中均内置了嵌入式安全控制芯片ESAM，该每个ESAM具有唯一的序列号，可以代表唯一的NVR。在进行身份认证时，NVR先读取自身第二ESAM的第二序列号，将该第二序列号发送给主站，具体地NVR可以向第二ESAM发送读取其第二序列号的请求，第二ESAM接收到该请求后，将自身的第二序列号返回给NVR。
主站接收到该第二序列号之后，根据该第二序列号，采用预设的第一算法生成第三随机数和第三验证信息，并将第三随机数发送给NVR。NVR接收到该第三随机数之后，通过自身内置的第二ESAM根据该第三随机数计算出第四验证信息。具体地，该第二ESAM中也预先保存了与第一算法相对应的第二算法，该第二算法可以通过接收到的第三随机数计算出第四验证信息。NVR将该第四验证信息发送给主站，由主站将该第四验证信息与之前生成的第三验证信息进行一致性对比，如果一致，则认为对该NVR的身份认证通过，NVR会接收到主站对该NVR认证通过的第二提示信息。
在NVR接收到主站发送的认证通过的第二提示信息之后，为了保证可以给将要传输的数据进行加密，使用自身内置的第二ESAM生成第二密钥。具体地，该第二ESAM预先保存了加密算法，该加密算法可以首先根据第二ESAM的第二序列号生成第四随机数，该第四随机数也可以为4字节随机数。在生成第四随机数之后，再根据该第四随机数和第二序列号，采用预设的加密算法生成第二密钥并保存。在后续进行数据交互时均采用该第 二密钥对待传输的数据进行加密，以保证数据传输的安全性。
实施例9：
基于相同的技术构思，本发明实施例提供一种视频数据传输方法，应用于主站。图6本发明实施例提供的一种视频数据传输方法的过程示意图，该过程包括：
S601：接收NVR发送的获取第一密钥的请求；
S602：采用NVR的第二密钥，对自身保存的IPC的第一密钥进行加密，将加密后的第一密钥发送给NVR。
进一步地，所述方法还包括：
接收NVR发送的加密后的控制命令，采用自身保存的所述NVR的第二密钥对所述加密后的控制命令进行解密；
采用自身保存的IPC的第一密钥对解密后的控制命令进行加密，并发送给NVR。
进一步地，所述方法还包括：
接收IPC发送的所述IPC内置的第一ESAM的第一序列号，根据所述第一序列号及预设的第一算法生成第二随机数和第一验证信息；
将所述第二随机数发送给所述IPC，使所述IPC根据所述第二随机数及预设的第二算法生成第二验证信息；
接收所述IPC发送的第二验证信息，判断所述第一验证信息和第二验证信息是否一致；
如果一致，向所述IPC发送认证通过的第一提示信息。
进一步地，所述如果一致，向所述IPC发送认证通过的第一提示信息之后，所述方法还包括：
接收IPC发送的所述IPC的标识信息、第一随机数和第一序列号，根据所述第一随机数和第一序列号生成所述标识信息的IPC的第一密钥并保存。
进一步地，所述方法还包括：
接收NVR发送的所述NVR内置的第二ESAM的第二序列号，根据所述第二序列号及预设的第一算法生成第三随机数和第三验证信息；
将所述第三随机数发送给所述NVR，使所述NVR根据所述第三随机数及预设的第二算法生成第四验证信息；
接收所述NVR发送的第四验证信息，判断所述第三验证信息和第四验证信息是否一致；
如果一致，向所述NVR发送认证通过的第二提示信息。
进一步地，所述如果一致，向所述NVR发送认证通过的第二提示信息之后，所述方法还包括：
接收NVR发送的所述NVR的标识信息、第四随机数和第二序列号，根据所述第四随 机数和第二序列号生成所述标识信息的NVR的第二密钥并保存。
为了防止非法人员接入该视频数据传输系统，主站需要对NVR和IPC进行身份认证。
具体地，主站在对IPC进行认证时，先接收该IPC发送的自身第一ESAM的第一序列号，根据该第一序列号，采用预设的第一算法生成第二随机数和第一验证信息。该预设的算法可以是国密算法包括的对称加解密算法、非对称加解密算法、杂凑算法等，例如，可以采用杂凑算法根据第一序列号生成第二随机数和第一验证信息，该第一验证信息可以是根据预设的算法和第一序列号生成的密钥。而为了保证生成的随机数不易被破解，该第二随机数可以是8字节随机数。在生成了第二随机数和第一验证信息时，将该第二随机数发送给IPC，使IPC根据该第二随机数生成第二验证信息。
主站接收该第二验证信息，将该第二验证信息与之前生成的第一验证信息进行一致性对比，如果一致，则认为对该IPC的身份认证通过，向IPC发送认证通过的第一提示信息。
具体地，主站在对NVR进行认证时，先接收该NVR发送的自身第二ESAM的第二序列号，根据该第二序列号，采用预设的第一算法生成第三随机数和第三验证信息。该预设的算法可以是国密算法包括的对称加解密算法、非对称加解密算法、杂凑算法等，例如，可以采用杂凑算法根据第二序列号生成第三随机数和第三验证信息，该第三验证信息可以是根据预设的算法和第二序列号生成的密钥。而为了保证生成的随机数不易被破解，该第三随机数可以是8字节随机数。在生成了第三随机数和第三验证信息时，将该第三随机数发送给NVR，使NVR根据该第二随机数生成第四验证信息。
主站接收该第四验证信息，将该第四验证信息与之前生成的第三验证信息进行一致性对比，如果一致，则认为对该NVR的身份认证通过，向NVR发送认证通过的第二提示信息。
在主站对NVR和IPC认证通过之后，为了保证NVR、主站、IPC三者之间进行数据交互时不被他人获取，主站也会对应生成IPC和NVR的密钥。
具体地，为了保证主站所生成的密钥为针对该IPC的第一密钥，首先需要该IPC将自身的标识信息、第一随机数和第一序列号发送给主站，主站在接收到该IPC的标识信息、第一随机数和第一序列号之后，根据该第一随机数和第一序列号生成该标识信息的IPC的第一密钥并保存。同样的，主站也采用同样的方式来保存NVR的第二密钥的过程，具体内容不再赘述。
在主站保存了该IPC和NVR的密钥之后，会和NVR共同对待传输的控制命令进行处理。具体地，主站接收NVR发送的采用NVR第二密钥加密的控制命令，使用自身保存的第二密钥对其进行解密，并使用IPC的第一密钥对解密后的控制命令进行再次加密，将该采用第一密钥加密的控制命令发送给NVR，由NVR将该控制命令发送给IPC。
而在NVR需要对接收的加密的视频数据进行解密时，会根据接收到的NVR发送的获 取第一密钥的请求时，为了保证密钥不会被别人拦截获取，先用自身存储的该NVR的第二密钥对该第一密钥进行加密，将加密后的第一密钥发送给NVR。
下面结合图7，以一个具体的实施例来详细描述IPC向NVR传输视频数据时设备间进行数据交互的过程，该过程包括以下步骤：
步骤1：IPC采用自身存储的第一密钥对待传输的视频数据进行加密，将加密后的视频数据发送给NVR。
步骤2：NVR接收该加密后的视频数据，向主站发送获取IPC的第一密钥的请求。
步骤3：主站采用NVR的第二密钥对该IPC的第一密钥进行加密，将加密后的第一密钥发送给NVR。
步骤4：NVR接收该加密的第一密钥，用自身的第二密钥对其进行解密，采用解密后得到的第一密钥，解密接收的视频数据。
以上各步骤的详细描述在上述各发明实施例中均有详细描述，在本发明实施例中不再赘述。
实施例10：
基于相同的技术构思，本发明实施例提供一种视频数据传输装置，应用于IPC。图8本发明实施例提供的一种视频数据传输装置的结构示意图，该装置包括：
第一接收模块801，用于接收NVR发送的控制命令；
采集模块802，用于如果所述控制命令为控制所述IPC进行视频数据采集时，所述IPC采集视频数据；
第一发送模块803，用于采用保存的第一密钥对所述视频数据进行加密，将加密后的视频数据发送给NVR。
进一步地，所述装置还包括：
第一保存模块804，用于接收主站发送的对所述IPC认证通过的第一提示信息；根据所述第一提示信息，采用自身内置的第一ESAM生成第一随机数，根据所述第一随机数及第一ESAM的第一序列号生成第一密钥并保存；并将自身的标识信息、所述第一随机数和第一序列号发送给主站。
进一步地，所述装置还包括：
第一认证模块805，用于向主站发送所述IPC内置的第一ESAM的第一序列号，使所述主站根据所述第一序列号及预设的第一算法生成第二随机数和第一验证信息；接收主站发送的第二随机数，根据所述第二随机数及预设的第二算法生成第二验证信息；将所述第二验证信息发送给主站，使主站判断所述第一验证信息和第二验证信息是否一致；接收所述主站发送的第一提示信息，所述第一提示信息为主站判断所述第一验证信息和所述第二验证信息一致时发送的。
实施例11：
基于相同的技术构思，本发明实施例提供一种视频数据传输装置，应用于NVR。图9本发明实施例提供的一种视频数据传输装置的结构示意图，该装置包括：
第二发送模块901，用于NVR向IPC发送控制命令；
第二接收模块902，用于接收IPC发送的加密后的视频数据，向主站发送获取第一密钥的请求；
第一解密模块903，用于接收主站发送的加密后的第一密钥，采用自身保存的第二密钥对所述加密后的第一密钥进行解密得到第一密钥；
第二解密模块904，用于使用所述第一密钥对加密后的视频数据进行解密。
进一步地，所述第二发送模块901，具体用于采用自身保存的第二密钥对待传输的控制命令加密；将加密后的控制命令发送给主站，使所述主站采用自身保存的所述NVR的第二密钥对所述加密后的控制命令进行解密，并采用自身保存的IPC的第一密钥对解密后的控制命令进行加密；接收主站发送的采用第一密钥加密的控制命令，将所述采用第一密钥加密的控制命令发送给IPC。
进一步地，所述装置还包括：
第二保存模块905，用于接收主站发送的对所述NVR认证通过的第二提示信息；根据所述第二提示信息，采用自身内置的第二ESAM生成第四随机数，根据所述第四随机数及第二ESAM的第二序列号生成第二密钥并保存；并将自身的标识信息、所述第四随机数和第二序列号发送给主站。
进一步地，所述装置还包括：
第二认证模块906，用于向主站发送所述NVR内置的第二ESAM的第二序列号，使所述主站根据所述第二序列号及预设的第一算法生成第三随机数和第三验证信息；接收主站发送的第三随机数，根据所述第三随机数及预设的第二算法生成第四验证信息；将所述第四验证信息发送给主站，使主站判断所述第三验证信息和第四验证信息是否一致；接收所述主站发送的第二提示信息，所述第二提示信息为主站判断所述第三验证信息和所述第四验证信息一致时发送的。
实施例12：
基于相同的技术构思，本发明实施例提供一种视频数据传输装置，应用于主站。图10本发明实施例提供的一种视频数据传输装置的结构示意图，该装置包括：
第三接收模块1001，用于接收NVR发送的获取第一密钥的请求；
第三发送模块1002，用于采用NVR的第二密钥，对自身保存的IPC的第一密钥进行加密，将加密后的第一密钥发送给NVR。
进一步地，所述装置还包括：
第四发送模块1003，用于接收NVR发送的加密后的控制命令，采用自身保存的所述NVR的第二密钥对所述加密后的控制命令进行解密，并采用自身保存的IPC的第一密钥对解密后的控制命令进行加密，并发送给NVR。
进一步地，所述装置还包括：
第三认证模块1004，用于接收IPC发送的所述IPC内置的第一ESAM的第一序列号，根据所述第一序列号及预设的第一算法生成第二随机数和第一验证信息；将所述第二随机数发送给所述IPC，使所述IPC根据所述第二随机数及预设的第二算法生成第二验证信息；接收所述IPC发送的第二验证信息，判断所述第一验证信息和第二验证信息是否一致；如果一致，向所述IPC发送认证通过的第一提示信息。
进一步地，所述装置还包括：
第一生成模块1005，用于接收IPC发送的所述IPC的标识信息、第一随机数和第一序列号，根据所述第一随机数和第一序列号生成所述标识信息的IPC的第一密钥并保存。
进一步地，所述装置还包括：
第四认证模块1006，用于接收NVR发送的所述NVR内置的第二ESAM的第二序列号，根据所述第二序列号及预设的第一算法生成第三随机数和第三验证信息；将所述第三随机数发送给所述NVR，使所述NVR根据所述第三随机数及预设的第二算法生成第四验证信息；接收所述NVR发送的第四验证信息，判断所述第三验证信息和第四验证信息是否一致；如果一致，向所述NVR发送认证通过的第二提示信息。
进一步地，所述装置还包括：
第二生成模块1007，用于接收NVR发送的所述NVR的标识信息、第四随机数和第二序列号，根据所述第四随机数和第二序列号生成所述标识信息的NVR的第二密钥并保存。
综上所述，本发明实施例提供一种视频数据传输系统、方法及装置，该系统包括：所述IPC用于接收NVR发送的控制命令，如果所述控制命令为控制所述IPC进行视频数据采集时，所述IPC采集视频数据，并采用保存的第一密钥对所述视频数据进行加密，将加密后的视频数据发送给NVR；所述NVR用于向IPC发送控制命令，接收IPC发送的加密后的视频数据，向主站发送获取第一密钥的请求，接收主站发送的加密后的第一密钥，采用自身保存的第二密钥对所述加密后的第一密钥进行解密得到第一密钥，使用所述第一密钥对加密后的视频数据进行解密；所述主站用于接收NVR发送的获取第一密钥的请求，采用NVR的第二密钥，对自身保存的IPC的第一密钥进行加密，将加密后的第一密钥发送给NVR。
对于系统/装置实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或 者一个操作与另一个实体或者另一个操作区分开来，而不一定要求或者暗示这些实体或者操作之间存在任何这种实际的关系或者顺序。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明实施例进行各种改动和变型而不脱离本发明实施例的精神和范围。这样，倘若本发明实施例的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (13)

  1. 一种视频数据传输系统，其特征在于，所述系统包括网络硬盘录像机NVR、主站和至少一个网络摄像机IPC，其中：
    所述IPC，用于接收NVR发送的控制命令，如果所述控制命令为控制所述IPC进行视频数据采集时，所述IPC采集视频数据，并采用保存的第一密钥对所述视频数据进行加密，将加密后的视频数据发送给NVR；
    所述NVR，用于向IPC发送控制命令，接收IPC发送的加密后的视频数据，向主站发送获取第一密钥的请求，接收主站发送的加密后的第一密钥，采用自身保存的第二密钥对所述加密后的第一密钥进行解密得到第一密钥，使用所述第一密钥对加密后的视频数据进行解密；
    所述主站，用于接收NVR发送的获取第一密钥的请求，采用NVR的第二密钥，对自身保存的IPC的第一密钥进行加密，将加密后的第一密钥发送给NVR。
  2. 如权利要求1所述的系统，其特征在于，所述NVR，用于采用自身保存的第二密钥对待传输的控制命令加密，并将加密后的控制命令发送给主站，接收主站发送的采用第一密钥加密的控制命令，将所述采用第一密钥加密的控制命令发送给IPC；
    所述主站，用于接收NVR发送的加密后的控制命令，采用自身保存的所述NVR的第二密钥对所述加密后的控制命令进行解密，并采用自身保存的IPC的第一密钥对解密后的控制命令进行加密，并发送给NVR；
    所述IPC，用于接收采用第一密钥加密的控制命令。
  3. 如权利要求1所述的系统，其特征在于，所述主站，还用于接收IPC发送的所述IPC内置的第一嵌入式安全控制芯片ESAM的第一序列号，根据所述第一序列号及预设的第一算法生成第二随机数和第一验证信息，将所述第二随机数发送给所述IPC；接收所述IPC发送的第二验证信息，判断所述第一验证信息和第二验证信息是否一致，如果一致，向所述IPC发送认证通过的第一提示信息；
    所述IPC，还用于向主站发送所述IPC内置的第一ESAM的第一序列号，接收所述主站发送的第二随机数，根据所述第二随机数及预设的第二算法生成第二验证信息，将所述第二验证信息发送给所述主站，接收所述主站发送的第一提示信息；
    所述IPC，还用于根据所述第一提示信息，采用所述第一ESAM生成第一随机数，根据所述第一随机数及所述第一序列号生成第一密钥并保存；并将自身的标识信息、所述第一随机数和第一序列号发送给主站；
    所述主站，还用于接收IPC发送的所述IPC的标识信息、第一随机数和第一序列号，根据所述第一随机数和第一序列号生成所述标识信息的IPC的第一密钥并保存。
  4. 如权利要求1所述的系统，其特征在于，所述主站，还用于接收NVR发送的所述NVR内置的第二ESAM的第二序列号，根据所述第二序列号及预设的第一算法生成第三随机数和第三验证信息，将所述第三随机数发送给所述NVR；接收所述NVR发送的第四验证信息，判断所述第三验证信息和第四验证信息是否一致，如果一致，向所述NVR发送认证通过的第二提示信息；
    所述NVR，还用于向主站发送所述NVR内置的第二ESAM的第二序列号，接收所述主站发送的第三随机数，根据所述第三随机数及预设的第二算法生成第四验证信息，将所述第四验证信息发送给所述主站，接收所述主站发送的第二提示信息；
    所述NVR，还用于根据所述第二提示信息，采用所述第二ESAM生成第四随机数，根据所述第四随机数及所述第二序列号生成第二密钥并保存；并将自身的标识信息、所述第四随机数和第二序列号发送给主站；
    所述主站，还用于接收NVR发送的所述NVR的标识信息、第四随机数和第二序列号，根据所述第四随机数和第二序列号生成所述标识信息的NVR的第二密钥并保存。
  5. 一种视频数据传输方法，其特征在于，应用于IPC，所述方法包括：
    接收NVR发送的控制命令；
    如果所述控制命令为控制所述IPC进行视频数据采集时，所述IPC采集视频数据；
    采用保存的第一密钥对所述视频数据进行加密，将加密后的视频数据发送给NVR。
  6. 如权利要求5所述的方法，其特征在于，保存第一密钥的过程包括：
    接收主站发送的对所述IPC认证通过的第一提示信息；
    根据所述第一提示信息，采用自身内置的第一ESAM生成第一随机数，根据所述第一随机数及第一ESAM的第一序列号生成第一密钥并保存；
    并将自身的标识信息、所述第一随机数和第一序列号发送给主站；
    其中，主站对所述IPC的认证过程包括：
    向主站发送所述IPC内置的第一ESAM的第一序列号，使所述主站根据所述第一序列号及预设的第一算法生成第二随机数和第一验证信息；
    接收主站发送的第二随机数，根据所述第二随机数及预设的第二算法生成第二验证信息；
    将所述第二验证信息发送给主站，使主站判断所述第一验证信息和第二验证信息是否一致；
    接收所述主站发送的第一提示信息，所述第一提示信息为主站判断所述第一验证信息和所述第二验证信息一致时发送的。
  7. 一种视频数据传输方法，其特征在于，应用于NVR，所述方法包括：
    NVR向IPC发送控制命令；
    接收IPC发送的加密后的视频数据，向主站发送获取第一密钥的请求；
    接收主站发送的加密后的第一密钥，采用自身保存的第二密钥对所述加密后的第一密钥进行解密得到第一密钥；
    使用所述第一密钥对加密后的视频数据进行解密。
  8. 如权利要求7所述的方法，其特征在于，所述NVR向IPC发送控制命令包括：
    采用自身保存的第二密钥对待传输的控制命令加密；
    将加密后的控制命令发送给主站，使所述主站采用自身保存的所述NVR的第二密钥对所述加密后的控制命令进行解密，并采用自身保存的IPC的第一密钥对解密后的控制命令进行加密；
    接收主站发送的采用第一密钥加密的控制命令，将所述采用第一密钥加密的控制命令发送给IPC；
    其中，保存第二密钥的过程包括：
    接收主站发送的对所述NVR认证通过的第二提示信息；
    根据所述第二提示信息，采用自身内置的第二ESAM生成第四随机数，根据所述第四随机数及第二ESAM的第二序列号生成第二密钥并保存；
    并将自身的标识信息、所述第四随机数和第二序列号发送给主站；
    其中，主站对所述NVR的认证过程包括：
    向主站发送所述NVR内置的第二ESAM的第二序列号，使所述主站根据所述第二序列号及预设的第一算法生成第三随机数和第三验证信息；
    接收主站发送的第三随机数，根据所述第三随机数及预设的第二算法生成第四验证信息；
    将所述第四验证信息发送给主站，使主站判断所述第三验证信息和第四验证信息是否一致；
    接收所述主站发送的第二提示信息，所述第二提示信息为主站判断所述第三验证信息和所述第四验证信息一致时发送的。
  9. 一种视频数据传输方法，其特征在于，应用于主站，所述方法包括：
    接收NVR发送的获取第一密钥的请求；
    采用NVR的第二密钥，对自身保存的IPC的第一密钥进行加密，将加密后的第一密钥发送给NVR。
  10. 如权利要求9所述的方法，其特征在于，所述方法还包括：
    接收IPC发送的所述IPC内置的第一ESAM的第一序列号，根据所述第一序列号及预设的第一算法生成第二随机数和第一验证信息；
    将所述第二随机数发送给所述IPC，使所述IPC根据所述第二随机数及预设的第二算 法生成第二验证信息；
    接收所述IPC发送的第二验证信息，判断所述第一验证信息和第二验证信息是否一致；
    如果一致，向所述IPC发送认证通过的第一提示信息；
    接收IPC发送的所述IPC的标识信息、第一随机数和第一序列号，根据所述第一随机数和第一序列号生成所述标识信息的IPC的第一密钥并保存；
    所述方法还包括：
    接收NVR发送的所述NVR内置的第二ESAM的第二序列号，根据所述第二序列号及预设的第一算法生成第三随机数和第三验证信息；
    将所述第三随机数发送给所述NVR，使所述NVR根据所述第三随机数及预设的第二算法生成第四验证信息；
    接收所述NVR发送的第四验证信息，判断所述第三验证信息和第四验证信息是否一致；
    如果一致，向所述NVR发送认证通过的第二提示信息。
  11. 一种视频数据传输装置，其特征在于，应用于IPC，所述装置包括：
    第一接收模块，用于接收NVR发送的控制命令；
    采集模块，用于如果所述控制命令为控制所述IPC进行视频数据采集时，所述IPC采集视频数据；
    第一发送模块，用于采用保存的第一密钥对所述视频数据进行加密，将加密后的视频数据发送给NVR。
  12. 一种视频数据传输装置，其特征在于，应用于NVR，所述装置包括：
    第二发送模块，用于NVR向IPC发送控制命令；
    第二接收模块，用于接收IPC发送的加密后的视频数据，向主站发送获取第一密钥的请求；
    第一解密模块，用于接收主站发送的加密后的第一密钥，采用自身保存的第二密钥对所述加密后的第一密钥进行解密得到第一密钥；
    第二解密模块，用于使用所述第一密钥对加密后的视频数据进行解密。
  13. 一种视频数据传输装置，其特征在于，应用于主站，所述装置包括：
    第三接收模块，用于接收NVR发送的获取第一密钥的请求；
    第三发送模块，用于采用NVR的第二密钥，对自身保存的IPC的第一密钥进行加密，将加密后的第一密钥发送给NVR。
PCT/CN2018/114012 2018-11-05 2018-11-05 一种视频数据传输系统、方法及装置 WO2020093212A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2018/114012 WO2020093212A1 (zh) 2018-11-05 2018-11-05 一种视频数据传输系统、方法及装置
JP2021523603A JP7208383B2 (ja) 2018-11-05 2018-11-05 ビデオデータ伝送システム、方法および装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2018/114012 WO2020093212A1 (zh) 2018-11-05 2018-11-05 一种视频数据传输系统、方法及装置

Publications (1)

Publication Number Publication Date
WO2020093212A1 true WO2020093212A1 (zh) 2020-05-14

Family

ID=70611580

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/114012 WO2020093212A1 (zh) 2018-11-05 2018-11-05 一种视频数据传输系统、方法及装置

Country Status (2)

Country Link
JP (1) JP7208383B2 (zh)
WO (1) WO2020093212A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112134881A (zh) * 2020-09-22 2020-12-25 宏图智能物流股份有限公司 一种基于序列号的网络请求防篡改方法
CN117596421A (zh) * 2024-01-18 2024-02-23 北京智芯微电子科技有限公司 基于融合终端的视频加密传输方法、装置及系统

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101163228A (zh) * 2007-10-24 2008-04-16 中国电信股份有限公司 网络视频监控的视频数据加密的系统和方法
US20120195425A1 (en) * 2010-12-23 2012-08-02 Electronics And Telecommunications Research Institute Security video transmission apparatus, video data reception apparatus, and key generation method thereof
CN104113409A (zh) * 2014-07-23 2014-10-22 中国科学院信息工程研究所 一种sip视频监控联网系统的密钥管理方法及系统
CN104270614A (zh) * 2014-10-16 2015-01-07 浙江宇视科技有限公司 一种视频加密解密方法及装置
CN104486083A (zh) * 2014-12-19 2015-04-01 小米科技有限责任公司 监控录像处理方法及装置
CN107547560A (zh) * 2017-09-25 2018-01-05 深圳市斑点猫信息技术有限公司 视频传输方法、装置及系统
CN108449563A (zh) * 2018-02-01 2018-08-24 晨星半导体股份有限公司 对音视频加解密的方法及系统

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2001283320A (ja) 2000-03-31 2001-10-12 Sony Corp 情報販売装置および方法、並びにプログラム格納媒体
JP2003023559A (ja) 2001-07-11 2003-01-24 Sony Corp 電力供給装置および方法
JP2006101398A (ja) 2004-09-30 2006-04-13 Hitachi Kokusai Electric Inc 監視システム
JP2006166279A (ja) 2004-12-10 2006-06-22 Yokogawa Electric Corp カメラ監視システム
JP2006352265A (ja) 2005-06-13 2006-12-28 Hitachi Kokusai Electric Inc 画像配信システム
JP2008022374A (ja) 2006-07-13 2008-01-31 Canon Inc 撮影装置およびその制御方法
JP2008172287A (ja) 2007-01-05 2008-07-24 Hitachi Kokusai Electric Inc 映像情報データ配信システム
JP2010011307A (ja) 2008-06-30 2010-01-14 Victor Co Of Japan Ltd カメラ情報表示装置及びカメラ情報表示方法
JP2013042335A (ja) 2011-08-15 2013-02-28 Kddi Corp 通信システム及びプログラム
FR3004041B1 (fr) 2013-03-28 2015-04-17 Commissariat Energie Atomique Procede et dispositif d'etablissement de cles de session

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101163228A (zh) * 2007-10-24 2008-04-16 中国电信股份有限公司 网络视频监控的视频数据加密的系统和方法
US20120195425A1 (en) * 2010-12-23 2012-08-02 Electronics And Telecommunications Research Institute Security video transmission apparatus, video data reception apparatus, and key generation method thereof
CN104113409A (zh) * 2014-07-23 2014-10-22 中国科学院信息工程研究所 一种sip视频监控联网系统的密钥管理方法及系统
CN104270614A (zh) * 2014-10-16 2015-01-07 浙江宇视科技有限公司 一种视频加密解密方法及装置
CN104486083A (zh) * 2014-12-19 2015-04-01 小米科技有限责任公司 监控录像处理方法及装置
CN107547560A (zh) * 2017-09-25 2018-01-05 深圳市斑点猫信息技术有限公司 视频传输方法、装置及系统
CN108449563A (zh) * 2018-02-01 2018-08-24 晨星半导体股份有限公司 对音视频加解密的方法及系统

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112134881A (zh) * 2020-09-22 2020-12-25 宏图智能物流股份有限公司 一种基于序列号的网络请求防篡改方法
CN117596421A (zh) * 2024-01-18 2024-02-23 北京智芯微电子科技有限公司 基于融合终端的视频加密传输方法、装置及系统
CN117596421B (zh) * 2024-01-18 2024-04-02 北京智芯微电子科技有限公司 基于融合终端的视频加密传输方法、装置及系统

Also Published As

Publication number Publication date
JP2022511664A (ja) 2022-02-01
JP7208383B2 (ja) 2023-01-18

Similar Documents

Publication Publication Date Title
CN105050081B (zh) 网络接入设备接入无线网络接入点的方法、装置和系统
US8930700B2 (en) Remote device secure data file storage system and method
CN106104562B (zh) 机密数据安全储存和恢复系统及方法
CN106453384B (zh) 一种安全云盘系统及其安全加密方法
US8239679B2 (en) Authentication method, client, server and system
US10693847B1 (en) Secure message search
CN100464549C (zh) 一种数据安全存储业务的实现方法
CN105049877A (zh) 一种用于直录播互动系统的加密方法及装置
WO2019047927A1 (zh) 数字证书管理方法及设备
CN112383391A (zh) 基于数据属性授权的数据安全保护方法、存储介质及终端
CN108768613A (zh) 一种基于多种加密算法的密文口令校验方法
CN113114668A (zh) 一种信息传输方法、移动终端、存储介质及电子设备
CN106789039A (zh) 一种机密数据的存储方法
CN113472793A (zh) 一种基于硬件密码设备的个人数据保护系统
CN113347143B (zh) 一种身份验证方法、装置、设备及存储介质
CN201336704Y (zh) 一种远程视频监控系统
WO2020093212A1 (zh) 一种视频数据传输系统、方法及装置
CN110098925A (zh) 基于非对称密钥池对和随机数的量子通信服务站密钥协商方法和系统
CN104660568A (zh) 一种通讯录信息的保护方法及装置
CN106953917A (zh) 数据同步方法及系统
CN113904830B (zh) 一种spa认证的方法、装置、电子设备和可读存储介质
CN114553557B (zh) 密钥调用方法、装置、计算机设备和存储介质
CN111147805B (zh) 一种视频数据传输系统、方法及装置
CN114760029A (zh) 一种身份鉴别方法和装置
CN111711836B (zh) 一种数据传输方法、装置、终端设备和存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18939425

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021523603

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18939425

Country of ref document: EP

Kind code of ref document: A1