WO2020186457A1 - 网络摄像机的认证方法和装置 - Google Patents

网络摄像机的认证方法和装置 Download PDF

Info

Publication number
WO2020186457A1
WO2020186457A1 PCT/CN2019/078732 CN2019078732W WO2020186457A1 WO 2020186457 A1 WO2020186457 A1 WO 2020186457A1 CN 2019078732 W CN2019078732 W CN 2019078732W WO 2020186457 A1 WO2020186457 A1 WO 2020186457A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
initial
account information
trusted
authentication request
Prior art date
Application number
PCT/CN2019/078732
Other languages
English (en)
French (fr)
Inventor
李旭
袁健
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2019/078732 priority Critical patent/WO2020186457A1/zh
Priority to CN201980093979.2A priority patent/CN113557703A/zh
Publication of WO2020186457A1 publication Critical patent/WO2020186457A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N7/00—Television systems
    • H04N7/18—Closed-circuit television [CCTV] systems, i.e. systems in which the video signal is not broadcast

Definitions

  • This application relates to network security technology, and in particular to an authentication method and device for network cameras.
  • IPC IP Camera
  • IPC IP Camera
  • this authentication method can log in to IPC to obtain video data by anyone with a user name and password, leading to privacy leaks, and even more account information and personal data leaks due to hacker attacks, and weak security.
  • This application provides an authentication method and device for a network camera, so as to improve the authentication security of a terminal to log in to an IPC.
  • this application provides a network camera authentication method, including: receiving an authentication request sent by a terminal, the authentication request including account information and device information of the terminal; when the account information matches the trusted account information, and the When the device information and the trusted device information match, the terminal is determined to be a trusted device, and the trusted account information and the trusted device information are stored in a secure partition of the storage area corresponding to the trusted execution environment.
  • the IPC pre-stores a whitelist in the security partition of the storage area corresponding to the local trusted execution environment, and records the account information and device information of the trusted device in the whitelist.
  • the trusted execution environment The terminal is authenticated based on the account information and device information in the whitelist to avoid malicious login after the account is stolen, ensure that the information will not be stolen, and improve the security of authentication.
  • the method before receiving the authentication request sent by the terminal, the method further includes: establishing a direct communication connection with the terminal; receiving an initial authentication request sent by the terminal, the initial authentication request including the initial account information and the terminal's Initial device information; the initial account information and the initial device information are stored in the secure partition of the storage area corresponding to the trusted execution environment.
  • a direct communication method is adopted. Since it does not depend on the external network environment, communication is only carried out between the terminal and the IPC to ensure the trustworthiness of the terminal, and the IPC is in a trusted execution environment Perform authentication processing and record whitelisting to ensure the safety and reliability of the processing process, avoid information theft, and improve the security of authentication.
  • the method further includes: encrypting video data to generate a video code stream; and sending the video code stream to the terminal.
  • the video code stream also includes a digital signature.
  • the account information and the device information included in the authentication request are encrypted and processed by the terminal using the first public key; after receiving the authentication request sent by the terminal, it further includes:
  • the first private key is used in the environment to decrypt the authentication request to obtain the account information and the device information.
  • the initial account information and the initial device information included in the initial authentication request are encrypted and processed by the terminal using the first public key; after receiving the initial authentication request sent by the terminal, the method further includes: The initial authentication request is decrypted by using the first private key in the trusted execution environment to obtain the initial account information and the initial device information.
  • the first public key and the first private key are a pair of key pairs.
  • the key pair is generated based on the identification information of the central processing unit chip of the network camera.
  • this application provides a method for authentication of a network camera, including: obtaining device information and account information input by a user; encrypting the account information and the device information using a first public key; sending an authentication request to the network camera , The authentication request includes the encrypted account information and the device information; after the network camera is authenticated, log in to the network camera.
  • the IPC pre-stores a whitelist in the security partition of the storage area corresponding to the local trusted execution environment, and records the account information and device information of the trusted device in the whitelist.
  • the trusted execution environment The terminal is authenticated based on the account information and device information in the whitelist to avoid malicious login after the account is stolen, ensure that the information will not be stolen, and improve the security of authentication.
  • the method before acquiring the device information and the account information input by the user, the method further includes: establishing a direct communication connection with the IPC; acquiring the initial device information and the initial account information input by the user, and using the first public The key encrypts the initial device information and the initial account information; and sends an initial authentication request to the IPC.
  • the initial authentication request includes the encrypted initial account information and the initial device information.
  • a direct communication method is adopted. Since it does not depend on the external network environment, communication is only carried out between the terminal and the IPC to ensure the trustworthiness of the terminal, and the IPC is in a trusted execution environment Perform authentication processing and record whitelisting to ensure the safety and reliability of the processing process, avoid information theft, and improve the security of authentication.
  • the method further includes: receiving a video stream sent by the network camera, the video stream including video data; and decrypting the video stream using the first public key Get the video data.
  • the video code stream further includes a digital signature; after logging in the network camera, it further includes: verifying the digital signature.
  • the present application provides an authentication device for a network camera, including: a transceiver module for receiving an authentication request sent by a terminal, the authentication request including account information and device information of the terminal; a security module, used for the account When the information matches the trusted account information, and the device information matches the trusted device information, the terminal is determined to be a trusted device, and the trusted account information and the trusted device information are stored in the storage corresponding to the trusted execution environment In the safe partition of the area.
  • the transceiver module is also used to establish a direct communication connection with the terminal; to receive an initial authentication request sent by the terminal, where the initial authentication request includes initial account information and initial device information of the terminal;
  • the security module is also used to store the initial account information and the initial device information in the secure partition of the storage area corresponding to the trusted execution environment.
  • the security module is also used to encrypt video data to generate a video code stream; the transceiver module is also used to send the video code stream to the terminal.
  • the video code stream also includes a digital signature.
  • the account information and the device information included in the authentication request are encrypted by the terminal using the first public key; the security module is also used to use the first public key in the trusted execution environment.
  • the private key decrypts the authentication request to obtain the account information and the device information.
  • the initial account information and the initial device information included in the initial authentication request are encrypted by the terminal using the first public key; the security module is also used in the trusted execution environment Use the first private key to decrypt the initial authentication request to obtain the initial account information and the initial device information.
  • the first public key and the first private key are a pair of key pairs.
  • the key pair is generated based on the identification information of the central processing unit chip of the network camera.
  • the present application provides an authentication device for a network camera, including: an acquisition module for acquiring device information and account information entered by a user; a security module for using the first public key for the account information and the device information Encryption; the transceiver module is used to send an authentication request to the network camera, the authentication request includes the encrypted account information and the device information; after the network camera is authenticated, log in to the network camera.
  • the transceiver module is also used to establish a direct communication connection with the IPC; the acquisition module is also used to acquire initial device information and initial account information entered by the user, and use the first public key The initial device information and the initial account information are encrypted; the transceiver module is also used to send an initial authentication request to the IPC, the initial authentication request including the encrypted initial account information and the initial device information.
  • the transceiver module is also used to receive a video stream sent by the network camera, and the video stream includes video data; the security module is also used to use the first public key for the video The code stream is decrypted to obtain the video data.
  • the video code stream further includes a digital signature; the security module is also used to verify the digital signature.
  • this application provides a network camera device, including: a processor and a transmission interface;
  • the processor reads the program instructions in the memory to perform the following steps: receive an authentication request sent by the terminal through the transmission interface, the authentication request includes account information and device information of the terminal; when the account information matches the trusted account information And when the device information matches the trusted device information, the terminal is determined to be a trusted device, and the trusted account information and the trusted device information are stored in a secure partition of the storage area corresponding to the trusted execution environment.
  • the processor reads the program instructions to perform the following steps: establish a direct communication connection with the terminal through the transmission interface; receive an initial authentication request sent by the terminal, the initial authentication request including the initial Account information and initial device information of the terminal; storing the initial account information and the initial device information in a secure partition of the storage area corresponding to the trusted execution environment.
  • the processor reads the program instructions to perform the following steps: encrypt video data to generate a video code stream; send the video code stream to the terminal through the transmission interface.
  • the video code stream also includes a digital signature.
  • the account information and the device information included in the authentication request have been encrypted and processed by the terminal using the first public key; the processor reads the program instructions to perform the following steps:
  • the first private key is used in the trusted execution environment to decrypt the authentication request to obtain the account information and the device information.
  • the initial account information and the initial device information included in the initial authentication request were encrypted and processed by the terminal using the first public key; the processor reads the program instructions to perform the following steps:
  • the initial authentication request is decrypted by using the first private key in the trusted execution environment to obtain the initial account information and the initial device information.
  • the first public key and the first private key are a pair of key pairs.
  • the key pair is generated based on the identification information of the central processing unit chip of the network camera.
  • this application provides a terminal, including:
  • One or more processors are One or more processors;
  • Memory used to store one or more programs
  • the one or more processors When the one or more programs are executed by the one or more processors, the one or more processors implement the method as in any one of the above second aspect.
  • the present application provides a computer-readable storage medium that stores an instruction that, when the instruction runs on a computer or a processor, causes the computer or the processor to execute the first or Any of the two methods.
  • this application provides a computer program product, which when the computer program product runs on a computer or a processor, causes the computer or the processor to execute the method in any one of the first or second aspects above.
  • Fig. 1 is a schematic diagram of an exemplary software framework of an IPC trusted environment provided by an embodiment of the application;
  • FIG. 2 is a schematic diagram of an exemplary IPC software and hardware architecture provided by an embodiment of the application
  • FIG. 3 is a schematic structural diagram of an exemplary IPC remote monitoring system provided by an embodiment of the application.
  • Fig. 4 is a flowchart of an exemplary authentication method of a network camera provided by an embodiment of the application
  • Fig. 5 is a flowchart of another exemplary authentication method of a network camera provided by an embodiment of the application.
  • FIG. 6 is a flowchart of yet another exemplary authentication method of a network camera according to an embodiment of the application.
  • FIG. 7 is a schematic structural diagram of an exemplary authentication device for a network camera according to an embodiment of the application.
  • FIG. 8 is a schematic structural diagram of another exemplary authentication device for a network camera according to an embodiment of the application.
  • FIG. 9 is a schematic structural diagram of an exemplary network camera device provided by an embodiment of the application.
  • At least one (item) refers to one or more, and “multiple” refers to two or more.
  • “And/or” is used to describe the association relationship of associated objects, indicating that there can be three types of relationships, for example, “A and/or B” can mean: only A, only B, and both A and B , Where A and B can be singular or plural.
  • the character “/” generally indicates that the associated objects are in an “or” relationship.
  • the following at least one item (a)” or similar expressions refers to any combination of these items, including any combination of a single item (a) or plural items (a).
  • At least one (a) of a, b or c can mean: a, b, c, "a and b", “a and c", “b and c", or "a and b and c" ", where a, b, and c can be single or multiple.
  • the trusted environment of IPC uses a mixture of hardware and software to physically isolate the two and coexist.
  • the execution environment, or by sharing part or all of the hardware, two coexisting execution environments that are logically isolated from each other are formed, namely: an ordinary non-secret execution environment and a secure confidential environment.
  • the ordinary non-confidential execution environment is also called the ordinary execution environment (Rich Execution Environment, REE)
  • the safe and confidential environment is also called the trusted execution environment (Trusted Execution Environment, TEE).
  • Fig. 1 is a schematic diagram of an exemplary software framework of an IPC trusted environment provided by an embodiment of the application.
  • the software framework of the IPC trusted environment includes REE software architecture and TEE software architecture.
  • REE is usually the operating environment of communication device operating systems such as Linux operating system, Android operating system, or Apple's mobile operating system (Iphone Operating System, iOS).
  • the REE software architecture includes client application (Client Application, CA), TEE function application programming interface (Application Programming Interface, API), TEE client API and common operating system.
  • the client application can be a client application provided to users, which can be a client application of an operator or a third-party client application, such as WeChat or Alipay.
  • the client application may have data that needs to be transmitted securely.
  • the TEE function API can provide a set of interfaces for client applications to access TEE security services (such as storage and encryption algorithms).
  • the TEE client API can provide a client application running in the REE environment to access a trusted application (TA) in the TEE environment and a communication interface for data exchange with the TA.
  • Common operating systems include public device driver modules and REE communication agent modules.
  • the public device driver module can provide the interface between the hardware device and the common operating system, and is used to notify the common operating system (Operation System, OS) of the function of the hardware device, and convert the instructions of the common operating system into commands that the hardware device can recognize .
  • REE communication agent can be used for message transmission between CA and TA.
  • TEE provides a safer and closed execution environment, which can ensure that various sensitive data are stored and protected in a trusted environment.
  • TEE software architecture includes TA, TEE internal API and trusted operating system.
  • TA runs in TEE.
  • TA can provide its users with security services (such as secure storage and encryption).
  • TA and TA can communicate with each other through TEE's internal API.
  • the TEE internal API can define a set of APIs for the TA running in the TEE. This set of APIs defines the development interface of the TA running in the TEE. Specifically, it can provide scheduling, communication and memory management interfaces, as well as providing secure storage and passwords. APIs interfaces such as services and encryption.
  • the trusted operating system includes TEE communication agent unit, trusted core framework unit and trusted functional unit. TEE communication agent and REE communication agent can be combined to realize the secure transmission of messages between client applications and TA.
  • the trusted core framework provides TA with trusted operating system functions.
  • the trusted function unit can provide auxiliary facility support to application developers.
  • FIG. 2 is a schematic diagram of an exemplary IPC software and hardware architecture provided by an embodiment of the application. As shown in Figure 2, the IPC includes the software and hardware architecture of REE, and the software and hardware architecture of TEE.
  • REE's software and hardware architecture includes REE hardware, REE hardware driver modules, common operating systems, TEE client APIs and client applications.
  • REE hardware includes input/output interfaces, memory and central processing unit (CPU) and other equipment.
  • REE hardware drivers can provide hardware device drivers for common execution environments under common operating systems, such as embedded multimedia card (Embedded MultiMedia Card, EMMC) and other hardware device drivers.
  • EMMC embedded MultiMedia Card
  • Common operating systems include REE communication agents and REE applications under common operating systems, such as client applications in REE that access TA in TEE.
  • the TEE client API can provide an interface for client applications to access the TA, and can use the global platform (global platform, GP) client standard interface.
  • global platform global platform, GP
  • TEE's software and hardware architecture includes secure hardware, secure hardware drivers, trusted operating systems, TEE internal core APIs and TAs.
  • Security hardware includes devices such as security input/output interfaces, security processors, security memories, and trusted devices.
  • the safety input/output interface in the safety hardware can be a safety mode of the REE input/output interface, or it can be an input/output interface isolated from the REE input/output interface; safety processor It can be a safe mode of the CPU in the REE, or a processor isolated from the CPU; the safe memory can be a partition of the memory in the REE, or a safe mode of the memory in the REE.
  • the secure hardware driver can provide drivers for secure hardware devices, such as fingerprint device drivers, which are used to read fingerprint information of fingerprint collection devices (trusted devices), which are files to be stored; EMMC drivers can be used to read the information in EMMC File or write files to EMMC, etc.
  • a trusted operating system can provide trusted operating system functions, such as core security function modules such as storage, encryption (such as hash operations, encryption operations), and TEE communication agents.
  • the processing module can provide unified secure data storage services and APIs in the TEE environment.
  • the encryption module can provide security services such as encryption and decryption, private key signature and hash calculation in the TEE environment.
  • FIG. 3 is a schematic structural diagram of an exemplary IPC remote monitoring system provided by an embodiment of the application.
  • the system includes IPC and terminals, where IPC is deployed in public areas as required Cameras in access control areas, etc., which can be connected to the network to receive control commands and transmit video streams.
  • the terminals are mobile phones, computers, tablets and other devices used by managers.
  • the terminals can establish a connection with IPC through access to the network. Control the IPC to change the shooting angle, direction, duration, etc., and can also receive the video stream transmitted by the IPC to realize real-time monitoring.
  • IPC includes CPU, memory, and hard disk (such as flash).
  • the hard disk includes a secure partition.
  • the secure partition can be a partition of the memory in the hard disk or a safe mode of the hard disk.
  • the secure partition is dedicated to a trusted execution environment .
  • a security encryption module is set between the memory and the hard disk, which is used to encrypt part or all of the data in the memory and store it in the hard disk.
  • the CPU includes two coexisting execution environments, namely REE and TEE. For example, under TEE, you can For a large number of applications on high-performance computing platforms, such as secure payment, Digital Rights Management (DRM), enterprise services, and Web-based services.
  • the terminal can be installed on the corresponding application (Application, APP) to realize the control and management of the IPC, the user can open the APP on the terminal, input instructions through the keyboard or touch screen, and watch the IPC surveillance video content on the screen.
  • a communication module can be set on the IPC and the terminal.
  • the communication module can include wireless fidelity (Wireless-Fidelity, WiFi), Bluetooth, and Near Field Communication (NFC) modules to realize the proximity between the IPC and the terminal.
  • wireless fidelity Wireless-Fidelity, WiFi
  • Bluetooth Wireless-Fidelity
  • NFC Near Field Communication
  • the communication module can also include 4G, 5G and other communication modules.
  • the authentication method of the network camera provided in this application is suitable for the system shown in Figure 3.
  • the terminal needs to be authenticated by the IPC.
  • Trusted device information is recorded in the IPC.
  • the trusted device can include terminals that have successfully logged in, and can also include trusted terminals that have been recorded in advance.
  • IPC can record the above trusted devices in the form of a whitelist Account information (user name and password), and device information such as identity (ID), model, and media access control (MAC) address.
  • the terminal When the terminal requests to log in to the IPC, if the account information (user name and password) and device information entered are consistent with the information recorded on the whitelist, it means that the terminal has passed the authentication, and the IPC only allows the terminals recorded on the whitelist to log in and call monitoring Video, which strengthens the security of terminal authentication.
  • the terminal logs in to the IPC for the first time.
  • the terminal is directly connected to the IPC through short-range communication technologies such as WiFi, Bluetooth, NFC, etc., eliminating the network transfer, and ensuring the first login to the IPC The terminal is trustworthy.
  • IPC records the account information and device information of the terminal that logs in for the first time in the whitelist.
  • the terminal routinely logs in to the IPC, and the terminal at this time has been recorded in the IPC whitelist.
  • the terminal can remotely try to access the IPC through the network, as long as the terminal's account information and device information and records If it matches, it can be authenticated.
  • the account information and device information of the terminal match the trusted account information and trusted device information, which means that the input terminal account information and terminal device information are in the whitelist One of multiple messages.
  • the terminal may also be directly connected to the IPC through the short-range communication technology, and this application does not specifically limit the communication technology in this scenario.
  • the terminal logs in to the IPC for the first time before the terminal logs in to the IPC for the first time, its information has been recorded in the whitelist, so that when the terminal logs in to the IPC for the first time, it can remotely try to access the IPC through the network or communicate with the IPC through short-range communication technology.
  • IPC direct connection as long as the terminal's account information and device information match the record, it can be authenticated.
  • Fig. 4 is a flowchart of an exemplary network camera authentication method provided by an embodiment of the application. As shown in Fig. 4, the method in this embodiment is a process of a terminal routinely logging in to an IPC, which may include:
  • Step 401 The terminal obtains device information and account information input by the user.
  • the user In the process of regular use of the terminal, when the user wants to retrieve the surveillance video taken by the IPC, or wants to perform real-time surveillance, the user first needs to log in to the corresponding IPC.
  • the user enters the account information that has been set through the keyboard or touch screen.
  • the terminal can obtain the device information by reading the relevant memory set at the factory, and the attribute information of the terminal is stored in the memory, such as the terminal's ID, type, MAC address, etc.
  • Step 402 The terminal sends an authentication request to the IPC.
  • the authentication request includes the aforementioned account information and device information.
  • Step 403 When the account information matches the trusted account information, and the device information matches the trusted device information, the IPC determines that the terminal is a trusted device.
  • the trusted account information and the trusted device information are stored in the secure partition of the storage area corresponding to the trusted execution environment.
  • the IPC pre-stores a whitelist in the security partition of the storage area corresponding to the local trusted execution environment, and records the account information and device information of the trusted device in the whitelist.
  • the IPC executes in the trusted In the environment, the terminal is authenticated based on the account information and device information in the whitelist, avoiding malicious login after the account is stolen, ensuring that the information is not stolen, and improving the security of authentication.
  • Fig. 5 is a flowchart of another exemplary authentication method of a network camera provided by an embodiment of this application. As shown in Fig. 5, the method of this embodiment is a process for a terminal to log in to an IPC for the first time, which may include:
  • Step 501 The terminal establishes a direct communication connection with the IPC.
  • the terminal logs into the IPC for the first time, in order to ensure that the device is trustworthy, it needs to establish a direct short-range communication connection with the IPC at a location close to the IPC, including the use of WiFi, Bluetooth, NFC and other technologies.
  • Step 502 The terminal obtains the initial device information and the initial account information input by the user, and uses the first public key to encrypt the initial device information and the initial account information.
  • the initial device information and initial account information are the information obtained when the terminal logs in to the IPC for the first time.
  • the user enters the initial account information set through the keyboard or touch screen, such as user name and password.
  • the initial device information includes ID, model, MAC address, etc.
  • the terminal can The device information is obtained by reading the relevant memory set at the factory, and the attribute information of the terminal is stored in the memory.
  • the manufacturer will generate the first key pair (including the first public key and the first private key) based on the ID of the IPC CPU, which is used to encrypt and decrypt the transmitted data.
  • the second key pair (including the second The public key and the second private key) are used to generate digital certificates and digital signatures.
  • the key pair can be generated using an asymmetric encryption algorithm, such as the RSA encryption algorithm.
  • Step 503 The terminal sends an initial authentication request to the IPC.
  • the initial authentication request includes the encrypted initial account information and initial device information.
  • the terminal carries the encrypted information in the initial authentication request and sends it to the IPC to ensure the security of the data during transmission.
  • Step 504 The IPC uses the first private key in the trusted execution environment to decrypt the initial authentication request to obtain initial account information and initial device information.
  • the IPC After receiving the initial authentication request of the terminal, the IPC uses the first private key paired with the first public key in the trusted execution environment to decrypt the initial authentication request to obtain the initial account information and initial device information.
  • the trusted execution environment provides a safer and closed execution environment, which can ensure that all kinds of sensitive data are stored and protected in a trusted environment. Therefore, IPC decrypts and obtains the initial account in the trusted execution environment Information and initial device information can ensure that information will not be stolen and strengthen the security of IPC identity authentication.
  • Step 505 The IPC encrypts the initial account information and the initial device information in the trusted execution environment, and stores them in the secure partition of the storage area corresponding to the trusted execution environment.
  • IPC records the initial account information and initial device information in the whitelist in the trusted execution environment, and there is a corresponding relationship between the account information and device information in the whitelist, and IPC stores the whitelist in the storage area corresponding to the trusted execution environment (Such as flash) in the secure partition.
  • IPC can also internally encrypt the initial account information and initial device information in a trusted execution environment and record it in the whitelist, or record the initial account information and initial device information in the whitelist. , Encrypt the whitelist, and then store it in a secure partition (such as flash) in the storage area corresponding to the trusted execution environment.
  • the trusted execution environment provides a safer and closed execution environment, which can ensure that all kinds of sensitive data are stored and protected in a trusted environment. Therefore, the IPC performs a trustworthy execution environment for initial account information and The initial device information is encrypted to ensure the safety and reliability of the processing process and prevent information from being stolen.
  • a direct communication method is adopted. Since it does not depend on the external network environment, communication is only carried out between the terminal and the IPC to ensure the trustworthiness of the terminal, and the IPC is in a trusted execution environment Perform authentication processing and record whitelisting to ensure the safety and reliability of the processing process, avoid information theft, and improve the security of authentication.
  • Fig. 6 is a flowchart of another exemplary authentication method of a network camera provided by an embodiment of the application. As shown in Fig. 6, the method of this embodiment is a process of a terminal routinely logging in to an IPC, which may include:
  • Step 601 The terminal obtains device information and account information input by the user.
  • the terminal logs in for the first time, in the process of regular use, when the user wants to retrieve the surveillance video taken by the IPC, or wants to perform real-time monitoring, he first needs to log in to the corresponding IPC.
  • the user enters the account information that has been set through the keyboard or touch screen.
  • the terminal can obtain the device information by reading the relevant memory set at the factory, and the attribute information of the terminal is stored in the memory, such as the terminal's ID, type, MAC address, etc.
  • Step 602 The terminal uses the first public key to encrypt account information and device information.
  • the terminal uses the first public key to encrypt the account information and device information.
  • Step 603 The terminal sends an authentication request to the IPC.
  • the authentication request includes encrypted account information and device information.
  • Step 604 The IPC uses the first private key in the trusted execution environment to decrypt the authentication request to obtain account information and device information.
  • the IPC After receiving the authentication request from the terminal, the IPC uses the first private key paired with the first public key in the trusted execution environment to decrypt the authentication request to obtain account information and device information.
  • the trusted execution environment provides a safer and closed execution environment, which can ensure that various sensitive data is stored and protected in a trusted environment. Therefore, IPC decrypts and obtains account information in the trusted execution environment And equipment information can ensure that information will not be stolen, and strengthen the security of IPC identity authentication.
  • Step 605 If the account information and device information match the trusted account information and the trusted device information, the IPC determines that the terminal is a trusted device.
  • the above-mentioned trusted account information and trusted device information are stored in a secure partition of the storage area corresponding to the trusted execution environment.
  • IPC matches the account information and device information with the information in the whitelist in the trusted execution environment. If the account information (user name and password) that is the same as the received account information (user name and password) is queried in the white list, And the device information corresponding to the account information in the whitelist is also the same as the received device information, which indicates that the terminal is trustworthy and the terminal login is successful.
  • Step 606 The terminal logs in to the IPC.
  • the IPC can use the first private key to encrypt the video data to generate a video code stream, and send the video code stream to the terminal.
  • IPC can also carry a digital signature in the code stream, that is, IPC uses a hash function to generate a digest from the video data, and then uses the second private key to encrypt the digest to generate a digital signature.
  • the digital signature and the video data are encrypted with the first private key and sent to the terminal.
  • the terminal after receiving the video stream, the terminal first decrypts it with the first public key to obtain the video data and digital signature, and then uses the same hash function as the IPC to calculate the digest from the received video stream, and then Use the second public key to decrypt the digital signature. If the decrypted digest is the same as the hash calculated digest, the terminal can confirm that the digital signature is IPC. This can ensure the correctness of the source of the data and improve security.
  • the IPC checks in the TrustZone environment that the device information of the terminal that initiated the login request does not match the device information in the whitelist, and cannot log in. IPC thus obtains surveillance video. Moreover, IPC can also send information based on the network to the terminals recorded in the whitelist, allowing legitimate users to confirm whether the login information is abnormal. If the user confirms that the login is not abnormal, IPC can add the device information of the new terminal to the whitelist and let The terminal is successfully logged in. If the user confirms that it is an abnormal login, the IPC does not allow the terminal to log in.
  • the IPC pre-stores a whitelist in the security partition of the storage area corresponding to the local trusted execution environment, and records the account information and device information of the trusted device in the whitelist.
  • the trusted execution environment The terminal is authenticated based on the account information and device information in the whitelist to avoid malicious login after the account is stolen, ensure that the information will not be stolen, and improve the security of authentication.
  • FIG. 7 is a schematic structural diagram of an exemplary network camera authentication device provided by an embodiment of this application.
  • the device of this embodiment can be set in an IPC, which includes a transceiver module 701 and a security module 702, Among them, the transceiver module 701 is used to receive an authentication request sent by the terminal, the authentication request includes account information and device information of the terminal; the security module 702 is used when the account information matches the trusted account information, and all When the device information matches the trusted device information, it is determined that the terminal is a trusted device, and the trusted account information and the trusted device information are stored in a secure partition of the storage area corresponding to the trusted execution environment.
  • the transceiver module 701 is used to receive an authentication request sent by the terminal, the authentication request includes account information and device information of the terminal; the security module 702 is used when the account information matches the trusted account information, and all When the device information matches the trusted device information, it is determined that the terminal is a trusted device, and the trusted account information and the trusted device information are stored in
  • the transceiver module 701 is also used to establish a direct communication connection with the terminal; to receive an initial authentication request sent by the terminal, where the initial authentication request includes initial account information and the terminal The initial device information; the security module 702 is also used to store the initial account information and the initial device information in the secure partition of the storage area corresponding to the trusted execution environment.
  • the security module 702 is also used to encrypt video data to generate a video code stream; the transceiver module 701 is also used to send the video code stream to the terminal.
  • the video code stream further includes a digital signature.
  • the account information and the device information included in the authentication request are encrypted by the terminal using the first public key; the security module 702 is also used to The first private key is used in the trusted execution environment to decrypt the authentication request to obtain the account information and the device information.
  • the initial account information and the initial device information included in the initial authentication request are encrypted by the terminal using a first public key; the security module 702 is also used to The first private key is used in the trusted execution environment to decrypt the initial authentication request to obtain the initial account information and the initial device information.
  • the first public key and the first private key are a pair of key pairs.
  • the key pair is generated based on the identification information of the central processing unit chip of the network camera.
  • the device in this embodiment can be used to implement the technical solutions of any of the method embodiments shown in FIGS. 4-6, and its implementation principles and technical effects are similar, and will not be repeated here.
  • FIG. 8 is a schematic structural diagram of another exemplary network camera authentication device provided by an embodiment of the application.
  • the device of this embodiment can be set in a terminal, and includes: an acquisition module 801, a security module 802 And a transceiver module 803, wherein the acquisition module 801 is used to acquire device information and account information entered by the user; the security module 802 is used to encrypt the account information and the device information using the first public key; the transceiver module 803 , Used to send an authentication request to the network camera, the authentication request including the encrypted account information and the device information; after the network camera is authenticated, log in to the network camera.
  • the transceiver module 803 is also used to establish a direct communication connection with the IPC; the acquisition module 801 is also used to acquire initial device information and initial account information entered by the user, and use The first public key encrypts the initial device information and the initial account information; the transceiver module 803 is further configured to send an initial authentication request to the IPC, and the initial authentication request includes the encrypted Initial account information and the initial device information.
  • the transceiver module 803 is further configured to receive a video stream sent by the network camera, and the video stream includes video data; the security module 802 is also used to use the The first public key decrypts the video code stream to obtain the video data.
  • the video code stream further includes a digital signature; the security module 802 is also used to verify the digital signature.
  • the device in this embodiment can be used to implement the technical solutions of any of the method embodiments shown in FIGS. 4-6, and its implementation principles and technical effects are similar, and will not be repeated here.
  • FIG. 9 is a schematic structural diagram of an exemplary network camera device provided by an embodiment of the application.
  • the network camera device 900 includes a processor 901, a memory 902, and a bus 903; among them, the processor 901 and the memory 902 They can be connected to each other via the bus 903.
  • the processor 901 is configured to authenticate the account information and device information of the terminal under the trusted execution environment TEE; write a whitelist that records the trusted device information into the secure partition in the memory 902; the secure partition is used to prevent The whitelist has been tampered with and/or rolled back.
  • the processor 901 may be a central processing unit (Central Processing Unit, CPU), a network processor (Network Processor, NP), or a combination of CPU and NP.
  • the processor 901 may further include a hardware chip.
  • the foregoing hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (Programmable Logic Device, PLD), or a combination thereof.
  • the above-mentioned PLD may be a complex programmable logic device (Comple Programmable Logic Device, CPLD), a Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA), a Generic Array Logic (Generic Array Logic, GAL) or any combination thereof.
  • the memory 902 can be used to store computer program instructions, including an operating system (Operation System, OS), various user application programs, and various computer program codes for executing the solutions of the present application; the memory can also be used for Store video data, image signal data, etc.; the processor 901 calls the stored program instructions to execute one or more steps in the embodiments shown in the above solutions, or optional implementation manners thereof.
  • OS Operating System
  • OS Operation System
  • user application programs various computer program codes for executing the solutions of the present application
  • the memory can also be used for Store video data, image signal data, etc.
  • the processor 901 calls the stored program instructions to execute one or more steps in the embodiments shown in the above solutions, or optional implementation manners thereof.
  • the memory 902 may include a non-power-down volatile memory, such as an embedded multimedia card (Embedded Multi Media Card, EMMC), universal flash storage (Universal Flash Storage, UFS), or read-only memory (Read-Only Memory, ROM), Or other types of static storage devices that can store static information and instructions, or volatile memory (volatile memory), such as Random Access Memory (RAM), or other types that can store information and instructions
  • EMMC embedded Multi Media Card
  • UFS Universal Flash Storage
  • ROM Read-Only Memory
  • volatile memory volatile memory
  • volatile memory volatile memory
  • RAM Random Access Memory
  • the type of dynamic storage device can also be Electrically Erasable Programmable Read-Only Memory (EEPROM), CD-ROM (Compact Disc Read-Only Memory, CD-ROM), or other optical disk storage, optical disc Storage (including compact discs, laser discs, optical discs, digital universal discs, Blu-ray discs, etc.), disk storage media or other magnetic storage devices, or can be used to carry or store program codes in the form of instructions or
  • the bus 903 may be a Peripheral Component Interconnect (PCI for short) bus or an Extended Industry Standard Architecture (EISA) bus, etc.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the bus can be divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in FIG. 9, but it does not mean that there is only one bus or one type of bus.
  • the memory 902 may also be integrated with the processor 901.
  • the communication device further includes a transmission interface; the transmission interface is used to: receive an authentication request, the authentication request includes the terminal's account information and device information; send a video stream, the video stream Including video data.
  • the transmission interface may be an interface used by the chip to send or receive data, code stream or various signals.
  • the processor may be considered as the chip except for Other parts other than the transmission interface.
  • the transmission interface may be considered as a part of the processor, and the processor sends or receives data through the transmission interface.
  • the present application provides a computer-readable storage medium that stores an instruction that when the instruction runs on a computer or processor, causes the computer or the processor to The device executes the method in any one of the embodiments shown in FIGS. 4-6.
  • this application provides a computer program product.
  • the computer program product runs on a computer or a processor
  • the computer or the processor can execute any of A method in the illustrated embodiment.
  • the disclosed device and method may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the unit described as a separate component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or may be distributed to multiple network units . Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware, or may be implemented in the form of hardware plus software functional units.
  • the above-mentioned integrated unit implemented in the form of a software functional unit may be stored in a computer readable storage medium.
  • the above-mentioned software functional unit is stored in a storage medium and includes several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor execute the method described in the various embodiments of the present application. Part of the steps.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code .

Abstract

本申请提供一种网络摄像机的认证方法和装置。本申请网络摄像机的认证方法，包括：接收终端发送的认证请求，所述认证请求包括账号信息和所述终端的设备信息；当所述账号信息和可信任账号信息匹配，且所述设备信息和可信任设备信息匹配时，确定所述终端为可信任设备，所述可信任账号信息和所述可信任设备信息存储在与可信任执行环境对应的存储区域的安全分区中。本申请有效的提升了终端登录IPC的认证安全性。

Description

网络摄像机的认证方法和装置 技术领域
本申请涉及网络安全技术，尤其涉及一种网络摄像机的认证方法和装置。
背景技术
网络摄像机(IP Camera，IPC)通常用于安防行业，实现远程监控的功能。目前IPC普遍采用用户名/密码的方式进行安全管理，即用户自行设定用户名和密码，该用户名和密码存储在IPC或者云端，用户通过终端登录IPC时只要输入的用户名和密码匹配上就可以登录成功，获取IPC传送过来的视频数据，实现异地远程监控。
但是，这种认证方式只要是持有用户名和密码的人都可以登录到IPC获取视频数据，导致隐私泄露，甚至是被黑客攻击导致更多账户信息、个人数据的泄露，安全性薄弱。
发明内容
本申请提供一种网络摄像机的认证方法和装置，以提升终端登录IPC的认证安全性。
第一方面，本申请提供一种网络摄像机的认证方法，包括：接收终端发送的认证请求，该认证请求包括账号信息和该终端的设备信息；当该账号信息和可信任账号信息匹配，且该设备信息和可信任设备信息匹配时，确定该终端为可信任设备，该可信任账号信息和该可信任设备信息存储在与可信任执行环境对应的存储区域的安全分区中。
本实施例IPC预先在本地可信任执行环境对应的存储区域的安全分区中存储白名单，在该白名单中记录可信任设备的账号信息和设备信息，当终端请求认证时，在可信任执行环境中基于白名单中的账号信息和设备信息对终端进行认证，避免账号被盗用后的恶意登录，确保信息不会被盗用，提升了认证的安全性。
在一种可能的实现方式中，该接收终端发送的认证请求之前，还包括：与该终端建立通信直连；接收该终端发送的初始认证请求，该初始认证请求包括初始账号信息和该终端的初始设备信息；将该初始账号信息和该初始设备信息存入与该可信任执行环境对应的存储区域的安全分区中。
本实施例在终端初始登录IPC时，采用通信直连的方式，由于不依赖于外部网络环境，仅在终端和IPC之间进行通信，确保终端的可信任性，而且IPC在可信任执行环境中进行认证处理和记录白名单，确保处理过程的安全可靠，避免信息被盗取，提升了认证的安全性。
在一种可能的实现方式中，该确定该终端为可信任设备之后，还包括：对视频数据进行加密生成视频码流；向该终端发送该视频码流。
在一种可能的实现方式中，该视频码流还包括数字签名。
在一种可能的实现方式中，该认证请求包括的该账号信息和该设备信息经该终端使用第一公钥加密处理过；该接收终端发送的认证请求之后，还包括：在该可信任执行环境中使用第一私钥对该认证请求进行解密获取该账号信息和该设备信息。
在一种可能的实现方式中，该初始认证请求包括的该初始账号信息和该初始设备信息经该终端使用第一公钥加密处理过；该接收该终端发送的初始认证请求之后，还包括：在该可信任执行环境中使用第一私钥对该初始认证请求进行解密获取该初始账号信息和该初始设备信息。
在一种可能的实现方式中，该第一公钥和该第一私钥为一对密钥对。
在一种可能的实现方式中，该密钥对基于网络摄像机的中央处理器芯片的标识信息生成。
第二方面，本申请提供一种网络摄像机的认证方法，包括：获取设备信息和用户输入的账号信息；使用第一公钥对该账号信息和该设备信息进行加密；向该网络摄像机发送认证请求，该认证请求包括加密过的该账号信息和该设备信息；在该网络摄像机认证通过后，登录该网络摄像机。
本实施例IPC预先在本地可信任执行环境对应的存储区域的安全分区中存储白名单，在该白名单中记录可信任设备的账号信息和设备信息，当终端请求认证时，在可信任执行环境中基于白名单中的账号信息和设备信息对终端进行认证，避免账号被盗用后的恶意登录，确保信息不会被盗用，提升了认证的安全性。
在一种可能的实现方式中，该获取设备信息和用户输入的账号信息之前，还包括：与该IPC建立通信直连；获取初始设备信息和用户输入的初始账号信息，并使用该第一公钥对该初始设备信息和该初始账号信息进行加密；向该IPC发送初始认证请求，该初始认证请求包括加密过的该初始账号信息和该初始设备信息。
本实施例在终端初始登录IPC时，采用通信直连的方式，由于不依赖于外部网络环境，仅在终端和IPC之间进行通信，确保终端的可信任性，而且IPC在可信任执行环境中进行认证处理和记录白名单，确保处理过程的安全可靠，避免信息被盗取，提升了认证的安全性。
在一种可能的实现方式中，该登录该网络摄像机之后，还包括：接收该网络摄像机发送的视频码流，该视频码流包括视频数据；使用该第一公钥对该视频码流进行解密获取该视频数据。
在一种可能的实现方式中，该视频码流还包括数字签名；该登录该网络摄像机之后，还包括：对该数字签名进行校验。
第三方面，本申请提供一种网络摄像机的认证装置，包括：收发模块，用于接收终端发送的认证请求，该认证请求包括账号信息和该终端的设备信息；安全模块，用于当该账号信息和可信任账号信息匹配，且该设备信息和可信任设备信息相匹配时，确定该终端为可信任设备，该可信任账号信息和该可信任设备信息存储在与可信任执行环境对应的存储区域的安全分区中。
在一种可能的实现方式中，该收发模块，还用于与该终端建立通信直连；接收该终端发送的初始认证请求，该初始认证请求包括初始账号信息和该终端的初始设备信息；该安全模块，还用于将该初始账号信息和该初始设备信息存入与该可信任执行环境对应的存储区域的安全分区中。
在一种可能的实现方式中，该安全模块，还用于对视频数据进行加密生成视频码流；该收发模块，还用于向该终端发送该视频码流。
在一种可能的实现方式中，该视频码流还包括数字签名。
在一种可能的实现方式中，该认证请求包括的该账号信息和该设备信息为该终端使用第一公钥加密处理过；该安全模块，还用于在该可信任执行环境中使用第一私钥对该认证请求进行解密获取该账号信息和该设备信息。
在一种可能的实现方式中，该初始认证请求包括的该初始账号信息和该初始设备信息为该终端使用第一公钥加密处理过；该安全模块，还用于在该可信任执行环境中使用第一私钥对该初始认证请求进行解密获取该初始账号信息和该初始设备信息。
在一种可能的实现方式中，该第一公钥和该第一私钥为一对密钥对。
在一种可能的实现方式中，该密钥对基于网络摄像机的中央处理器芯片的标识信息生成。
第四方面，本申请提供一种网络摄像机的认证装置，包括：获取模块，用于获取设备信息和用户输入的账号信息；安全模块，用于使用第一公钥对该账号信息和该设备信息进行加密；收发模块，用于向网络摄像机发送认证请求，该认证请求包括加密过的该账号信息和该设备信息；在该网络摄像机认证通过后，登录该网络摄像机。
在一种可能的实现方式中，该收发模块，还用于与该IPC建立通信直连；该获取模块，还用于获取初始设备信息和用户输入的初始账号信息，并使用该第一公钥对该初始设备信息和该初始账号信息进行加密；该收发模块，还用于向该IPC发送初始认证请求，该初始认证请求包括加密过的该初始账号信息和该初始设备信息。
在一种可能的实现方式中，该收发模块，还用于接收该网络摄像机发送的视频码流，该视频码流包括视频数据；该安全模块，还用于使用该第一公钥对该视频码流进行解密获取该视频数据。
在一种可能的实现方式中，该视频码流还包括数字签名；该安全模块，还用于对该数字签名进行校验。
第五方面，本申请提供一种网络摄像装置，包括：处理器和传输接口；
该处理器读取存储器中的程序指令，以执行如下步骤：通过该传输接口接收终端发送的认证请求，该认证请求包括账号信息和该终端的设备信息；当该账号信息和可信任账号信息匹配，且该设备信息和可信任设备信息匹配时，确定该终端为可信任设备，该可信任账号信息和该可信任设备信息存储在与该可信任执行环境对应的存储区域的安全分区中。
在一种可能的实现方式中，该处理器读取该程序指令，以执行如下步骤：通过该传输接口与该终端建立通信直连；接收该终端发送的初始认证请求，该初始认证请求包括初始账号信息和该终端的初始设备信息；将该初始账号信息和该初始设备信息存入与该可信任执行环境对应的存储区域的安全分区中。
在一种可能的实现方式中，该处理器读取该程序指令，以执行如下步骤：对视频数据进行加密生成视频码流；通过该传输接口向该终端发送该视频码流。
在一种可能的实现方式中，该视频码流还包括数字签名。
在一种可能的实现方式中，该认证请求包括的该账号信息和该设备信息为该终端使用第一公钥加密处理过；该处理器读取该程序指令，以执行如下步骤：在该可信任执行环境中使用第一私钥对该认证请求进行解密获取该账号信息和该设备信息。
在一种可能的实现方式中，该初始认证请求包括的该初始账号信息和该初始设备信息为该终端使用第一公钥加密处理过；该处理器读取该程序指令，以执行如下步骤：在该可信任执行环境中使用第一私钥对该初始认证请求进行解密获取该初始账号信息和该初始设备信息。
在一种可能的实现方式中，该第一公钥和该第一私钥为一对密钥对。
在一种可能的实现方式中，该密钥对基于网络摄像机的中央处理器芯片的标识信息生成。
第六方面，本申请提供一种终端，包括：
一个或多个处理器；
存储器，用于存储一个或多个程序；
当该一个或多个程序被该一个或多个处理器执行，使得该一个或多个处理器实现如上述第二方面中任一项该方法。
第七方面，本申请提供一种计算机可读存储介质，该计算机可读存储介质存储有指令，当该指令在计算机或处理器上运行时，使得该计算机或该处理器执行如上述第一或二方面中任一项该的方法。
第八方面，本申请提供一种计算机程序产品，当该计算机程序产品在计算机或处理器上运行时，使得该计算机或该处理器执行如上述第一或二方面中任一项该的方法。
附图说明
图1为本申请实施例提供的一种示例性的IPC的可信环境的软件框架示意图；
图2为本申请实施例提供的一种示例性的IPC软件和硬件的架构示意图；
图3为本申请实施例提供的一种示例性的IPC远程监控系统的结构示意图；
图4为本申请实施例提供的一种示例性的网络摄像机的认证方法的流程图
图5为本申请实施例提供的另一种示例性的网络摄像机的认证方法的流程图；
图6为本申请实施例提供的再一种示例性的网络摄像机的认证方法的流程图；
图7为本申请实施例提供的一种示例性的网络摄像机的认证装置的结构示意图；
图8为本申请实施例提供的另一种示例性的网络摄像机的认证装置的结构示意图；
图9为本申请实施例提供的一种示例性的网络摄像装置的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合本申请中的附图，对本申请中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请的说明书实施例和权利要求书及附图中的术语“第一”、“第二”等仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元。方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固 有的其它步骤或单元。
应当理解，在本申请中，“至少一个(项)”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，用于描述关联对象的关联关系，表示可以存在三种关系，例如，“A和/或B”可以表示：只存在A，只存在B以及同时存在A和B三种情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b或c中的至少一项(个)，可以表示：a，b，c，“a和b”，“a和c”，“b和c”，或“a和b和c”，其中a，b，c可以是单个，也可以是多个。
本申请为了保障IPC的安全性，IPC中涉及数据安全的功能的实现，需要依赖于IPC内的可信环境，IPC的可信环境通过混合使用硬件和软件的方法在物理上隔离出两个并存的执行环境，或者通过共享部分或全部硬件的方式形成在逻辑上彼此隔离的两个并存的执行环境，即：普通的非保密执行环境和安全的保密环境。其中，普通非保密执行环境又称为普通执行环境(Rich Execution Environment，REE)，安全的保密环境又称为可信任执行环境(Trusted Execution Environment，TEE)。图1为本申请实施例提供的一种示例性的IPC的可信环境的软件框架示意图。如图1所示，该IPC的可信环境的软件框架包括REE软件架构和TEE软件架构。
REE通常是Linux操作系统、安卓(Android)操作系统或苹果公司的移动操作系统(Iphone Operating System，iOS)等通信设备操作系统的运行环境。REE软件架构包括客户端应用(Client Application，CA)、TEE功能应用程序编程接口(Application Programming Interface，API)、TEE客户端API和普通操作系统等。客户端应用可提供给用户使用的客户端应用，可以是运营商的客户端应用，也可以是第三方客户端应用，比如微信或支付宝等。客户端应用可能会有需要进行安全传输的数据。TEE功能API可提供给客户端应用一套访问TEE安全服务(比如存储和加密算法)的接口。TEE客户端API可提供运行于REE环境的客户端应用访问TEE环境中的可信应用(Trusted Application，TA)及与TA进行数据交换的通信接口。普通操作系统包含公共设备驱动模块及REE通信代理模块等。公共设备驱动模块可提供硬件设备和普通操作系统之间的接口，用于将硬件设备的功能通知普通操作系统(Operation System，OS)，将普通操作系统的指令，转化为硬件设备能够识别的命令。REE通信代理可用于CA与TA之间的消息传送。
TEE提供了一个较安全的封闭的执行环境，可确保各种敏感数据在一个可信环境中被存储和受到保护。TEE软件架构包括TA、TEE内部API和可信操作系统。TA运行于TEE中，TA可向它的用户提供安全服务(比如安全存储和加密)，TA与TA之间可通过TEE内部API进行通信。TEE内部API可为运行于TEE内的TA定义一套APIs，这套APIs定义运行在TEE内部的TA的开发接口，具体来说，可以提供调度、通信和内存管理接口，以及提供安全存储、密码服务和加密等APIs接口。可信操作系统包括TEE通信代理单元、可信核心框架单元和可信功能单元等。TEE通信代理与REE通信代理可结合实现客户端应用与TA之间消息的安全传送。可信核心框架向TA提供可信操作系统功能。可信功能单元可向应用开发者提供辅助设施支撑。
图2为本申请实施例提供的一种示例性的IPC软件和硬件的架构示意图。如图2所 示，该IPC包括REE的软件和硬件架构、以及TEE的软件和硬件架构。
REE的软件和硬件架构包括REE硬件、REE硬件驱动模块、普通操作系统、TEE客户端API和客户端应用等。REE硬件包括输入/输出接口、存储器和中央处理器(Central Processing Unit，CPU)等设备。REE硬件驱动可提供普通操作系统下的普通执行环境硬件设备驱动，如嵌入式多媒体卡(Embedded Multi Media Card，EMMC)等硬件设备的驱动，当普通操作系统需要使用硬件设备时，比如向EMMC写文件，普通操作系统会先发送相应指令到EMMC的驱动程序，EMMC的驱动程序接收到指令后，将指令翻译成EMMC能识别的电子信号命令，从而实现向EMMC写文件。普通操作系统包括REE通信代理及普通操作系统下的REE应用，比如可以是访问TEE中TA的REE中客户端应用。TEE客户端API可为客户端应用提供访问TA的接口，可采用全球平台组织(global platform，GP)客户端标准接口。
TEE的软件和硬件架构包括安全硬件、安全硬件驱动、可信操作系统、TEE内部核心API及TA等。安全硬件包括安全输入/输出接口、安全处理器、安全存储器及可信设备等设备。一种可能实现方式中，安全硬件中的安全输入/输出接口可以是REE的输入/输出接口的一种安全模式，也可以是与REE的输入/输出接口隔离的输入/输出接口；安全处理器可以是REE中的CPU的一种安全模式，也可以是与CPU隔离的一个处理器；安全存储器可以是REE中的存储器的分区，也可以是REE的存储器的一种安全模式。安全硬件驱动可提供安全硬件设备的驱动，比如指纹设备驱动，用于读取指纹采集设备(可信设备)的指纹信息，指纹信息为待存储的文件；EMMC驱动，可用于读取EMMC中的文件或者向EMMC写入文件等。可信操作系统可提供可信操作系统功能，例如存储、加密(如哈希运算、加密运算)和TEE通信代理等核心安全功能模块。处理模块在TEE环境下可提供统一安全数据存储服务及API。加密模块可提供在TEE环境下的加解密、私钥签名和哈希运算等安全服务。
基于上述内容，图3为本申请实施例提供的一种示例性的IPC远程监控系统的结构示意图，如图3所示，该系统包括IPC和终端，其中，IPC为按照需求部署在各公共区域、门禁区域等地的摄像头，该摄像头可以接入网络以接收控制命令和传输视频码流，终端为供管理人员使用的手机、计算机、平板等设备，终端通过接入网络可以与IPC建立连接以控制IPC改变拍摄角度、方向、时长等，还可以接收IPC传输的视频码流，实现实时监控。IPC包括CPU、内存和硬盘(例如flash)，硬盘中包括安全分区，该安全分区可以是硬盘中的存储器的分区，也可以是硬盘的一种安全模式，该安全分区专用于可信任执行环境下。在内存和硬盘之间设置有安全加密模块，用于将内存中的部分或全部数据加密后存入硬盘中，CPU包括两个并存的执行环境，即REE和TEE，示例性的，TEE下可以针对高性能计算平台上的大量应用，例如安全支付、数字版权管理(Digital Rights Management，DRM)、企业服务和基于Web的服务等。终端上可以通过安装相应的应用程序(Application，APP)来实现对IPC的控制管理，用户可以在终端上打开该APP，通过键盘或触摸屏输入指令，并通过屏幕观看IPC的监控视频内容。
另外，在IPC和终端上还可以设置通信模块，该通信模块可以包括无线保真(WIreless-Fidelity，WiFi)、蓝牙、近场通信(Near Field Communication，NFC)等模块，实现IPC和终端的近距离通信，通信模块还可以包括4G、5G等通信模块。
本申请提供的网络摄像机的认证方法，适用于图3所示的系统，当用户通过终端调取IPC拍摄的监控视频时，需要由IPC对终端进行认证，除了传统的用户名和密码，本申请还在IPC中记录了可信任的设备信息，该可信任的设备可以包括已经成功登录过的终端，还可以包括预先记录在案的可信任终端，IPC可以以白名单的形式记录上述可信任的设备的账号信息(用户名和密码)，以及身份标识(Identity，ID)、型号、媒体介入控制层(Media Access Control，MAC)地址等设备信息。终端请求登录IPC时，若其输入的账号信息(用户名和密码)和设备信息与白名单上记录的信息一致，就表示该终端认证通过，IPC只允许白名单上记录的终端登录并调取监控视频，这样加强了终端认证的安全性。
以下通过具体的实施例对本申请的方法进行说明。
在一种示例性的应用场景中，终端初次登录IPC，在该过程中终端是通过WiFi、蓝牙、NFC等近距离通信技术与IPC直连，除去了网络的中转，可以保证第一次登录IPC的终端是可信任的，IPC在白名单中记录下初次登录的终端的账号信息和设备信息。
在另一种示例性的应用场景中，终端常规登录IPC，此时的终端已经记录在了IPC的白名单中，终端可以通过网络远程尝试接入IPC，只要终端的账号信息和设备信息与记录的相匹配，就可以认证通过。本申请中，如果白名单上记录了多条信息，终端的账号信息和设备信息与可信任账号信息和可信任设备信息相匹配表示：输入终端的账号信息和终端的设备信息为白名单中的多条信息中的一个。在该场景下终端也可以通过近距离通信技术与IPC直连，本申请对该场景下的通信技术不做具体限定。
在另一种示例性的应用场景中，终端在初次登录IPC之前，其信息已经记录在白名单中，这样终端在初次登录IPC时，可以通过网络远程尝试接入IPC或者通过近距离通信技术与IPC直连，只要终端的账号信息和设备信息与记录的相匹配，就可以认证通过。
图4为本申请实施例提供的一种示例性的网络摄像机的认证方法的流程图，如图4所示，本实施例的方法为终端常规登录IPC的过程，可以包括：
步骤401、终端获取设备信息和用户输入的账号信息。
终端在常规使用过程中，当用户想要调取IPC拍摄的监控视频，或者想要进行实时监控，首先需要登录相应的IPC。用户通过键盘或触摸屏输入已经设置好的账号信息。终端可以通过读取出厂时设置的相关内存获取设备信息，该内存中存储了终端的属性信息，例如该终端的ID、类型、MAC地址等。
步骤402、终端向IPC发送认证请求。
该认证请求包括上述账号信息和设备信息。
步骤403、当账号信息和可信任账号信息匹配，且设备信息和可信任设备信息匹配时，IPC确定终端为可信任设备。
可信任账号信息和可信任设备信息存储在与可信任执行环境对应的存储区域的安全分区中。
本实施例IPC预先在本地可信任执行环境对应的存储区域的安全分区中存储白名单，在该白名单中记录可信任设备的账号信息和设备信息，当终端请求认证时，IPC在可信任执行环境中基于白名单中的账号信息和设备信息对终端进行认证，避免账号被盗用后的恶意登录，确保信息不会被盗用，提升了认证的安全性。
图5为本申请实施例提供的另一种示例性的网络摄像机的认证方法的流程图，如图5 所示，本实施例的方法为终端初次登录IPC的过程，可以包括：
步骤501、终端与IPC建立通信直连。
终端初次登录IPC，为了确保该设备是可信任的，需要在接近IPC的位置与IPC建立近距离通信直连，包括使用WiFi、蓝牙、NFC等技术。
步骤502、终端获取初始设备信息和用户输入的初始账号信息，并使用第一公钥对初始设备信息和初始账号信息进行加密。
初始设备信息和初始账号信息是终端在初次登录IPC时获取到的信息，用户通过键盘或触摸屏输入设置的初始账号信息，例如用户名和密码，初始设备信息包括ID、型号、MAC地址等，终端可以通过读取出厂时设置的相关内存获取设备信息，该内存中存储了终端的属性信息。在IPC出厂时厂商会基于IPC的CPU的ID生成第一密钥对(包括第一公钥和第一私钥)，用于对传输的数据进行加解密，第二密钥对(包括第二公钥和第二私钥)，用于生成数字证书和数字签名等。密钥对可以采用非对称加密算法生成，例如RSA加密算法。当终端与IPC建立连接后，IPC会向终端发送第一公钥。终端使用第一公钥对账号信息和终端的初始设备信息进行加密。
步骤503、终端向IPC发送初始认证请求。
初始认证请求包括加密过的初始账号信息和初始设备信息。终端将加密后的信息携带于初始认证请求中发送给IPC，保证了数据在传输过程中的安全性。
步骤504、IPC在可信任执行环境中使用第一私钥对初始认证请求进行解密获取初始账号信息和初始设备信息。
IPC接收到终端的初始认证请求后，在可信任执行环境中使用与第一公钥成对的第一私钥对初始认证请求进行解密，获取初始账号信息和初始设备信息。如上所述，可信任执行环境提供了一个较安全的封闭的执行环境，可确保各种敏感数据在一个可信环境中被存储和受到保护，因此IPC在可信任执行环境中解密并获取初始账号信息和初始设备信息可以确保信息不会被盗取，加强IPC身份认证安全性。
步骤505、IPC在可信任执行环境中对初始账号信息和初始设备信息进行加密处理，并存入与可信任执行环境对应的存储区域的安全分区中。
IPC在可信任执行环境中将初始账号信息和初始设备信息记录在白名单中，且白名单中账号信息和设备信息之间有对应关系，IPC将白名单存储在可信任执行环境对应的存储区域的(例如flash)安全分区中。为了提高白名单的安全性，IPC还可以在可信任执行环境中对初始账户信息和初始设备信息进行内部加密后记录在白名单中，或者将初始账号信息和初始设备信息记录在白名单中后，对白名单进行加密，然后存放在可信任执行环境对应的存储区域的(例如flash)安全分区中。如上所述，可信任执行环境提供了一个较安全的封闭的执行环境，可确保各种敏感数据在一个可信环境中被存储和受到保护，因此IPC在可信任执行环境中对初始账号信息和初始设备信息进行加密处理，确保处理过程的安全可靠，避免信息被盗取。
本实施例在终端初始登录IPC时，采用通信直连的方式，由于不依赖于外部网络环境，仅在终端和IPC之间进行通信，确保终端的可信任性，而且IPC在可信任执行环境中进行认证处理和记录白名单，确保处理过程的安全可靠，避免信息被盗取，提升了认证的安全性。
图6为本申请实施例提供的又一种示例性的网络摄像机的认证方法的流程图，如图6 所示，本实施例的方法为终端常规登录IPC的过程，可以包括：
步骤601、终端获取设备信息和用户输入的账号信息。
终端初次登录后，在常规使用过程中，当用户想要调取IPC拍摄的监控视频，或者想要进行实时监控，首先需要登录相应的IPC。用户通过键盘或触摸屏输入已经设置好的账号信息。终端可以通过读取出厂时设置的相关内存获取设备信息，该内存中存储了终端的属性信息，例如该终端的ID、类型、MAC地址等。
步骤602、终端使用第一公钥对账号信息和设备信息进行加密。
为了确保传输中的数据安全，终端使用第一公钥对账号信息和设备信息进行加密。
步骤603、终端向IPC发送认证请求。
该认证请求包括加密过的账号信息和设备信息。
步骤604、IPC在可信任执行环境中使用第一私钥对认证请求进行解密获取账号信息和设备信息。
IPC接收到终端的认证请求后，在可信任执行环境中使用与第一公钥成对的第一私钥对认证请求进行解密，获取账号信息和设备信息。如上所述，可信任执行环境提供了一个较安全的封闭的执行环境，可确保各种敏感数据在一个可信环境中被存储和受到保护，因此IPC在可信任执行环境中解密并获取账号信息和设备信息可以确保信息不会被盗取，加强IPC身份认证安全性。
步骤605、若账号信息和设备信息与可信任账号信息和可信任设备信息相匹配，则IPC确定终端为可信任设备。
上述可信任账号信息和可信任设备信息存储在与可信任执行环境对应的存储区域的安全分区中。IPC在可信任执行环境中将账号信息和设备信息与白名单中的信息进行匹配，若在白名单中查询到与接收到的账号信息(用户名和密码)相同的账号信息(用户名和密码)，且白名单中的账号信息对应的设备信息与接收到的设备信息也相同，则说明该终端是可信任的，终端登录成功。
步骤606、终端登录IPC。
在终端登录后，IPC可以使用第一私钥对视频数据进行加密生成视频码流，向终端发送视频码流。为了进一步确保视频数据的安全，IPC还可以在码流中携带数字签名，即IPC用一个哈希函数从视频数据中生成摘要，然后用第二私钥对这个摘要进行加密生成数字签名，将该数字签名和视频数据一起再使用第一私钥加密，发送给终端。相应的，终端接收到视频码流后，先用第一公钥进行解密，得到视频数据和数字签名，然后用与IPC一样的哈希函数从接收到的视频码流中计算出摘要，接着再用第二公钥对数字签名进行解密，如果解密得到的摘要和哈希计算的摘要相同，终端就可以确认该数字签名是IPC的。这样可以确保数据的来源方的正确性，提高安全性。
通过上述方法，即使有其他人知道了账号信息，在新的终端上登录IPC时，IPC在TrustZone环境下检查到发起登录请求的终端的设备信息与白名单的设备信息不匹配，也无法登录到IPC从而获取监控视频。而且IPC还可以基于网络发送信息给白名单中记录的终端，让合法用户确认是否为异常登录信息，如果用户确认不是异常登录，则IPC可以将新的终端的设备信息加入到白名单，并让该终端登录成功，如果用户确认是异常登录，则IPC不允许该终端登录。
本实施例IPC预先在本地可信任执行环境对应的存储区域的安全分区中存储白名单，在该白名单中记录可信任设备的账号信息和设备信息，当终端请求认证时，在可信任执行环境中基于白名单中的账号信息和设备信息对终端进行认证，避免账号被盗用后的恶意登录，确保信息不会被盗用，提升了认证的安全性。
图7为本申请实施例提供的一种示例性的网络摄像机的认证装置的结构示意图，如图7所示，本实施例的装置可以设置于IPC，其包括：收发模块701和安全模块702，其中，收发模块701，用于接收终端发送的认证请求，所述认证请求包括账号信息和所述终端的设备信息；安全模块702，用于当所述账号信息和可信任账号信息匹配，且所述设备信息和可信任设备信息相匹配时，确定所述终端为可信任设备，所述可信任账号信息和所述可信任设备信息存储在与可信任执行环境对应的存储区域的安全分区中。
在一种可能的实现方式中，所述收发模块701，还用于与所述终端建立通信直连；接收所述终端发送的初始认证请求，所述初始认证请求包括初始账号信息和所述终端的初始设备信息；所述安全模块702，还用于将所述初始账号信息和所述初始设备信息存入与所述可信任执行环境对应的存储区域的安全分区中。
在一种可能的实现方式中，所述安全模块702，还用于对视频数据进行加密生成视频码流；所述收发模块701，还用于向所述终端发送所述视频码流。
在一种可能的实现方式中，所述视频码流还包括数字签名。
在一种可能的实现方式中，所述认证请求包括的所述账号信息和所述设备信息经所述终端使用第一公钥加密处理过；所述安全模块702，还用于在所述可信任执行环境中使用第一私钥对所述认证请求进行解密获取所述账号信息和所述设备信息。
在一种可能的实现方式中，所述初始认证请求包括的所述初始账号信息和所述初始设备信息经所述终端使用第一公钥加密处理过；所述安全模块702，还用于在所述可信任执行环境中使用第一私钥对所述初始认证请求进行解密获取所述初始账号信息和所述初始设备信息。
在一种可能的实现方式中，所述第一公钥和所述第一私钥为一对密钥对。
在一种可能的实现方式中，所述密钥对基于网络摄像机的中央处理器芯片的标识信息生成。
本实施例的装置，可以用于执行图4-6任一所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图8为本申请实施例提供的另一种示例性的网络摄像机的认证装置的结构示意图，如图8所示，本实施例的装置可以设置于终端，其包括：获取模块801、安全模块802和收发模块803，其中，获取模块801，用于获取设备信息和用户输入的账号信息；安全模块802，用于使用第一公钥对所述账号信息和所述设备信息进行加密；收发模块803，用于向所述网络摄像机发送认证请求，所述认证请求包括加密过的所述账号信息和所述设备信息；在所述网络摄像机认证通过后，登录所述网络摄像机。
在一种可能的实现方式中，所述收发模块803，还用于与所述IPC建立通信直连；所述获取模块801，还用于获取初始设备信息和用户输入的初始账号信息，并使用所述第一公钥对所述初始设备信息和所述初始账号信息进行加密；所述收发模块803，还用于向所述IPC发送初始认证请求，所述初始认证请求包括加密过的所述初始账号信息和所述初始设 备信息。
在一种可能的实现方式中，所述收发模块803，还用于接收所述网络摄像机发送的视频码流，所述视频码流包括视频数据；所述安全模块802，还用于使用所述第一公钥对所述视频码流进行解密获取所述视频数据。
在一种可能的实现方式中，所述视频码流还包括数字签名；所述安全模块802，还用于对所述数字签名进行校验。
本实施例的装置，可以用于执行图4-6任一所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
基于上述内容和相同构思，本申请提供一种网络摄像装置900，用于执行上述方法。图9为本申请实施例提供的一种示例性的网络摄像装置的结构示意图，如图9所示，网络摄像装置900包括处理器901、存储器902和总线903；其中，处理器901和存储器902可通过总线903相互连接。
处理器901，用于在可信任执行环境TEE下，对终端的账号信息和设备信息进行认证；将记录可信任设备信息的白名单写入存储器902中的安全分区；所述安全分区用于防止白名单被篡改和/或回滚。
处理器901可以是中央处理器(Central Processing Unit，CPU)，网络处理器(Network Processor，NP)，或者CPU和NP的组合。处理器901还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(Application-Specific Integrated Circuit，ASIC)，可编程逻辑器件(Programmable Logic Device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(Comple Programmable Logic Device，CPLD)，现场可编程门阵列(Field-Programmable Gate Array，FPGA)，通用阵列逻辑(Generic Array Logic，GAL)或其任意组合。
存储器902，可用于存储计算机程序指令，包括操作系统(Operation System，OS)、各种用户应用程序、以及用于执行本申请方案的程序代码在内的各类计算机程序代码；存储器还可以用于存储视频数据、图像信号数据等；处理器901调用所存储的程序指令，可以执行上述方案中所示实施例中的一个或多个步骤，或其中可选的实施方式。
存储器902可以包括非掉电易失性存储器，例如是嵌入式多媒体卡(Embedded Multi Media Card，EMMC)、通用闪存存储(Universal Flash Storage，UFS)或只读存储器(Read-Only Memory，ROM)，或者是可存储静态信息和指令的其他类型的静态存储设备，还可以是掉电易失性存储器(volatile memory)，例如随机存取存储器(Random Access Memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的程序代码并能够由计算机存取的任何其他计算机可读存储介质，但不限于此。存储器902还可以包括上述种类的存储器的组合。
总线903可以是外设部件互连标准(Peripheral Component Interconnect，简称PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，简称EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图9中仅用一条粗线表示， 但并不表示仅有一根总线或一种类型的总线。
在一种可能的实现方式中，存储器902也可以和处理器901集成在一起。
在一种可能的实现方式中，所述通信设备还包括传输接口；所述传输接口用于：接收认证请求，该认证请求包括终端的账号信息和设备信息；发送视频码流，该视频码流包括视频数据。
应当理解，当该装置为芯片时，处理器和传输接口共同构成芯片，该传输接口可以为芯片用于发送或接收数据、码流或各种信号的接口，该处理器可以认为是芯片中除了传输接口之外的其他部分。或者，该传输接口可以认为是处理器的一部分，该处理器通过传输接口发送或接收数据。
在一种可能的实现方式中，本申请提供一种计算机可读存储介质，该计算机可读存储介质存储有指令，当该指令在计算机或处理器上运行时，使得所述计算机或所述处理器执行如上述图4-6任一所示实施例中的方法。
在一种可能的实现方式中，本申请提供一种计算机程序产品，当所述计算机程序产品在计算机或处理器上运行时，使得所述计算机或所述处理器执行如上述图4-6任一所示实施例中的方法。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述该作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
上述以软件功能单元的形式实现的集成的单元，可以存储在一个计算机可读取存储介质中。上述软件功能单元存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本申请各个实施例所述方法的部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。上述描述的装置的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
最后应说明的是：以上各实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述各实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (22)

  1. 一种网络摄像机的认证方法，其特征在于，包括：
    接收终端发送的认证请求，所述认证请求包括账号信息和所述终端的设备信息；
    当所述账号信息和可信任账号信息匹配，且所述设备信息和可信任设备信息匹配时，确定所述终端为可信任设备，所述可信任账号信息和所述可信任设备信息存储在与可信任执行环境对应的存储区域的安全分区中。
  2. 根据权利要求1所述的方法，其特征在于，所述接收终端发送的认证请求之前，还包括：
    与所述终端建立通信直连；
    接收所述终端发送的初始认证请求，所述初始认证请求包括初始账号信息和所述终端的初始设备信息；
    将所述初始账号信息和所述初始设备信息存入与所述可信任执行环境对应的存储区域的安全分区中。
  3. 根据权利要求1或2所述的方法，其特征在于，所述确定所述终端为可信任设备之后，还包括：
    对视频数据进行加密生成视频码流；
    向所述终端发送所述视频码流。
  4. 根据权利要求3所述的方法，其特征在于，所述视频码流还包括数字签名。
  5. 根据权利要求1-4中任一项所述的方法，其特征在于，所述认证请求包括的所述账号信息和所述设备信息经所述终端使用第一公钥加密处理过；
    所述接收终端发送的认证请求之后，还包括：
    在所述可信任执行环境中使用第一私钥对所述认证请求进行解密获取所述账号信息和所述设备信息。
  6. 根据权利要求2所述的方法，其特征在于，所述初始认证请求包括的所述初始账号信息和所述初始设备信息经所述终端使用第一公钥加密处理过；
    所述接收所述终端发送的初始认证请求之后，还包括：
    在所述可信任执行环境中使用第一私钥对所述初始认证请求进行解密获取所述初始账号信息和所述初始设备信息。
  7. 根据权利要求5或6所述的方法，其特征在于，所述第一公钥和所述第一私钥为一对密钥对。
  8. 根据权利要求7所述的方法，其特征在于，所述密钥对基于网络摄像机的中央处理器芯片的标识信息生成。
  9. 一种网络摄像机的认证装置，其特征在于，包括：
    收发模块，用于接收终端发送的认证请求，所述认证请求包括账号信息和所述终端的设备信息；
    安全模块，用于当所述账号信息和可信任账号信息匹配，且所述设备信息和可信任设备信息相匹配时，确定所述终端为可信任设备，所述可信任账号信息和所述可信任设备信息存储在与可信任执行环境对应的存储区域的安全分区中。
  10. 根据权利要求9所述的装置，其特征在于，所述收发模块，还用于与所述终端建立通信直连；接收所述终端发送的初始认证请求，所述初始认证请求包括初始账号信息和所述终端的初始设备信息；
    所述安全模块，还用于将所述初始账号信息和所述初始设备信息存入与所述可信任执行环境对应的存储区域的安全分区中。
  11. 根据权利要求9或10所述的装置，其特征在于，所述安全模块，还用于对视频数据进行加密生成视频码流；
    所述收发模块，还用于向所述终端发送所述视频码流。
  12. 根据权利要求11所述的装置，其特征在于，所述视频码流还包括数字签名。
  13. 根据权利要求9-12中任一项所述的装置，其特征在于，所述认证请求包括的所述账号信息和所述设备信息经所述终端使用第一公钥加密处理过；
    所述安全模块，还用于在所述可信任执行环境中使用第一私钥对所述认证请求进行解密获取所述账号信息和所述设备信息。
  14. 根据权利要求10所述的装置，其特征在于，所述初始认证请求包括的所述初始账号信息和所述初始设备信息经所述终端使用第一公钥加密处理过；
    所述安全模块，还用于在所述可信任执行环境中使用第一私钥对所述初始认证请求进行解密获取所述初始账号信息和所述初始设备信息。
  15. 根据权利要求13或14所述的装置，其特征在于，所述第一公钥和所述第一私钥为一对密钥对。
  16. 根据权利要求15所述的装置，其特征在于，所述密钥对基于网络摄像机的中央处理器芯片的标识信息生成。
  17. 一种网络摄像装置，其特征在于，包括：处理器和传输接口；
    所述处理器读取存储器中的程序指令，以执行如下步骤：
    通过所述传输接口接收终端发送的认证请求，所述认证请求包括账号信息和所述终端的设备信息；
    当所述账号信息和可信任账号信息匹配，且所述设备信息和可信任设备信息匹配时，确定所述终端为可信任设备，所述可信任账号信息和所述可信任设备信息存储在与可信任执行环境对应的存储区域的安全分区中。
  18. 根据权利要求17所述的装置，其特征在于，所述处理器读取所述程序指令，以执行如下步骤：
    通过所述传输接口与所述终端建立通信直连；接收所述终端发送的初始认证请求，所述初始认证请求包括初始账号信息和所述终端的初始设备信息；
    将所述初始账号信息和所述初始设备信息存入与所述可信任执行环境对应的存储区域的安全分区中。
  19. 根据权利要求17或18所述的装置，其特征在于，所述处理器读取所述程序指令，以执行如下步骤：
    对视频数据进行加密生成视频码流；
    通过所述传输接口向所述终端发送所述视频码流。
  20. 根据权利要求17-19中任一项所述的方法，其特征在于，所述认证请求包括的所 述账号信息和所述设备信息为所述终端使用第一公钥加密处理过；所述处理器读取所述程序指令，以执行如下步骤：
    在所述可信任执行环境中使用第一私钥对所述认证请求进行解密获取所述账号信息和所述设备信息。
  21. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有指令，当所述指令在计算机或处理器上运行时，使得所述计算机或所述处理器执行如权利要求1-8中任一项所述的方法。
  22. 一种计算机程序产品，其特征在于，当所述计算机程序产品在计算机或处理器上运行时，使得所述计算机或所述处理器执行如权利要求1-8中任一项所述的方法。
PCT/CN2019/078732 2019-03-19 2019-03-19 网络摄像机的认证方法和装置 WO2020186457A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2019/078732 WO2020186457A1 (zh) 2019-03-19 2019-03-19 网络摄像机的认证方法和装置
CN201980093979.2A CN113557703A (zh) 2019-03-19 2019-03-19 网络摄像机的认证方法和装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/078732 WO2020186457A1 (zh) 2019-03-19 2019-03-19 网络摄像机的认证方法和装置

Publications (1)

Publication Number Publication Date
WO2020186457A1 true WO2020186457A1 (zh) 2020-09-24

Family

ID=72519465

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/078732 WO2020186457A1 (zh) 2019-03-19 2019-03-19 网络摄像机的认证方法和装置

Country Status (2)

Country Link
CN (1) CN113557703A (zh)
WO (1) WO2020186457A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113163168A (zh) * 2021-04-09 2021-07-23 杭州萤石软件有限公司 一种信息交互系统及网络摄像机
CN113556518A (zh) * 2021-09-23 2021-10-26 成都派沃特科技股份有限公司 视频数据调度方法、装置、设备及存储介质
CN114466249A (zh) * 2022-04-13 2022-05-10 荣耀终端有限公司 数据请求处理方法、装置和存储介质
WO2023050612A1 (zh) * 2021-09-29 2023-04-06 天翼物联科技有限公司 摄像设备的适配方法、装置、物联网终端及存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114595437B (zh) * 2022-05-09 2022-09-30 荣耀终端有限公司 访问控制方法、电子设备及计算机可读存储介质

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6930709B1 (en) * 1997-12-04 2005-08-16 Pentax Of America, Inc. Integrated internet/intranet camera
CN101720030A (zh) * 2009-11-30 2010-06-02 广州市聚晖电子科技有限公司 一种视频数据传送方法和系统及一种摄像设备
CN101938485A (zh) * 2010-09-10 2011-01-05 上海复控华龙微系统技术有限公司 基于双向安全认证的点对点协议的IP Camera服务实现方法
CN105635062A (zh) * 2014-10-31 2016-06-01 腾讯科技（上海）有限公司 网络接入设备的验证方法和装置
CN105978861A (zh) * 2016-04-26 2016-09-28 浙江大华技术股份有限公司 一种获取设备监控信息的方法及装置
CN106452772A (zh) * 2016-11-16 2017-02-22 华为技术有限公司 终端认证方法和装置
CN106789986A (zh) * 2016-12-08 2017-05-31 浙江宇视科技有限公司 监控设备认证方法及装置
CN107733858A (zh) * 2017-09-01 2018-02-23 北京知道未来信息技术有限公司 一种智能保护摄像头信息的监控设备及方法

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103888257B (zh) * 2013-11-03 2017-01-18 北京工业大学 一种基于tpcm的网络摄像机身份认证方法
CN104392188B (zh) * 2014-11-06 2017-10-27 三星电子（中国）研发中心 一种安全数据存储方法和系统
KR101575222B1 (ko) * 2015-05-22 2015-12-08 주식회사 비밥소프트웨어 Ip 카메라 영상을 제공하기 위한 시스템, 서비스 제공자 장치, 서비스 이용자 장치 및 방법, 그리고 컴퓨터 프로그램
CN104980926B (zh) * 2015-06-05 2019-02-12 小米科技有限责任公司 移动终端的远程控制方法及装置
CN106295290B (zh) * 2015-06-26 2021-12-21 创新先进技术有限公司 基于指纹信息生成认证信息的方法、装置及系统
CN105656948A (zh) * 2016-03-30 2016-06-08 北京小米移动软件有限公司 账号登录方法及装置
CN105743931B (zh) * 2016-05-11 2019-10-29 百度在线网络技术（北京）有限公司 应用于智能家居平台的控制方法和装置
CN106656978A (zh) * 2016-10-19 2017-05-10 广东欧珀移动通信有限公司 一种账号登录的方法及服务器
CN106878020A (zh) * 2017-01-24 2017-06-20 广州弘度信息科技有限公司 网络系统、网络设备的认证方法和装置
CN107769928A (zh) * 2017-10-11 2018-03-06 深圳市金立通信设备有限公司 一种终端及计算机可读存储介质

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6930709B1 (en) * 1997-12-04 2005-08-16 Pentax Of America, Inc. Integrated internet/intranet camera
CN101720030A (zh) * 2009-11-30 2010-06-02 广州市聚晖电子科技有限公司 一种视频数据传送方法和系统及一种摄像设备
CN101938485A (zh) * 2010-09-10 2011-01-05 上海复控华龙微系统技术有限公司 基于双向安全认证的点对点协议的IP Camera服务实现方法
CN105635062A (zh) * 2014-10-31 2016-06-01 腾讯科技（上海）有限公司 网络接入设备的验证方法和装置
CN105978861A (zh) * 2016-04-26 2016-09-28 浙江大华技术股份有限公司 一种获取设备监控信息的方法及装置
CN106452772A (zh) * 2016-11-16 2017-02-22 华为技术有限公司 终端认证方法和装置
CN106789986A (zh) * 2016-12-08 2017-05-31 浙江宇视科技有限公司 监控设备认证方法及装置
CN107733858A (zh) * 2017-09-01 2018-02-23 北京知道未来信息技术有限公司 一种智能保护摄像头信息的监控设备及方法

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113163168A (zh) * 2021-04-09 2021-07-23 杭州萤石软件有限公司 一种信息交互系统及网络摄像机
CN113163168B (zh) * 2021-04-09 2023-05-26 杭州萤石软件有限公司 一种信息交互系统及网络摄像机
CN113556518A (zh) * 2021-09-23 2021-10-26 成都派沃特科技股份有限公司 视频数据调度方法、装置、设备及存储介质
CN113556518B (zh) * 2021-09-23 2021-12-17 成都派沃特科技股份有限公司 视频数据调度方法、装置、设备及存储介质
WO2023050612A1 (zh) * 2021-09-29 2023-04-06 天翼物联科技有限公司 摄像设备的适配方法、装置、物联网终端及存储介质
CN114466249A (zh) * 2022-04-13 2022-05-10 荣耀终端有限公司 数据请求处理方法、装置和存储介质
CN114466249B (zh) * 2022-04-13 2022-09-20 荣耀终端有限公司 数据请求处理方法、装置和存储介质

Also Published As

Publication number Publication date
CN113557703A (zh) 2021-10-26

Similar Documents

Publication Publication Date Title
US20210306335A1 (en) Out-of-band authentication based on secure channel to trusted execution environment on client device
KR102504519B1 (ko) 네트워킹된 장치들을 갖는 컴퓨터 구동 시스템의 반가상 보안 위협 보호
WO2020186457A1 (zh) 网络摄像机的认证方法和装置
US11848753B2 (en) Securing audio communications
WO2020093214A1 (zh) 一种应用程序登录方法、应用程序登录装置及移动终端
US9386045B2 (en) Device communication based on device trustworthiness
US8832783B2 (en) System and method for performing secure communications
CN112513857A (zh) 可信执行环境中的个性化密码安全访问控制
JP2019531567A (ja) 装置認証のシステム及び方法
WO2015180691A1 (zh) 验证信息的密钥协商方法及装置
US10484372B1 (en) Automatic replacement of passwords with secure claims
TWI725709B (zh) 資料儲存方法、裝置及設備
US11050570B1 (en) Interface authenticator
CN108763917B (zh) 一种数据加解密方法及装置
US8090946B2 (en) Inter-system binding method and application based on hardware security unit
KR20150070388A (ko) 집중 보안 엔진을 사용하는 웹 서비스 제공자를 위한 프라이버시 강화 키 관리
CN107567630A (zh) 受信输入/输出设备的隔离
US9529733B1 (en) Systems and methods for securely accessing encrypted data stores
WO2017166362A1 (zh) 一种esim号码的写入方法、安全系统、esim号码服务器及终端
WO2012075904A1 (zh) 一种验证绑定数据卡和移动主机的方法、装置及系统
EP3794485A1 (en) Method and network node for managing access to a blockchain
US10192056B1 (en) Systems and methods for authenticating whole disk encryption systems
US20230198746A1 (en) Secure key exchange using key-associated attributes
WO2017020449A1 (zh) 一种指纹读取方法及用户设备
US11671422B1 (en) Systems and methods for securing authentication procedures

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19919728

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19919728

Country of ref document: EP

Kind code of ref document: A1