WO2022135308A1 - Method and apparatus for detecting media data - Google Patents

Abstract

Disclosed are a method and apparatus for detecting media data, which relate to the field of conference communications. The method comprises: a detection device receiving media data sent by a first terminal, and then determining, according to first feature information carried in the media data, whether the act of the first terminal sending the media data is legitimate. By means of the method, not only can the identity of a user who discloses media data be determined, media data that is sent illegitimately can also be intercepted in real time, thereby reducing the risk of information leakage.

Description

A method and device for detecting media data technical field

The present application relates to the field of conference communications, and in particular, to a method and apparatus for detecting media data.

Background technique

With the advancement of technology, video/voice conferencing has become a new trend in contemporary office. However, the content of some online conferences is sensitive information. Therefore, the information security management and control of conferences is a very critical part.

In order to reduce the possibility of information leakage, the terminal devices accessing the conference and the corresponding participants are generally authenticated. However, this method cannot guarantee that the authorized participants illegally leak the conference content. For example, the participant can restart a new meeting on the computer and share the interface of the current confidential meeting to other users for viewing. Under such circumstances, the disclosure of confidential information by the participants will lead to unpredictable consequences. Therefore, an information security management and control scheme is urgently needed to monitor the behavior of users illegally leaking confidential information.

SUMMARY OF THE INVENTION

The present application provides a method and apparatus for detecting media data. The feature information in the media data is detected by a detection device to identify whether there is an act of illegally sending the media data, thereby reducing the risk of information leakage.

In a first aspect, the present application provides a method for detecting media data. A detection device receives first media data sent by a first terminal, the first media data includes first feature information, and then the detection device uses the first feature information according to the first feature information. Determine whether the act of sending the first media data by the first terminal is legal. The first feature information may be a watermark identifier or any other information that can be added or acquired by encoding and decoding media data. The media data may be audio data or video data.

In the above method, the detection device verifies whether the behavior of the first terminal sending the first media data is legal through the first feature information included in the media data, and the method can perform real-time detection on the behavior of leaking information. During behavior, the illegally sent media data can be intercepted in real time to reduce the risk of information leakage.

In a possible implementation manner, the first media data sent by the first terminal is sent by the second terminal to the first terminal through the first media server.

In the above implementation manner, when the first terminal sends media data to the second terminal, it is processed and forwarded by the first media server. The stability of communication between them.

In another possible implementation manner, the first feature information is added by the first media server.

In the above implementation manner, the first media server may receive the first feature information distributed by the conference scheduling server, or the first media server may generate the first feature information by itself. Then, the first media server adds the first feature information to the first media data, so that the subsequent detection device can judge whether the first media data sent by the first terminal is legal according to the first feature information.

In another possible implementation manner, the first feature information is added by the second terminal.

In the above implementation manner, the second terminal may receive the first feature information distributed by the conference scheduling server, or the second terminal may receive the first feature information distributed by the conference scheduling server forwarded by the first media server, or the second terminal The first feature information can be generated by itself. Then, the second terminal adds the first feature information to the first media data, so that the subsequent detection device can judge whether the behavior of the first terminal sending the first media data is legal according to the first feature information.

In another possible implementation manner, the first feature information further includes a confidentiality level, where the confidentiality level is used to indicate a scope in which the first media source data can be disclosed. For example, the confidentiality level may be internal disclosure.

In another possible implementation manner, the first characteristic information includes legal sender information and/or legal recipient information.

In the above implementation manner, the legitimate sender/receiver information may refer to user information of the legitimate sender/receiver, such as a user account, a user mobile phone number, and the like. Alternatively, the legitimate sender/receiver information may also refer to terminal information used by the legitimate sender/receiver, such as a terminal device identifier. Alternatively, the legal sender information refers to the source address or source port of the sent data, and the legal receiver information refers to the destination address or destination port of the sent data. In this implementation manner, the detection efficiency is improved and the probability of false detection is reduced by adding legal sender/receiver information to the first feature information.

In another possible implementation manner, the legal receiver information includes first terminal information, and the legal sender information includes second terminal information or first media server information.

In the above implementation manner, the first terminal is a legal recipient when receiving media data from the second terminal, therefore, the legal recipient information may include first terminal information, and the first terminal information may include the IP (Internet) of the first terminal. Protocol) address or MAC (Media Access Control) address, etc., and may also include user information corresponding to the first terminal. The second terminal information may also be an IP address or a MAC address of the second terminal, and may also include user information corresponding to the second terminal. The first media server information may also be an IP address or a MAC address of the first media server.

In another possible implementation manner, the legitimate sender information includes first media server information, and when the detection device determines according to the first feature information that the first media data sent by the first terminal is illegal, the detection device The first feature information sends first alarm information to the first media server.

In the above implementation manner, the detection device can obtain the first media server information from the legal sender information, and when it is confirmed that the behavior of the first terminal sending the first media data is abnormal, it will alert the first media server to improve data communication. security.

In another possible implementation manner, the first feature information includes legal sender information and legal receiver information, wherein the legal sender information includes first media server information, and when the detection device determines the first terminal according to the first feature information When sending the first media data is illegal, the detection device sends second alarm information to the first media server according to the first feature information, where the second alarm information is used to indicate that the first terminal is an abnormal terminal.

In the above implementation manner, the detection device can directly determine the illegal terminal of the first terminal according to the first characteristic information, and notify the first media server that the first terminal is abnormal. That is, according to the first characteristic information, it can be determined which terminal in the current data communication has the risk of information leakage, and then the relevant information of the leaker can be determined.

In another possible implementation manner, the first feature information includes legal sender information and legal receiver information, and the legal sender information includes first media server information. When the detection device determines the first terminal according to the first feature information When the sending of the first media data is illegal, the detection device instructs the first media server to stop sending the second media data to the first terminal according to the first feature information.

In the above implementation manner, the detection device can directly determine that the first terminal is abnormal according to the first feature information, and notify the first media server to stop sending media data to the first terminal. The method can prevent the abnormal terminal from acquiring new media data and reduce the risk of information leakage from the source.

In another possible implementation manner, the detection device does not directly send the alarm information to the first media server, but first sends the alarm information to the conference scheduling server, and then the conference scheduling server notifies the first media server that there is currently a risk of information leakage .

In another possible implementation manner, the detection device receives the first media data sent by the first terminal to the third terminal, and the third terminal communicates with the first terminal through the detection device.

In the above implementation manner, when the first terminal sends the first media data to the third terminal, it passes through the detection device, and then the detection device can detect the first media data, and can perform real-time interception when it finds that there is an illegal sending behavior, so as to reduce the risk of information leakage. loss.

In another possible implementation manner, the detection device may be a first media server, or the detection device may be a second media server different from the first media server, or the detection device may be a media proxy gateway. Alternatively, the detection device may be a border firewall.

In another possible implementation manner, the first media data is generated by the first terminal according to third media data received by the fourth terminal, and the third media data includes the first feature information.

In the above implementation manner, the fourth terminal is a legitimate conference receiving terminal, and the third media data it receives includes the first feature information, and then when the first terminal leaks the information received by the fourth terminal through various channels , the detection device can identify the illegal sending behavior according to the first feature information included in the first media data, and then intercept in real time to reduce the risk of information leakage.

In another possible implementation manner, the first media data includes a digital signature, and the digital signature is used to determine that the first media data has not been tampered with. Adding a digital signature to the transmitted data can ensure the security of the transmission channel in the entire communication system

In the method described above, by adding characteristic information to the media data, the detection device can detect the legitimacy of data transmission according to the characteristic information. Losses are minimized. On the other hand, the identity of the leaker can also be determined according to the characteristic information, and the source of the information leak can also be traced on the basis of truncating the illegally sent data in real time.

In a second aspect, the present application provides an apparatus for detecting media data. The apparatus includes various modules for executing the media data communication detection method in the first aspect or any possible implementation manner of the first aspect.

In a third aspect, the present application provides a device for detecting media data. The device includes a processor, a memory, a communication interface, and a bus. The processor, the memory, and the communication interface are connected through a bus and complete mutual communication. The memory is used to store computer-executed instructions, and when the device is running, the processor executes the computer-executed instructions in the memory to use the hardware resources in the device to execute the first aspect or any possibility of the first aspect. method described in the implementation.

In a fourth aspect, the present application provides a computer-readable storage medium. When the program instructions stored in the computer-readable storage medium are executed on a computer, the computer executes the first aspect or any possible implementation of the first aspect. methods provided in the implementation. The storage medium includes, but is not limited to, volatile memory, such as random access memory, non-volatile memory, such as flash memory, hard disk drive (HDD), solid state drive (solid state drive, SSD).

In a fifth aspect, the present application provides a computer program product comprising program instructions, when the program instructions are run on a computer, the computer executes the method described in the first aspect and any possible implementation manner of the first aspect .

On the basis of the implementation manners provided by the above aspects, the present application may further combine to provide more implementation manners.

Description of drawings

FIG. 1 is a schematic diagram of an application system architecture provided by an embodiment of the present application according to an embodiment of the present application.

FIG. 2 is a schematic diagram of another application system architecture provided by an embodiment of the present application.

FIG. 3 is a schematic diagram of another application system architecture provided by an embodiment of the present application.

FIG. 4 is an overall flowchart of a method for detecting media data provided by an embodiment of the present application.

FIG. 5 is a flowchart of a method for detecting media data provided by an embodiment of the present application.

FIG. 6 is a flowchart of another method for detecting media data according to an embodiment of the present application.

FIG. 7 is a schematic diagram of an apparatus for detecting media data according to an embodiment of the present application.

FIG. 8 is a schematic diagram of a device for detecting media data according to an embodiment of the present application.

Detailed ways

The present application provides a method, device and system for detecting media data. By detecting the characteristic information in the media data, it can identify the behavior of illegally leaking information.

In order to enhance the readability of the present application, the terms appearing in the present application are first explained.

Feature information: In the embodiments provided in this application, the feature information is added to the media data by the media server or the terminal, and plays a role of identifying the media data. The feature information can be a watermark or any other information that can be added or acquired by encoding and decoding the media data. The robustness of the feature information can make the illegally sent media data still include the feature information, and then the detection device can determine the legitimacy of the data sending behavior according to the feature information. The characteristic information may include user information, source address/port for data transmission, destination address/port for data transmission, and confidentiality level. The confidentiality level represents the range that the media data can be disclosed. For example, when the confidentiality level is "2", it means that the media data can be disclosed internally. In the following specific embodiments, for the convenience of description, "feature information" is replaced by "watermark identification".

Media server: The media server mainly performs encoding and decoding processing, mixing or forwarding of audio and video streams. For example, it may be a multimedia control unit (Multimedia Control Unit, MCU). The media server can be deployed in the cloud or in the local computer room. In a possible implementation manner, the media server is configured to add a watermark to the received media data. In another possible implementation manner, the media server further includes a detection module for detecting whether the media data contains a watermark and the specific content of the watermark.

Conference scheduling server: with resource scheduling function. When a terminal initiates a conference request to the conference scheduling server, the conference scheduling server allocates a media server for each conference according to the terminal's requirement and the capabilities of each media server. In a possible implementation manner, the conference scheduling server and a certain media server are the same server, that is, the media server has the function of conference scheduling. The conference scheduling server stores information about each conference, such as addresses of participating terminals in each conference, user information of participants, and the like.

Digital Watermark: It refers to the embedding of specific information into a digital signal, which may be audio, picture or video. The robustness of digital watermarks is strong. If a video with a digital watermark is copied, the same digital watermark can also be detected in the copied video. Digital watermarks can be divided into two types: emergent and hidden. The former is visible watermarking, and the information it contains can be seen at the same time when viewing pictures or videos. Hidden watermarks are digital data added to audio, pictures or videos, but cannot be seen under normal circumstances. One of the important applications of hidden watermarking is to protect copyright, which is expected to avoid or prevent unauthorized copying and copying of digital media. In the embodiments of the present application, the digital watermark is a type of feature information.

Conference receiver/sender: In each remote conference, there is a conference sender and a conference receiver. Exemplarily, in a video conference, the conference sender is a terminal owned by the presenter of the conference, assuming that it is a terminal for screen sharing; the conference receiver is a terminal owned by the conference participants, and the participants watch the presenter through their respective terminals. shared screen. In the following embodiments, "receiving end" and "sending end" are used to replace "conference receiving end" and "conference sending end", respectively. It should be noted that, in the embodiments provided in this application, both the receiving end and the sending end refer to the receiving end and the sending end of the initial conference (confidential conference).

A legitimate sender is a sender who has the authority to send confidential media data. Legal sender information: In the embodiments provided in this application, the legal sender information may include information of a conference sender or information of a media server involved in the conference. When the legitimate sender information includes the information of the conference sender, it corresponds to the device information, network address (IP address or MAC address) of the terminal 1 in the following embodiments 1, 2, 3, and 4, or the personal information of the user 1, such as an account number Name, mobile phone number, work number, etc.; when the legitimate sender information includes the information of the media server, it corresponds to the network address of the media server 1 in the first embodiment, or corresponds to the address of the media server 21 in the second embodiment, etc. Wait, I won't go into details here.

Legitimate recipient: Refers to a recipient who has permission to receive confidential media data. Legal recipient information: In the embodiments provided in this application, the legal recipient information is the information of the conference recipient. Corresponding to the device information, network address (IP address or MAC address) of the terminal 2 in the following embodiments 1, 2, 3, and 4, or the personal information of the user 2, such as account name, mobile phone number, work number, etc.

Media session information: In the embodiments provided in this application, the media session information may include one or more of the source address, source port, destination address, destination port, etc. of the media data transmission. The port can be a TCP (Transmission Control Protocol) port or a UDP (User Datagram Protocol) port, and the address can be an IP address or a MAC address. In addition, the media session information may further include a Session ID (Session Identification). In a conference, it is assumed that the conference sender and the conference receiver communicate through the media server 1, and the conference media server will record the Session IDs corresponding to the two media sessions of the sender and the media server 1, and the media server 1 and the receiver respectively.

Secure networking: A network environment that can control user behavior. The network environment includes multiple terminals or network elements, and the media data transmission of the terminals and the network elements in the networking are all within the monitoring range. In the embodiments provided in this application, the secure networking includes multiple terminals and at least one media server. In a possible implementation manner, a border firewall or a general firewall is further set on the border of the security network to intercept illegally forwarded media data. In another possible implementation manner, a media proxy gateway is further deployed in the security network or on the border. When the media proxy gateway is deployed at the border of the security network, its function is the same as that of the border firewall, and it is used to monitor the media data flowing out of the security network; when the media proxy gateway is deployed in the security network, it is used to monitor the media data in the security network. media data transferred within.

With the rapid development of the times, video/voice conferencing has become an important part of today's office scene. However, some of the content involved in the meeting is classified information, and if it is illegally disclosed, it will have unpredictable consequences. In general, in order to ensure the information security of the conference, the conference system will add a visible watermark related to the personal information of the conference recipients in the media data, which can play a certain deterrent effect, and the leakage can be traced later according to the visible watermark. the identity of the person. However, the effect of this method is very limited, because this method cannot prevent the real-time leakage of information and can only be used for accountability afterwards.

The present application provides a method for detecting media data, by setting a detection module in the process of media data transmission to verify the legitimacy of the media data transmission. The method for detecting media data can intercept illegally transmitted media data in real time, thereby reducing the risk of information leakage.

A schematic diagram of an application system architecture provided by an embodiment of the present application is introduced with reference to FIG. 1 . The system architecture is mainly divided into two network environments, one is inside the security network and the other is outside the security network. The media data transmitted within the security network and the media data flowing outside the boundary of the security network are all within the scope of control. In the system architecture shown in FIG. 1 , the sender and the receiver are in the same security network. For example, the sender and receiver are in the same company's security network.

The system architecture shown in FIG. 1 includes a media server 1, a media server 2, a conference scheduling server, a conference sending end, a conference receiving end, a border firewall, a media proxy gateway, and an external media server. The sending end and the receiving end conduct conference communication, and the conference scheduling server allocates a media server 1 to the conference for processing and forwarding the media data in the conference. That is, the media server 1 is the media server used for the conference. The media server 2 is a random media server in the security network, which does not participate in the conference communication between the sender and the receiver. The border firewall is located at the border of the security network and can monitor the media data flowing from the inside of the network to the outside of the network. The external media server is outside the security network.

Based on the architecture shown in Figure 1, the sending end sends media data to the receiving end via the media server 1, and the receiving end illegally forwards the media data through various channels after receiving the media data, which will be blocked by the media server 1 in the network. , 2 or the firewall on the border, and the transmission of this media data will be intercepted in real time.

A schematic diagram of another application system architecture provided by an embodiment of the present application is introduced with reference to FIG. 2 . The system architecture is mainly divided into three network environments, one is within the security network 1, one is within the security network 2, and the other is outside the security network. That is to say, in the system architecture shown in FIG. 2 , the sending end and the receiving end are in two different security networks. For example, the sender is in the security network 1 of company A, and the receiver is in the security network 2 of company B.

The system architecture shown in FIG. 2 includes a media server 11, a media server 21, a media server 22, a conference scheduling server, a border firewall 1, a border firewall 2, a conference receiver, a conference sender, a media proxy gateway, and an external media server. The sending end and the receiving end still communicate in the conference, and the media servers allocated by the conference scheduling server for the conference are the media server 11 and the media server 21 to process and forward the media data in the conference. The media server 22 is a random media server in the secure networking 2 where the receiving end is located. The border firewalls 1 and 2 are located on the borders of the security networks 1 and 2 respectively, and are used to monitor the media data flowing from the inside of the network to the outside of the network. The external media server is located outside the security network.

Based on the architecture shown in FIG. 2 , the sending end sends media data to the receiving end via the media server 11 and the media server 21 , and passes through the border firewall 1 and the border firewall 2 in turn on the way. After the receiving end receives the media data and then illegally forwards it, this behavior will be detected by the media server 21, media server 22, media proxy gateway or border firewall 2 in the security network 2, and the media data transmission will be blocked. Truncate in real time.

A schematic diagram of another application system architecture provided by an embodiment of the present application is introduced with reference to FIG. 3 . The system architecture is mainly divided into two network environments, one is inside the security network and the other is outside the security network. In the architecture shown in FIG. 3 , the conference receiving end is located in the security network, and the conference sending end is located outside the security network. For example, the user corresponding to the sender works from home, while the receiver is in the company's security network.

The system architecture shown in FIG. 3 includes a conference scheduling server, a media server 3, a media server 4, a media server 5, an external media server, a border firewall, a conference sending end and a conference receiving end. The sending end and the receiving end still communicate in the conference, and the media servers allocated by the conference scheduling server for the conference are the media server 3 and the media server 4, so as to process and forward the media data in the conference. The media server 5 is a random media server in the secure networking where the receiving end is located. The border firewall is located at the border of the security network and is used to monitor the media data flowing from the inside of the network to the outside of the network.

Based on the architecture shown in FIG. 3 , the sending end sends media data to the receiving end via the media server 3 and the media server 4 , passing through the border firewall on the way. After receiving the media data, the receiving end illegally forwards it in the network, and the media server 4, media server 5 or media proxy gateway will detect the illegal behavior and implement a real-time truncation mechanism; The firewall will detect this illegal behavior and implement a real-time truncation mechanism.

It should be noted that the number of media servers involved in the conference shown in the three system architectures provided in the embodiments of the present application is only for example. For example, in the system architecture shown in FIG. 2 , the conference sending end can directly pass through the border firewall 1 to send the media data to the media server 21 without going through the media server 11 . For another example, in the system architecture shown in FIG. 3 , the conference sending end can send media data to the media server 4 directly through the border firewall without going through the media server 3.

In addition, the embodiment of the present application does not limit the location of the conference scheduling server, that is, the conference scheduling server may be located in the security network of the receiving end, or in the security network of the transmitting end, or outside the security network. In a possible implementation manner, the conference scheduling server and a certain media server are the same server.

The media server, the media proxy gateway, and the border firewall in the above three system architectures all have the capability of identifying watermarks (the capability of the external media server is not specifically limited). For example, a watermark detection module may be included in the media server, which may usually be combined with a decoding module in the media server for decoding media stream data and extracting relevant features therefrom to identify watermark information in the media data. For another example, the media proxy gateway or border firewall can install a watermark detection component, which can be understood as a software program, and the media proxy gateway or border firewall can use the watermark detection component to detect and identify watermarks in media data. Therefore, the media server, the media proxy gateway, and the border firewall can all be used as detection devices in the embodiments of the present application.

It should be noted that the security networking is only used to limit the media server, media proxy gateway, or border firewall and other network elements with detection capability when the conference receiving end leaks information to the outside world. Anything that can achieve the same effect as the security networking The solutions are all within the scope of protection of the present invention.

In the embodiments provided in this application, the media data is watermarked, and then a network element (such as a media server, border firewall, or media proxy gateway, etc.) with watermark identification capability is used to determine the legitimacy of media data transmission. The method can monitor the behavior of illegally forwarding confidential information, and can truncate the leakage of information in real time, and then the leaker can be determined according to the information contained in the watermark.

The following describes the overall flow of the method for detecting media data provided by the embodiment of the present application with reference to FIG. 4 . It is assumed that terminal A communicates with terminal B through a media server, terminal A acts as a conference initiator, and terminal B acts as a conference receiver.

Step S41: The detection device receives media data sent by terminal A, where the media data includes feature information.

After receiving the media data legally sent by the terminal B through the media server, the terminal sends the received media data to other people through various channels, and passes the detection device in the process of sending the media data to other people. As described above, when the media data is leaked to a terminal within the network, the detection device may be a media proxy gateway or a media server; when the media data is leaked to a terminal outside the network, the detection device can be The detection device can be a border firewall.

In addition, the feature information in the media data can be added by the terminal A or added by the media server.

Step S42: The detection device determines whether the media data sent by the terminal B is legal.

The detection device can determine whether the act of terminal B sending the media data is legal according to the feature information contained in the media data. When it is determined that the behavior of the terminal B to send the media data is legal, step S45 is performed; when it is determined that the behavior of the terminal B to send the media data is illegal, steps S43-44 are performed.

Step S43: The detection device intercepts the first media data.

When it is confirmed that the behavior of terminal B sending the media data is illegal, the detection device will intercept the media data at the first time, stop the downward forwarding or prevent the media data from passing through.

Step S44: The detection device sends an alarm prompt to the conference scheduling server or the media server.

Step S45: When the detection device is a media server or a media proxy gateway, it will continue to forward the media data downward; when the detection device is a border firewall, the media data will pass through the network boundary.

In the above method, the detection device identifies whether the behavior of the terminal sending the media data is legal by detecting the characteristic information in the media data, thereby ensuring the data security of the media communication and reducing the risk of information leakage.

In the embodiment provided by this application, there are mainly two ways to add watermark identification (feature information): one is that the media server adds the watermark identification to the media data, and the other is that the conference terminal adds the watermark identification to the media data. The following The specific implementation methods when using these two methods are introduced respectively.

Embodiment 1: Terminal 1 and Terminal 2 perform conference communication. Terminal 1 serves as a conference sending end, and Terminal 2 serves as a conference receiving end. The user corresponding to Terminal 1 is User 1, and the user corresponding to Terminal 2 is User 2. Terminal 1 and Terminal 2 are in the same secure network (refer to FIG. 1 ), and the watermark is added by the media server. The following describes a specific method for detecting media data with reference to FIG. 5 .

Step S51: The terminal 1 sends a meeting request to the meeting scheduling server, where the meeting request carries the addresses of the terminal 1 and the terminal 2, and the addresses may be a MAC address or an IP address. Optionally, the conference request further includes conference service content, such as a voice conference or a video conference; or, the conference request also includes various conference-related information such as conference duration. Optionally, the meeting request also includes information about terminal 1 and information about terminal 2, for example, the device identifiers of terminal 1 and terminal 2, or user information corresponding to terminal 1 and terminal 2, such as meeting account information, private information ( Such as mobile phone number, user name) and other information that can indicate the user's identity.

Step S52: The conference scheduling server receives the conference request and allocates media resources for the conference. The conference scheduling server determines that the media server 1 provides services for the conference according to the conference request, that is, the media server 1 processes and forwards the media data in the conference. In an implementation manner, the conference scheduling server binds the addresses of the media server 1, the terminal 1, and the terminal 2 together and records them in a list, and assigns a conference identifier.

After the media server providing the service is determined, the conference scheduling server sends the address of the media server 1 and the conference ID to the terminal 1 and the terminal 2 respectively. At the same time, the conference scheduling server also sends the conference identification and the addresses of the terminal 2 and the terminal 1 to the media server 1 . So far, the terminal 1, the terminal 2 and the media server 1 have established a conference communication connection. The purpose of steps S51-S52 is mainly to allocate a media server for the conference and establish a connection channel between the sending end and the receiving end, and any other method that can achieve this purpose can replace steps S51-S52.

Step S53: The conference scheduling server generates a watermark identifier of the terminal 2 and sends it to the media server involved in the conference.

The conference scheduling server generates the terminal 2 watermark identifier. In an implementation manner, the conference scheduling server generates a watermark identifier of the terminal 2 based on the relevant information of the terminal 2 (eg, user information). In another implementation manner, the conference scheduling server generates a watermark identifier of the terminal 2 based on the media session information. The media session information indicates that the source address of data transmission is the address of the media server 1 or the address of the terminal 1; or, the media session information is used to indicate that the destination address of the data transmission is the address of the terminal 2. In another implementation manner, the conference scheduling server generates the receiver watermark identifier based on the media session information and related information of the terminal 2 (eg, user information).

The conference scheduling server sends the generated watermark identifier of the terminal 2 to the media server involved in the conference. In the embodiment provided in this application, the conference scheduling server sends the generated watermark identifier of the terminal 2 to the media server 1 .

Step S53': This step is an alternative step to step S43. The difference from step S43 is that in this step, the media server involved in the conference generates a watermark identifier. In the embodiment provided in this application, it is the media server 1 that generates the watermark. And the content contained in the watermark is the same as the description in step S43.

Step S54 : the terminal 1 sends the media data to the media server 1 . Exemplarily, terminal 1 performs desktop sharing, terminal 2 serves as a participant to view the shared screen of terminal 1, and media server 1 serves as an intermediate processing and forwarding unit.

Step S55: After receiving the media data sent by the terminal 1, the media server 1 adds the watermark of the terminal 2 to the media data.

There are many ways to add watermarks to media streams: for example, using inter-frame frequency transform to embed watermarks, which is robust, stable, and imperceptible; another example, using methods such as dual-tree complex wavelet transform (DT CWT) to embed geometric Invariant watermarking, this method can resist common watermarking attacks. The embodiments of the present application do not specifically limit the manner of embedding the watermark.

Step S56: The media server 1 sends the media data carrying the watermark identifier of the terminal 2 to the terminal 2.

When user 2 forwards the media data to other users in the network, steps S57-S59 are performed; when user 2 forwards the media data to other users outside the network, steps S510-S512 are performed.

Step S57: The user 2 leaks the received media data carrying the watermark identifier of the terminal 2 to other users in the network.

User 2 can divulge the media data to other users in various ways. For example, user 2 starts a new conference on terminal 2, and shares the media data sent by terminal 1 as a shared screen to the participants of the new conference. Due to the high robustness of digital watermarking, the media data of the new conference The watermark added by the media server 1 will still be detected. In this leakage mode, the terminal that leaks the information and the conference receiving terminal are the same terminal, that is, the terminal 2 uses the same terminal to leak the conference information after receiving the media data, as shown in FIG. 5 . In another possible implementation manner, the user 2 may also use other terminals other than the terminal 2 to leak the conference information. Of course, the other terminals must be in a secure network. For example, user 2 uses his mobile phone to start a new meeting, and still shares the original meeting image with others through the new meeting. In such a case, there will still be a digital watermark in the media data sent by the mobile phone, which will be identified and intercepted by the detection device in the future.

Step S58: The media server 2 detects that the media data carries the watermark, confirms that the media data transmission is abnormal, and sends an alarm prompt to the conference scheduling server.

When user 2 leaks media data to other users in the intranet, it will be forwarded through the media server. Suppose that when user 2 leaks media data to other users on the intranet, it is forwarded through media server 2. When media server 2 receives the illegally transmitted media data, it detects that there is a watermark in it, indicating that the media data transmission is illegal. That is to say, in the embodiment of the present application, as long as the media server receives the media data including the watermark identifier, it means that the transmission of the media data is illegal. When the media server 2 determines that the received media data is illegal, it will not forward the media data to any terminal.

In another possible implementation manner, in order to improve the accuracy of detecting media data, after determining that the received media data contains a watermark, the media server 2 may further determine whether the information contained in the watermark is correct. In such an implementation manner, the watermark identifier of the terminal 2 needs to include media session information. As described in step S43, the media session information in the watermark of the terminal 2 indicates that the source address of the media data is the address of the media server 1 or the address of the terminal 1. Alternatively, the media session information indicates that the destination address of the media data is the address of the terminal 2 . After the media server 2 parses the watermark in the media data, it finds that the source address (the address of the media server 1 or the address of the terminal 1) indicated by the watermark is different from the source address (the address of the terminal 2) currently sending the media data, Then the media server 2 can determine that there is an abnormality in the transmission of the media data. Of course, the media server can also judge according to the destination address in the watermark (the address of the terminal 2) and the destination address currently receiving the media data (the address of the media server 2), or combine the source address and the destination address.

When it is determined that the media data transmission behavior is abnormal, the media server 2 (detection device) may send an alarm prompt to the conference scheduling server. When the address of the media server 1 is included in the watermark identifier, the media server 2 may directly send an alarm prompt to the media server 1 . Further, when the watermark identifier also includes related information of the terminal 2, the media server 2 can directly determine that the terminal 2 is an abnormal terminal, and then directly send an alarm prompt to the media server 1 to instruct it to stop sending media data to the terminal 2.

It should be noted that, in the embodiment provided in this application, only one media server (ie, media server 1 ) is involved in a conference, but in an actual situation, two media servers may exist in a conference. For example, terminal 1 transmits media data to terminal 2 via media server A and media server B in sequence, and terminal 1, terminal 2, media server A, and media server B are in the same security network. In such a case, the media server (media server B) close to the receiving end may mark the media data with a watermark identification related to the information of the receiving end. Terminal 2 forwards the media data sent by terminal 1 to other users. As long as the media server in the secure network detects that the received media data contains a watermark, it can indicate that there is an abnormality in the transmission of the media data. Further judgment is made according to the watermark content. In conclusion, this application does not specifically limit the number of media servers involved in a conference.

Step S59 : the conference scheduling server sends a notification to the media server 1 to instruct it to stop sending the media data from the terminal 1 to the terminal 2 .

When the watermark identifier also includes the relevant information of the terminal 2, the alarm prompt sent by the media server 2 to the conference scheduling server may carry the relevant information of the terminal 2 to indicate that it is an abnormal terminal. Furthermore, the conference scheduling server can confirm that the terminal 2 is an abnormal terminal according to the alarm prompt, and then immediately send the instruction information to the media server 1 to instruct it to stop forwarding the media data from the terminal 1 to the terminal 2 .

Step S510: The user 2 leaks the received media data carrying the watermark identifier of the terminal 2 to other users outside the network.

As described in step S57, user 2 has multiple possible leakage paths: for example, user 2 opens a new conference on terminal 2, and shares the media data sent by terminal 1 as a shared image to the participants of the new conference. Watch (shown in Figure 4). Due to the high robustness of digital watermarks, the watermarks will still be detected in the media data of new conferences. In another possible implementation manner, user 2 may use other terminals other than terminal 2 to leak information to users in the network. For example, use your own mobile phone to start a new conference, and share the conference screen with terminal 1 to the participants of the new conference. The media data sent by the mobile phone will still include the terminal 2 watermark, which can be subsequently identified by the detection device and intercepted in real time.

Step S511: When the terminal 2 sends the media data to the outside, the border firewall detects that the media data contains a watermark identifier, and determines that there is an abnormality in the transmission of the media data.

When the media server 1 sends the media data to the terminal 2, it has already marked the watermark containing the terminal 2. When the terminal 2 illegally forwards it to the outside, due to the robustness of the digital watermark, the border firewall can detect the watermark contained in the media data. . As long as the border firewall detects the watermark in the media data, it means that there is an abnormality in the transmission of the media data. When the border firewall determines that the media data transmission is abnormal, it will block the passage of the media data, and send an alarm prompt to the conference scheduling server.

In another possible implementation manner, in order to improve the detection accuracy, after the watermark identification is detected, it is further possible to finally determine whether there is an abnormality in the transmission of the media data according to the content of the watermark identification. In such an implementation manner, the conference scheduling server must use the media session information, such as the source address or the destination address, when generating the watermark identifier of the terminal 2 . When the border firewall receives the media data sent by the terminal 2, it identifies the media session information included in the watermark identifier. The session information indicates that the source address is the address of the media server 1 or the address of the terminal 1, and the destination address is the address of the terminal 2. If the source address of the media data currently received by the firewall is the address of terminal 2 and the destination address is another terminal, it means that the media data transmission is illegal. Alternatively, it is also possible to judge whether there is an abnormality in the transmission of the media data only according to the destination address or the source address.

Similar to step S58, when it is determined that there is abnormal transmission, the border firewall will send an alarm prompt to the conference scheduling server. When the watermark identifier also includes the address of the media server 1 and related information of the terminal 2 , the border firewall can directly send an alarm prompt to the media server 1 to instruct it to stop sending media data to the terminal 2 .

Step S512 : the conference scheduling server sends a notification to the media server 1 to instruct it to stop sending the media data from the terminal 1 to the terminal 2 .

When the alarm prompt carries information indicating that terminal 2 is an abnormal terminal, when the conference scheduling server receives the alarm prompt from media server 2, it will immediately send instruction information to media server 1 to instruct it to stop forwarding to terminal 2 from terminal 1. media data.

In the above steps S51-S512, the watermark identifier (terminal 2 watermark identifier) mainly includes terminal 2 related information and media session information. In another possible implementation manner, the watermark identifier may also include a confidentiality level. Exemplarily, the watermark identifier carries information indicating that the confidentiality level is "internal disclosure", then when the media data is re-forwarded or re-shared in the intranet (step S57-step S59), the media server 2 will not intercept. The media data; but when the media data is forwarded to the outside (step S510-step S512), the border firewall will intercept the media data.

In the above method, the media server (media server 1) involved in the conference adds a watermark to the media data before forwarding the media data from the conference sender to the conference receiver. Then, when the conference receiving end performs secondary sharing or secondary forwarding, the media server in the networking and the firewall on the networking boundary will detect that the media data carries the watermark to confirm that the media data transmission is abnormal. When the watermark is detected, or it is determined that the content contained in the watermark does not match the real situation, the media server in the network or the firewall on the border will send an alarm to the conference scheduling server, and then instruct the media server involved in the conference to stop Send media data to the conference receiver. In the above method, no matter whether the user leaks information within the network or leaks information outside the network, it can be intercepted in real time, and there will be no malignant consequences caused by information leakage; Information watermark identification. When the media server in the network or the firewall on the border intercepts the media data containing the watermark identification, the leaker can be determined by analyzing the content of the watermark identification.

The key to the above detection information leakage is the watermark identification. In order to ensure that the watermark identification itself has not been tampered with, in a possible implementation manner, a digital signature needs to be used to ensure the security of the media data transmission channel. Digital signatures are often carried in the header of media data packets. Digital signatures can be used in every media session to ensure the security of the transmission channel. For example, when terminal 1 performs desktop sharing with terminal 2, there are two media sessions in total, one is from terminal 1 to the media server, and the other is from the media server 1 to terminal 2. In addition, the media session when the terminal 2 leaks to the outside may also use a digital signature to ensure the security of channel transmission. The principle of using digital signatures for each media session is similar.

Taking the use of a digital signature from the terminal 1 to the media server 1 to ensure the security of the transmission channel as an example, the method of using the digital signature is introduced in detail. The conference scheduling server distributes a key to all media servers in the network and firewalls on the border, and the conference scheduling server uses the key to encrypt the media session information and/or user information of the terminal 1 to generate a digital signature. It should be noted that the conference scheduling server, the media server and the border firewall in the network can negotiate the algorithm of the digital signature in advance. There are many kinds of digital signature algorithms: including RSA (Rivest, Shamir, Adleman), DSA (DIgital Signature Algorithm) and so on. The conference scheduling server issues the generated digital signature to the terminal 1, and the terminal 1 carries the digital signature in the packet header of the media data when the terminal 1 transmits the media data to the media server (step S44). When receiving the media data sent by the terminal 1, the media server 1 obtains the digital signature carried in the media data. Then, the media server 1 calculates the digital signature based on the key distributed by the conference scheduling server and the algorithm negotiated in advance. The media server 1 compares the calculated digital signature with the digital signature carried in the media data, and if they are consistent, the transmission channel is safe, that is, the transmission data has not been tampered with.

Taking the terminal 2 leaking information to other users in the network through the media server 2 as an example, the method of using a digital signature to ensure the security of the transmission channel is introduced. Similarly, the conference scheduling server distributes a key to all media servers in the network and firewalls on the border, and the conference scheduling server uses the key to encrypt the media session information and/or user information of the terminal 2 to generate a digital signature. The conference scheduling server issues the digital signature to the terminal 2, and the terminal 2 carries the digital signature in it when sharing or re-forwarding the media data externally. When the media server 2 receives the media data sent by the terminal 2, it calculates the digital signature according to the algorithm negotiated with the conference scheduling server and the key, and compares the calculated digital signature with the digital signature carried in the received media data to determine the digital signature. Whether the transmission channel is secure. When there is no digital signature or the digital signature is invalid, the media server 2 will not forward the media data to any terminal, and will also send an alarm prompt to the conference scheduling server to feedback that the terminal 2 is an abnormal terminal.

In Embodiment 1, the media server involved in the conference adds a watermark to the media data. When the media data is re-forwarded or shared, the detection device will detect that the re-forwarded or re-shared media data contains The watermark is identified, and then real-time interception is performed to reduce the loss caused by information leakage. Moreover, the detection device can track the leaker according to the information contained in the watermark identification.

Embodiment 2: Terminal 1 and Terminal 2 perform conference communication, Terminal 1 serves as a conference sender, and Terminal 2 serves as a conference receiver. The user corresponding to Terminal 1 is User 1, and the user corresponding to Terminal 2 is User 2. Terminal 1 and Terminal 2 are in the same security network (refer to Figure 1), and each terminal in the conference will add information related to its own information or related to media session information to the media data when sending media data. watermark. The following describes a specific method for detecting media data with reference to FIG. 6 .

Steps S61-S62: have the same functions as steps S51-S52, and are not repeated here.

Step S63 : the conference scheduling server generates the watermark identifier of terminal 1 and sends it to the media server involved in the conference, and then the media server involved in the conference forwards the watermark identifier of terminal 1 to terminal 1 .

In another possible implementation manner, the conference scheduling server directly sends the generated watermark identifier of the terminal 1 to the terminal 1 without forwarding through the MCU.

Similar to the description in Embodiment 1, the terminal 1 watermark can be generated based on terminal 1 related information (eg user information), media session information, or terminal 1 related information and media session information. The media session information is used to indicate that the source address of data transmission is the address of media server 1 or the address of terminal 1; or the media session information is used to indicate that the destination address of data transmission is the address of terminal 2.

Step S63': This step is an alternative step to step S63. Different from step S63, in this step, the media server involved in the conference generates the terminal 1 watermark. In the embodiment provided in this application, the media server 1 generates the watermark identifier of the terminal 1, and then the media server 1 sends the generated watermark identifier of the terminal 1 to the terminal 1.

Step S64: The terminal 1 sends the media data to which the watermark of the terminal 1 is added to the media server 1.

In this step, before sending the media data to the media server 1 , the terminal 1 first adds the received watermark identifier to the media data, and then sends the media data to the media server 1 . There are many ways for the terminal 1 to add a watermark to the media data, and reference may be made to step S55.

Step S65: After receiving the media data sent by the terminal 1, the media server 1 determines that the media data is legal according to the watermark identifier of the terminal 1 contained therein.

After receiving the media data of the terminal 1, the media server 1 determines that it contains only one watermark, and determines that the transmission of the media data is normal according to the media session information contained in the watermark and the actual transmission situation.

It should be noted that this step is an optional step. The media server 1 has determined that the terminal 1 is the sender of the conference and the terminal 2 is the receiver of the conference according to steps S61 to S62. It can be directly forwarded to the conference receiver without parsing the media data, so as to reduce the occupation of the computing resources of the media server.

Step S66 : the media server 1 sends the media data from the terminal 1 to the terminal 2 .

When user 2 forwards the media data to other users in the network, steps S57-S59 are performed; when user 2 forwards the media data to other users outside the network, steps S610-S612 are performed.

Step S67: User 2 leaks the received media data carrying the watermark of terminal 1 to other users in the network. There are multiple ways for user 2 to leak to other users in the network:

Mode 1: User 2 starts a new conference on terminal 2 through the same conference system, and shares the conference screen with terminal 1 to the participants of the new conference. Among them, the same conference system can be understood as the same conference service provider.

Mode 2: User 2 starts a new conference on terminal 2 through another conference system.

Mode 3: User 2 starts a new conference on terminal 3 through the same conference system. For example, when the terminal 2 is the computer of the user 2, the terminal 3 may be the mobile phone of the user 2.

Mode 4: User 2 starts a new conference on terminal 3 through another conference system.

The above method for opening a new conference is only an example, and any other behavior of leaking data to other users in the form of media streaming is within the scope of protection of this application. In addition, the terminal 3 must also be in a secure network. For example, the terminal 3 is connected to the company's Wi-Fi.

In the case of mode 1, it is assumed that the media server used for the new conference is the media server 2. When the terminal 2 initiates a new conference, the conference scheduling server or the media server 2 will distribute the terminal 2 watermark to the terminal 2. For the content included in the watermark identifier of the terminal 2, please refer to step S63. In this case, since the same conference system is used, the terminal 2 will also mark the media data with the terminal 2 watermark when sending the media data of the new conference to the outside. That is to say, the media data sent out by the terminal 2 includes two watermark identifiers (the watermark identifier of the terminal 1 and the watermark identifier of the terminal 2).

In the case of Mode 2, it is assumed that the media server used in the new conference is Media Server 2. Since the same conference system is not used, Terminal 2 will not mark its own watermark when sending media data to the outside world, that is, The media data sent by the terminal 2 to the outside only includes the watermark of the terminal 1.

In the case of mode 3, it is assumed that the media server used for the new conference is the media server 2. Since the same conference system is used, when the terminal 3 establishes a new conference, the conference scheduling server or the media server 2 will send the terminal to the terminal 3. 3 watermark logo. For the content included in the watermark of the terminal 3, please refer to step S63. That is to say, in this manner, the media data leaked by the user 2 to the outside includes two watermarks (the watermark of the terminal 1 and the watermark of the terminal 3).

In the case of mode 4, it is assumed that the media server used in the new conference is media server 2. Since the media server is used in a different system, terminal 3 will not mark its own watermark when sending media data to the outside world, that is to say, terminal 3 sends media data to Only the watermark of terminal 1 is included in the media data sent outside.

Step S68: The media server 2 detects and identifies the watermark in the media data, and confirms that the media data is abnormally transmitted.

When receiving the illegally transmitted media data, the media server 2 will detect and identify the watermark contained therein, and judge whether the media data transmission is legal according to the content of the watermark. In the case of Mode 1 and Mode 3, if the media server 2 detects that the media data contains two watermarks, it can directly indicate that the transmission of the media data is illegal. However, when the media server 2 detects only one watermark, it needs to determine whether the media data transmission is legal or not according to the media session information contained in the watermark. Exemplarily, in the case of Mode 2, the media server 2 detects that the media session information in the watermark identifier of the terminal 1 included in the media data indicates that the destination address is the address of the terminal 2, and the destination address of the media data should be is the address of the media server 2, it can be determined that the media data transmission is illegal transmission. The rest of the situation will not be repeated here.

Similar to step S58, when it is detected that the media data transmission is abnormal, the media server 2 will send an alarm prompt to the conference scheduling server or the media server 1.

Step S69: After receiving the alarm prompt, the conference scheduling server instructs the media server 1 to stop sending media data to the terminal 2.

The detection device can determine that the terminal 2 is an abnormal terminal according to the information contained in the watermark identifier, and the detection device will carry the relevant information of the terminal 2 in the alarm prompt sent to the conference scheduling server. Further, the conference scheduling server will notify the media server 1 to stop sending new media data to the terminal 2 according to the alarm prompt.

Step S610: User 2 leaks the received media data carrying the watermark of terminal 1 to other users outside the network.

As in step S67, there may be multiple leakage paths for user 2. No matter what method the user 2 uses to leak the received media data, based on the robustness of the digital watermark, the user's illegal leaking behavior can be detected by the detection device (media server 2 ) and intercepted in real time.

Step S611: When the terminal 2 sends the media data to the outside, the border firewall detects and identifies the watermark identifier contained in the media data, and determines that the media data transmission is illegal transmission.

In the embodiment provided in this application, the detection device (border firewall) can directly determine that the media data transmission is illegal transmission after detecting that the media data contains two watermarks. The border firewall detects that the media data contains only one watermark, and needs to judge whether the media transmission is legal based on the media session information in the watermark and the actual situation.

When it is determined that the media data transmission is illegal transmission, the border firewall may send an alarm prompt to the conference scheduling server. When the border firewall can determine that the terminal 2 is an abnormal terminal based on the content of the watermark identification, the alarm prompt can carry the relevant information of the terminal 2 .

Step S612: The conference scheduling server controls the media server 1 to stop sending media data to the terminal 2 based on the alarm prompt.

When the conference scheduling server can determine that the terminal 2 is an abnormal terminal based on the alarm prompt, the conference scheduling server will notify the media server 1 to stop sending new media data to the terminal 2 .

Similar to the first embodiment, the watermark identification may also include a confidentiality level. According to different confidentiality levels, different detection equipment will adopt different strategies. For example, when the watermark identifier carries information indicating that the confidentiality level of the media data is internal disclosure, the media server 2 in the network will not intercept the media data when it receives the media data; The firewall will intercept the media data, and ultimately ensure that the media data's disclosure scope is internal disclosure.

In the above embodiment, the terminal will mark the media data with a watermark when sending the media data. When the media data is subsequently leaked, the detection device can judge whether the transmission of the media data is legal according to the content of the watermark, which ensures the data. Security of communications.

Embodiment 3: Terminal 1 and Terminal 2 perform conference communication, Terminal 1 serves as a conference sender, and Terminal 2 serves as a conference receiver. The user corresponding to Terminal 1 is User 1, and the user corresponding to Terminal 2 is User 2. Terminal 1 and Terminal 2 are in two different security networks (refer to Figure 2), and the watermark can be added by the media server (media server 21) close to the receiving end or by the media server (media server 11) close to the sending end. In order to simplify the process, in this embodiment, the default firewall only detects media streams that flow outside the network. The following will introduce a specific method for detecting information leakage.

Steps S71-S72: refer to steps S51-S52, this step is mainly used by the conference scheduling server to allocate a media server for the conference. In this embodiment, the media server 11 and the media server 21 are media servers allocated by the conference scheduling server for the conference.

Step S73: The media server 21 receives the terminal 2 watermark identifier generated by the conference scheduling server, or the media server 21 directly generates the terminal 2 watermark identifier.

Similar to step S53, the terminal 2 watermark identifier may include terminal 2 related information (eg user information), or the terminal 2 watermark identifier may include media session information, or the terminal 2 watermark identifier may include terminal 2 related information and media session information. The media session information is used to indicate that the destination address of the media data is the address of the terminal 2 . Or, when the watermark is identified as being added by the media server 11, the media session information is used to indicate that the source address of the media data is the address of the terminal 1 or the address of the media server 11; when the watermark is identified as being added by the media server 21, the media session information The source address used to indicate the media data is the address of the terminal 1 , the address of the media server 11 or the address of the media server 21 .

Step S74: The terminal 1 sends media data to the media server 21 through the media server 11, the firewall 1, and the firewall 2 in sequence.

Step S75: After the media server 21 receives the media data sent from the media server 11, it adds the watermark of the terminal 2 to the media data. For the method of adding a watermark, reference may be made to step S55.

Step S76: The media server 21 sends the media data carrying the watermark identifier of the terminal 2 to the terminal 2.

When user 2 forwards the media data to other users in the network, steps S77-S79 are performed; when user 2 forwards the media data to other users outside the network, steps S710-S712 are performed.

Step S77: The user 2 leaks the received media data carrying the watermark identifier of the terminal 2 to other users in the network.

Step S78: The media server 22 receives the media data leaked by the user 2 to other users, and determines that the media data transmission is illegal according to the watermark identifier in the media data. The media server 22 is the media server through which the user 2 sends media data to other users in the intranet. Similar to Embodiment 1, there are many ways to determine that the media transmission is illegal. When the watermark is detected, it can be directly determined that the media transmission is illegal; The media session information and the actual transmission situation are used to determine whether the media data transmission is legal.

Step S79: The media server 22 sends an alarm prompt to the conference scheduling server. When the address of the media server 21 is included in the watermark identifier of the terminal 2 , the media server 22 may also directly send an alarm prompt to the media server 21 . Further, the watermark identifier also includes information about the terminal 2, and the media server 22 can determine that the terminal 2 is an abnormal terminal. Furthermore, the relevant information of the terminal 2 may be carried in the alarm prompt to notify the media service 22 to stop sending new media data to the terminal 2 .

Step S710: The user 2 leaks the received media data carrying the watermark identifier of the terminal 2 to other users outside the network. For various leakage paths, please refer to step S510.

Step S711: The border firewall 2 detects that the received media data includes a watermark, and determines that the media data transmission is abnormal.

When the user 2 sends media data to the group through various channels, the border firewall 2 will detect the watermark in it, and then determine that the sending behavior is illegal. Further, in order to improve the detection accuracy, it is also determined whether the sending behavior is illegal based on the content contained in the watermark identifier. For the specific determination process, please refer to step S511.

Step S712: The border firewall 2 sends an alarm prompt to the conference scheduling server. When the media server 21 is also included in the watermark identifier, the border firewall 2 may directly send an alarm prompt to the media server 21 . Further, when the watermark identifier includes information about the terminal 2, the border firewall can directly determine that the terminal 2 is an abnormal terminal, and then can notify the media server 21 to stop sending new media data to the terminal 2.

The difference between the third embodiment and the first embodiment is only whether the terminal 1 and the terminal 2 are in the same security network. Because they are in different networks, the forwarding paths when the terminal 1 sends the media data to the terminal 2 are different. But the idea of detecting media data is the same. In order to monitor the illegal leakage behavior of the terminal 2, the terminal 2 needs to be in a secure network, or in other words, the terminal 2 needs to be in a monitored network environment.

For the system architecture 2 (FIG. 2), the third embodiment only takes the media server adding the watermark as an example. When the watermark is added by the terminal device, please refer to the system architecture 2 and the second embodiment.

Embodiment 4: Terminal 1 and Terminal 2 perform conference communication, Terminal 1 serves as a conference sending end, Terminal 2 serves as a conference receiving end, the user corresponding to Terminal 1 is User 1, and the user corresponding to Terminal 2 is User 2. Terminal 1 is outside the security network, and Terminal 2 is within the security network (refer to Figure 3). The watermark can be added by the media server (media server 4) close to the receiving end or by the media server (media server 3) close to the sending end. In this embodiment, the default firewall only detects media data that flows outside the network.

In this case, the watermark identifier may include terminal 2 related information, or the watermark identifier may include media session information, or the watermark identifier may include terminal 2 related information and media session information. The media session information is used to indicate that the destination address of the media data is the address of the terminal 2 . When the watermark is added by the media server 3, the media session information is also used to indicate that the source address of the media data is the address of the terminal 1 or the address of the media server 3; when the watermark is added by the media server 4, the media session information is also used for to indicate that the source address of the media data is the address of the terminal 1, the address of the media server 3 or the address of the media server 4. Only in this case can the terminal 1 successfully send the media data to the terminal 2, and then the terminal 2 can be intercepted by the detection device when it leaks the media data to the outside.

The difference between the fourth embodiment and the third embodiment or the first embodiment mainly lies in the system architecture, but the idea of detecting whether the media data transmission is legal is the same.

For the system architecture 3 (FIG. 3), the fourth embodiment only takes the media server adding a watermark as an example. When the watermark is added by a terminal device, please refer to the system architecture 3 and the second embodiment.

All the above embodiments take the terminal 2 adding a watermark before receiving the legally transmitted media data as an example, and in another possible implementation manner, the watermark is added by the terminal 2 when the terminal 2 forwards the watermark to the outside. logo. Exemplarily, the conference system may provide the user with a one-click forwarding or one-click sharing function. In this case, when the terminal 2 receives the media data sent by the terminal 1 (the media data does not contain a watermark identifier at this time) and then forwards it to the outside through the one-key forwarding function, the terminal 2 watermark identifier is added. The watermark identifier It may include user information of the terminal 2 or a network address of the terminal 2, or a confidentiality level. When receiving the media data sent by the terminal 2, the detection device judges whether the transmission of the media data is legal based on the content of the watermark identification.

In another embodiment of the present invention, the detection device can detect whether the media data sent by the terminal 2 contains permission information to determine whether the behavior of the terminal 2 to send the media data is legal. For example, the permission information may be forwarding permission or the like. When the media data does not contain permission information, it is considered that the behavior of the terminal 2 to send the media data is illegal.

The method for detecting media data is described above with reference to FIGS. 1-6 , and the apparatus and device for performing the above method will be described below with reference to FIGS. 7-8 .

An embodiment of the present application provides an apparatus 700 for detecting media data, the apparatus includes a communication module 710 and a processing module 711, wherein the communication module 710 is configured to receive first media data sent by a first terminal, the first media data It includes first feature information; the processing module 711 is configured to determine, according to the first feature information, whether the first media data sent by the first terminal is legal.

Optionally, the first media data sent by the first terminal is sent by the second terminal to the first terminal through the first media server. In this case, the first terminal is the conference receiving end, corresponding to the terminal 2 in the first, second, third, and fourth embodiments, and the second terminal is the conference sending end, corresponding to the first, second, third, and fourth embodiments. terminal 1.

Optionally, the first feature information is added by the first media server.

Optionally, the first feature information is added by the second terminal.

Optionally, the first feature information includes legal sender information or legal receiver information.

Optionally, the first feature information includes the legal sender information, the legal sender information includes the first media server information, and the communication module 710 is further configured to: when according to the first feature information When it is determined that the first media data sent by the first terminal is illegal, first alarm information is sent to the first media server according to the first feature information.

Optionally, the first feature information includes the legal sender information and the legal receiver information, the legal sender information includes the first media server information, and the communication module 710 is further configured to: when When it is determined that the first media data sent by the first terminal is illegal according to the first feature information, second alarm information is sent to the first media server according to the first feature information, and the second alarm information uses for indicating that the first terminal is an abnormal terminal.

Optionally, the first feature information includes the legal sender information and the legal receiver information, the legal sender information includes the first media server information, and the communication module 710 is further configured to: when When it is determined according to the first feature information that the first media data sent by the first terminal is illegal, the first media server is instructed to stop sending the second media data to the first terminal according to the first feature information.

Optionally, the communication module 710 is further configured to: receive first media data sent by the first terminal to a third terminal, where the third terminal communicates with the first terminal through the apparatus.

Optionally, the apparatus 700 for detecting media data may be the first media server, or the apparatus may be a second media server, and the second media server is different from the first media server, or the apparatus may be Firewall, or the device is a media proxy gateway.

Optionally, the first media data is generated by the first terminal according to third media data received by the fourth terminal, where the third media data includes the first feature information. In this case, the fourth terminal is the conference receiving terminal, the first terminal leaks the data received by the fourth terminal through various channels, and the detection device can detect the behavior based on the feature information included in the data. When the behavior is illegal, the transmission of the data can be intercepted in real time.

Optionally, the first media data includes a digital signature, and the digital signature is used to determine that the first media data has not been tampered with.

FIG. 8 is a device 80 for detecting media data provided by an embodiment of the present application. As shown in the figure, the device 80 includes a processor 81 , a memory 82 , and a communication interface 83 . Among them, the processor 81, the memory 82, and the communication interface 83 realize the communication connection by means such as wired or wireless transmission. The memory 82 is used to store instructions, and the processor 81 is used to execute the instructions. The memory 82 stores program instructions, and the processor 81 can invoke the program instructions stored in the memory 82 to perform the following operations:

Receive first media data sent by a first terminal, where the first media data includes first feature information; and determine whether the first media data sent by the first terminal is legal according to the first feature information.

Optionally, the processor 81 executes the program instructions to complete:

When it is determined according to the first feature information that the first media data sent by the first terminal is illegal, first alarm information is sent to the first media server according to the first feature information.

Optionally, the processor 81 executes the program instructions to complete:

When it is determined according to the first feature information that the first media data sent by the first terminal is illegal, send second alarm information to the first media server according to the first feature information, the second alarm information It is used to indicate that the first terminal is an abnormal terminal.

Optionally, the processor 81 executes the program instructions to complete:

When it is determined according to the first feature information that the first media data sent by the first terminal is illegal, instruct the first media server to stop sending the second media data to the first terminal according to the first feature information .

It should be understood that, in this embodiment of the present application, the processor 81 may be a CPU, or other general-purpose processors that can execute stored program instructions. The memory 82 , which may include read-only memory and random access memory, provides instructions and data to the processor 81 . Memory 82 may also include non-volatile random access memory. For example, memory 82 may also store device type information. The memory 82 may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory. Volatile memory may be random access memory (RAM). By way of example and not limitation, many forms of RAM are available, such as dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (double data date SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synchlink DRAM, SLDRAM) and direct memory bus random access memory (direct rambus RAM, DR RAM). In addition to the data bus, the bus 94 may also include a power bus, a control bus, a status signal bus, and the like. However, for the sake of clarity, the various buses are designated as bus 84 in the figure.

The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented in software, the above-described embodiments may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more program instructions. When the program instructions are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general purpose computer, special purpose computer, computer network, or other programmable device. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center is by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, a data center, or the like that contains one or more sets of available media. The usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media. The semiconductor medium may be a solid state drive (SSD).

The above descriptions are merely specific embodiments of the present application. Those skilled in the art can think of changes or substitutions based on the specific embodiments provided by the present application, which should all fall within the protection scope of the present application.

Claims (28)

1. A method for detecting media data, characterized in that the method comprises:

   The detection device receives first media data sent by the first terminal, where the first media data includes first feature information;

   The detection device determines, according to the first feature information, whether the first media data sent by the first terminal is legal.
2. The method according to claim 1, wherein the first media data sent by the first terminal is sent by the second terminal to the first terminal through a first media server.
3. The method according to claim 2, wherein the first characteristic information is added by the first media server.
4. The method according to claim 2, wherein the first characteristic information is added by the second terminal.
5. The method according to any one of claims 1-4, wherein the first characteristic information includes legal sender information and/or legal receiver information.
6. The method according to claim 5, wherein the legal recipient information includes first terminal information, and the legal sender information includes second terminal information or first media server information.
7. The method according to claim 6, wherein the first characteristic information comprises the legal sender information, the legal sender information comprises the first media server information, and the method further comprises:

   When the detection device determines according to the first feature information that the first media data sent by the first terminal is illegal, the detection device sends a first alarm to the first media server according to the first feature information information.
8. The method according to claim 6, wherein the first characteristic information comprises the legal sender information and the legal receiver information, the legal sender information comprises the first media server information, and the The method also includes:

   When the detection device determines according to the first feature information that the first media data sent by the first terminal is illegal, the detection device sends a second alarm to the first media server according to the first feature information information, the second alarm information is used to indicate that the first terminal is an abnormal terminal.
9. The method according to claim 6, wherein the first characteristic information comprises the legal sender information and the legal receiver information, the legal sender information comprises the first media server information, and the The method also includes:

   When the detection device determines according to the first feature information that the first media data sent by the first terminal is illegal, the detection device instructs the first media server to stop sending data to the first media server according to the first feature information The first terminal sends the second media data.
10. The method according to any one of claims 1-9, wherein the detection device receiving the first media data sent by the first terminal specifically includes:

    The detection device receives first media data sent by the first terminal to a third terminal, and the third terminal communicates with the first terminal through the detection device.
11. The method according to any one of claims 1-10, wherein the detection device is the first media server, or the detection device is a second media server, and the second media server and the The first media servers are different, or the detection device is a firewall, or the detection device is a media proxy gateway.
12. The method according to claim 1, wherein the first media data is generated by the first terminal according to third media data received by a fourth terminal, and the third media data includes the first media data. characteristic information.
13. The method according to any one of claims 1-12, wherein the first media data includes a digital signature, and the digital signature is used to determine that the first media data has not been tampered with.
14. A device for detecting media data, characterized in that the device comprises a communication module and a processing module:

    The communication module is configured to receive first media data sent by a first terminal, where the first media data includes first feature information;

    The processing module is configured to determine, according to the first feature information, whether the first media data sent by the first terminal is legal.
15. The apparatus according to claim 14, wherein the first media data sent by the first terminal is sent by the second terminal to the first terminal through a first media server.
16. The apparatus according to claim 15, wherein the first characteristic information is added by the first media server.
17. The apparatus according to claim 15, wherein the first characteristic information is added by the second terminal.
18. The apparatus according to any one of claims 14-17, wherein the first characteristic information includes legal sender information and/or legal receiver information.
19. The apparatus according to claim 18, wherein the legal recipient information includes first terminal information, and the legal sender information includes second terminal information or first media server information.
20. The apparatus according to claim 19, wherein the first characteristic information comprises the legal sender information, the legal sender information comprises the first media server information, and the communication module is further configured to:

    When it is determined according to the first feature information that the first media data sent by the first terminal is illegal, first alarm information is sent to the first media server according to the first feature information.
21. The apparatus according to claim 19, wherein the first characteristic information comprises the legal sender information and the legal receiver information, the legal sender information comprises the first media server information, and the The communication module described above is also used to:

    When it is determined according to the first feature information that the first media data sent by the first terminal is illegal, send second alarm information to the first media server according to the first feature information, the second alarm information It is used to indicate that the first terminal is an abnormal terminal.
22. The apparatus according to claim 19, wherein the first characteristic information comprises the legal sender information and the legal receiver information, the legal sender information comprises the first media server information, and the The communication module described above is also used to:

    When it is determined according to the first feature information that the first media data sent by the first terminal is illegal, instruct the first media server to stop sending the second media data to the first terminal according to the first feature information .
23. The device according to any one of claims 14-22, wherein the communication module is further configured to:

    Receive first media data sent by the first terminal to a third terminal, where the third terminal communicates with the first terminal through the device.
24. The device according to any one of claims 14-23, wherein the device is the first media server, or the device is a second media server, the second media server and the first media server The media servers are different, or the device is a firewall, or the device is a media proxy gateway.
25. The apparatus according to claim 14, wherein the first media data is generated by the first terminal according to third media data received by a fourth terminal, and the third media data includes the first media data. characteristic information.
26. The apparatus according to any one of claims 14-25, wherein the first media data includes a digital signature, and the digital signature is used to determine that the first media data has not been tampered with.
27. A device for detecting media data, the device includes a processor and a memory, the memory stores computer instructions, the processor executes the computer instructions in the memory to implement any one of claims 1-13. Methods.
28. A computer-readable storage medium, storing program instructions in the computer-readable storage medium, when the program instructions are executed on a computer, the computer can execute the method according to any one of claims 1-13.

Images