KR101837188B1 - Video protection system - Google Patents

Abstract

The present invention relates to a video protection system to protect a video file distributed through a closed circuit television (CCTV) system over the entire process. According to the present invention, the video protection system comprises: a camera (CAM) to output encrypted video data in which photographed video data is encrypted; a network video recorder (NVR) to receive the encrypted video data from the camera (CAM) to store the received data; a local key server (LKS) detachably connected to the network video recorder (NVR) to provide a local key; a remote video player (RVP) receiving the encrypted video data with an added key block from the network video recorder (NVR) and playing the received encrypted video data. The camera (CAM) includes a video encryption agent (VEA) to generate the encrypted video data. The network video recorder (NVR) includes a video management agent (VMA) to manage the encrypted video data. The remote video player (RVP) includes a video decryption agent (VDA) to decrypt the encrypted video data to which the key block is added.

Description

[0001] VIDEO PROTECTION SYSTEM [

The present invention relates to a video protection system for preventing leakage and misuse of video in a system.

<Definition of Video Protection System>

A video protection system (VPS) is a security system for protecting all video and digital data generated and distributed within a video related system. Here, the generation of the data may be performed, for example, through a camera (CAM) of CCTV or Video Surveillance System (VSS).

The video protection system (VPS) includes a data transmission / reception step between the camera (CAM) and the network video recorder (NVR) (e.g., (E.g., encrypting the communication channel to prevent image swapping or image leakage), a storage step in the network video recorder (NVR) (E.g., maintaining the encryption state of all outgoing files and performing access control via authentication).

<Characteristics of CCTV technology and market>

The video protection system (VPS) of the present invention can be applied to all video related systems, but the CCTV system will be described below as a main example.

In general, the basic functions of a CCTV system do not differ greatly from one manufacturer to another. Typically, vendors use proprietary video file formats, but they also use standard technologies such as Real-time Transportation Protocol (RTP) or mp4. The codec is mainly used for H.264 and H.265, and the files of the network video recorder (NVR) may be divided in size or time and stored in a separate file system.

The IP camera (CAM) is provided with an SD card slot for backup purposes, and the network video recorder (NVR) is connected to the camera (CAM) via the IP network. However, among network video recorders (NVRs), there are many so-called isolated network video recorders (NVRs) that are not connected to the Internet.

On the playing side of video, there are some cases where you play video in the browser, but a lot of dedicated apps (apps, applications, applications) are also used. However, there is not much support for the HTML5 browser yet.

Simultaneous requests from multiple channels for a single camera (CAM) are possible, and more than one video stream can be generated from a single camera (CAM). At this time, the bit rate of the primary video which is full HD is about 2 to 5 Mbps, and the resolution and the bit rate of the video for the live display are lowered.

The video delivered to the network video recorder (NVR) can be stored in a file form, output to the screen, transmitted to the outside in real time, or backed up to a USB device. The maximum number of channels that can be processed by one network video recorder (NVR) is about 128 channels. In this case, the live stream is sent in the resolution of CIF and displayed on the screen.

BACKGROUND ART [0002]

Conventionally, according to the patent document, a CCTV image security management system including a camera 100 and a video management server 200 is disclosed. As shown in FIG. 2 of the patent document, when the video management server 200 requests the camera 100 to provide an image, the CCTV image security management system transmits the encoded image to the video management server 200 , And the video management server 200 restores the encoded image to the original state and further converts it into a privacy-providing image and stores it (paragraph [28]).

Here, the image management server 200 stores the identification information and the password of the entire camera 100 connected to the video management server 200, and the camera 100 can store the identification information and the password of the camera itself. The identification information may be, for example, a unique ID. The video management server 200 may transmit a photographic image providing request to the camera 100. [ According to an embodiment, the camera 100 may provide an image (paragraph [33], [34]) even if the image management server 200 does not transmit the captured image providing request to the camera 100 .

The camera 100 generates a time stamp, generates a coding key by inputting the password of the camera and the time stamp into a first one-way function, and symmetrically codes the captured image using the coding key to generate encoded video data And transmits the encoded image data, the time stamp, and the identification information of the camera to the video management server (paragraph [35]).

The video management server 200 retrieves the password corresponding to the received camera identification information from the pre-stored camera information to obtain the camera password. Also, the video management server 200 generates the encoding key by inputting the camera password and the received time stamp into a predetermined one-way function shared with the camera. For example, the encoding key may be a hash value of the first hash function using the camera password and the time stamp value as input parameters. In addition, the video management server 200 reconstructs the received encoded image data using the encoding key (paragraph [38] to [40]).

If the password of the camera 100 is not known, the CCTV video security management system of this patent document can not obtain the encoding key, and thus the encoded video data can not be restored to the original state. Therefore, the camera 100 can not restore the encoded video data to the video management server 200 There is an effect (paragraph [41]) that can prevent the original image from being leaked even if the data to be transmitted is leaked in the middle.

Patent registration 10-1331201

<Security attack model - Problem>

However, in such a conventional general CCTV system, weak security that depends on an ID and a password is basically problematic.

First, the system user can share his / her ID and password with others. And a man-in-the-middle attack can occur on all networks and I / O channels. In addition, a replay attack is possible for all communication messages in the system. It is also possible to reverse-engineer attacks against the binary agent library. In addition, all data stored in a file format can be changed, copied, deleted, and so on.

It is also possible to attack the camera 100 of the key creation device, for example, the patent document, or to remove, change, or the like to the local key generating device installed directly to the device connected to the camera. And a random message attack against the local key server (LKS) is possible. And an access attack against the internal storage device of the local key server (LKS) is possible. Or an intrusion attack against an Access Authorization Server (AAS) (Access Authization Server), which is an external generation providing key. And DDOS attacks against the Access Authorization Server (AAS) are possible.

<Requirement - Assignment>

In order to solve the above problem, the present invention provides a video protection system that protects a video file distributed through a CCTV system over the entire process.

In addition, a video which performs authentication, encryption, and decryption necessary for the whole of a camera (CAM), a network video recorder (NVR), a local video player (LVP), a remote video player Protection system.

And we implement and implement a video protection system based on DRM technology.

And we are trying to provide a video protection system by devising a security mechanism that can be applied to an isolated environment without the Internet.

And to provide a comprehensive system configurable video protection system to support as many CCTV system operation models as possible.

Rather than seeking the best security, we want to provide a video protection system based on cost-effective security technology.

In a multi-network video recorder (NVR) environment equipped with a plurality of network video recorders (NVR), one of them is set as a primary network video recorder (NVR) and the other is set as a secondary network video recorder , And the primary network video recorder (NVR) is used for authentication and play key (PK) issuance of the secondary network video recorder (NVR), thereby providing a video protection system capable of systematic authentication and play key management.

According to an aspect of the present invention, there is provided a video protection system including a camera (CAM) for outputting encrypted video data encrypted with captured video data, and a network video recorder for receiving and storing the encrypted video data from the camera (NVR) , wherein the camera (CAM ) is provided with a video encryption agent ( VEA ) for generating the encrypted video data, and the network video recorder (NVR) And a local key server ( LKS ), which is detachably connected to the network video recorder (NVR) and provides a local key (LK), is provided with a video management agent ( VMA ) A local video player &lt; RTI ID = 0.0 &gt; (LVP) , wherein the local video player (LVP) is provided with a video decryption agent ( VDA ) for decrypting the encrypted video data, and in generating the local key (LK), the video management agent VMA) requests the local key server (LKS) to generate the local key (LK), and the local key server (LKS) generates the new local key (LK) Wherein the network video recorder (NVR) calls the video management agent (VMA) before generating the encrypted data, and the video management agent (VMA) (CAM) transmits the local key (LK) to the video encryption agent (VEA) when generating the encrypted data, wherein the camera (VEA), the video encryption agent (VEA) encrypts the video data using the local key (LK) to generate the encrypted video data, and when decrypting the encrypted video data, The video decryption agent VDA requests the local key server LKS for the local key LK and the local key server LKS sends the local key LK to the video decryption agent VDA And the video decoding agent (VDA) decrypts the encrypted video data with the local key (LK).

Here, the local video player (LVP) preferably receives user authentication from the local key server (LKS) through the video management agent (VMA).

On the other hand, the video protection system of the present invention includes a camera (CAM) for outputting encrypted video data in which captured video data is encrypted, and a network video recorder (NVR) for receiving and storing the encrypted video data from the camera Wherein the camera (CAM) is provided with a video encryption agent ( VEA ) for generating the encrypted video data, and the network video recorder (NVR) is provided with a video And a local key server ( LKS ) provided with a management agent (VMA) and detachably connected to the network video recorder (NVR) for providing a local key (LK) block (block key) is added to the encrypted remote playing the video data received video player Following is equipped with a (RVP), the remote video player (RVP), the is provided a video decoding agent (VDA) for decoding the encoded video data, wherein the key block is added upon creation of the local key (LK) Wherein the video management agent VMA requests the local key server LKS to generate the local key LK and the local key server LKS transmits the local key LK (NVR) invokes the video management agent (VMA), and the video management agent (VMA) creates a new video management agent ) Transmits the newly generated local key (LK) to the video encryption agent (VEA), and in generating the encrypted data, the camera (CAM) The video encryption agent VEA calls the video encryption agent VEA after imaging and the video encryption agent VEA encrypts the video data using the local key LK to generate the encrypted video data, , The video management agent (VMA) requests the local key server (LKS) for the key block for the local key (LK) used for encryption, and the local key server (LKS) Generates the key block so that at least the local key (LK) encrypted with the key (PK) and the play key ID (PKID) corresponding to the play key (PK) are included at least in decoding the encrypted video data , The video decoding agent VDA uses the play key ID PKID of the key block to decrypt the local key LK decrypted with the play key PK obtained from the local key server LKS It characterized in that the decoding of video data expensive.

Here, in generating the local key LK, the local key server LKS transmits a local key ID (LKID) together with the local key LK to the video management agent (VMA) In generating the key block, the video management agent (VMA) requests the key block while providing the local key ID (LKID) received from the local key server (LKS) to the local key server (LKS) , The local key server LKS generates the key block for the local key LK corresponding to the local key ID LKID.

If the local key server LKS does not respond, the video management agent VMA encrypts the local key LK using the temporarily generated play key PK to generate a temporary key block , After the local key server (LKS) is restored, the video management agent (VMA) transmits the temporary key block to the local key server (LKS) for files using the temporary play key (PK) It is preferable to re-encrypt the key block PK to generate a new key block.

In a multi-network video recorder (NVR) environment in which a plurality of network video recorders (NVRs) are provided, one of the network video recorders (NVR) is set as a primary network video recorder (NVR) (NVR) is set as a secondary network video recorder (NVR), the primary network video recorder (NVR) is equipped with a module of an access authorization server (AAS), the secondary network video recorder Wherein the module of the Access Authorization Agent (AAA) is configured to authenticate the corresponding secondary network video recorder (NVR) through communication with the modules of the Access Authorization Agent (AAA) desirable.

In a multi-network video recorder (NVR) environment in which a plurality of network video recorders (NVRs) are provided, one of the network video recorders (NVR) is set as a primary network video recorder (NVR) (NVR) is set as a secondary network video recorder (NVR), the primary network video recorder (NVR) is equipped with a module of an access authorization server (AAS), the secondary network video recorder Wherein the secondary network video recorder NVR is equipped with a module of the primary network video recorder NVR via the access authorization agent AAA to the access authorization server AAS of the primary network video recorder NVR, PK), and the primary network video recorder (NVR) And is configured to issue the play key (PK) from the local key server (LKS) and deliver it to the access authorization agent (AAA) through the access authorization server (AAS).

On the other hand, the video protection system of the present invention includes a camera (CAM) for outputting encrypted video data in which captured video data is encrypted, and a network video recorder (NVR) for receiving and storing the encrypted video data from the camera Wherein the camera (CAM) is provided with a video encryption agent ( VEA ) for generating the encrypted video data, and the network video recorder (NVR) is provided with a video is equipped with a management agent (VMA), the network is detachably connected to the video recorder (NVR), it is provided with a local key, the server (LKS) to provide a local key (LK), in the generation of the local key (LK) , The video management agent (VMA) requests the local key server (LKS) to generate the local key (LK) The local key server LKS generates the new local key LK and transmits it to the video management agent VMA in response to the request, and before generating the encrypted data, the network video recorder (NVR) (VMA), the video management agent (VMA) sends the newly generated local key (LK) to the video encryption agent (VEA), and upon generation of the encrypted data (CAM) calls the video encryption agent (VEA) after imaging the video data, and the video encryption agent (VEA) encrypts the video data using the local key (LK) The video management agent (VMA) generates the encrypted video data, and if the local key server (LKS) does not respond, the video management agent (VMA) Characterized by using the property.

According to the present invention, a video protection system that protects a video file distributed through a CCTV system over the entire process is provided.

In addition, a video which performs authentication, encryption, and decryption necessary for the whole of a camera (CAM), a network video recorder (NVR), a local video player (LVP), a remote video player A protection system is provided.

And a video protection system based on DRM technology is provided.

Also, a video protection system implemented by devising a security mechanism applicable to an isolated environment without the Internet is provided.

A comprehensive system configurable video protection system is provided to support as many CCTV system operation models as possible.

Rather than seeking the ultimate in security, video protection systems based on cost-effective security technologies are provided.

In a multi-network video recorder (NVR) environment equipped with a plurality of network video recorders (NVR), one of them is set as a primary network video recorder (NVR) and the other is set as a secondary network video recorder , And the primary network video recorder (NVR) is used for authentication and play key (PK) issuance of the secondary network video recorder (NVR), thereby providing a video protection system capable of systematic authentication and play key management.

FIG. 1 is a schematic block diagram showing the configuration of an embodiment of the video protection system of the present invention. FIG. 1 (a) shows a configuration in which a plurality of network video recorders (NVRs) independently perform authentication and key management, b) shows a form in which a plurality of network video recorders (NVRs) are connected to each other to systematically perform authentication and key management.
2 is a sequence diagram illustrating data flow between a camera (CAM), a network video recorder (NVR), and a local key server (LKS) that are components of the video protection system of the present invention.
3 shows the data flow between the network video recorder (NVR) / local video player (LVP) and the local key server (LKS), which are components of the video protection system of the present invention, at the time of playback in the local video player Fig.
4 shows the data flow between the remote video player RVP, the network video recorder NVR and the local key server LKS, which are components of the video protection system of the present invention, at the time of playback in the remote video player RVP Fig.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and how to achieve them, will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. It should be understood, however, that the invention is not limited to the disclosed embodiments, but may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein, It is intended that the disclosure of the present invention be limited only by the terms of the appended claims. Like reference numerals refer to like elements throughout the specification.

Unless defined otherwise, all terms (including technical and scientific terms) used herein may be used in a sense commonly understood by one of ordinary skill in the art to which this invention belongs. In addition, commonly used predefined terms are not ideally or excessively interpreted unless expressly defined otherwise.

<Overall system configuration>

As shown in Fig. 1 (a), in the video protection system according to the present invention for achieving the above object, in a configuration in which a player of the network video recorder (NVR) itself is provided, according to the camera (CAM) (10), and a video protection system comprising includes a network video recorder (NVR) (20) for receiving and storing the encrypted video data from the camera (CAM) (10) for outputting, the camera (CAM) 10 is provided with a video encryption agent ( VEA ) for generating the encrypted video data, and the network video recorder (NVR) 20 is provided with a video management agent (VMA) that is provided, it is detachably connected to the network video recorder (NVR) (20), the local key, the server (LKS) (40) providing a local key (LK) sphere And, the network video recorder (NVR), and a local video player (LVP) to play receive the encrypted video data provided from the 20, the local video player (LVP), the video decoding agents for decrypting the encrypted video data ( VDA ) may be provided.

When generating the local key LK, the video management agent VMA requests the local key server LKS 40 to generate the local key LK, (LKS) generates the new local key (LK) and transmits it to the video management agent (VMA) according to the request.

(NVR) 20 calls the video management agent (VMA), and the video management agent (VMA) calls the newly created local key (LK) To the video encryption agent (VEA).

(CAM) (10) calls the video encryption agent (VEA) after imaging of the video data, and the video encryption agent (VEA), when generating the encrypted data, LK) to encrypt the video data to generate the encrypted video data.

When decrypting the encrypted video data, the video decoding agent VDA requests the local key server LKS 40 and the local key server LKS 40, Transmits the local key (LK) to the video decryption agent (VDA), and the video decryption agent (VDA) decrypts the encrypted video data with the local key (LK).

Here, the local video player (LVP) preferably receives user authentication from the local key server (LKS) 40 through the video management agent (VMA).

On the other hand, in a configuration in which a network video recorder (NVR) such as a PC or a smart phone and a remote video player (RVP) of an end user are provided remotely, the video protection system of the present invention can prevent the captured video data from being encrypted (CAM) 10 for outputting data and a network video recorder (NVR) 20 for receiving and storing the encrypted video data from the camera (CAM) 10, the video protection system comprising: (CAM) 10 is provided with a video encryption agent ( VEA ) for generating the encrypted video data, and the network video recorder (NVR) 20 is provided with a video management agent ( VMA And a local key server ( LKS ) 20, which is detachably connected to the network video recorder (NVR) 20 and provides the local key LK, ) 40 is provided, is provided by the network video recorder (NVR), (20), the key blocks (key block), a remote video player (RVP) (30 to play receive the encrypted video data added from a), the The remote video player (RVP) 30 is provided with a video decryption agent ( VDA ) for decrypting the encrypted video data to which the key block is added.

When generating the local key LK, the video management agent VMA requests the local key server LKS 40 to generate the local key LK, LKS) 40 newly generates and transmits the local key (LK) to the video management agent (VMA) according to the request.

(NVR) 20 calls the video management agent (VMA), and the video management agent (VMA) calls the newly created local key (LK) To the video encryption agent (VEA).

(CAM) (10) calls the video encryption agent (VEA) after imaging of the video data, and the video encryption agent (VEA), when generating the encrypted data, LK) to encrypt the video data to generate the encrypted video data.

(VMA) requests the local key server (LKS) 40 for the key block for the local key (LK) used for encryption when generating the key block, and the video management agent The key server LKS 40 encrypts the local key LK with the stored play key PK and transmits the play key PK corresponding to the play key PK, .

When decrypting the encrypted video data, the video decryption agent VDA encrypts the play key PK obtained from the local key server (LKS) 40 using the play key ID PKID of the key block, And decrypts the encrypted video data with the local key (LK) decrypted with the local key (LK).

<Generation of key block by local key ID>

When generating the local key LK, the local key server LKS 40 transmits a local key ID (LKID) together with the local key LK to the video management agent VMA do.

When generating the key block, the video management agent (VMA) sends the local key ID (LKID) received from the local key server (LKS) 40 to the local key server (LKS) 40 , And the local key server (LKS) 40 generates the key block for the local key (LK) corresponding to the local key ID (LKID).

&Lt; Response configuration at the time of non-response of the local key server >

When the local key server (LKS) 40 does not respond, the video management agent (VMA) encrypts the local key (LK) using the temporarily generated play key (PK) And after the local key server (LKS) 40 is recovered, the video management agent (VMA), for the files using the temporary play key (PK), sends the temporary key block to the local key It is preferable to newly encrypt the key block with the play key PK of the server (LKS) 40 to generate a new key block.

<Multi Network Video Recorder Environment>

Also, as shown in FIG. 1 (b), a multi-network video recorder (NVR) environment in which the network video recorder (NVR) 20 is provided may be provided. The multi-network video recorder (NVR) environment is an expansion of a plurality of network video recorders (NVRs) shown in FIG. 1 (a). In this multi-network video recorder (NVR) environment, any one network video recorder (NVR) 20 is set as the primary network video recorder (NVR) 20 'and the remaining network video recorders 20 may be configured as a secondary network video recorder (NVR) Here, the primary network video recorder (NVR) 20 'is loaded with a module (or program) of an access approval server (AAS), and the secondary network video recorder (NVR) (Or program) is mounted.

The module of the access authorization server AAS performs authentication (device ID verification) with respect to the corresponding secondary network video recorders (NVR) 20 through communication with the modules of the access authorization agent (AAA) .

In addition, in the multi-network video recorder (NVR) environment, the secondary network video recorders (NVRs) 20 are connected to the primary network video recorder (NVR) 20 ' (NVR) 20 'requests issuance of the play key (PK) to the access authorization server (AAS), and the primary network video recorder (NVR) 20' (PK) to the access authorization agent (AAA) through the access authorization server (AAS).

However, the access authorization server (AAS) module and the access authorization agent (AAA) modules are not provided in the network video recorder (NVR) but are provided in the local key server (LKS) . In this case, the local key server (LKS) 40 with the module of the access authorization server (AAS) becomes the primary local key server (LKS) 40 ', and the access authorization agent The provided local key server (LKS) 40 becomes the secondary local key server (LKS) 40.

<Local management of the video management agent>

On the other hand, the video protection system of the present invention includes a camera (CAM) 10 for outputting encrypted video data in which captured video data is encrypted, and a network 10 for receiving and storing the encrypted video data from the camera (CAM) It includes a video recorder (NVR) (20) in the composed video protection system, wherein the camera (CAM) (10) has, is provided with a video encryption agents (VEA) for generating the encoded video data, and the network video recorder ( (NVR) 20 is provided with a video management agent ( VMA ) for managing the encrypted video data, a local key server ( DVR) detachably connected to the network video recorder (NVR) ( LKS ) 40 may be provided.

When generating the local key LK, the video management agent VMA requests the local key server LKS 40 to generate the local key LK, LKS) 40 newly generates and transmits the local key (LK) to the video management agent (VMA) according to the request.

(NVR) 20 calls the video management agent (VMA), and the video management agent (VMA) calls the newly created local key (LK) To the video encryption agent (VEA).

(CAM) (10) calls the video encryption agent (VEA) after imaging of the video data, and the video encryption agent (VEA), when generating the encrypted data, LK) to encrypt the video data to generate the encrypted video data.

Here, when the local key server (LKS) 40 does not respond, the video management agent (VMA) generates and uses the local key LK itself.

Hereinafter, it will be described in detail.

<Encryption of camera (CAM) transmission video>

The camera (CAM) 10 calls an initialization routine of the video encryption agent (VEA) (Video Encryption Agent) at boot time. The video encryption agent (VEA) creates, for example, an http daemon that is waiting in a predefined URL. A video management agent (VMA) of the network video recorder (NVR) 20 creates a secure session with a video encryption agent (VEA) through this daemon.

To do this, for example, a session key (SK) is exchanged using a key exchange protocol, and a session sequence number is set.

The video management agent (VMA) authenticates the camera (CAM) 10 using, for example, the ID and the MAC address of the camera (CAM) To this end, upon initial connection after installation, the video management agent (VMA) inquires and stores the IP address, ID, and MAC address of the camera (CAM) 10.

The camera (CAM) 10 calls the Video Encryption Agent (VEA) API just before the video transmission to request encryption of the video data. For this encryption, a video management agent (VMA) must generate a separate key for each camera (CAM) 10 and transmit it beforehand. The video encryption agent (VEA) then extracts, for example, the H.264 / H.265 NAL unit sequence to perform encryption. However, it is preferable to encrypt only the important data portion without encrypting the entire area, so that the operation and performance of the existing network video recorder (NVR) 20 program are not affected. For example, a packaging algorithm of CoreCrypt (registered trademark) can be used.

When transmitting multiple streams, all streams can be encrypted with the same key. The video data transmitted to the network video recorder (NVR) 20 is immediately stored without being decoded.

The network video recorder (NVR) 20 divides the video of each camera (CAM) 10 into separate files according to size and time reference, and sequentially stores them. At this time, different keys may be used for different files in order to increase security.

The video management agent (VMA) distinguishes an even-numbered key from an odd-numbered key for a sequentially generated key. The video management agent (VMA) sends two keys to the video encryption agent (VEA) in advance when it first starts. Thus, the video encryption agent VEA always has two keys in the order of even-odd or even-paired.

The video management agent (VMA) allocates a new key at the time the storage file is changed and sends it to the video encryption agent (VEA). For example, if the Video Encryption Agent (VEA) currently has a pair key and a hole key, the newly transmitted key becomes a pair key, and the key used for encryption is changed from the current pair key to the hole key. Thus, the video encryption agent (VEA) has a hole key and a new mating key, and this process is repeated in sequence.

Whether the key used for the current encryption is paired or not is to be recorded in the transmission packet. In the case of a standard protocol such as MPEG2-TS or real time transmission protocol, the corresponding field must be found and recorded.

Since the video management agent (VMA) and the video encryption agent (VEA) operate asynchronously, there may be packets encrypted by the previous key even after the file being stored is changed. This key alignment problem must be solved by the video management agent (VMA).

Consideration also needs to be given to the simple mode. Depending on the vendor, it may not be possible to distinguish pairs and holes. In this case, the key can be changed only when the same key is continuously used without changing the encryption key, and the system is reset.

<Encrypted file storage of network video recorder (NVR)>

The network video recorder (NVR) 20 calls the initialization routine of the video management agent (VMA) at boot time. The video management agent (VMA) creates an http daemon to provide a key for a live video stream and creates a video encryption agent (VEA) of each camera (CAM) 10 connected to a network video recorder (NVR) And creates a secure session. After generating a security session with the local key server (LKS) 40 and authenticating, two local keys (LK) are issued to each camera (CAM) 10 and transmitted to the corresponding key and the hall key .

The network video recorder (NVR) 20 calls the key arrangement API of the video management agent (VMA) for all packets arriving from the camera (CAM) The video management agent (VMA) can know which key the video encryption agent (VEA) is currently using for encryption. For example, if the Video Encryption Agent (VEA) has a pair and a hole key, and the file is changed to send a new pair key while the encryption is in progress with the pair key, the encryption key is changed to the hole key.

However, since the delivery of new keys may take some time, some packets in the meantime are still encrypted with the old mapped key. The video management agent (VMA) performs decryption and re-encryption with a hole key if it is a packet encrypted with the old pair key. When the re-encryption is not required, the video management agent (VMA) returns the original packet as it is.

In the case where the camera (CAM) 10 performs only the simple encryption, the key alignment API can perform decryption and re-encryption by allocating another local key (LK).

The network video recorder (NVR) 20 requests a video management agent (VMA) for a key block at the end of each file storage and attaches the data to the end of the file and stores it. This key block includes a local key (LK) used for encryption.

When the local key server (LKS) 40 does not respond, the video management agent (VMA) of the isolated network video recorder (NVR) 20 generates and uses the local key LK itself, And encrypts the local key LK using the generated play key PK. After the local key server (LKS) 40 is restored, the key block is re-encrypted with the play key PK of the local key server (LKS) 40 for files using this play key PK .

<Local Key Server (LKS)>

The local key server (LKS) 40 is, for example, a USB dongle type computer that processes a request for key issuance or the like while communicating with a network video recorder (NVR) The local key server (LKS) 40 must be able to install and execute the developed program. It should have its own clock. Also, stability of operation and system life should be the same level as general computer.

The local key server (LKS) 40 includes a chip for internally generating, storing a key pair, and performing an encryption / decryption function capable of performing a cryptographic operation. (NVR ID) of the network video recorder (NVR) and the local key server ID (NVR ID) of the network video recorder (NVR) of the network video recorder (NVR) LKS ID).

At the initial connection after installation, the video management agent (VMA) acquires identification information including the site ID (NVR SID) of its network video recorder (NVR) 20 and the network video recorder (NVR ID) So that the local key server (LKS) 40 can authenticate at a later time. In this way, the local key server (LKS) 40 is paired with the first connected network video recorder (NVR) 20. As the identification information, a MAC address or an HDD ID may be utilized. Authentication of the video management agent (VMA) to the local key server (LKS) 40 may be seen as passed unless the local key server (LKS) 40 violates the protocol sequence.

The local key server (LKS) 40 performs a function of generating a local key (LK) for encryption. Generates and issues a random local key (LK) and a local key ID (LKID) at the request of the video management agent (VMA) of the network video recorder (NVR) To prevent hacking of the key transport channel, the video management agent (VMA) creates a secure session with the local key server (LKS) 40, e.g., using a key exchange protocol.

The local key server (LKS) 40 performs a key block providing function. When the video management agent (VMA) makes a request with a local key ID (LKID), a key block including the corresponding local key (LK) is generated and transmitted. The local key LK encrypted by the play key PK is included in this key block and this play key PK is issued by the local key server (LKS) 40 together with the key ID (KID) . The key block may include a network video recorder site ID (NVR SID), a key ID (PKID), an encrypted local key, a generation time, an access authorization server URL (AAS URL)

The local key server (LKS) 40 updates the periodic play key (PK) of the network video recorder (NVR) The local key server (LKS) 40 can update the play key (PK) periodically via the video management agent (VMA).

The local key server (LKS) 40 updates the play key (PK) of the isolated network video recorder (NVR) The local key server (LKS) 40 of the isolated network video recorder (NVR) 20 continues to use the issued play key PK without change, at the time of initial setting. This is a way that the key can be operated without being connected to the Internet even though the security level is low. It is possible to update after manually connecting to the Internet.

However, even if the key update is performed, the previous play key PK must be continuously stored in the local key server (LKS) 40 and maintained until all related files are deleted.

In order to initialize the local key server (LKS) 40, the initial setting process of the local key server (LKS) 40 is performed before distribution. The local key server (LKS) 40 generates a key pair, returns its own local key server ID (LKS ID), a public key, and an authentication token. The local key server (LKS) 40 also generates a key and a key ID (PKID, XKID) to be used as a first play key (PK) or an export key, and records the key and the key ID in the self DB.

&Lt; Video Decoding by Local Video Player (LVP) >

To use the local video player (LVP), the network video recorder (NVR) 20 receives user authentication from the local key server (LKS) The local video player (LVP) can play file video or live video.

To play the stored file video, the network video recorder (NVR) 20 requests decryption from the video management agent (VMA). First, the key block is read at the end of the file, and the key block is transferred to the video management agent (VMA). The video management agent (VMA) sends the key block to the local key server (LKS) 40 via a secure session. The local key server (LKS) 40 obtains the local key LK and replies using the play key PK stored therein. The video management agent (VMA) uses the local key (LK) to decrypt the video data requested by the network video recorder (NVR) (20).

In order to play live video transmitted in real time from the camera (CAM) 10, the network video recorder (NVR) 20 requests the video management agent (VMA) to decode the received packets immediately. The video management agent (VMA) can know which key to use for the current decoding. For example, if the current key is a hole key and the requested packet is set to a pair, then the packet is encrypted with the old pair key. Thus, the video management agent (VMA) must store both the current key, the immediately preceding key, and the next key.

&Lt; Video decoding of remote video player (RVP) >

The remote video player (RVP) 30 is a program of a CCTV vendor capable of playing file video stored in a network video recorder (NVR) 20 or live video transmitted in real time on an external device. This program runs on, for example, a PC (Windows, Linux) or a smartphone (Android, iOS).

The file video may be transmitted in stream form. When video data is transmitted by streaming, the key block is transmitted first.

The player must call a video decoding agent (VDA) before processing the video data to perform the decoding process. The video decoding agent (VDA) extracts and decodes, for example, an H.264 / H.265 NAL unit sequence using, for example, the NAL unit access SDK provided by the vendor of the network video recorder (NVR)

The remote video player (RVP) 30 outside the network video recorder (NVR) 20 must always be accessible to the local key server (LKS) 40 via the Internet. The initialization routine of the video decryption agent (VDA) of the remote video player (RVP) 30 must generate a secure session with the local key server (LKS) 40 and authenticate itself. For this purpose, it is necessary to register the self-identification information such as the MAC address at the first connection after the installation. The local key server (LKS) 40 may use this information to manage the allowable number of remote video player (RVP) 30 devices that can be played per user. The user must receive user authentication from the local key server (LKS) 40 in order to use the remote video player (RVP)

To decrypt the file video, the video decryption agent (VDA) sends the key ID (PKID) to the local key server (LKS) The local key server (LKS) 40 finds and replies to the corresponding play key PK. The video decryption agent (VDA) decrypts the key block using the play key (PK), and obtains a local key (LK) for decrypting the video data. This key is used to decode the currently requested stream or file video data.

<User authentication method through local key server (LKS)>

A local video player LVP in the network video recorder 20 and an external remote video player RVP 30 are respectively connected to a video management agent VMA and a video decryption agent VDA for operation, (LKS) 40 through the local key server (LKS) 40.

The OTP (One Time Password) generated from the smartphone app is used to perform additional authentication in addition to the existing ID / password.

In the OTP generation application, after the application is installed in the smartphone, if the URL of the local key server (LKS) 40 to be connected and the network video recorder site ID (NVR SID) are registered, the app stores the user ID, (LKS) 40 to the local key server (LKS) 40 together with the same identification information. The administrator of the local key server (LKS) 40 manually accepts the request phone, for example, through a direct confirmation process. Each time the app user requests a new OTP, the local key server (LKS) 40 generates, transmits, and records a random number. Each time a new OTP is requested, the old OTP is immediately invalidated. And it is invalidated without using for about 1 minute.

The local video player (LVP), and the remote video player (RVP) (30) must receive the OTP in addition to the user ID and password. The video management agent (VMA) and the video decryption agent (VDA) transmit their network video recorder site ID (NVR SID) and user ID, OTP to the local key server (LKS) The local key server (LKS) 40 performs user authentication by hashing the identification information of the user and the stored random number.

User authentication is valid while a session with the local key server (LKS) 40 is maintained. While the program instance is being maintained, there is no need to re-authenticate the user.

<Another example of user authentication through local key server (LKS)>

The local video player (LVP) of the network video recorder (NVR) 20 is able to proceed with user authentication through the local key server (LKS) 40 when no Internet connection is available. This type of user authentication is possible not only in a system operating in an isolated mode but also in a system having a temporary Internet connection failure.

To do this, you need to run the OTP generation app on your smartphone in local mode. An app running in local mode must be time synchronized with the local key server (LKS) 40. To create an OTP, for example, a 6-digit OTP is generated using an environment variable and user information. The local video player LVP receives the ID / password and the OTP through the login window, and transfers the ID / password and the OTP to the local key server (LKS) 40. The local key server (LKS) 40 performs verification of the OTP using the environment variables and the user information.

<Primary Local Key Server (LKS)>

The primary functions of the primary local key server (LKS) are as follows.

- The initial registration process of the secondary local key server (LKS) 40 distributed to the network video recorder (NVR) 20 site is executed. At this time, the backup process of the secondary local key server (LKS) 40 is executed.

- generates and issues a play key (PK), and records it in the DB together with the generation time.

- Create and register the network video recorder site ID (NVR SID).

- Create and register a network video recorder (NVR) 20 ID (NVR ID).

- Authenticates the video decryption agent (VDA) and provides the requested play key (PK).

- Handles the registration of smartphone to receive OTP.

- OTP generation OTP is issued at the request of the app.

- Save your key pair and perform digital signature.

The local key server LKS is basically installed and operated in the network video recorder (NVR) 20 site. It is possible to support several network video recorders (NVR) 20 at the same time.

<Function>

The present invention provides end-to-end protection for video files distributed through a CCTV system.

Based on DRM technology, it provides a light but high level of security.

It is also possible to encrypt files stored in an isolated network video recorder (NVR) 20 and play them on any system connected to the Internet.

It minimizes the number of matching points and matching operation with existing CCTV system and enables system deployment in a short period of time.

It can support complex and diverse CCTV system configuration and operation models, from small to large.

It provides optimal price / performance ratio.

Even in the temporary interruption of the Internet, the network video recorder (NVR) 20 can operate normally.

<When the network video recorder (NVR) stores video data in DB format>

In this case, encrypting the transmission between the camera (CAM) 10 and the network video recorder (NVR) 20 can be involved in the present invention. In this case, it is assumed that the key is unchanged.

The stream program reads the data from the DB and encrypts the portion to be transmitted to the external remote video player (RVP) 30. The local key server (LKS) 40 issues a local key (LK) and uses it as an encryption key. While the usage session is being held, the keys are not changed. The remote video player (RVP) 30 queries this key from the video management agent (VMA).

When the file storage program stores the DB data as a file, the encryption is performed. A video management agent (VMA) performs a function of issuing and encrypting a local key (LK), and attaches a key block.

The function of the local key server (LKS) 40 is maintained as it is only at the time and position where the actual encryption is performed.

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, You will understand. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

The present invention can be used in industries related to video protection systems to prevent leakage and misuse of video in the system.

10: Camera (CAM)
20: Network Video Recorder (NVR) (Network Video Recorder)
30: Remote Video Player (RVP) (Remote Video Player)
40: Local Key Server (LKS)

Claims (8)

A video protection system comprising a camera (CAM) for outputting encrypted video data encrypted with captured video data, and a network video recorder (NVR) for receiving and storing the encrypted video data from the camera (CAM)
The camera (CAM ) is provided with a video encryption agent ( VEA ) for generating the encrypted video data,
The network video recorder (NVR ) is provided with a video management agent ( VMA ) for managing the encrypted video data,
A local key server (LKS) detachably connected to the network video recorder (NVR) and providing a local key (LK)
A local video player (LVP) for receiving and playing the encrypted video data from the network video recorder (NVR)
The local video player (LVP ) is provided with a video decoding agent ( VDA ) for decoding the encrypted video data,
Upon generation of the local key (LK)
The video management agent (VMA) requests the local key server (LKS) to generate the local key (LK)
The local key server (LKS) generates the new local key (LK) and sends it to the video management agent (VMA) according to the request,
Before the generation of the encrypted video data,
Wherein the network video recorder (NVR) calls the video management agent (VMA)
The video management agent (VMA) transmits the newly generated local key (LK) to the video encryption agent (VEA)
Upon generation of the encrypted video data,
The camera (CAM) calls the video encryption agent (VEA) after imaging of the video data,
Wherein the video encryption agent VEA encrypts the video data using the local key LK to generate the encrypted video data,
Upon decoding the encrypted video data,
The video decryption agent VDA requests the local key LKS from the local key server LKS,
The local key server (LKS) transmits the local key (LK) to the video decryption agent (VDA)
The video decryption agent (VDA) decrypts the encrypted video data with the local key (LK)
The video protection system comprising: The method according to claim 1,
The local video player (LVP) receives user authentication from the local key server (LKS) through the video management agent (VMA)
The video protection system comprising: A video protection system comprising a camera (CAM) for outputting encrypted video data encrypted with captured video data, and a network video recorder (NVR) for receiving and storing the encrypted video data from the camera (CAM)
The camera (CAM ) is provided with a video encryption agent ( VEA ) for generating the encrypted video data,
The network video recorder (NVR ) is provided with a video management agent ( VMA ) for managing the encrypted video data,
A local key server (LKS) detachably connected to the network video recorder (NVR) and providing a local key (LK)
A remote video player (RVP) for receiving and playing the encrypted video data to which a key block is added from the network video recorder (NVR)
The remote video player (RVP ) is provided with a video decoding agent (VDA) for decoding the encrypted video data to which the key block is added,
Upon generation of the local key (LK)
The video management agent (VMA) requests the local key server (LKS) to generate the local key (LK)
The local key server (LKS) generates the new local key (LK) and sends it to the video management agent (VMA) according to the request,
Before the generation of the encrypted video data,
Wherein the network video recorder (NVR) calls the video management agent (VMA)
The video management agent (VMA) transmits the newly generated local key (LK) to the video encryption agent (VEA)
Upon generation of the encrypted video data,
The camera (CAM) calls the video encryption agent (VEA) after imaging of the video data,
Wherein the video encryption agent VEA encrypts the video data using the local key LK to generate the encrypted video data,
Upon creation of the key block,
The video management agent (VMA) requests the local key server (LKS) for the key block for the local key (LK) used for encryption,
The local key server LKS encrypts the local key LK with the stored play key PK and the key block corresponding to the play key PK corresponding to the play key PK &Lt; / RTI &
Upon decoding the encrypted video data,
The video decryption agent VDA encrypts the encrypted video LK with the local key LK decrypted with the play key PK obtained from the local key server LKS using the play key ID PKID of the key block LK, Decrypts the data
The video protection system comprising: The method of claim 3,
Upon generation of the local key (LK)
The local key server (LKS) sends a local key ID (LKID) to the video management agent (VMA) together with the local key (LK)
Upon generation of the key block,
The video management agent (VMA) requests the key block while providing the local key ID (LKID) received from the local key server (LKS) to the local key server (LKS)
The local key server LKS generates the key block for the local key LK corresponding to the local key ID LKID
The video protection system comprising: The method of claim 3,
If the local key server LKS does not respond,
The video management agent (VMA) encrypts the local key (LK) using the temporarily generated play key (PK) to generate a temporary key block,
After the local key server (LKS) is recovered,
The video management agent (VMA) re-encrypts the temporary key block with the play key (PK) of the local key server (LKS) for files using the temporarily generated play key (PK) Created
The video protection system comprising: The method of claim 3,
In a multi-network video recorder (NVR) environment having a plurality of network video recorders (NVR)
One of the network video recorders (NVR) is set as the primary network video recorder (NVR)
The remaining network video recorder NVR is set as the secondary network video recorder NVR,
The primary network video recorder (NVR) is equipped with a module of an access approval server (AAS)
The secondary network video recorder (NVR) is equipped with a module of an access authorization agent (AAA)
Wherein the module of the Access Authorization Server (AAS) is configured to perform authentication for a corresponding secondary network video recorder (NVR) through communication with modules of the access authorization agent (AAA)
The video protection system comprising: The method of claim 3,
In a multi-network video recorder (NVR) environment having a plurality of network video recorders (NVR)
One of the network video recorders (NVR) is set as the primary network video recorder (NVR)
The remaining network video recorder NVR is set as the secondary network video recorder NVR,
The primary network video recorder (NVR) is equipped with a module of an access approval server (AAS)
The secondary network video recorder (NVR) is equipped with a module of an access authorization agent (AAA)
Wherein the secondary network video recorder NVR requests issuance of the play key PK to the access authorization server AAS of the primary network video recorder NVR via the access grant agent AAA,
The primary network video recorder NVR issues the play key PK from the connected local key server LKS to the access authorization agent AAA via the access authorization server AAS. Configured to
The video protection system comprising: A video protection system comprising a camera (CAM) for outputting encrypted video data encrypted with captured video data, and a network video recorder (NVR) for receiving and storing the encrypted video data from the camera (CAM)
The camera (CAM ) is provided with a video encryption agent ( VEA ) for generating the encrypted video data,
The network video recorder (NVR ) is provided with a video management agent ( VMA ) for managing the encrypted video data,
A local key server (LKS) detachably connected to the network video recorder (NVR) and providing a local key (LK)
Upon generation of the local key (LK)
The video management agent (VMA) requests the local key server (LKS) to generate the local key (LK)
The local key server (LKS) generates the new local key (LK) and sends it to the video management agent (VMA) according to the request,
Before the generation of the encrypted video data,
Wherein the network video recorder (NVR) calls the video management agent (VMA)
The video management agent (VMA) transmits the newly generated local key (LK) to the video encryption agent (VEA)
Upon generation of the encrypted video data,
The camera (CAM) calls the video encryption agent (VEA) after imaging of the video data,
Wherein the video encryption agent VEA encrypts the video data using the local key LK to generate the encrypted video data,
If the local key server LKS does not respond,
The video management agent (VMA) generates and uses the local key (LK)
The video protection system comprising:

Images