Disclosure of Invention
According to the technical characteristics and the safety requirements of the existing video monitoring terminal, a domestic cipher algorithm encryption communication channel is established, and finally a set of domestic cipher application system of the video monitoring terminal is realized, so that the safety and the reliability of the video monitoring system are greatly enhanced.
The invention relates to a domestic password application system of a video monitoring terminal, which comprises the following steps:
the router: the system is used for building a local area network environment and connecting a camera;
the network camera: the system comprises a router, a web server and a server, wherein the router is used for shooting video data, adding the video data into a local area network constructed by the router by configuring an IP address and connecting the video data with the web server;
a Web server: the web server is one of NGINX, Apache and IIS, and the proxy forwarding function of the web server is used for accessing the camera by proxy, encrypting and transmitting the video data shot by the camera and forwarding the video data to the client;
a client: accessing a web server using a browser, establishing a secure communication channel with the web server for transmitting video data;
encrypting the communication channel: based on an opensssl library, a domestic cryptographic algorithm supporting SM2, SM3 and SM4, a static connection library supporting an SM2 secret digital certificate and an encryption transmission protocol based on the SM2 certificate are realized, and then the static connection library is configured on a web server and accessed by the web server agent to complete the establishment of an encryption communication channel supporting the secret.
The invention also provides a domestic password application method of the video monitoring terminal, which comprises the following steps:
s1: the method comprises the steps of using three cryptographic algorithms of an SM2 elliptic curve public key cryptographic algorithm, an SM3 hash cryptographic algorithm and an SM4 symmetric cryptographic algorithm to realize a cryptographic suite and an encryption transmission protocol, then configuring the cryptographic suite and the encryption transmission protocol on a web server, and building an encryption communication channel supporting the domestic cryptographic algorithm;
s2: after receiving the real-time data transmitted by the camera, encrypting and transmitting the shot video data through the encryption communication channel and uploading the video data to a server;
s3: and establishing a secure communication channel with the web server by using the browser to access the web server and the video data.
For example, an embodiment of the present invention provides a method for applying a domestic password to a video monitoring terminal, where the step S1 includes:
s11: inserting a camera on the router, and performing IP configuration to enable the camera and the server to be in the same local area network;
s12: installing a docker container web _ server on a server to complete the configuration of a compiling environment;
s13: expanding an openssl library, compiling to generate a static link library file protocol library (libssl.a) and a cryptographic algorithm library (libcrypto.a), and putting the two static library files and an include file folder containing some necessary header files into a gmssl file folder to complete the encryption part of the whole system;
s14: configuring the two static library files and the header file to a web server, and building the web server supporting the domestic cryptographic algorithm;
s15: the authentication of a client and a server in information communication and the selection of related parameters to be used in communication are completed through a handshake layer protocol, and the establishment of an encrypted communication channel is completed; wherein the handshake protocol procedure includes: exchanging hello messages to negotiate to decide a cipher suite; exchanging necessary parameters to negotiate a master key; exchanging certificates to verify the identity of the other party; providing security parameters in a subsequent communication process to the recording layer;
s16: the recording layer protocol encapsulates the data to be sent transmitted from the upper layer, then transmits the encapsulated data packet to the TCP layer protocol, and finally completes the end-to-end safe transmission of the video data on the bottom transmission layer;
for example, an embodiment of the present invention provides a method for applying a domestic password to a video monitoring terminal, where the step S3 includes:
s31: the Client sends a Client Hello message to the server, wherein the Client Hello message carries information of the Client, and the information comprises a password suite list and the like supported by the Client;
s32: the server side sends confirmation information to the Client side, confirms that the information sent by the Client side is received, and then sends a Client Hello message to the Client side, wherein the information carrying the server side comprises a password suite selected by the server side according to a password suite list provided by the Client side and used for subsequent communication;
s33: the client sends confirmation information to the server to confirm the receipt of the information sent by the server.
S34: the server side sends confirmation information to the client side, confirms that the information sent by the client side is received, and then sends a certificate, a secret key and handshake finishing information to the client side;
s35: the client sends confirmation information to the server, confirms that the information sent by the server is received, and then sends information such as a master key of the client to the server;
s36: the server side sends confirmation information to the client side, confirms that the information sent by the client side is received, and then sends encrypted data to the client side for data transmission.
Compared with the prior art, the domestic password application method and the system of the video monitoring terminal have the following advantages that: the domestic password is adopted, so that the safety risk caused by a back door system implanted by the international password technology is effectively avoided, and the safety of the video monitoring technology in China is greatly improved.
The domestic password application method of the video terminal mainly solves the problem that: the domestic encryption algorithm is applied to the video monitoring system, so that the blank of the domestic encryption algorithm in the field of video monitoring is filled.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer and more complete, the technical solutions of the embodiments of the present invention will be described below with reference to the drawings of the embodiments of the present invention, it is obvious that the described embodiments are some but not all embodiments of the present invention, and all other embodiments obtained by a person of ordinary skill in the art without creative efforts based on the described embodiments of the present invention belong to the protection scope of the present invention.
In a traditional video monitoring terminal, a safety communication protocol and a cryptographic algorithm designed by foreigners are introduced to ensure the safety of video data transmission. However, in this solution, we face the safety risk caused by the "back door system" embedded by international code technology, and cannot guarantee the reliability of some important systems and instruments.
The cryptographic technology is a key for solving the problem of information security and is an important tool for realizing the secure transmission of video monitoring data. The domestic password algorithm application system of the video monitoring terminal provided by the embodiment of the invention builds the encryption communication channel by using the domestic password, thereby greatly improving the security of the video monitoring technology in China.
As shown in fig. 1, the method for applying a domestic cryptographic algorithm of a video monitoring terminal according to an embodiment of the present invention includes the following steps:
s1: and configuring a web server and building an encryption communication channel supporting the domestic cryptographic algorithm.
The method for configuring the web server comprises the following steps:
firstly, a camera is inserted into a router, IP configuration is carried out, the camera and a server are in the same local area network, and a firewall is configured according to the firewall condition and the rule of the server, so that the firewall can monitor an access request from a client;
installing a docker tool in a server, then executing a docker run-di-name web _ server-net host cdaa14a12dfc command at a terminal to generate a docker container web _ server required by the system, installing a gcc tool, a c + + compiler and a kernel file by using yum-y install gcc-c + + kernel-level command, and then installing a make tool by using a yum-y install autoconflue make command to complete the configuration of a compiling environment;
expanding an openssl library, configuring static compilation by using-/config-fPIC no-shared, performing compilation operation by using a make command, generating a static library file protocol library (libssl.a) and a cryptographic algorithm library (libcrypto.a) required by the system after the compilation is correct, putting the two static library files and an include file folder containing some necessary header files into a gmssl file folder, and completing the encryption part of the whole system;
copying the above mentioned encryption tool folder gmssl supporting the domestic cryptographic algorithm to a/usr/local directory, copying a web server to a system/root directory, and installing a pcre-level by using a yum install pcre-level command;
as shown in fig. 2, the server is configured to be installed, the http module is disabled, the ssl module is imported, then the encrypted transmission protocol defined in the protocol library (libssl.a) is called, and https is partially used in urls;
appointing an openssl library file path on which the NGINX ssl module depends, namely the path of the aforementioned encryption tool folder gmssl supporting the domestic cryptographic algorithm;
specifying a necessary include file path, namely a path of a header file in the aforementioned encryption tool folder gmssl supporting the domestic cryptographic algorithm;
finally, compiling and installing by using a make install command, and generating an NGINX folder under a/usr/loacl directory, wherein the NGINX folder comprises four subfolders: the conf folder is a configuration folder and is used for storing some configuration files; the html folder is a page folder and is used for storing default pages in some test cases, such as welcome pages of NGINX; the logs folder is a log folder and is used for storing error logs or other logs and the like generated in the running process; the sbin folder is an operation folder, and only one executable file NGINX is arranged under a directory of the sbin folder and used for starting the NGINX server, so that the installation of the web server supporting the domestic cryptographic algorithm is completed;
the authentication of a client and a server in information communication and the selection of related parameters to be used in communication are completed through a handshake layer protocol, and the establishment of an encrypted communication channel is completed; wherein the handshake protocol procedure includes: exchanging hello messages to negotiate to decide a cipher suite; exchanging necessary parameters to negotiate a master key; exchanging certificates to verify the identity of the other party; providing security parameters in a subsequent communication process to the recording layer;
the recording layer protocol encapsulates the data to be sent transmitted from the upper layer, then transmits the encapsulated data packet to the TCP layer protocol, and finally completes the end-to-end safe transmission of the video data at the bottom layer transmission layer.
S2: after receiving the real-time data transmitted by the camera, the shot video data is encrypted and transmitted through the encryption communication channel and uploaded to the server, and the proxy access function of the server is used for preparing for subsequent access of the client.
The method for realizing the proxy access function of the server specifically comprises the steps of restarting a web server built by the system by using an NGINX-s load command in the server, opening a related log debugging file in a configuration file, starting a debugging mode at a log level, and generating a log file to a usr/local/NGINX/logs directory;
the web server is accessed by a 360-security browser through a 443 port in the client, and the web server encrypts and forwards live data of the camera to the client;
s3: and establishing a secure communication channel with the web server by using the browser to access the web server and the video data.
The Client sends a Client Hello message to the server, wherein the Client Hello message carries information of the Client, and the information comprises a password suite list and the like supported by the Client;
the server side sends confirmation information to the Client side, confirms that the information sent by the Client side is received, and then sends a Client Hello message to the Client side, wherein the information carrying the server side comprises a password suite selected by the server side according to a password suite list provided by the Client side and used for subsequent communication;
the client sends confirmation information to the server to confirm the receipt of the information sent by the server.
The server side sends confirmation information to the client side, confirms that the information sent by the client side is received, and then sends a certificate, a secret key and handshake finishing information to the client side;
the client sends confirmation information to the server, confirms that the information sent by the server is received, and then sends information such as a master key of the client to the server;
the server side sends confirmation information to the client side, confirms that the information sent by the client side is received, and then sends encrypted data to the client side for data transmission.
As shown in fig. 3, the static library file protocol library (libssl.a) and the cryptographic algorithm library (libcrypto.a) support the secret transport protocol and the cryptographic suite required by the system, wherein the encrypted transport protocol includes a handshake protocol, a cryptographic specification change protocol, an alarm protocol, a gateway-to-gateway protocol and an underlying record layer protocol. The handshake layer protocol is responsible for completing the authentication of the client and the server in information communication, the selection of relevant parameters to be used in communication and the like; the password specification change protocol plays a role when related parameters in the communication process need to be sent and changed and is responsible for finishing informing the other party of new security parameters in communication; the alarm protocol service finishes the communication and sends out warning signals to problems generated in the communication process; the gateway-to-gateway protocol is responsible for building a transmission channel between a gateway of the client and a gateway of the server; the recording layer protocol is responsible for completing the tasks of splitting, compressing and decompressing information to be sent, encrypting and decrypting, verifying the accuracy of the information and the like.
As shown in fig. 4, the home-made cryptographic algorithm application system of the video monitoring terminal provided by the embodiment of the invention includes the following modules:
the router: the system is used for building a local area network environment and connecting a camera;
the network camera: the system comprises a router, a web server and a server, wherein the router is used for shooting video data, adding the video data into a local area network constructed by the router by configuring an IP address and connecting the video data with the web server;
a Web server: the web server is one of NGINX, Apache and IIS, and the proxy forwarding function of the web server is used for accessing the camera by proxy, encrypting and transmitting the video data shot by the camera and forwarding the video data to the client;
a client: accessing a web server using a browser, establishing a secure communication channel with the web server for transmitting video data;
encrypting the communication channel: based on an opensssl library, a domestic cryptographic algorithm supporting SM2, SM3 and SM4, a static connection library supporting an SM2 secret digital certificate and an encryption transmission protocol based on the SM2 certificate are realized, and then the static connection library is configured on a web server and accessed by the web server agent to complete the establishment of an encryption communication channel supporting the secret.
As shown in fig. 5, the encrypted communication channel provided by this example was tested using a panning website accessed by a web server proxy client, which would be accessed through an encrypted communication channel supporting a domestic cryptographic algorithm using the proxy pass http:// www.taobao.com command by changing the NGINX. conf file under the conf directory in the NGINX folder under the/usr/local directory of host 1.
As shown in fig. 6, through deep analysis of the data packet captured by the wires hark, the encrypted communication channel supporting the cryptographic key, which is set up in the above steps, basically meets the requirements of the system, can complete the task of encrypting and transmitting video data in the system, and meets the designed safety requirements.