Patent Application
20200366673
The present disclosure generally relates to IoT devices producing digital data streams in a communication network. In particular, a solution for securing digital data transmission in the communication network is disclosed.
The Internet is a global system of interconnected computers and computer networks that use a standard Internet protocol as for example the Transmission Control Protocol (TCP) and Internet Protocol (IP) to communicate with each other. The Internet of Things (IoT) is based on the idea that everyday objects, not just computers and computer networks, can be readable, recognizable, locatable, addressable, and controllable via an IoT communications network as for example an ad-hoc network or the Internet.
There are a number of key applications for the IoT. For example, in the field of smart grids and energy management, utility companies can optimize delivery of energy to homes and businesses while customers can better manage energy usage. In the field of home and building automation, smart homes and buildings can have centralized control over virtually any device or system in the home or office, from appliances to plug-in electric vehicle security systems. In the field of asset tracking, enterprises, hospitals, factories, and other large organizations can accurately track the locations of high-value equipment, patients, vehicles, and so on. In the area of health and wellness, doctors can remotely monitor health of patients while people can track the progress of fitness routines. As such, in the near future, increasing development in IoT technologies will lead to numerous IoT devices surrounding a user at home, in vehicles, at work, and many other locations. IoT capable devices can provide substantial real-time information about the environment of the user (e.g., likes, choices, habits, device conditions and usage patterns, images of location area, data from various environmental sensors associated with the IoT devices, energy consumption data, etc.).
In a further IoT devices application field, as for example cameras taking images from an area to be monitored generate image content without any solution to ensure integrity of the images. In particular, when the images are transmitted to a monitoring central station or terminal via a communication network such as internet, some kind of protection is needed. The images may be used for live monitoring or temporary storage for later use by the central station or terminal. There is an issue regarding information to indicate in a secure way at least which camera has generated and transmitted the images. In addition to a specific identifier of the cameras, further information such as camera location area or position coordinates, current date and time may be necessary to ensure authenticity of the images. This information would guaranty that the images have not been modified or a camera substituted by another one.
In order to provide solutions to the above-mentioned issues, embodiments of the present disclosure propose a method for securing transmission of digital data in a communication network. The communication network generally comprises a central station or a terminal and at least one device monitored by the central station via the communication network. The at least one device is configured to produce and to transmit a digital data stream to the central station or terminal. The at least one device further comprises a secure non-volatile memory for storing at least device specific information data. The at least one device forms a data block based on at least the device specific information data stored in the secure memory. The data block thus formed may compose additional data to be merged with the digital data stream produced by the at least one device. A modified digital data stream results from this merging operation and is transmitted by the at least one device to the central station or terminal.
The method may be performed on a network comprising a central station monitoring only one device as well as on a network where the central station monitors two or more devices.
According to an embodiment, the central station monitors at least one first and second device via the network, the at least one first and second device being configured to communicate with each other. The device specific information data of the first device is provided to the second device and the device specific information data of the second device is provided to the first device. The at least one first and second device each store the device specific information data of the first and second device in the secure non-volatile memory.
The additional data based on the data block is thus different for each device thanks to the incorporated device specific information data. Therefore, the central station or terminal receives a modified digital data stream specific to each device belonging to the communication network.
According to the method, the device specific information data of the first device is provided to the second device and vice-versa so that each device stores these specific identifiers in the secure memory.
In a general way, each device's memory stores the device specific information data of the device in question and the device specific information data of the other device belonging to a particular network.
According to an embodiment illustrated by
According to a further embodiment, the devices D1, D2, D3 . . . may securely communicate with each other via the central station CST in a star shaped network mode. Each device is linked to the central station which exchanges data with the devices in a secure way. In an exemplary configuration as shown by
A secure transmission channel may be established between two devices, a device and the central station CST and the database DB according to known methods using a common secret shared by the devices or methods using public and private encryption keys exchange protocols. The devices may comprise a non-volatile secure memory containing unique and secured device specific information data. The secure device specific information data may comprise a unique identifier specific to the device and other data as for example secret to be shared on the network and/or encryption keys for establishing secure links with other devices, the central station CST and the database DB.
The central station CST monitoring the secure communication network may store reference data related to each device connected to the communication network in the database DB. The central station further analyzes and processes data produced by the devices.
In an initialization phase of the secure communication network, preparation steps may be performed for securing data exchanges between the devices and the central station and between the devices themselves, namely:
The network may comprise only devices having already a unique identifier or only devices without pre-stored identifier or a combination thereof. The central station CST may interrogate each device for acquiring the identifiers or for attributing an identifier to the devices without identifier.
The unique identifier of one or more devices on the network may be updated or one or more devices may be removed or added to the network monitored by the central station CST. In this case, the central station may transmit to each device connected to the network an updated list of unique identifiers. According to an embodiment, one or more updated identifiers may be pushed into the network in an analogous way than a virus which infects each connected device. The one or more updated identifiers are thus known by each device by propagation initiated by the central station CST and stored in the secure non-volatile memory of each device.
After the initialization phase, each device of the network stores in the secure non-volatile memory the identifier of all other devices in addition to its own identifier.
A preferred application example discussed hereafter relates to devices in form of monitoring cameras each producing a video stream to be processed by the central station. The cameras are configured to transmit the produced video stream to the central station and to communicate with each other either directly via a data link or via the central station through the link used for transmitting the video stream.
The cameras further comprise a secure memory for storing at least a unique specific identifier and the identifiers of the other cameras. Each camera is configured to generate a data block based on the stored identifiers and to merge with the video stream produced by the camera additional data comprising the data block. The additional data may form a watermark comprising at least the specific identifier of the camera and the data block. Each camera thus outputs and transmits via the secure communication network a watermarked video stream to the central station.
The video sensor SE including a Charge-Coupled Device (CCD) or a Complementary Metal Oxide Semiconductor (CMOS) image sensor produces video data to be processed by the processor CPU. The communication module TR may be configured to exchange data with the central station as well as with other cameras on the secure network and to transmit processed video data in form of a modified video stream.
The processor CPU instructs the merging module MG for preparing and inserting additional data into the video data received from the video sensor SE according to a predetermined software program stored in the memory M. The software program is further configured to retrieve from the memory, generate, manage and transform various data to be used as additional data before insertion into the video data. The video data modified by the merging module MG with the additional data is then forwarded to the communication module TR for transmission to the central station CST.
The merging module MG modifies the produced video data comprising displayable frames to be displayed as images on a screen at the central station by inserting the additional data into at least some of the displayable frames. The additional data form a watermark that may be visible or not by human eyes. The images may include as watermark for example some visible pixels or any kind of mark preferably in a non-significative part of the image such as along the edges or in the corners.
The watermark is used by the central station for verifying:
The data block forming the watermark may comprise in addition to the identifiers of the cameras belonging to the network, a network address, a network identifier, a position indicator or coordinates of the camera, a time stamp, etc. or any combination thereof.
According to an embodiment, a mathematical function may be applied by each camera over the identifiers of all other cameras of the network stored in the secure memory. The data block is then formed by the obtained result instead of the identifiers themselves. This mathematical function may be for example a unidirectional collision free hash function known also by the central station so that the data block can be recalculated by the central station for verification. The watermark therefore comprises a global hash calculated by each camera on all or part of the identifiers of the cameras belonging to the network.
A watermark analyzer of the central station may extract the watermark from the video streams received from each camera for analyzing and comparing the received global hashes with a hash calculated over the identifiers stored in the database DB associated with the central station. If the received global hashes match with the calculated hash, the network is considered, by the central station, as conform with all cameras present and operating. In case of mismatch, an alarm can be raised.
When the watermark, respectively the data block, contains, in addition to the global hash, additional data such as network addresses or position coordinates of the cameras, the central station may check conformity of this additional data by comparing the data extracted from the watermark with corresponding data retrieved from the database DB by using the identifiers of the cameras.
The watermark may change periodically and the corresponding reference data in the database DB updated consequently by the central station. The central station may attribute periodically random identifiers to each camera, which calculates corresponding global hash before watermarking the produced video stream.
The central station CST may also monitor the cameras in the secure network by checking if updates of the data stored in the database DB are necessary or not. For example, the central station may periodically interrogate each camera for checking presence in the non-volatile memory of the identifiers of the other cameras belonging to the secure communication network.
In order to verify authenticity of the images, the watermark may further contain authentication data comprising a time code or a sequence number and a corresponding image signature based on a sequence or a group of consecutive frames produced by a camera. For example, at a predefined time a sequence of frames having a certain length may be encoded to form a fingerprint which may be encrypted with a key known by the central station. The time code or sequence number may be preferably unpredictable in order to prevent malicious replay of the sequence and fingerprint re-calculation. The time code or sequence number may be cryptographically transformed or associated with a pseudo-random number that is generated by using a known initial value at a known time.
This encrypted fingerprint forms a signature which can be decrypted by the central station for checking authenticity of the images received from a predefined camera. These images are thus verified as having been transmitted by a specific camera only, without having been modified by a third party connected to the network. The fingerprint may also be formed by a hash calculated over data representing a predetermined sequence of frames.
The watermark may further contain a reference fingerprint calculated on one or more individual frames or on a complete sequence of frames showing known images. The database DB may store these reference fingerprints based on typical images captured by each camera depending on the area where the camera is located. The verification of the watermark may be performed by using this reference fingerprint. In fact, a watermark analyzer of the central station carries out a search of a given reference fingerprint corresponding to a particular camera in the received video stream. When the reference fingerprint has been found and matches with the one retrieved from the database DB, the watermark analyzer may extract additional data such as identifiers, time stamps, signatures used for verification and validating authenticity of the received video stream. The authentication data may be also used for defining position of a visible watermark in the image.
The verification of a sequence of frames serves to determine if the sequence corresponds to the images effectively captured by a camera without having been manipulated by addition, deletion or substitution of frames.
The watermark based on images authentication data may be periodically renewed by changing parameters such as time code, sequence number or sequence duration or digest coding algorithm.
According to a further embodiment the watermark may be invisible by human eyes but machine readable. A technology based on encoding video data blocks of the displayable frames with the additional data by applying a predetermined watermarking algorithm may be used. Only a computer based image analyzer will thus be able to localize, extract and read the watermark in a sequence of images. The image analyzer knowing the watermarking algorithm used for encoding the video data blocks and being able to identify the encoded video data blocks can determine the watermark representing the additional data. Depending on the type of watermarking algorithm, the watermark may be determined by comparing video data of the images sequence with video data of a reference images sequence without watermark.
A further verification may be performed by the cameras to ensure that the central station or a terminal used as central station is authentic and not a fake terminal substituting the central station or terminal. This verification may be based on exchanges of messages containing an authentication code in form of a signature specific to the central station and not reproducible by any other device. For example, an identifier of the central station stored in the secure memory of each camera and encrypted by a key common to the cameras and the central station may be exchanged before video data processing.
In case of a large network with a set of a high number of cameras, the size of the data block forming the watermark increases proportionally so that the verification by the watermark analyzer is unnecessarily slowed down. The authentication messages exchanged between the cameras and the central station also becoming numerous may cause issues related to decrease of data throughput and transmission speed. To solve these potential issues, the watermark may be applied only on particular groups of frames instead on all frames produced by the cameras.
The set of a high number of cameras may be divided into subsets of smaller number of cameras. In this case the watermark may be based only on the identifiers of the cameras belonging to the subset and on an identifier specific to the subset. For example, a set of 100 cameras may be divided into 10 subsets of 10 cameras where each subset may have an identifier depending on the location of the subset. The watermark may thus be based on the 10 identifiers of the cameras belonging to the subset and an identifier of the subset or a hash calculated over these identifiers.
Although embodiments of the present disclosure have been described with reference to specific example embodiments, it will be evident that various modifications and changes may be made to these embodiments without departing from the broader scope of these embodiments. Accordingly, the specification and drawings are to be regarded in an illustrative rather than a restrictive sense. The accompanying drawings that form a part hereof, show by way of illustration, and not of limitation, specific embodiments in which the subject matter may be practiced. The embodiments illustrated are described in sufficient detail to enable those skilled in the art to practice the teachings disclosed herein. Other embodiments may be utilized and derived there from, such that structural and logical substitutions and changes may be made without departing from the scope of this disclosure. The detailed description, therefore, is not to be taken in a limiting sense, and the scope of various embodiments is defined only by the appended claims, along with the full range of equivalents to which such claims are entitled.
Such embodiments of the inventive subject matter may be referred to herein, individually and/or collectively, by the term “disclosure” merely for convenience and without intending to voluntarily limit the scope of this application to any single inventive concept if more than one is in fact disclosed. Thus, although specific embodiments have been illustrated and described herein, it should be appreciated that any arrangement calculated to achieve the same purpose may be substituted for the specific embodiments shown. This disclosure is intended to cover any and all adaptations or variations of various embodiments. Combinations of the above embodiments, and other embodiments not specifically described herein, will be apparent to those of skill in the art upon reviewing the above description.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/US2018/064472 | 12/7/2018 | WO | 00 |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 15838972 | Dec 2017 | US |
| Child | 16768360 | US |
