System and method for securely transmitting video over a network

A method comprises receiving a bit stream associated with at least one video image, wherein the bit stream comprises at least one macroblock header and a plurality of macroblocks. The method continues by encrypting the at least one macroblock header. The method concludes by transmitting the bit stream such that the at least one macroblock header is in an encrypted format and at least one macroblock is in an unencrypted format.

TECHNICAL FIELD

This present disclosure relates generally to electronic video systems and more particularly to a system and method for securely transmitting video over a network.

BACKGROUND

Digital video generally comprises large amounts of data. Traditional techniques for securely transmitting digital video over a network often requires more time and/or processing resources than are available in typical video systems.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Overview

In one embodiment, a method comprises receiving a bit stream associated with at least one video image, wherein the bit stream comprises at least one macroblock header and a plurality of macroblocks. The method continues by encrypting the at least one macroblock header. The method concludes by transmitting the bit stream such that the at least one macroblock header is in an encrypted format and at least one macroblock is in an unencrypted format.

Various embodiments described herein may have none, some, or all of the following advantages. One advantage is that a video system may efficiently provide video encryption. In particular, the video system is operable to encode a video as one or more bit streams. Each bit stream may comprise a macroblock header and a plurality of macroblocks. The macroblock header may comprise an index for mapping each macroblock in the bit stream to a respective portion of a video image. In some embodiments, the video system may encrypt the macroblock header without encrypting the entire bit stream. Encrypting the macroblock header while allowing the macroblocks to remain unencrypted may be faster and use less processing power than encrypting the entire bit stream.

Another advantage is that the encrypted bit stream may be securely transmitted over a network. In conjunction with encrypting the macroblock header, the video system may rearrange the sequence of macroblocks in the bit stream without encrypting the data within each macroblock. Because the macroblock header comprises an index for mapping the macroblocks into a particular image, a node that intercepts the bit stream cannot generate the particular image as long as the macroblock header remains encrypted. Thus, the video may be encrypted efficiently and transmitted securely. Other advantages may be apparent to one skilled in the art from the description and the appended claims.

Description

FIG. 1illustrates a video system10, according to certain embodiments. Video system10is generally operable to capture, encode, encrypt, and transmit video12over one or more networks60. Video system10may comprise a camera20, an encoder30, an encrypter40, one or more routers50, one or more networks60, a decrypter70, a decoder80, and one or more display devices90.

Camera20represents any suitable device that records and/or captures video12. Video12is a sequence of images14that represent a scene in motion. Each image14in the video sequence may be referred to as a frame. Camera20may be a camcorder, webcam, digital camera, television camera, cell-phone, and/or any suitable device for recording and/or capturing video12. According to certain embodiments, camera20may be part of a video/audio conferencing system. Camera20may output video12in any suitable format. In some embodiments, camera20records video12onto a disk, magnetic tape, and/or suitable storage medium. In other embodiments, camera20outputs video12as an analog and/or digital signal.

System10may comprise an encoder30that receives and encodes video12from camera20. Encoding may refer to the conversion and/or compression of video12into bit streams16that conform to a particular digital format. In some embodiments, encoding comprises the “thinning” of chrominance data, lossy compression, lossless compression, and/or the quantization of images14from video12. Encoder30is operable to encode video12according to any suitable format such as, for example, the H.261, H.263, H.264, MPEG-1, MPEG-2, and/or MPEG-4 formats. In some embodiments, encoding may comprise re-encoding video12from a particular digital format into another digital format. In other embodiments, encoding may comprise converting video12from an analog format to a digital format.

Encoder30may comprise any suitable hardware and/or software to provide the described functions and/or operations. In some embodiments, encoder30may represent a general-purpose personal computer (PC), a laptop, a Macintosh, a workstation, a Unix-based computer, a server computer, or any suitable processing device. In certain embodiments, encoder30is part of camera20.

Encoder30may comprise encoder memory18and encoder processor22. Encoder memory18may comprise any suitable arrangement of random access memory (RAM), read only memory (ROM), magnetic computer disk, CD-ROM, or other magnetic or optical storage media, or any other volatile or non-volatile memory devices that store one or more files, lists, tables, or other arrangements of information. In some embodiments, encoder memory18may store bit streams16and encoder logic24. Encoder logic24generally comprises rules, algorithms, code, tables, and/or other suitable instructions for encoding video12from camera20.

Encoder memory18may be communicatively coupled to encoder processor22. Encoder processor22is generally operable to execute encoder logic24to encode and/or convert video12from camera20into bit streams16. Encoder processor22may comprise any suitable combination of hardware and software implemented in one or more modules to provide the described functions and/or operations.

As explained above, encoder30may output bit streams16. In some embodiments, each bit stream16corresponds to at least a portion of a given image14in video12. Encoder30may package a particular bit stream16as a Real-Time Protocol (RTP) packet. Bit stream16for a particular image14may comprise one or more headers and a plurality of macroblocks26. Each macroblock26corresponds to a respective portion of the pixels of the particular image14. For example, a particular macroblock26may be a block of 8×8 pixels, 16×16 pixels, and/or any suitable number of pixels from image14. A particular macroblock26of multiple pixels may comprise data regarding the luminance and/or chrominance of the corresponding pixels in image14.

In some embodiments, at least one header in each bit stream16is a macroblock header28. Macroblock header28generally comprises an index that maps each macroblock26in bit stream16to a respective location in image14associated with bit stream16. System10may use macroblock header28to decode bit stream16and to map particular macroblocks26to particular pixels of a display. Thus, system10may use macroblock header28to reconstitute the particular image14from bit stream16. In some embodiments, macroblock header28may be a “groups of blocks” (GOB) header. In other embodiments, macroblock header28may be any suitable header that comprises an index for mapping macroblocks26in bit stream16to respective pixels of image14from video12.

In some embodiments, macroblock header28may further comprise movement data. Movement data in macroblock header28may describe the movement of an object in a series of video frames. In some portions of video12, the appearance of a particular object may not change from one frame to the next. However, the particular object may move relative to other objects. For example, a portion of video12may depict a car that is moving across a landscape. The appearance of the car may not change from one frame to the next, but the position of the car relative to other objects in the landscape may change. Rather than re-transmit the pixel, color, and other image data for the car with each successive frame, bit stream16may instead communicate movement data that instructs a processor regarding how and where to move the car in successive frames. In some embodiments, by configuring macroblock header28with movement data, encoder30may conserve processing and memory resources. Thus, macroblock header28may comprise (1) movement data and/or (2) index data that maps each macroblock26in bit stream16to a respective location in image14associated with bit stream16.

Encoder30may transmit bit stream16to encrypter40. Encrypter40is generally operable to encrypt at least a portion of bit stream16. In particular, encrypter40may encrypt macroblock header28in the respective bit stream16associated with each image14of video12. In some embodiments, encrypter40may rearrange the sequence of macroblocks26in bit stream16. Once macroblock header28has been encrypted, bit stream16may be referred to as encrypted bit stream32. Encrypter40may output at least one encrypted bit stream32for each image14of video12.

Encrypter40may comprise any suitable hardware and/or software to provide the described functions and/or operations. In some embodiments, encrypter40may represent a general-purpose personal computer (PC), a laptop, a Macintosh, a workstation, a Unix-based computer, a server computer, or any suitable processing device. In certain embodiments, encrypter40is part of router50. In other embodiments, encrypter40is part of encoder30. According to certain embodiments, both encrypter40and encoder30are part of camera20.

Encrypter40may comprise encrypter memory34and encrypter processor36. Encrypter memory34may comprise any suitable arrangement of random access memory (RAM), read only memory (ROM), magnetic computer disk, CD-ROM, or other magnetic or optical storage media, or any other volatile or non-volatile memory devices that store one or more files, lists, tables, or other arrangements of information. In some embodiments, encrypter memory34may store encrypted bit stream32and encrypter logic38. Encrypter logic38generally comprises rules, algorithms, code, tables, and/or other suitable instructions for encrypting one or more bit streams16.

Encrypter memory34may be communicatively coupled to encrypter processor36. Encrypter processor36is generally operable to execute encrypter logic38to encrypt at least a portion of bit stream16. Encrypter processor36may comprise any suitable combination of hardware and software implemented in one or more modules to provide the described functions and/or operations.

In some embodiments, encrypter40may be communicatively coupled to router50. Router50refers to a network device that is operable to route and/or forward data in one or more networks60. For example, router50may be a switch (e.g., layer three switch, network switch, and/or any suitable component) that routes IP packets in an IP network60. In some embodiments, router50may interconnect logical subnets of one or more networks60. Router50may determine the destination address of a data packet, determine an appropriate network path for the data packet, and/or forward the data packet along the determined network path. In some embodiments, router50may comprise a control plane, a forwarding plane, and/or one or more routing tables. A routing table may comprise a list of destination addresses and/or interfaces associated therewith. Router50may represent a provider edge router, subscriber edge router, inter-provider router, core router, residential gateway, enterprise router, and/or any suitable network device for routing data in network60. Router50may comprise a processor, memory, and/or any suitable hardware and/or software for performing the described functions and operations.

Router50may be communicatively coupled to one or more networks60. Network60may represent any number and combination of wireline and/or wireless networks suitable for data transmission. Network60may, for example, communicate internet protocol packets, frame relay frames, asynchronous transfer mode cells, and/or other suitable information between network addresses. Network60may include one or more intranets, local area networks, metropolitan area networks, wide area networks, cellular networks, all or a portion of the Internet, and/or any other communication system or systems at one or more locations. Network60may comprise any suitable number and combination of routers50.

One or more routers50associated with network60may be communicatively coupled to decrypter70. Decrypter70is generally operable to decrypt at least a portion of encrypted bit stream32. In particular, decrypter70may decrypt macroblock headers28. In some embodiments, decrypter70may unscramble the sequence of macroblocks26in encrypted bit stream32. Decrypter70may output and transmit bit stream16to decoder80.

Decrypter70may comprise any suitable hardware and/or software to provide the described functions and/or operations. In some embodiments, decrypter70may represent a general-purpose personal computer (PC), a laptop, a Macintosh, a workstation, a Unix-based computer, a server computer, or any suitable processing device. In certain embodiments, decrypter70is part of router50. In other embodiments, decrypter70is part of decoder80. According to certain embodiments, both decrypter70and decoder80are part of display device90.

Decrypter70may comprise decrypter memory42and decrypter processor44. Decrypter memory42may comprise any suitable arrangement of random access memory (RAM), read only memory (ROM), magnetic computer disk, CD-ROM, or other magnetic or optical storage media, or any other volatile or non-volatile memory devices that store one or more files, lists, tables, or other arrangements of information. In some embodiments, decrypter memory42may store bit stream16and decrypter logic46. Decrypter logic46generally comprises rules, algorithms, code, tables, and/or other suitable instructions for decrypting one or more encrypted bit streams32.

Decrypter memory42may be communicatively coupled to decrypter processor44. Decrypter processor44is generally operable to execute decrypter logic46to decrypt at least a portion of encrypted bit stream32. Decrypter processor44may comprise any suitable combination of hardware and software implemented in one or more modules to provide the described functions and/or operations.

In some embodiments, decrypter memory42and/or encrypter memory34may store one or more cryptographic keys48. Cryptographic key48may represent parameters, numbers, and/or other information that may be input into a cryptographic algorithm. In some embodiments, cryptographic key48may control data transformation associated with the encryption and/or decryption of data. Cryptographic key48may be configured for a symmetric key algorithm, asymmetric key algorithm, digital signature scheme, and/or any suitable cryptographic technique. In some embodiments, cryptographic key48may be randomly generated. In other embodiments, cryptographic key48may be based at least in part on a password from a user. A password from a user may represent a shared secret that is exchanged between encrypter40and decrypter70prior to the transmission of one or more encrypted bit streams32over network60. To encrypt/decrypt bit stream16, encrypter40and/or decrypter70may execute an algorithm that conforms to the Digital Encryption Standard (DES), Advanced Encryption Standard (AES), Triple Data Encryption Standard (Triple DES), and/or any suitable type and/or combination of cryptographic algorithms.

Decrypter70may transmit bit stream16to decoder80, which is generally operable to decode bit stream16. For a particular image14, decoding may comprise decompressing bit stream16into at least a portion of image14of video12. Decoder80may decompress bit stream16based at least in part on entropy decompression, pixel prediction, inloop deblocking, frequency transform, and/or any number and combination of suitable video decoding techniques. In some embodiments, decoding comprises mapping particular macroblocks26from bit stream16to particular portions of image14based at least in part on macroblock header28. As explained above, macroblock header28may comprise an index that maps each macroblock26to a respective portion of image14in video12. In some embodiments, decoding comprises converting a digital video signal to an analog format. In other embodiments, decoding comprises converting a video signal from a particular digital format to another digital format.

Decoder80may comprise any suitable hardware and/or software to provide the described functions and/or operations. In some embodiments, decoder80may represent a general-purpose personal computer (PC), a laptop, a Macintosh, a workstation, a Unix-based computer, a server computer, or any suitable processing device.

Decoder80may comprise decoder memory52and decoder processor54. Decoder memory52may comprise any suitable arrangement of random access memory (RAM), read only memory (ROM), magnetic computer disk, CD-ROM, or other magnetic or optical storage media, or any other volatile or non-volatile memory devices that store one or more files, lists, tables, or other arrangements of information. In some embodiments, decoder memory52may store video12and decoder logic56. Decoder logic56generally comprises rules, algorithms, code, tables, and/or other suitable instructions for decoding one or more bit streams16.

Decoder memory52may be communicatively coupled to decoder processor54. Decoder processor54is generally operable to execute decoder logic56to decode bit stream16to a video signal that may be input to display device90. Decoder processor54may comprise any suitable combination of hardware and software implemented in one or more modules to provide the described functions and/or operations.

Display device90is generally operable to receive and display video12from decoder80. Display device90may comprise any suitable device for providing a visual presentation of video12. Display device90may comprise a television, computer monitor, CRT device, plasma display, projector, LCD display, computer, workstation, electronic notebook, phone, Personal Digital Assistant (PDA), and/or any suitable device (wireless, wireline, or otherwise). According to certain embodiments, display device90may be part of a video/audio conferencing system. In some embodiments, decoder80may be part of display device90.

It should be understood that the internal structure of video system10and the servers, processors, and memory devices associated therewith is malleable and can be readily changed, modified, rearranged, or reconfigured to achieve the intended operations of video system10. It should be further understood that particular components of video system10may be combined or separated in any suitable manner according to the desired configuration of video system10.

In operation, camera20records and/or captures video12that comprises a sequence of images14. Encoder30then encodes video12into a suitable digital format such as, for example, the H.261, H.263, H.264, MPEG-1, MPEG-2, and/or MPEG-4 format. For a particular image14, encoder30may output at least one bit stream16that comprises macroblock header28and a plurality of macroblocks26. Encrypter40may then encrypt at least a portion of bit stream16. In particular, encrypter40may encrypt macroblock header28and may rearrange the sequence of macroblocks26in bit stream16. Other headers and/or portions of bit stream16may remain unencrypted. Encrypter40may then transmit encrypted bit stream32to router50.

Router50may forward encrypted bit stream32over network60to the appropriate router50associated with decrypter70. In some embodiments, because portions of encrypted stream were not encrypted, router50may read and/or determine the appropriate destination address of encrypted bit stream32without having to decrypt all or portions of encrypted bit stream32.

Decrypter70may receive and decrypt encrypted bit stream32from network60. In particular, decrypter70may decipher and/or convert macroblock header28to its original format. Decrypter70may further unscramble the sequence of macroblocks26in encrypted bit stream32. Decrypter70may transmit bit stream16to decoder80, which may decompress bit stream16into at least a portion of image14in video12. Using the decrypted macroblock header28in bit stream16, decoder80may map macroblocks26from bit stream16to their respective locations in image14associated with bit stream16. Decoder80may output and transmit video12to display device90, which may display video12to a user.

In some embodiments, video system10may provide various advantages. Various embodiments of video system10may have none, some, or all of these advantages. One advantage is that video system10may encrypt and securely transmit video12over network60. In particular, for a particular bit stream16, video system10may encrypt macroblock header28without encrypting the entire bit stream16. For example, the data in each macroblock26may remain unencrypted. Because the data within each macroblock26remains unencrypted, encrypting and decrypting bit stream16in video system10may be faster and require less processing resources than encrypting and decrypting an entire bit stream16. Because macroblock header28comprises an index for mapping macroblocks26to image14, decoder80cannot generate image14from bit stream16as long as macroblock header28remains encrypted. Thus, video12may be encrypted efficiently and kept secure from unauthorized users.

FIG. 2illustrates the encryption of bit stream16, according to certain embodiments. As explained above, encoder30may output bit stream16that comprises macroblock header28and a plurality of macroblocks26. Each macroblock26corresponds to a respective portion of the pixels of a particular image14. In some embodiments, each macroblock26is associated with a respective identifier. For example, bit stream16may comprise a first macroblock26identified as “MB1”, a second macroblock26identified as “MB2”, and so forth. The plurality of macroblocks26in bit stream16may be arranged in a particular sequence. In some embodiments, macroblock header28signifies the start of the plurality of macroblocks26in bit stream16. As explained above, macroblock header28may comprise an index that maps each macroblock26to a respective portion of image14in video12.

Encoder30may transmit bit stream16to encrypter40, which may store a cryptographic key48. Cryptographic key48may be a shared secret that is exchanged between encrypter40and decrypter70prior to the transmission of one or more bit streams16over network60. In some embodiments, a particular cryptographic key48may be hard coded in encrypter40and/or decrypter70. In other embodiments, cryptographic key48may be derived from a password input by a user and/or received from any suitable key source. Encoder30may input cryptographic key48into an encryption algorithm stored in encrypter memory34in order to encrypt macroblock header28in bit stream16. The encryption algorithm may be a symmetric key algorithm, asymmetric key algorithm, DES algorithm, AES algorithm, Triple DES algorithm, and/or any suitable algorithm for encrypting macroblock header28.

In some embodiments, bit stream16may comprise a header flag58in association with macroblock header28. Header flag58may be one or more bits that signify the start of macroblock header28in bit stream16. In some embodiments, header flag58signifies whether macroblock header28is in an encrypted state. According to certain embodiments, encrypter40does not encrypt header flag58. Upon receiving encrypted bit stream32from network60, decrypter70may scan encrypted bit stream32for header flag58in order to locate the encrypted macroblock header28.

In some embodiments, encrypter memory34stores a scramble key62. Encrypter40may use scramble key62to rearrange macroblocks26in bit stream16into a scrambled sequence. Rearranging macroblocks26in bit stream16may comprise changing the sequence of macroblocks26without actually encrypting the bits of data (e.g., chrominance data, luminance data, etc.) in each macroblock26. Scramble key62may represent a series of numbers, a code, a series of macroblock identifiers, and/or other suitable information from which the original sequence of macroblocks26can be determined. Encrypter40may input scramble key62into a transform function to determine a scrambled sequence in which to rearrange macroblocks26. According to certain embodiments, encrypter40rearranges macroblocks26into a random or pseudo-random sequence. In some embodiments, after using scramble key62to rearrange the sequence of macroblocks26, encrypter40encrypts scramble key62and transmits the encrypted scramble key62with encrypted bit stream32. In other embodiments, encrypter40transmits the encrypted scramble key62separately from encrypted bit stream32. According to certain embodiments, scramble key62is associated with and/or derived from a password that is exchanged between encrypter40and decrypter70in conjunction with the transmission of data over network60.

In some embodiments, although encrypter40encrypts macroblock header28, encrypter40does not encrypt data in the other portions of bit stream16. For example, encrypter40may not encrypt the sequence header, destination address, buffer parameters, and/or other portions of bit stream16. According to certain embodiments, although encrypter40rearranges the sequence of macroblocks26, encrypter40does not encrypt the data in each macroblock26. By allowing portions of bit stream16to remain unencrypted, encrypter40may effectively secure bit stream16while expending less time and processing resources than if the entire bit stream16were encrypted.

Once macroblock header28is encrypted and the sequence of macroblocks26is rearranged, encrypter40may transmit encrypted bit stream32to router50. Because portions of encrypted bit stream32are not encrypted (e.g., destination address, RTP header, etc.), router50may determine that encrypted bit stream32comprises video data. Router50may further determine the appropriate path along which to forward encrypted bit stream32.

Once encrypted bit stream32traverses network60, decrypter70may receive and decrypt encrypted bit stream32. In some embodiments, decrypter70may use cryptographic key48to decipher macroblock header28. Deciphering macroblock header28may comprise restoring macroblock header28to its original form. In conjunction with decrypting macroblock header28, decrypter70may use cryptographic key48to decipher the encrypted scramble key62. Decrypter70may then input scramble key62into a transform function to determine the original sequence of macroblocks26in bit stream16. Decrypter70may rearrange macroblocks26back to their original sequence. Decrypter70may output bit stream16to decoder80, which may decompress bit stream16into video12, which may be displayed on display device90.

Although the foregoing example describes bit stream16that comprises macroblock header28and a plurality of macroblocks26, it should be understood that bit stream16associated with video12may comprise a plurality of layers. For example, bit stream16may comprise a picture layer, a macroblock header layer (e.g., groups of blocks (“GOB”) layer), a macroblock layer, and a block layer. In some embodiments, the encryption/decryption described above occurs at the macroblock header layer.

In the foregoing example, encrypter40encrypts macroblock header28in conjunction with scrambling the sequence of macroblocks26. In some embodiments, encrypter40may effectively encrypt bit sequence without scrambling the sequence of macroblocks26. In particular, encrypter40may encrypt macroblock header28in bit stream16but leave the plurality of macroblocks26in their original sequence.

FIG. 3illustrates a flowchart for encrypting and transmitting video12over network60, according to certain embodiments. The method begins at step302where camera20records video12comprising a plurality of images14. At step304, encoder30receives and encodes video12into a compressed format. Encoding video12may comprise generating at least one bit stream16for each image14of video12. Bit stream16may comprise macroblock header28and a plurality of macroblocks26. In some embodiments, macroblock header28may comprise an allocation map that correlates each macroblock26to a particular slice of image14.

At step314, decrypter70decrypts macroblock header28and scramble key62. Encoder30and decoder80may perform the encryption/decryption using any suitable cryptographic algorithm and/or cryptographic key48. At step316, decrypter70inputs the decrypted scramble key62into a transform function to determine the original sequence of macroblocks26in bit stream16. Decrypter70may rearrange macroblocks26into their original sequence. At step318, decrypter70transmits bit stream16to decoder80. At step320, decoder80decompresses one or more bit streams16into video12. Decoder80may decompress bit stream16based at least in part on entropy decompression, pixel prediction, inloop deblocking, frequency transform, and/or any number and combination of suitable video decoding techniques. At step322, display device90displays video12to a user. The method then ends.

The present disclosure encompasses all changes, substitutions, variations, alterations, and modifications to the example embodiments described herein that a person having ordinary skill in the art would comprehend. Similarly, where appropriate, the appended claims encompass all changes, substitutions, variations, alterations, and modifications to the example embodiments described herein that a person having ordinary skill in the art would comprehend.