Method and apparatus for streaming video security

A streaming video security device is provided that comprises an input LAN interface, at least one streaming video decoder, an output LAN interface, at least one streaming video encoder coupled at one side to said LAN interface for streaming video output and coupled at the other side to a raw video display-compatible output interface; and unidirectional data flow element coupled at the transmitting side to the streaming video decoder through the raw video display-compatible output interface and coupled at the receiving side to one or more video encoder through the raw video display-compatible input interface.

FIELD OF THE INVENTION

The present invention relates to a method, system and apparatus that secure computer networks from attacks that abuses incoming or outgoing streaming video, and more particularly a method and apparatus that act as network isolator and firewall for streaming video, remote sensing and multimedia applications.

BACKGROUND OF THE INVENTION

Streaming video is in wide use by many individual computer users and many organizations. Streaming video is used for various applications today—from entertainment, to video conferencing, on-line events, training, industrial control, remote sensing and security camera feeds. The use of streaming video in modern organizations causes major information security concerns as video is delivered over IP traffic and IP traffic may contain malicious code. Such malicious code inserted into incoming traffic may infect internal organization networks with viruses and Trojans. Code inserted into outbound video traffic may be used to leak classified information to interested parties outside the organization. To reduce the risks involved with inbound streaming video traffic most organizations are using firewalls with preprogrammed set of policies to handle video traffic.

Prior-art firewalls are typically not suitable or not optimized for streaming video traffic. There are several inherent difficulties and disadvantages involved with prior-art firewalls used to secure streaming video:1. Streaming video in many applications requires low latency while flooding the network with intensive stream of traffic.2. Prior-art firewalls cannot assemble the video images from the stream and therefore cannot secure the stream from video inserted code.3. Prior-art firewalls must be powerful, big and expensive to handle multiple streams at the same time.4. Prior-art firewalls performing deep packet inspection in parallel silicon engines tends to create visual artifacts in the output stream.

In many cases due to the intensive QOS (Quality Of Service) requirements of video conferencing and streaming video, many organizations separate these streams by set of rules and bypasses deep security analysis.

U.S. Pat. No. 7,047,561; to Lee; titled “Firewall for real-time internet applications”; discloses a firewall for use in association with real-time Internet applications such as Voice over Internet Protocol (VoIP). The firewall applies an application proxy to the signaling and control channels and a packet filter to the bearer channels.

United States Patent Application 20050283536; to Swanson, Jon N.; et al; titled “Real time streaming data communications through a security device”; discloses a method of for connecting a plurality of clients to one another over a computer network for communication of real-time streaming data to one another, with at least one of the clients being separated by a security device from the network.

The white paper: “Streaming Video and Firewalls. Is It Safe?”, which may be found in http://www.vbrick.com/documentation/WhitePapers/Streaming_Video_and_Firewalls.pdf details some of the risks and difficulties involving video streaming.

SUMMARY OF THE EMBODIMENTS

In view of the security risks associated with streaming video connected to secure networks, and in view of the shortcoming of prior art network firewalls, there is a need for a streaming video security device that will satisfy at least some of the following requirements:1. Provide efficient and low-latency packet inspection and packet filtering. In an exemplary embodiment, this function is performed by the two firewall blocks inside the device. These blocks are responsible for:a. Providing packet filtering (OSI layers 1-4) based on predefined policy or rules.b. Handling layer 4 (transport layer) and thus function as transport layer filter. Note that this function requires buffering of incoming packets and thus adds latency to the process and therefore can be disabled if low latency is critical for the application.c. It provides some basic application layer filtering—only functions relevant to multimedia streams and command control packets]2. Provide efficient protection from non-video traffic passed through video sessions;3. Provides efficient protection form malicious code inserted into video frames;4. Passes meta-data while providing an efficient protection from attacks abusing this channel;5. Will be Low power, low cost, small size;6. Provide secure a forward path for video related data such as sensors information; and7. Provide a secure backwards path for data such as sensor commands.8. Provide galvanic network isolation between incoming and internal networks.

Therefore, it is provided in accordance with a preferred embodiment of the present invention a streaming video security device comprising:an input LAN interface capable of receiving streaming video input;at least one streaming video decoder coupled at one side to said input LAN interface for streaming video input and coupled at the other side to a raw video display-compatible output;an output LAN interface capable of transmitting streaming video output;at least one streaming video encoder coupled at one side to said LAN interface for streaming video output and coupled at the other side to a raw video display-compatible output interface; andunidirectional data flow element coupled at the transmitting side to said at least one streaming video decoder through said raw video display-compatible output interface and coupled at the receiving side to one or more video encoder through said raw video display-compatible input interface.

Furthermore, in accordance with another preferred embodiment of the present invention, said raw video display-compatible input and output are selected from a group consisting of: ITU-R BT.656, VGA, DVI, HDMI, and LCD interface.

Furthermore, in accordance with another preferred embodiment of the present invention, the device further comprising:an input firewall function connected between said input LAN interface for streaming video input and said at least one streaming video encoder; andan output firewall function connected between said output LAN interface for streaming video output and said at least one streaming video decoder;wherein said input firewall function is capable of:sorting out non video packets from a stream of packets arriving from said input LAN interface;analyzing said non video packets and rejecting unsafe packets; andtransferring only safe non video packets to said output firewall function, and wherein said output firewall function is capable of:sorting out non video packets from a stream of packets arriving from said output LAN interface;analyzing said non video packets and rejecting unsafe packets; andtransferring only safe non video packets to said input firewall function,

Furthermore, in accordance with another preferred embodiment of the present invention, the device further comprising at least one data filter function connected between said input firewall function and said output firewall function, said data filter is capable of passing only predefined traffic based on programmed rules.

Furthermore, in accordance with another preferred embodiment of the present invention, the device further comprising at least one data diode connected in series with said at least one data filter, wherein said data diode is capable of enforcing data flow only in one direction.

Furthermore, in accordance with another preferred embodiment of the present invention, the device further comprising a decryption function connected between said input LAN interface and said at least one streaming video encoder, wherein said decryption function is capable of decrypting incoming encrypted streaming video input.

Furthermore, in accordance with another preferred embodiment of the present invention, the device further comprising an output encryption/decryption function connected between said at least one streaming video decoder and said output LAN interface for streaming video output, and wherein said encryption/decryption function is capable of at least encrypting the streaming video output.

Furthermore, in accordance with another preferred embodiment of the present invention, the device further comprising an auxiliary display interface coupled to said raw video display-compatible output to enable connection of a local display.

Furthermore, in accordance with another preferred embodiment of the present invention, the device further comprising meta-data filter capable of filtering the video embedded meta-data based on preprogrammed criterions and passing said video embedded meta-data between said at least one streaming video decoder and said at least one streaming video encoder.

Furthermore, in accordance with another preferred embodiment of the present invention, the device further comprising at least one data diode connected in series with said at least one data filter, wherein said data diode is capable of enforcing data flow only in one direction.

Furthermore, in accordance with another preferred embodiment of the present invention, the device further comprising a galvanic isolator, capable of providing galvanic isolation between said input LAN interface for streaming video input and said output LAN interface for streaming video output, wherein said galvanic isolator is selected from a group consisting of: optical isolators, transformers, Radio Frequency isolators and differential signal pairs.

Furthermore, in accordance with another preferred embodiment of the present invention, the device further comprising a management function capable of providing at least one service selected from a group consisting of: diagnostics, settings, monitoring, security keys loading, asset management and alarms.

Furthermore, in accordance with another preferred embodiment of the present invention, said management function is an out-of-band management connected to a management LAN via a separate LAN interface.

Furthermore, in accordance with another preferred embodiment of the present invention, the device further comprising a log function having a non-volatile memory capable of capturing, storing and reporting normal or abnormal device events based on predefined criterions.

Furthermore, in accordance with another preferred embodiment of the present invention, the device further comprising:at least one intrusion sensor capable of sensing mechanical intrusion attempt to the internal circuitry of the streaming video security device; andan anti-tampering circuitry coupled to said at least one intrusion sensor, wherein said anti-tampering circuitry is configured to permanently disable at least one of the functions of the streaming video security device as a result of sensing the intrusion attempt.

Furthermore, in accordance with another preferred embodiment of the present invention, said anti-tampering circuitry further comprises an independent power source selected from a group consisting of: a battery, and a super-capacitor.

Furthermore, in accordance with another preferred embodiment of the present invention, said unidirectional data flow element further comprises a video transmitter and a video receiver pair, wherein said video transmitter is coupled to said at least one streaming video decoder and said at least one streaming video receiver is coupled to said at least one streaming video encoder, and wherein said video transmitter and said video receiver are linked together.

Furthermore, in accordance with another preferred embodiment of the present invention, the device further comprising at least one unidirectional data flow element coupled at the transmitting side to said at least one streaming video decoder through raw audio output interface and coupled at the receiving side to said at least one streaming video encoder through raw audio input interface to securely pass one or more audio channels.

Furthermore, in accordance with another preferred embodiment of the present invention, the device is having a modular blade form-factor, capable of being inserted into a modular blade chassis.

Furthermore, in accordance with another preferred embodiment of the present invention, at least one of said at least one streaming video decoder and said at least one streaming video encoder further capable of detecting abnormal incoming video frames behavior based on predefined rules, wherein upon detection of an abnormal traffic, it discards that traffic and does not pass it to the device output.

It is optionally provided yet another preferred embodiment of the present invention: a secure video streaming system comprising:at least a first secured network;at least a first unsecured network; andat least a first streaming video security device, connected between said at least first secured network and said at least first unsecured network, said first streaming video security device comprising:an input LAN interface capable of receiving streaming video input;at least one streaming video decoder coupled at one side to said input LAN interface for streaming video input and coupled at the other side to a raw video display-compatible output;an output LAN interface capable of transmitting streaming video output;at least one streaming video encoder coupled at one side to said LAN interface for streaming video output and coupled at the other side to a raw video display-compatible output interface; andunidirectional data flow element coupled at the transmitting side to said at least one streaming video decoder through said raw video display-compatible output interface and coupled at the receiving side to one or more video encoder through said raw video display-compatible input interface.

Furthermore, in accordance with another preferred embodiment of the present invention, the system further comprising:a second secured network;a second unsecured network;a second streaming video security device, connected between said second unsecured network and said second secured network; anda blade chassis,wherein said first a second streaming video security device and said second a second streaming video security device are having blade form-factor and are capable of being inserted into said blade chassis.

Unless marked as background or art, any information disclosed herein may be viewed as being part of the current invention or its embodiments.

DETAILED DESCRIPTION OF THE DRAWINGS

In discussion of the various figures described herein below, like numbers refer to like parts. The letter “x” after an element number may stand to any letter such as “a”, “b”, etc. The drawings are generally not to scale. For clarity, non-essential elements may have been omitted from some of the drawing.

To the extent that the figures illustrate diagrams of the functional blocks of various embodiments, the functional blocks are not necessarily indicative of the division between hardware circuitry. Thus, for example, one or more of the functional blocks (e.g., processors or memories) may be implemented in a single piece of hardware (e.g., a general purpose signal processor or random access memory, or the like) or multiple pieces of hardware. Similarly, the programs may be stand alone programs, may be incorporated as subroutines in an operating system, may be functions in an installed software package, and the like.

FIG. 1illustrates a block diagram100presenting a prior art remote streaming video system having conventional network firewall device2to provide security to classified network38. Video source51is video camera, conference phone, thermal imager sensor, radar sensor, video encoder or any other remote sensor capable of generating video over IP stream. In this system, video stream IP traffic47is passed through unsecure public networks49such as internet or wireless network. At the user's site, a router or modem39connected to the IP stream47, passes the IP traffic through LAN (Local Area Network) cable25ato the network firewall2LAN input port3. Network firewall device2applies a per-programmed set of rules and policies and blocks incoming and outgoing packets of data that do not comply with these rules. Classified network subsystem38is coupled to the network firewall device2through output LAN port4, LAN cable25band LAN switch29. LAN switch29is coupled to the secure network user devices computers27a,27band27cthrough LAN cables25c,25d, and25erespectively and to server/storage rack31through LAN cable25f. The use of prior-art firewall device2to secure the classified network38may impose the following risks:1. Limited video bandwidth;2. Quality of Service issues that causes video artifacts;3. Video latency issues;4. Advanced malicious code may be passed through the streaming video from the un-trusted video source51or from the unsecure public network49; and5. Classified information residing on user computers27xor on centralized storage or servers31may be leaked to external attackers through the streaming video traffic passed through the prior-art firewall device2.

FIG. 2illustrates a block diagram200presenting a prior art conventional network firewall device2used for remote streaming video applications such as the system100shown inFIG. 1above. This firewall2may be designed based on conventional x86 server or PC machine or may be an appliance that that is based on RISC architecture CPUs such as ARM or based on large array of microprocessors such as Tiles or GPGPU (General Purpose Graphical Processing Units). In all cases the block diagram is similar. A firewall is a device or set of devices designed to permit or deny network transmissions based on a set of rules and is frequently used to protect networks from unauthorized access while permitting legitimate communications to pass. The firewall2has input LAN (Local Access Network) port3. Input LAN port3is coupled to the streaming video source in this prior-art embodiment example. Input LAN port3may be 10/100 Ethernet, Giga Ethernet, 10 Giga Ethernet, Optical fiber interface or any other type of network port capable of delivering digitized video traffic.

Input LAN port3is coupled to one or more CPU8through Input LAN interface function5. One or more CPU8may be x86 CISC (complex instruction set computer) type or RISC (reduced instruction set computer) type processors such as MIPS (Microprocessor without Interlocked Pipeline Stages) or ARM cores. Input LAN Interface function5may be PCI (Peripheral Component Interconnect) interface, LOM (LAN-on-Motherboard), MAC (Media Access Control), PHY (LAN Physical Layer), SERDES (Serializer/Deserializer) or any other required circuitry to interface the Input LAN port3with one or more CPU8.

One or more CPU8is coupled to a Volatile Memory9such as RAM (Random Access Memory) or SRAM (Static RAM) to temporarily store programs and data. One or more CPU8is also coupled to a Non-volatile Memory12where program files and operational settings are stored. Non-volatile Memory12may be hard-disk, flash storage device or any other suitable storage device.

One or more CPU8is further coupled to an optional Network Processing hardware accelerator circuitry14that is designed to perform specific packet operations such as Deep Packet Inspection or encryption/decryption operations.

One or more CPU8is also coupled to the output LAN port4through LAN interface function6to enable connection of the filtered video stream traffic to the target networks. Output LAN port4may be 10/100 Ethernet, Giga Ethernet, 10 Giga Ethernet, Optical fiber interface or any other type of network port.

LAN port4is coupled to one or more CPU8directly or through LAN interface function6similar to LAN interface function5described above.

It should be noted that some of the functions described above may be implemented on a single-chip die to reduce the cost and size of the product.

This prior-art firewall is typically lacking the efficiency and the security level required for certain applications.

In order to effectively detect complex malicious code injected into the incoming video stream, firewall device2must perform extensive scale of operations on each packet or set of packets and on each video frame. This need for extensive scale of operations tends to:1. Limit the amount of traffic that can pass through the firewall device2.2. Limit the depth of analysis done on incoming traffic and hence reduces the level of security provided by the firewall device2.3. Increase the latency of traffic passing through firewall device2. This may negatively impact certain uses of the video traffic. For example, this may reduces the performance of real time video applications such as video conferencing.4. Increase the performance requirements of the firewall device2and hence increase its cost.5. Increase the power requirements and heat dissipation of the firewall device2.

It should be noted that most prior-art firewall devices are not optimized for video traffic and therefore cannot provide the required depth of analysis on each video frame and sequence of frames. In fact some prior-art firewalls are not capable of reconstructing the video frames at all and therefore are limited to packet related threats. Prior-art network firewalls also suffer from the disadvantage that it cannot guarantee unidirectional data flow. Such outbound traffic may be used to leak classified information to interested parties outside the organization.

In certain applications there is also a need to add a network galvanic isolator before the input network port3as prior-art firewalls are not electrically isolating.

FIG. 3illustrates a block diagram300presenting a remote streaming video system having an exemplary device16or18of the current invention to provide security to classified network38. This system300is similar to the system100ofFIG. 1above but instead of the prior-art firewall device2, an inventive streaming video security device16or18according to an exemplary embodiment of the current invention is used to secure the streaming video traffic. Some details of streaming video security device16or18may be seen inFIGS. 4 and 5respectively.

Streaming video security device18is coupled to the unsecure network49at one side (via router or modem39) and to the classified network38on the other side to secure the classified network38.

In this system the streaming video security device18provides the following functions:1. Passing incoming streaming video traffic without delays or artifacts;2. Preventing malicious code from entering the classified network38through incoming video traffic47;3. Minimizing the risks of Denial of Service attack from the internet49on the classified network38computers27x, server and storage resources31; and4. Preventing classified network38data leakages to the unsecured network (such as the internet)49.

FIG. 4illustrates a high-level block-diagram400of a streaming video security device16according to an exemplary embodiment of the current invention.

Streaming video security device16receives incoming streaming video traffic through input LAN port3. Input LAN port3may be 10/100 Ethernet, Giga Ethernet, 10 Giga Ethernet, Optical fiber interface or any other type of network port capable of delivering digitized video stream.

Input LAN port3is coupled through input LAN interface function5to video encoder function32through lines22and23. It should be noted that many Video Encoder chips available today have an integrated LAN interface function. Some chips also contain a LAN Physical Layer while other requires external Physical Layer interface chip.

Video Encoder function converts the incoming video streaming packets into a raw video format33. This raw video display-compatible output stream33is typically implemented as ITU-R BT.656, VGA (Video Graphics Array), DVI (Digital Visual Interface), HDMI (High-Definition Multimedia Interface) or DisplayPort video output.

Raw video display-compatible output stream33is coupled to unidirectional flow enforcing function41that assure unidirectional flow of data as indicated by the arrow in the figure. The unidirectional flow enforcing function41provides raw video display-compatible output43which is coupled to the Video Encoder function42, where it is digitized and compressed to form the video over IP output44that is coupled through lines44, output LAN interface function6and through lines45to the LAN output4. It should be noted that many Video Decoder chips available today have an integrated LAN interface function. Some chips also contain a LAN Physical Layer while other requires external Physical Layer interface chip.

It also should be noted that some video CODEC chips are capable of performing video decoding and video encoding simultaneously and independently and if such chip is used then the video decoder function output is coupled to the video encoder input through unidirectional flow enforcing function41.

Audio output may be embedded inside the raw video display-compatible output44(for example in HDMI format) or passed through dedicated digital or analog outputs as seen inFIG. 5below.

Video Decoder function32and Video Encoder function42may have additional internal or external functions such as non-volatile memory to store the decoder/encoder firmware and volatile memory to temporarily store decoder/encoder data and parameters. These internal functions are not shown inFIG. 4to prevent cluttering.

It should be noted that the unidirectional flow enforcing function41may be an integral component of the Video Decoder function32, Video Encoder function42or both.

In other implementations of the current invention the unidirectional flow enforcing function41also provides galvanic isolation between the input and the output sections of the device. This galvanic isolation requires internal isolated power supply (not shown here).

Video Encoder function42may be designed and programmed to generate any required streaming video protocol similar to streaming video input or different as required for specific application (such as format converter, transcoding, transrating function).

For example the embodiment of the current invention may be programmed to support one or more of the following input-output protocol operating modes:1. Protocol Transparent Mode—the same input video protocol received by Video Decoder function32is generated by Video Encoder function42.2. Protocol Independent Mode—input video protocol received by Video Decoder function32may vary. Output video protocol generated by Video Encoder function42is fixed through predefined settings.3. Static Protocols Mode—Both input video protocol received by Video Decoder function32and output video protocol generated by Video Encoder function42are fixed through predefined settings (may be same or may be different as needed).

To enable the transfer of information about the input video protocol to be communicated between the Video Decoder function and the Video encoder function, additional unidirectional channel may be added as shown inFIG. 5below in items69,74and75.

This relatively simple and low-cost exemplary embodiment of the current invention combines extensive security capabilities with low power consumption and small size and reduce cost compared to prior-art devices.

The conversion to raw video protocol and the back conversion into streaming video over IP traffic assure that only displayable data is passing through. All other injected data or malicious code would not pass such double conversion. This exemplary embodiment of the current invention may run additional code in the Video Decoder32or Video Encoder42firmware to detect abnormal video frames based on predefined criterions.

For example Video Decoder32may check average contrast changes in each frame. A rapid deviation of more than a predefined percentage from the average value may indicate bar-code image or attempt to inject abnormal image. Such attempt may be detected by the Video Decoder32and the suspicious frames will be deleted. The signal representing these abnormal frames is not passed to the raw video display-compatible signals33and therefore not passed to the output LAN port4in video over IP form. Other more detailed criterions may be applied to prevent potential attacks through abnormal video images. For example:1. Rapid changes in the brightness or luminance or colors at the same frame;2. Rapid changes in the brightness or luminance or colors at different frames;3. Detection of black-white symbols or characters;4. Detection of dark frames (no video images); and5. Detection of motion freeze frames.

FIG. 5illustrates a high-level block-diagram500of another streaming video security device18according to an exemplary embodiment of the current invention. Streaming video security device18is similar to the device16ofFIG. 4above but comprising of additional functions to further enhance the device functionality and security as explained below. For drawing clarity, Input LAN interface function5and output LAN interface function6are not seen in this and the following figures.

In this embodiment of the current invention the input LAN port3is coupled to an optional Input Encryption/Decryption function24that is used to encrypt and decrypt incoming traffic using predefined algorithms such as standard AES-256, ECC (Elliptic Curve Cryptographic) or modified/non-standard decryption algorithm. Bi-directional traffic encryption/decryptions is primarily used to establish normal communication with the video decoder function32. The resulted plain-text IP traffic input/output26is coupled to the Input Firewall function28data input. Input Firewall function28uses a set of predefined rules and algorithms to filter incoming traffic and drop abnormal packets. For example, the firewall28may use standard OSI layers1-3rules to discard packets that not compatible with the criterions—of example incorrect port numbers, IP MAC, etc; it may also applies layer4rules for connection state if required. The output of this firewall connected to the video decoder32that essentially has 2 ports—one for the video connection and the other one for management and configuration. It may also be programmed to respond to a flood or Denial Of Service attacks. The Input Firewall function28data output30is typically a LAN or some internal bidirectional data bus.

In contrast to some firewall devices of the art, devices streaming video security devices16and18are asymmetric in the sense that video streaming is handled only in the direction from Input LAN port3to output LAN port4, but not in the other direction. In the embodiments depicted inFIGS. 3, 6 and 8, video data flows only from the video sources51x. Thus, asymmetric streaming video security devices suffice. This situation may be true for other applications, where video data from other sources (e,g, remote servers) is viewed by users at computer27x. In these situations, no video streaming is required in the direction from output LAN port4to Input LAN port3, and the cost of implementing symmetric video streaming may be avoided. Additionally, the absence of video streaming capability in the return path may be advantageous as it further inhibits data leak (in form of video streaming) to the unsecure network.

It should be noted here that a symmetric firewall structure similar to the exemplary embodiment of the current inventions shown here may be needed for supporting both streaming video input to the classified organization and streaming video output from the classified organization (e.g. for video conferencing, etc.). It should be apparent to the man skilled in the art that streaming video security devices16and18may be adapted to symmetric video streaming operation by duplication of the video streaming path in reverse direction. For example, we may define a video channel99as the elements in the dashed box marked inFIG. 5. Connecting an additional similar but mirror-image (inverted left-to-right) video channel between firewalls28and46would create a symmetric streaming video security device.

The Input Firewall function28data output30is coupled to the Video Decoder function32data input where video over IP is converted into internal raw video bus36such as 24 bit RGB (Red Green Blue) LCD (Liquid Crystal Display) bus. Internal video output bus36is converted through video transmitter function34into raw video display-compatible output33such as ITU-R BT.656, VGA, DVI, HDMI or DisplayPort signals.

Video Decoder function32may have additional internal or external functions such as non-volatile memory to store the decoder firmware and volatile memory to temporarily store decoder data and parameters. These internal functions are not shown inFIG. 5to prevent cluttering.

It should be noted that display Plug and Play or EDID (Extended display identification data) handshaking is preferably disconnected or not implemented in the raw video display-compatible output33to prevent data leakages from the Video Decoder function32.

Optionally, raw video display-compatible output signals33are passed through lines35into the optional auxiliary local display port96. The optional auxiliary local display port96enables connection of local user display to view streaming video locally.

Raw video display-compatible output signals33are coupled to the Unidirectional video data flow enforcing function41.

Unidirectional video data flow enforcing function41enforces the flow of the raw video display-compatible output33in one direction only—from the Video Decoder function32through the video transmitter34to the Video Encoder function42through the video receiver40. Video receiver40receives the raw video display-compatible output43from the Unidirectional video data flow enforcing function41aand converts it back into raw video stream37that is similar to raw video stream36or different as required for specific application (such as format converter, transcoding, transrating function). Raw video stream37is coupled to the video input of Video Encoder function42.

The Video Encoder function42receives the raw video stream37and converts it back to digitized video over IP format such as H.264 or similar.

It should be noted that the Unidirectional video data flow function41and video transmitter34and receiver40may be an integral component of the Video Decoder function32, Video Encoder function42or both. Also some video transmitters34and receivers40has the inherent function of unidirectional data flow enforcement and therefore direct connection between the video transmitter34and video receiver40is possible.

Video Encoder function42converts the incoming video stream into compressed video over IP packets and passes the resulted streaming video through output lines44to the output firewall function46. The output firewall function46is similar to the input firewall function28but is located at the device18data output path. This firewall function similar to the input side firewall24: It prevents attempts to access resources from inside the network to the network outside. It handles the 1-3 layers discarding illegal packets or attempts to flood the device with packets. Both or any one of the sides may also keep logs and can report in real time through either the connected network or through a dedicated out-of-band management network (not shown here. For example management interface72seen inFIG. 7). It should be noted that output network cannot be fully trusted as infected computers at that network may attempt to transfer data to the outside world through the device18.

The role of the output firewall function46is to protect the device18from attacks originated at the output network side (38inFIG. 3above).

The output48of output firewall function46is coupled to the output encryption/decryption function50where streaming video is optionally encrypted using predefined algorithm as described above in the input encryption/decryption function24. Optional output encryption/decryption function50LAN output52is coupled to the device LAN output jack4to enable connection to the target network side. It should be noted here that the operation of the input encryption/decryption function24and the output encryption/decryption function50may be independent in some environments. It is possible for example that the incoming streaming video is encrypted but the outgoing streaming video is not or vise versa.

Audio signals may be embedded in the incoming streaming video data and therefore should be securely handled by device18. Video Decoder function32may generate streaming audio output, for example I2C compatible signal, that is coupled to audio CODEC60. Audio CODEC60converts the digitized audio stream into analog audio stream61(mono, stereo or multiple channels as needed). Analog audio stream61is passed through audio unidirectional flow enforcing function62and through analog audio output63, it is coupled into another audio CODEC64where it is converted back into a digital data stream. This digital data stream is then coupled to the Video Encoder function42where it is compressed and digitized together with the video signals. It should be noted that this separate audio path may not be necessary if the video transmitted34and video receiver40is HDMI, DisplayPort or similar protocol that supports embedded audio signals.

In some embodiments of the current invention device18may further comprises a dedicated commands channel. This channel may be needed for applications such as camera control (pan, tilt, zoom etc.) or remote sensors operation. In some cases this data is passed through separate (non-video) packets that may be sorted by the output firewall function46and handled separately from the video stream. To reduce the security risks involved with such reverse data path, data diode57is connected between the output firewall function46and the input firewall function28to enforce only one-way traffic. Data filter56may be added to further filter returned commands based on predefined template or criterions (for example—a specific XML structure having specific commands and internal data or specific SNMP—Simple Network Management Protocol data).

In other embodiments of the current invention a forward data path may be needed as well in order to deliver non-video data such as sensors data, video source information such as date, time, location coordinates etc. or acknowledge for commands (for example distance to the target shown in the image). In some cases this data is passed through separate (non-video) packets that may be sorted by the input firewall function28and handled separately from the video stream. Such data cannot pass securely through the video path and therefore a dedicated forward data diode55passes this data between the input firewall function28and the output firewall function46. Data filter54may be added to further filter the passing data based on predefined template or criterions (for example—a specific XML structure having specific commands and internal data or SNMP data).

In some exemplary embodiments of the present invention the streaming video is optionally further containing meta-data that must be securely handled by the device18. As video meta-data cannot be easily diverted from the video traffic as described above, there is an additional meta-data path coupling the video decoder function32with the video encoder function42through programmable filter65. This path may also comprise of a data diode66to enforce unidirectional data-flow. Programmable filter65may be configured to pass only specific types of data based on the current application.

In an embodiment of the present invention the streaming video security device18is optionally further equipped with another data path to enable forward data-flow of specific traffic69from Video Decoder function32, through data filter74optional data diode75to the Video Encoder function. Such path may be used to enable coordination of Video Encoder protocols with Video Decoder or transfer of specific video meta-data.

In an embodiment of the present invention the streaming video security device18is optionally further equipped with active anti-tampering function84. This function uses low power microcontroller or discrete components to sense mechanical intrusion attempt through sensor such as switch82that is mechanically coupled to the device enclosure. When switch82is interrupted, the anti-tampering function84senses this transition and triggers a chain of events through line85that cause at least one of the following effects:a. Device is disabled permanently—it cannot be activated anymore.b. Input Encryption/Decryption function24is disabled, algorithm and keys are erased.c. Output Encryption/Decryption function50is disabled, algorithm and keys are erased.d. Input firewall function28is disabled—no incoming traffic is passing through.e. Output firewall function46is disabled—no outgoing traffic is passing through.f. Drives LED87to illuminate in red color to provide clear visual indication that the device was tampered.

During normal operation, the anti-tampering function84is powered by the device external supply power source (not shown in this figure).

Coin battery or super-capacitor83provides backup power for the anti-tampering function84and sensor82to enable detection even when the device is unpowered (for example during shipment). Addition means such as tamper evident labels may be used to provide visual indications of the tampering attempt.

It should be noted that the active anti-tampering function may be critical to assure that product was not tampered with modified or extra circuitry to provide a covert data channel with remote attacker.

The streaming video security device of the current invention may be implemented in such way that multiple video streams may pass concurrently through a single device through the use of multichannel video encoders-decoders99xas shown inFIG. 7below. In addition it is possible to design the device of the current invention in a blade format that fits inside a standard or custom rack thus enabling large scale video security through the use of multiple blades each capable of handling one or more video streams.

It should be noted that the streaming video security device of the current invention may be installed and configured to handle an outgoing streaming video as opposed to incoming video streaming as shown in this example. The reversible structure of device18enables installations wherein video is streamed from the classified organization to the non-classified or internet environment. Alternatively, a symmetric version (as discussed above) may be used.

FIG. 6illustrates a block diagram600presenting a multiple-sources remote-streaming video system, having an exemplary streaming video security device20′ of the current invention to secure the classified network38.

This system600is similar to the system300ofFIG. 3above but instead of one streaming video source51, there are multiple streaming video sources51a,51band51ccoupled through non-secured networks49ato49crespectively into the router or modem39′ which is connected to the streaming video security device20′.

The exemplary embodiment20′ of the current invention is used to secure the multiple sources streaming video traffic. Streaming video security device20′ is coupled to the unsecure networks49xat one side and to the classified network38on the other side to secure the classified network38.

FIG. 7illustrates a high-level block-diagram700of another exemplary embodiment of the present invention having multiple video channel functions99x(marked in this figure as99a,99b, . . .99i) and additional Out Of Band Management function70. In this embodiment of the current invention, the incoming plain-text IP traffic is passed from the input firewall28into a managed input LAN switch67where each one of the independent video streams is routed to the proper video channel99xthrough lines30xrespectively. Each one of the streaming video channel is then converted into a raw video display-compatible output that converted back into streaming video IP traffic (as seen in block99seen inFIG. 5above) that passed through lines44xrespectively to the managed output LAN switch68. In the managed output LAN switch68all incoming streaming video traffic is combined into one physical network that is coupled to the output firewall46.

Control traffic in the forward and reverse directions is handled in the same way as inFIG. 5above but in this implementation all IP based commands traffic from all video channels is handled by the same data diodes (55and57) and filters (54and56). Video embedded meta-data is handled internally by each one of the Video channels99xas in Video channel99inFIG. 5above.

To enable device configuration, monitoring and diagnostics, the exemplary embodiment of the current invention may also comprise of an optional management function70.

Optionally, management function70is an out of band management function which is coupled to the organization management LAN through lines71and the management LAN port72. The out of band management function70may be implemented by using System On a Chip or microcontroller that is coupled to at least one of the other device functions through lines73xand lines79x.Line73aenables the out of band management function70to communicate with the output encryption/decryption function50. This communication may be used to configure the encryption/decryption function50, to set keys, to monitor the encryption/decryption process etc.Line73benables the out of band management function70to communicate with the output firewall46. This communication may be used to configure the output firewall46, to set its rules and policies and to monitor traffic abnormalities and attacks.Line73cenables the out of band management function70to communicate with the output LAN switch68. This communication may be used to configure the output LAN switch68, to create VLAN, to define traffic rules etc.Lines79x(79a,79b, . . .79i) enable the out of band management function70to communicate with the Video channel99x(99a,99band99irespectively). This communication may be used to configure the video channel99i, to set video encoding and decoding settings, to configure the meta-data filter65, to monitor the video and audio traffic, etc.Lines73gand73henable the out of band management function70to communicate with the forward command data channel filter54and with the backwards command data channel filter56respectively. This communication may be used to configure the filters with rules, black-lists, white-lists etc.Line73denables the out of band management function70to communicate with the input LAN switch67. This communication may be used to configure the output LAN switch67, to create VLAN, to define traffic rules etc.Line73eenables the out of band management function70to communicate with the input firewall28. This communication may be used to configure the output firewall28, to set its rules and policies and to monitor traffic abnormalities and attacks.Line73fenables the out of band management function70to communicate with the input encryption/decryption function24. This communication may be used to configure the input encryption/decryption function24, to set keys, to monitor the encryption/decryption process etc.Line73kenables the out of band management function70to communicate with the anti-tampering function84. This communication may be used to provide alarms on the management LAN when the device18is being tampered or physically attacked.

The out of band management function70may be further comprise of a Power Over Ethernet circuitry to enable independent supply of power to the management functions even when the device18is powered off.

The out of band management function70may further comprise of a non-volatile memory that is capable of storing system log information. Log information may be supplied by each one of the device coupled module to indicate an event or exception. For example input firewall function28may send blocked packet information through line73einto the Out Of Band management70to be stored at the said non-volatile memory. Such information may be accessible through the management LAN port72to enable remote reporting, statistics, alarms, analysis etc.

The out of band management function70may be further comprises of asset management functions to support an automated enterprise level asset management.

In some embodiments of the current invention, the management function is not coupled into a separate management LAN but it is coupled to the input or output LAN and therefore it is not considered out-of band management.

FIG. 8illustrates a block diagram800presenting a multiple sources remote streaming video system having an exemplary blade form-factor device86xof the current invention to secure the two isolated classified networks38aand38b. Only two blades shown in this figure for simplicity though typical blade chassis88of the current invention may comprise of up to 20 blades to achieve higher densities.

This system800is similar to the system600ofFIG. 6above but instead of one router or modem39′, there are two routers or modems: router39′ais coupled to video source51a, router and39′bcoupled to video sources51band51c.

Blade chassis88contains two blades86aand86bwherein each one of these blades is similar to the streaming video security device18ofFIG. 5above,20′ ofFIG. 6above or18′ ofFIG. 7above. Each streaming video security blades86xis having an input LAN interface3xand output LAN interface4x. Power to the streaming video security blades86X is supplied by a main chassis power supply89that is preferably designed for hot swapping to facilitate easier maintenance without the need to shutdown the whole chassis88.

Screws or Dzus fasteners81(see http://www.dzusfasteners.net/) enables easy removal of the streaming video security blades86X through board to board connectors at the back of each blade86X and a backplane fixed to the chassis88.

Optional chassis management module90is coupled to each one of the streaming video security blades86xOut Of Band Management functions70as seen inFIG. 7above. This module enables a unified management interface to the whole chassis through one user interface. Remote user interface may be web based over management LAN coupled to the chassis management module90similar to LAN interface72ofFIG. 7above.

Optional chassis video switch module91is coupled to each one of the streaming video security blades86xoptional local video output36ofFIG. 5above on one side and to one or more user displays on the other side. The chassis video switch module91enables the local display to show video output from each one of the streaming video security blades86ibased on user selection.

LAN output jack4aof streaming video security blade86ais coupled through LAN cable25cto first LAN switch29a. First LAN switch29ais coupled through LAN cable25eto computer27a, and coupled through LAN cable25fto computer27a. The first streaming video security blade86a, LAN switch29aand computers27aand27bare part of first classified network38a.

Similarly, streaming video security blade86bLAN output jack4bis coupled through LAN cable25dto second LAN switch29b. Second LAN switch29bis coupled through LAN cable25gto computer27c, and is coupled through LAN cable25fto server or storage rack31. The second streaming video security blade86b, LAN switch29band computer27cand server or storage rack31are part of second classified network38b.

First classified network38aand second classified network38bare fully isolated to enable security segmentation or different levels of security at the same organization. This arrangement may be needed to support large number of incoming and outgoing video streams coupled to multiple isolated networks. Typical application is a modern operations or mission control room that is coupled to large number of remote sensors such as surveillance cameras, airborne sensors, radars etc. It should be noted that other elements of system800(e.g. modems and switches) may have blade form-factor and may reside in the same rack or different racks.

Further, the limitations of the following claims are not written in means-plus-function format and are not intended to be interpreted based on 35 U.S.C. § 112, sixth paragraph, unless and until such claim limitations expressly use the phrase “means for” followed by a statement of function void of further structure.