Abstract:
Integration of the components of video monitoring, audio messaging, IP telephony, and video conferencing on a single infrastructure platform is provided. Data communications enable voice and video devices to communicate directly with compatible platforms at unlimited geographical locations supported by common wired and wireless networking standards and telecommunications protocols. Completely software driven encryption methods are used to ensure a portable, private, encryption-secure device-to-device and client server based video monitoring and teleconferencing system. Voice biometrics are also used as an authentication method to access the integrated system.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     This application claims the benefit of U.S. Provisional Application No. 60/685,874, filed Jun. 1, 2005, which is incorporated by reference, herein, in its entirety. 
    
    
     FIELD OF THE INVENTION 
     This invention relates to an integrated computer system that provides private encryption-secured device-to-device and client server based video monitoring and video teleconferencing technology for remote monitoring. 
     BACKGROUND OF THE INVENTION 
     Video encryption is extremely useful for preventing the interception and viewing of any transmitted video or other information over computer networks. For example, law enforcement video surveillance being relayed back to a central viewing center, can be easily intercepted and viewed by third parties if the information is not encrypted. Conventional remote monitoring systems have been unable to successfully encrypt live streaming video data over wireless computer networks. 
     Traditional systems utilize video scrambling technology or interlacing in order to encrypt video streams. However, scrambling and interlacing methods can be easily decoded by third parties, and the transmitted information compromised. 
     Traditional web browsers such as Firefox, Microsoft Internet Explorer, Netscape, Mozilla, and Opera may be used to access video streams. However, these interfaces are replete with information security deficiencies, and it is very easy for unauthorized individuals to capture and/or redirect video streams viewed through these browsers. In many instances, the intended receiver does not know that the video stream has been compromised. 
     SUMMARY OF THE INVENTION 
     An object of the invention, among others that will be noted by the reader, is to overcome the problems of the aforementioned approaches. 
     The invention facilitates the integration of remote video conferencing, video monitoring, voice over IP (VOIP), remote access and data messaging on a single infrastructure platform, into commercially available wired or wireless devices. The platform integrates the use of computers, cameras, databases, servers, handheld devices, PDA&#39;s, audio devices and other devices in remote monitoring systems. 
     Data communications enable voice and video devices to communicate directly with compatible platforms at unlimited geographical locations supported by common wired and wireless networking standards (such as IEEE or IETF) and telecommunications protocol (such as Bluetooth, Wi-Fi, cellular, broadband, Internet Protocol, and satellite communications). 
     The system provides private, encryption-secured, device-to-device monitoring, and includes encryption-secured communications backbone capability with ad-hoc virtual private network creation and maintenance capabilities. The encryption process is software controlled, and requires no additional hardware components. 
     The invention is taught below by way of various specific exemplary embodiments explained in detail, and illustrated in the enclosed drawing figures. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The drawing figures depict, in highly simplified schematic form, embodiments reflecting the principles of the invention. Many items and details that will be readily understood by one familiar with this field have been omitted so as to avoid obscuring the invention. In the drawings: 
         FIG. 1  is a highly simplified schematic diagram showing one embodiment of the invention. 
         FIG. 2  shows a more detailed view of one of the components depicted in  FIG. 1 . 
         FIG. 3  shows a more detailed view of another one of the components depicted in  FIG. 1 . 
         FIG. 4  shows a detailed view of the data collection and receiving system in an exemplary embodiment of the invention. 
         FIG. 5  shows the failover capability of the system in an exemplary embodiment of the invention. 
         FIG. 6  shows the bit inversion process in an exemplary embodiment of the invention. 
         FIG. 7  shows a view of an exemplary embodiment of the invention. 
         FIG. 8  shows a view of yet another exemplary embodiment of the invention. 
         FIG. 9  shows a detailed view of one of the components of  FIG. 8 . 
     
    
    
     DETAILED DESCRIPTION 
     The invention will now be taught using various exemplary embodiments. Although the embodiments are described in detail, it will be appreciated that the invention is not limited to just these embodiments, but has a scope that is significantly broader. The appended claims should be consulted to determine the true scope of the invention. 
       FIG. 1  shows an embodiment of the invention. In  FIG. 1 ,  100  indicates a collection unit,  200  indicates a gateway server, and  300  indicates a client receiving unit. 
     The collection unit  100 , shown in more detail in  FIG. 2 , includes a digital camera  101 , a CPU  102 , and a communication unit  103 . The camera  101  is used to capture moving images from a remote location. Although only one camera is depicted in the figure, it is to be understood that multiple cameras may be used to capture information from plural locations. The captured frames are converted into a series of Internet Protocol (IP) packets and sent via communication unit  103 , to the gateway server  200 . 
     The gateway server  200 , shown in more detail in  FIG. 3 , includes a data sending unit  201 , a data receiving unit  202 , a communication unit  203 , an analyzing unit  204 , a security/administration unit  205 , an encrypting unit  206 , a database management system  207 , and a controller  208 . 
     The following discussion relates to an implementation using the IP protocol, in which data units are IP packets. Those familiar with this field will appreciate that the teachings can be applied in other environments such as Asynchronous Transfer Mode (ATM) or Multi Protocol Layering Service (MPLS), and with protocols having data units other than IP packets. 
     The gateway server  200  receives IP frames from the collection unit via a switch ( 502 ). A data receiving unit  202  receives the IP frames under control of the CPU  208 . The data is then analyzed by the analyzing unit to determine the source and destination addresses, and to ensure that the frame is valid. 
     In one exemplary embodiment of the invention, the IP frames are encrypted by a software-based encryption process in the gateway server. The composition of an IP frame in the context of the present exemplary embodiment will become clearer with the discussion below with regard to Table 1. 
     
       
         
               
             
               
               
               
             
           
               
                 TABLE 1 
               
               
                   
               
               
                 IP Header Format 
               
               
                   
               
             
             
               
                   
               
             
          
           
               
                   
                 OCTET 1 
                 Version (4 bit) + IHL (4 bit) 
               
               
                   
                 OCTET 2 
                 Type of service 
               
               
                   
                 OCTET 3, 4 
                 Total Length 
               
               
                   
                 OCTET 5, 6 
                 Identification 
               
               
                   
                 OCTET 7, 8 
                 Flags 
               
               
                   
                 OCTET 9 
                 Time to Live 
               
               
                   
                 OCTET 10 
                 Protocol 
               
               
                   
                 OCTET 11, 12 
                 Header Checksum 
               
               
                   
                 OCTET 13, 14, 15, 16 
                 Source Address 
               
               
                   
                 OCTET 17, 18, 19, 20 
                 Destination Address 
               
               
                   
                 OCTET 21, 22, 23 
                 Options 
               
               
                   
                 OCTET 24 
                 Padding 
               
               
                   
                 OCTET 25, 26 . . . 
                 Data 
               
               
                   
                   
               
             
          
         
       
     
     The IP header informs the recipient of the destination and source addresses of the packet, the number of octets in the packet, the protocol that the packet carries, etc. The Options octets (Octets 21, 22, and 23) are 24 bits in total length, and in the present embodiment may be understood to constitute an indicator field used in association with encryption and control processes. The indicator field data is seeded/encrypted with values associated with the encryption and control parameters of each IP packet and examined using inspection of the packet header, in context (including information relating to packet data, connections utilized, and packet validity) at the network level, which may utilize, e.g. AES 256 encryption of the data payload. The gateway server evaluates the seeded values in the bits of the indicator field against a user key to determine whether the packet is valid. 
     The indicator field is primarily used to determine data characteristics including, but not limited to: the identity of the sender of the packet (Packet sender Id) (PSI) (the authenticated identification code of the sender, not the source IP address); packet viewing priority (PVP) (permissions); packet control characteristics (PCC); the packet encryption method (PEM); the packet encryption seed (PES) (the seed value associated with the stated packet encryption method); and the packet encryption credentials (PEC) (a pointer to a preauthorized public or private encryption key which is stored within the collection unit, the gateway server or the client receiver unit). 
     The data characteristic flags are set in a heuristic manner, by eliminating any obfuscation (data clarification) and unshuffling (normalizing) shuffled packet data, then proceeding to derive by calculation or reference table value checking (table lookup) the values for the associated parameter (such as PSI, PVP, PCC, PEM, PES, and PEC) keyed to the applicable numerical value in the appropriate octet, nibble (half-octet), bit, or combination. 
     Data shuffling and data obfuscation of IPv4 protocol option octets and IPv6 protocol extension headers may be used for parameter encoding and security during data transfer. Heuristic (rule-based) IPv4 data packet option octet clarification and normalization may be used for parameter decoding; heuristic derivation of IPv4 data packet characteristics are indicated by data packet option octet data by means of algorithm or table lookup, and heuristic IPv6 data packet extension headers normalization and clarification may be used for parameter decoding. 
     The packet data is intentionally shuffled or obfuscated, and must be evaluated using the same rule sets that were used to initially shuffle or obfuscate the packet data. For Example: 
     Shuffled Data: 
     
         
         
           
             1001 0110 1001 0110 1001 0110, might actually represent: 
             0110 1001 0110 1001 0110 1001—if inverted, each bit is replaced with its opposite value. 
             1010 1010 1010 1010 1010 1010—if partially trans-positionally inverted, alternating half nibbles are transposed. 
             0000 0000 0000 0000 0000 0000—if partially positionally negated, the 1&#39;s are negated etc.
 
Obfuscated Data:
 
             1001 0110 1001 0110 1001 0110, might actually represent: 
             1001 0000 0000 0110 1001 0000—if partial octet obfuscation is employed, 
             1000 0111 1000 0111 1000 0111—if bitwise obfuscation is employed, etc 
           
         
       
    
     The encryption process of the present invention is therefore done on an “intra-packet” basis, as opposed to the entire packet being encrypted. In conventional encryption methods, the entire packet is analyzed and encapsulated. This results in increased processing time. In the present invention, only specific bits in the IP header are sampled and encrypted. This results in a decreased processing time. 
     The database management system  207  of the gateway server archives live audio, video and data streams received from the collection unit. This data may then be transmitted to various client receiving units. Each frame of video data, for example, may be stored as a record. 
     The security/administration unit  205  contains a list of all authorized users and devices in the network. This unit stores the last known locations of all devices, their IP addresses, including Dynamic Host Configuration Protocol/Network Address Translation (DHCP/NAT) information, and other attributes. 
       FIG. 4  depicts a detailed view of the data collection and receiving system of an embodiment of the present invention. 
     A collection unit  501  may be remotely controlled by a user at a client receiving unit  505 . The user sends commands to the gateway server  200 . The gateway server  200  then sends the corresponding commands to the indicated collection unit to enable the user to control that unit. The user has the ability to rotate, pan, or tilt the camera and zoom in and out in order to more closely examine selected images. The ability of the user to control the camera remotely depends on the level of authority the user has. The captured images or frames are transformed into packet form and than sent to a switch  502 . The switch  502  then determines which gateway server should receive the frames. The gateway server analyzes the frames and sends each frame to client receiving unit  505  based on the results of the analysis. The gateway also examines each indicator field of each packet to determine whether to pass commands on to a specified collector unit  501 . 
     At the gateway server, the data may be digitally watermarked prior to being stored and after a copy of the data has been sent to the client receiving unit  505 . In this process, a pattern of bits are inserted into the digital image, audio, or video file in order to easily identify the image or data. The presence or absence of the watermarks allow a user to determine whether the information has been altered. Digitally watermarking the data is also advantageous in that it easily provides identification to the data if it is being used for evidentiary purposes. 
     In one exemplary embodiment of the invention, the data may be encrypted in the collection unit. If the data entering the gateway server is encrypted, it is decrypted, watermarked and then stored. If the data entering the gateway server is unencrypted, it is watermarked and then stored. 
     In another aspect of the invention depicted in  FIG. 5 , the system is fully redundant in that it has complete failover capability. In the event of a failure in any one of the camera  501 , switch  502 , or gateway server  503 , in a particular network, the network router located in the failed network mirrors its routing table and authentication data to the second or alternate network. Accordingly, data from the failed network is routed to the alternate network. 
     In another aspect of the invention, Public-Key Infrastructure (PKI), users are authenticated by a root authority or “certificate authority”. These features are commonly embedded into Government, military, financial, and corporate organizations and their data processing infrastructures. Prior to accessing data, the user must be electronically authenticated to the system through a digital certificate or approved token or “signing authority”, using an X.509 compliant protocol. Users who are authenticated to the system of the invention by means of PKI may have their access be granted, limited, revoked, or suspended. 
     In yet another variation, the collection units and the client receiving units may be wireless devices. The intra-packet encryption method encrypts random bits within the packet, its use in wireless systems would also prevent the data from being easily decoded by third parties, and prevent unauthorized individuals from capturing and/or redirecting video streams. 
     In still another variation, if a signal failure or discontinuity of a signal from the collection unit is detected by the gateway server, a discontinuity indicator (or test pattern) is inserted into the data stream being sent to the client receiving unit  505 . This alerts the user to the fact that a transmission failure has occurred. 
     Other variations might include biometric authentication in order to provide greater security to the system. If the user device is biometric enabled, the user will be authenticated by providing fingerprint, voice print, smartcard or other biometric methods in order to access the system. For example, in voice print biometric access, the user&#39;s voice print is matched against a digital certificate stored on the gateway server. If authentication is successful, the user is granted access to the system, and is given rights based on their user authority. Users with authority to administer the system can create or remove users, schedule audio or video data collections, and have full administrative control of the system. 
     In yet another embodiment, the system is scalable. The system can be embodied in a portable manner by utilizing a cart-borne mobile monitoring/surveillance device. The mobile cart-type device comprises a weather proof enclosure which protects the interior units from the environment; a power inverter; a solar panel; a storage battery; a gateway server, and an IP-based camera with its own environmental enclosure. 
     The mobile cart-borne system is advantageous in that it gives users the flexibility to rapidly establish remote surveillance or monitoring in emergency situations. 
     In still another embodiment, the system is embodied as an Outhouse unit. This system comprises storage batteries, a power inverter; an ac/dc converter; a network switch; a wireless access port; an IP-based camera with environmental enclosure, and two-way audio transmission. Although the Outhouse remote monitoring/surveillance system may not be fully mobile, it may be moved to different locations as a need arises. 
     Yet other combinations and subcombinations of the various embodiments described above will occur to those familiar with this field, without departing from the scope and spirit of the invention.