# US 11,444,927 B2 · Method and apparatus for encrypting data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,927 B2 - Document ID: US11444927B2 - Status: Granted - Kind: B2 - Application number: 16/646,761 - Filed: 2018-08-23 - Published: 2020-08-27 - Granted: 2022-09-13 - Earliest claimed: 2017-09-13 - Assignees: Hangzhou Hikvision Digital Technology Co., Ltd. - Applicants: Hangzhou Hikvision Digital Technology Co., Ltd. - Inventors: Anmin Xin - Web page: https://patentgrep.com/patent/US11444927B2 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - G06F 21/60: Protecting data - G06F 21/602: {Providing cryptographic facilities or services} - H04L 9/065: {Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3} - H04L 63/0457: {wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption (cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065)} - H04L 63/0464: {using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it} - H04L 65/70: Media network packetisation - H04L 69/22: Parsing or analysis of headers - H04N 21/2347: involving video stream encryption - H04N 21/4405: involving video stream decryption - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION ## Abstract A method and apparatus for encrypting data includes: acquiring a first data unit included in a media frame to be encrypted, wherein the first data unit includes a boundary portion and a content portion, the boundary portion including boundary information for identifying a starting boundary of the first data unit, and the content portion including content data of the first data unit; encrypting the content data included in the content portion of the first data unit to acquire a second data unit, wherein a boundary portion of the second data unit includes the boundary information, and a content portion of the second data unit includes a data length of the content data and encrypted data acquired by encrypting the content data. ## Claims ### Claim 1 A method for encrypting data, comprising: acquiring a first data unit included in a media frame to be encrypted, wherein the first data unit comprises a boundary portion and a content portion, the boundary portion comprises boundary information for identifying a starting boundary of the first data unit, and the content portion comprises content data of the first data unit; and encrypting the content data included in the content portion of the first data unit to acquire a second data unit, wherein a boundary portion of the second data unit comprises the boundary information, and a content portion of the second data unit comprises a data length of the content data and encrypted data acquired by encrypting the content data, wherein the boundary portion of the second data unit is unencrypted, and the boundary information comprises an identification code which is configured to indicate a type of the content data, the type being parameter information or media data. ### Claim 2 (depends on 1) The method according to claim 1, wherein after encrypting the content data included in the content portion of the first data unit to acquire the second data unit, the method further comprises: generating a first media packet including the second data unit when the content data is parameter information of the media frame, wherein a header field of the first media packet comprises a timestamp of the media frame and a packet sequence number of the first media packet, and a load field of the first media packet comprises the second data unit. ### Claim 3 (depends on 2) The method according to claim 2, wherein the load field of the first media packet comprises the identification code in the boundary information and the content portion of the second data unit. ### Claim 4 (depends on 1) The method according to claim 1, wherein after encrypting the content data included in the content portion of the first data unit to acquire the second data unit, the method further comprises: generating a second media packet when the content data is media data of the media frame, wherein a header field of the second media packet comprises a timestamp of the media frame and a packet sequence number of the second media packet, and a load field of the second media packet comprises first identification information for identifying the second media packet as a starting packet, the boundary information and a part of data intercepted from a starting position of the content portion of the second data unit. ### Claim 5 (depends on 4) The method according to claim 4, wherein the load field of the second media packet comprises an indicator, a header and a payload field, the header is located between the indicator and the payload field, and the identification code comprises a first part of content and a second part of content; wherein the indicator comprises the first part of content, the header comprises the second part of content and the first identification information, and the payload field comprises the part of data intercepted from the starting position of the content portion of the second data unit. ### Claim 6 (depends on 4) The method according to claim 4, wherein the load field of the second media packet comprises a header and a payload field, and the header being located before the payload field; wherein the header comprises the middle 6-bit content of a first byte of the identification code and the first identification information, and the payload field comprises the part of data intercepted from the starting position of the content portion of the second data unit. ### Claim 7 (depends on 4) The method according to claim 4, wherein after generating the second media packet, the method further comprises: when a length of unintercepted remaining data included in the content portion of the second data unit exceeds a preset threshold, intercepting a part of data from a starting position of the remaining data to generate a third media packet, wherein a header field of the third media packet comprises a timestamp of the media frame and a packet sequence number of the third media packet, and a load field of the third media packet comprises second identification information for identifying the third media packet as an intermediate packet and the intercepted part of data. ### Claim 8 (depends on 4) The method according to claim 4 wherein after generating the second media packet, the method further comprises: when a length of unintercepted remaining data included in the content portion of the second data unit does not exceed a preset threshold, generating a fourth media packet, wherein a header field of the fourth media packet comprises a timestamp of the media frame and a packet sequence number of the fourth media packet, and a load field of the fourth media packet comprises third identification information for identifying the fourth media packet as an ending packet and the remaining data. ### Claim 9 (depends on 1) A non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium is configured to store a computer program, and when the computer program is loaded and executed by a processor, the program causes the processor to execute the method according to claim 1. ### Claim 10 An apparatus for encrypting data, comprising: one or more processors; and one or more memories; wherein the one or more memories is configured to store program codes that when executed by the one or more processors cause the one or more processor to implement the following operations: acquiring a first data unit included in a media frame to be encrypted, wherein the first data unit comprises a boundary portion and a content portion, the boundary portion comprises boundary information for identifying a starting boundary of the first data unit, and the content portion comprises content data of the first data unit; and encrypting the content data included in the content portion of the first data unit to acquire a second data unit, wherein a boundary portion of the second data unit comprises the boundary information, and a content portion of the second data unit comprises a data length of the content data and encrypted data acquired by encrypting the content data, wherein the boundary portion of the second data unit is unencrypted, and the boundary information comprises an identification code which is configured to indicate a type of the content data, the type being parameter information or media data. ### Claim 11 (depends on 10) The apparatus according to claim 10, wherein after encrypting the content data included in the content portion of the first data unit to acquire the second data unit, the program codes are further executed by the one or more processors to implement the following operations: generating a first media packet including the second data unit when the content data is parameter information of the media frame, wherein a header field of the first media packet comprises a timestamp of the media frame and a packet sequence number of the first media packet, and a load field of the first media packet comprises the second data unit. ### Claim 12 (depends on 11) The apparatus according to claim 11, wherein the load field of the first media packet comprises the identification code and the content portion of the second data unit. ### Claim 13 (depends on 10) The apparatus according to claim 10, wherein after encrypting the content data included in the content portion of the first data unit to acquire the second data unit, the program codes are further executed by the one or more processors to implement the following operations: generating a second media packet when the content data is media data of the media frame, wherein a header field of the second media packet comprises a timestamp of the media frame and a packet sequence number of the second media packet, and a load field of the second media packet comprises first identification information for identifying the second media packet as a starting packet, the boundary information and a part of data intercepted from a starting position of the content portion of the second data unit. ### Claim 14 (depends on 13) The apparatus according to claim 13, wherein the load field of the second media packet comprises an indicator, a header and a payload field, the header is located between the indicator and the payload field, the identification code comprises a first part of content and a second part of content; wherein the indicator comprises the first part of content, the header comprises the second part of content and the first identification information, and the payload field comprises the part of data intercepted from the starting position of the content portion of the second data unit. ### Claim 15 (depends on 13) The apparatus according to claim 13, wherein the load field of the second media packet comprises a header and a payload field, and the header being located before the payload field, and the boundary information comprises an identification code; wherein the header comprises the middle 6-bit content of a first byte of the identification code and the first identification information, and the payload field comprises the part of data intercepted from the starting position of the content portion of the second data unit. ### Claim 16 (depends on 13) The apparatus according to claim 13, wherein after generating the second media packet, the program codes are further executed by the one or more processors to implement the following operations: when a length of unintercepted remaining data included in the content portion of the second data unit exceeds a preset threshold, intercepting a part of data from a starting position of the remaining data to generate a third media packet, wherein a header field of the third media packet comprises a timestamp of the media frame and a packet sequence number of the third media packet, and a load field of the third media packet comprises second identification information for identifying the third media packet as an intermediate packet and the intercepted part of data. ### Claim 17 (depends on 14) The apparatus according to claim 14, wherein after generating the second media packet, the program codes are further executed by the one or more processors to implement the following operations: when a length of unintercepted remaining data included in the content portion of the second data unit exceeds a preset threshold, intercepting a part of data from a starting position of the remaining data to generate a third media packet, wherein a header field of the third media packet comprises a timestamp of the media frame and a packet sequence number of the third media packet, and a load field of the third media packet comprises second identification information for identifying the third media packet as an intermediate packet and the intercepted part of data. ### Claim 18 (depends on 15) The apparatus according to claim 15, wherein after generating the second media packet, the program codes are further executed by the one or more processors to implement the following operations: when a length of unintercepted remaining data included in the content portion of the second data unit exceeds a preset threshold, intercepting a part of data from a starting position of the remaining data to generate a third media packet, wherein a header field of the third media packet comprises a timestamp of the media frame and a packet sequence number of the third media packet, and a load field of the third media packet comprises second identification information for identifying the third media packet as an intermediate packet and the intercepted part of data. ### Claim 19 (depends on 13) The apparatus according to claim 13, wherein after generating the second media packet, the program codes are further executed by the one or more processors to implement the following operations: when a length of unintercepted remaining data included in the content portion of the second data unit does not exceed a preset threshold, generating a fourth media packet, wherein a header field of the fourth media packet comprises a timestamp of the media frame and a packet sequence number of the fourth media packet, and a load field of the fourth media packet comprises third identification information for identifying the fourth media packet as an ending packet and the remaining data. ### Claim 20 (depends on 14) The apparatus according to claim 14, wherein after generating the second media packet, the program codes are further executed by the one or more processors to implement the following operations: when a length of unintercepted remaining data included in the content portion of the second data unit does not exceed a preset threshold, generating a fourth media packet, wherein a header field of the fourth media packet comprises a timestamp of the media frame and a packet sequence number of the fourth media packet, and a load field of the fourth media packet comprises third identification information for identifying the fourth media packet as an ending packet and the remaining data.