Research Article Study on Strengthening Plan of Safety Network …downloads.hindawi.com/journals/am/2015/960416.pdf · 2019-07-31 · Research Article Study on Strengthening Plan

Research ArticleStudy on Strengthening Plan of Safety Network CCTVMonitoring by Steganography and User Authentication

Jung-oh Park1 and Sanggeun Kim2

1Department of Information Communications, Dongyang Mirae University, Seoul 152-714, Republic of Korea2Division of Computer Engineering, Sungkyul University, Anyang-si 430-742, Republic of Korea

Correspondence should be addressed to Sanggeun Kim; [email protected]

Received 16 October 2014; Accepted 4 December 2014

Academic Editor: Seungmin Rho

Copyright © 2015 J.-o. Park and S. Kim.This is an open access article distributed under the Creative CommonsAttribution License,which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

Recently, as the utilization of CCTV (closed circuit television) is emerging as an issue, the studies on CCTV are receiving muchattention. Accordingly, due to the development of CCTV, CCTV has IP addresses and is connected to network; it is exposedto many threats on the existing web environment. In this paper, steganography is utilized to confirm the Data Masqueradingand Data Modification and, in addition, to strengthen the security; the user information is protected based on PKI (public keyinfrastructure), SN (serial number), and R value (random number) attributed at the time of login and the user authenticationprotocol to block nonauthorized access of malicious user in network CCTV environment was proposed. This paper should beappropriate for utilization of user infringement-related CCTVwhere user information protection-related technology is not appliedfor CCTV in the future.

1. Introduction

Due to networking of CCTVand openness of the internet, thenecessity to protect privacy video data and information safety,trust, protection, and concealment is in demand, and as theaccording application technique, the study on steganographymethodwhich inserts confidential information to the transfermedia is actively in progress.

The existing web has much vulnerability, and as CCTVwas involved with networking, it became a problem thatCCTV is exposed to such vulnerability of web. Also, CCTVvideos are related to privacy, and if such videos are exposedto unspecified public, it would be a sufficiently sensitive issue.

Recently, there are many problems related to CCTV; themanager does not frequently change the public IP or dynamicIP of network camera, rendering it easy to be exposed outside,and once IP address is leaked, the crack program breakingthe password is used to access the administrator account andhave the monitoring video leaked at any time. Network mon-itoring camera, however, has a large data size and sends datathrough streaming unlike other IT resources; thus it is hard

to change the IP address and is easily exposed outside. Due tosuch issues, it is only amatter of time for themonitoring videoto be leaked. Other than that, there is possibility of leakage ofCCTV videos due to several threats, and data security mustbe provided accordingly. Existing studies [1–17] on CCTVsecurity concentrated on security structure of CCTVnetworkinfrastructure, security policy, and utilization under specificenvironment (crime prevention, etc.). This paper shifts fromsuch general topics to propose a user authentication protocolunder network CCTV environment which reinforces CCTVmonitoring with steganography and prevents malicious useraccess. International trends of CCTV security are given inTable 1.

2. Related Studies

2.1. Network CCTV System. By inserting IP to the existingCCTV, CCTV can be managed individually, and as longas internet is available, remote management and remotemonitoring are available. Such network CCTV system is asin Figure 1.

Hindawi Publishing CorporationAdvances in MultimediaVolume 2015, Article ID 960416, 9 pageshttp://dx.doi.org/10.1155/2015/960416

2 Advances in Multimedia

Table 1: International trends of CCTV security (purpose and characteristics).

Country Purpose Location Characteristics

Korea Theft prevention, traffic and parking,and disaster prevention All regions of Korea

Operating integrated CCTV controlcenters by local governmentsaround the nation

UK Theft prevention and prevention ofriot, protest, and terrorism All regions of UK

Converted from analog to HDCCTV, installing large number ofCCTV compared to population

Germany Building security such as alert on theft,fire, intrusion, and robbery Major buildings Video equipment related to theft

and intrusion combined as one

UAE Prevention of terrorism and variouscrimes

Facilities such as schools, hospitals, andparks

Entirely relies on importation withhigh ratio of CCTV used to preventauto theft

United States Public security such as homelandsecurity and disaster prevention All regions of the United States

Has largest market size and quicklyapplies latest technological trends(intelligent CCTV)

Switzerland Homeland security, public security,and corporations Major public institutions High ratio of CCTV used to

maintain public order

China Crime prevention and public security Major public institutions, automobiles,and households

Low ratio of HD CCTV and lowavailability

Router

Camera Internet

Reception software or web browser

Mobile monitoringReception software or web browser

Figure 1: Network CCTV system.

2.2. Problems of Network CCTV Systems. As CCTV getsinvolved with networking, there are many emerging issues.The number of police protecting the safety of the citi-zens is increasing every year, but due to the increase insocial violent crime occurrences and public order issues,the installation/operation of network-based CCTV systemsare expanding nationwide for the purpose of citizen pro-tection and personal security. Particularly, thanks to theadvancement of internet technologies, the utilization scopebecame more diverse from illegal trash dumping to pub-lic order/crime prevention to illegal parking/stop, and soforth.

On the other hand, despite the expansion of installa-tion/expansion of CCTV system, relative absence of clear

governmental guidelines and reckless introductionwith stan-dards are emerging as security issues [18, 19].

The purpose of CCTV in different nations is preventionof major crimes and promotion of public security. Existinganalog CCTV devices are changing into network-baseddigital CCTV with HD screen. The market for network-based CCTV system is growing for operation of integratedcontrol centers. Examples [20–22] of security scenarios thatcan occur in network-based CCTV systems are as follows.

A Collection of information by CCTV system that usespublic IP: as the system is linked to various paths,exposure of IP address as problem that informationon the operating system and application used byCCTV system server can be collected with ease.

Advances in Multimedia 3

CCTV ServerReal-time video transmission

Steganography insertion Steganography extraction

+

Figure 2: Overall structural diagram.

CCTVstream datageneration

CCTVstream datageneration

DequantizationVariable block

LSB

Variable blockLSB

insertioninsertion algorithm

extraction

Data

Receive data

[Converter process]

[Converter process]

PD-steganography

PD-steganography

extractionalgorithm

transmission

[Generating process]

[Extraction process]

Quantization

Figure 3: Overall data flowchart.

Hackers can use this as a starting point tomake differ-ent hacking attempts based on information collectedfrom each server.

B Sniffing and spoofing of sectionswith security vulner-abilities: since all IP-based CCTV systems commu-nicate via different network devices and servers in apublic network, information can be exposed when asection without security infrastructure is hacked.

C Lack of data safety fromnonapplication of encryptionon video data: existing analog CCTV and networkCDTV with relatively low hardware specificationshave a problem in which real-time data cannot beencrypted.This results in easy exposure of data storedin servers.

D Security vulnerabilities of CCTV control centers:as control centers are always connected to networkbecause they need to manage and control CCTV on areal-time basis, security vulnerabilities of server andcontrol PC can expose ID and password of importantadministrator accounts. Hacked CCTV systems canbe used as a means to attack internal infrastructureand attack route.

As shown in the hacking scenarios described above, hackingof important information and exposure of CCTV informa-tion have reached a dangerous level of security alert fornetwork CCTV systems resulting in leakage of confidentialinformation of public institutions and corporations, deletionor alteration of important information such as major theftcrimes, and unauthorized release of private CCTV informa-tion.

3. Video Steganography Application Plan forNetwork CCTV Monitoring Security

As in Figure 2, the overall system structure diagram showsthat when sending the video from the CCTV, the steganogra-phy is inserted realtime before being sent to the server, andthen the server extracts the steganography from the videoagain.

This report proposes a method to protect the systemby inserting steganography to the real-time video of CCTVmonitoring system provided in open source. Figure 3 is theoverall data flowchart of this report. This structure is inthree different work processes of generation, conversion,and extraction. The generation part generates the video datafrom CCTV and converts the video data into bits. Theconversion part is the LSB process for the bit-converted videodata and proposed steganography insertion application. Theextraction part is the process of reverse-quantization ofdata extract by LSB method and generating video data. Theproposed steganography input method is as in Figure 4.

Figure 5 shows the application of shift to the correspond-ing data line by the same rule as in Table 2. For example, thedata in Figure 4 shall have the time value of image filmedwithCCTV, user name, key value of CCTV, and so forth.

4. User Authentication Protocol to BlockMalicious User

Figure 6 is the overall outline diagram of the proposedprotocol. In the proposed user registration process, alongwith the user authentication, the user and related CCTV are


8

8

8

8

8

8

8

8 8 8 8 8 8

100

100

Imaging

Signed value of bits

(001001000100..)

Time: 17:37Park Tae Sung870906-1∗∗∗∗∗∗

010-2078-6754

8

8

8

88

8

8

8

8 8 8 8 8 8

100

Figure 4: After shift of steganography-inserted data.

8

8

8

8

8

8

8

8 8 8 8 8 8

100

100

Signed value of bits(001001000100..)

ImagingTime: 17:37Park Tae Sung870906-1∗∗∗∗∗∗

010-2078-6754

8

8

8

8

8

8

8

888 88 8 8 8 8

Figure 5: Before shift of steganography-inserted data.


Connection to CCTV, transmission of NS, ID, passwordand R, and request for service

Completion of user authentication and

User

VMS

CCTVService request

Login and request for user information ID,

password, SN transmission

Transmission of ID, password, and SN

User au

thenticatio

n using R

User au

thenticatio

n results

and notificat

ion

Completion of login and transmission of

provision of service

CCTV_IP and R of wheth

er serv

ice will b

e provided

②

③

④

⑤

⑥

⑧

⑦

①

Figure 6: Overall composition diagram.

Table 2: Steganography data shift rules.

Line Shift1 None2 ≫13 ≫34 ≫65 ≫10...

.

.

.

𝑛 ≫𝑛(𝑛 − 1)/2

synchronized at the same time providing the SN of CCTV,and in user authentication process, this SN and randomnumber attributed to the user are used to strengthen identityauthentication, and it is rendered impossible to leak CCTVvideo by password unlock crack or simple CCTV IP access.

4.1. User Registration Protocol. Figure 7 is the user registra-tion process of the proposed protocol. The proposed userregistration protocol is achieved by executing the followingprocedure.

A The user sends the network CCTV video servicerequest message to the operation PC of VMS.

B The operation PC of VMS requests the user informa-tion necessary for member subscription.

C The user requests the user information for membersubscription.

Response {User Data(Name, Num)}.

The corresponding information is, respectively, user’sname and user’s resident registration number.

D The operation PC of VMS sends the received userinformation to the identity confirmation agency andrequests authentication.

Verify User Data confirm {User(Name, Num)}.

VMS does not feature an agency to identify theinformation for the user. Therefore, the operationPC of VMS sends the data received from the userto the identity confirmation agency to request theconfirmation of the information for the user.

E The identity confirmation agency checks the user’spersonal information, and if the information is cor-rect, it sends an approval message to the operation PCof VMS, and if not, it sends a rejection message.

F Theoperation PC ofVMS sends the responsemessagereceived from the identity confirmation agency to theauthentication server.

G The operation PC of VMS checks the user informa-tion with the received message.

H The authentication server sends the approval messagefor the user information to the operation PC.

0 The operation PC sends the approval messagereceived from the authentication server to the user.

1 The user encrypts the ID and password to be usedwith the public key of VMS and sends it to theoperation PC of VMS.Send {EVMSPu(ID ‖ PW)}.The user sends the ID and password encrypted withthe public key of VMS so that the user ID andpassword can only be decrypted by VMS and it is safefrom external attacks such as password speculationattack.

2 The operation PC decrypts the data received from theuser with the personal key of VMS to extract ID andpassword.Transaction {DVMSPri(ID ‖ PW)}.

3 The operation PC sends the value hashed to preventthe exposure of user’s ID and password to the authen-tication server.Send {ID ‖ h(PW)}.


Identification authorityUser

Request service

Request user data

User authentication

Verify user data confirm{User(Name, Num)}

Response confirm messageResponse confirm message

Verify user authentication

Response

server

Response {User Data(Name, Num)}

②

③

⑩

⑭⑮

⑨

④

⑤ ⑥

⑧

Send {ID ‖h(PW)}

Operation PCAuthentication

VMS

Send {EVMSPu (ID ‖PW)}

Send {EUserPu (SN)}Update

Confirm data of user⑦

⑬

⑫

⑪ Transaction {DVMSPri (ID ‖PW)}

①

Figure 7: Proposed user registration protocol.

4 The authentication server registers the received userinformation.

5 The authentication server sends the result for thecompletion of member subscription to the operationPC.

6 The operation PC encrypts the SN value of CCTVnecessary for the authentication process with thepublic key of the user and sends it.Send {EUserPu(SN)}.

The objective of this user registration protocol is to checkthe user information and obtain SN which is the informationneededwhen requesting service from the networkCCTV thatthe user wants to see.

4.2. User Authentication Protocol. Figure 8 is the proposeduser authentication protocol process.

The proposed user authentication protocol is achieved byexecuting the following procedure.

A The user makes a service request to the operation PCof VMS.

B The operation PC checks the member subscription ofthe user before providing the service, and if the user isamember, it requests the user information andCCTVSN distributed at the time of member subscription.

C After encrypting the hashed data of user ID, pass-word, and CCTV SN value with the public key ofVMS, it is sent to the operation PC.Response {EVMSPu(ID ‖ PW ‖ h(SN))}.

D The operation PC decrypts the received data withthe personal key of VMS to check the SN value ofCCTV and hashes to prevent exposure of user ID andpassword and sends it to the authentication server.Send {ID ‖ h(PW)}.

E The authentication server checks the received ID andpassword and generates a single-use 𝑅 value for thecorresponding user.

F Theauthentication server sends the generated𝑅 valueto the operation PC.

G The operation PC encrypts the corresponding portnumber of IP information of CCTV for the SN valueand 𝑅 value received from the authentication servertogether with the public key of the user and sends itto the user.Send {EUserPu(𝑅 ‖CCTV IP ‖P Num)}.

H The user decrypts the received data with the personalkey of the user to access CCTV. The user connectsthe data where SN of CCTV is encrypted with thepublic key of CCTV to the data where the user ID,


CCTVUser

Transaction {DVMSPri (ID ‖PW ‖R)}

Verify and create random number R

Verify ID, h(PW) and R

Send {ID ‖h(PW)}Response {EVMSPu (ID ‖PW ‖h(SN))}

serverOperation PCAuthentication VMS

Request service

Request user data

Send {ECCTVPu ((SN), EVMSPu (ID ‖PW ‖R))}

Random number R

Response authenticationSend {ECCTVPu (Authentication_data)}

Send {EUserPu (R ‖CCTV_IP)}

Send {EVMSPu (ID ‖PW ‖R)}

Send {ID ‖h(PW) and R}

①

⑩

②

③④

⑤

⑨

⑭

⑦

⑬

⑫

⑪

⑥

⑧

Figure 8: Proposed user authentication protocol.

password, and random number (𝑅) are encryptedwith the public key of VMS and sends it to CCTV.Send {ECCTVPu

(SN) ‖EVMSPu(ID ‖ PW ‖ 𝑅)}.0 CCTV decrypts the received data with the personal

key of CCTV, and if the SN value matches that ofthe CCTV itself, it sends the data encrypted with thepublic key of VMS to VMS.Send {EVMSPu(ID ‖ PW ‖ 𝑅)}.

1 VMS operation PC decrypts the received data withthe personal key of VMS and extracts ID, password,and 𝑅 value.Transaction {DVMSPri (ID ‖ PW ‖ 𝑅)}.

2 The operation PC transfers the hash value and ran-dom number 𝑅 to the authentication server in orderto prevent exposure of ID and password.Send {ID ‖ h(PW) ‖ 𝑅}.

3 Theauthentication server verifies that the received ID,password, and 𝑅 value are the same as those providedby VMS.Verify ID, h(PW), and 𝑅.

4 Send user authentication message to the operationPC.

5 Operation PC encrypts the user authentication mes-sage with the public key of CCTV and sends it toCCTV.

Send {ECCTVPu(Authentication data)}.

5. Implementation andPerformance Evaluation

Figure 9 shows theVMSClient access of the proposed system.It shows the insertion of SN value and𝑅 value attributed fromthe server and the port number, and the server IP is alsoshowing.

The proposed user authentication protocol is used toauthenticate the SN acquired by the user when registeringthe user. In the authentication process, checking SN andcomparing information such as 𝑅 value, ID, and password ofthe corresponding session render it safe from many threats,and by using the PKI-based encryption mechanism, dataconfidentiality is guaranteed, and by applying hash algorithmto user’s personal information, the personal information isalso guaranteed integrity.

Figure 10 shows the photo before and after the insertionof steganography. Through this Figure, it can be shown thatthere is no visual difference in the video despite the insertion


Figure 9: VMS Client implementation.

(a) (b)

Figure 10: Before (a) and after (b) the insertion of steganography.

0 1 2 3 4 5−1−2−3−4−5

0

−100

−60

−80

−40

−20

Nor

mal

ized

mag

nitu

de (d

B)

Frequency (MHz)

(a)

0

0

1 2 3 4 5−1−2−3−4−5−100

−60

−80

−40

−20

Nor

mal

ized

mag

nitu

de (d

B)

Frequency (MHz)

(b)

Figure 11: Comparison of frequency before (a) and after (b) the insertion of steganography.

of steganography, and through Figure 11, it is shown that theincrease of complexity in data leads to the increase in thestrength of encryption.

The safety of the existing network CCTV system environ-ment and the proposed system is as in Table 3.

6. Conclusion and Future Research

In this report, the image checking technique through steg-anography for security of image transfer process and userauthentication protocol to block malicious users in network


Table 3: Comparative analysis of safety.

Noauthentication

Existingsystem

Proposedsystem

Password speculationattack Weak Weak Safe

User impersonationattack Weak Weak Safe

Replay attack Weak Weak SafeOmnidirectional safety Weak Weak SafeWebsite hacking Weak Weak SafeInput contentsfalsification, keyboardhacking

Weak Weak Safe

CCTV environment was proposed. In future, it would benecessary to continue to complement weakness for greatersafety against attacks of malicious users and search for amoreefficient algorithm and authentication method.

Conflict of Interests

The authors declare that there is no conflict of interestsregarding the publication of this paper.

References

[1] S. Kim, A Study aboutWays to Improve Crime Prevention Effectsof Crime Prevention CCTV, Dongguk University, 2007.

[2] H. No, Effective Use of CCTV for Crime Prevention, KoreanAssociation of Public Safety and Criminal Justice, 2004.

[3] E. E. Zelniker, “Global abnormal behaviour detection using anetwork of CCTV cameras,” in Proceedings of the 8th Inter-national Workshop on Visual Surveillance, Marseille, France,October 2008.

[4] S. Baek, Design and Implementation of a Video SurveillanceSystem in a Wired/Wireless Network Environment, DankookUniversity, Yongin, Republic of Korea, 2006.

[5] C. Im, A Study on the Problems with the Use of CCTV for CrimePrevention and Ways for Improvement, Yonsei University, 2007.

[6] Y. Shin, “A study on the protection of personal informationfollowing the introduction of CCTV at public institutions,”Journal of Korean Association for Regional Information Society,vol. 11, no. 2, pp. 1–21, 2008.

[7] I. Minhyeok, “The direction of crime prevention policiesthrough analysis of the crime prevention effects of crimeprevention CCTV,” Korean Political Science Association, vol. 12,no. 4, pp. 77–101, 2008.

[8] S. Go, “A study on human rights infringement and likelihoodof risks when CCTV video images are stored long termindiscriminately,” Internet Law, vol. 27, pp. 49–72, 2005.

[9] Y. Kim,TheCurrent State of Development of IP Cameras, StorageSolutions and Video Analysis, Korea Educational Center ofFuture Technology, 2011.

[10] M. Lee, “The current state of CCTV regulations and its impli-cations,” Korea Association for Telecommunications Policies, vol.18, no. 12, 2006.

[11] Y. Jo, “Efficient construction of an integrated control envi-ronment using an existing disaster briefing room,” RegionalInformation, 2009.

[12] Korea Educational Center of Future Technology, Business Out-look for Implementation Strategies of Next-Generation VideoSurveillance and Intelligent Integrated Security Control Systems,Korea Educational Center of Future Technology, 2011.

[13] I.-S. Lee and W. S. Yi, “Security requirements for networkCCTV,” World Academy of Science, Engineering & Technology,vol. 70, no. 47, p. 184, 2010.

[14] A. J. Lipton, C. H. Heartwell, N. Haering, and D. Madden,“Automated video protection, monitoring & detection,” IEEEAerospace and Electronic Systems Magazine, vol. 18, no. 5, pp.3–18, 2003.

[15] L. Li, W. Huang, I. Y.-H. Gu, R. Luo, and Q. Tian, “An effi-cient sequential approach to tracking multiple objects throughcrowds for real-time intelligent CCTV systems,” IEEE Transac-tions on Systems, Man, and Cybernetics, Part B: Cybernetics, vol.38, no. 5, pp. 1254–1269, 2008.

[16] N. Buch, S. A. Velastin, and J. Orwell, “A review of computervision techniques for the analysis of urban traffic,” IEEE Trans-actions on Intelligent Transportation Systems, vol. 12, no. 3, pp.920–939, 2011.

[17] T. D. Raty, “Survey on contemporary remote surveillancesystems for public safety,” IEEE Transactions on Systems, Manand Cybernetics Part C: Applications and Reviews, vol. 40, no. 5,pp. 493–515, 2010.

[18] KISA, Global Information Security Industry Trend SurveyResearch, Korea Internet Security Agency, 2013.

[19] KOTRA, International Business Product Information, MarketTrends, 2013, http://tradedoctor.kotra.or.kr/.

[20] T. Seo, S. Lee, B. Bae, E. Yoon, and C. Kim, “An analysisof vulnerabilities and performance on the CCTV securitymonitoring and control,” Journal of Korea Multimedia Society,vol. 15, no. 1, pp. 93–100, 2012.

[21] T. Seo, “A study on vulnerabilities of monitoring and controlsystem based on IT convergence technology,” in Proceedingsof the 6th International Conference on Multimedia InformationTechnology and Applications, 2010.

[22] TrendMicro, Blurring Boundaries: Trend Micro Security Predic-tions for 2014 and Beyond, Trend Micro, 2013.

International Journal of

AerospaceEngineeringHindawi Publishing Corporationhttp://www.hindawi.com Volume 2014

RoboticsJournal of

Hindawi Publishing Corporationhttp://www.hindawi.com Volume 2014


Active and Passive Electronic Components

Control Scienceand Engineering

Journal of



RotatingMachinery


Hindawi Publishing Corporation http://www.hindawi.com

Journal ofEngineeringVolume 2014

Submit your manuscripts athttp://www.hindawi.com

VLSI Design



Shock and Vibration


Civil EngineeringAdvances in

Acoustics and VibrationAdvances in



Electrical and Computer Engineering

Journal of

Advances inOptoElectronics

Hindawi Publishing Corporation http://www.hindawi.com

Volume 2014

The Scientific World JournalHindawi Publishing Corporation http://www.hindawi.com Volume 2014

SensorsJournal of


Modelling & Simulation in EngineeringHindawi Publishing Corporation http://www.hindawi.com Volume 2014


Chemical EngineeringInternational Journal of Antennas and

Propagation




Navigation and Observation



DistributedSensor Networks


Documents

Research Article Study on Strengthening Plan of Safety Network …downloads.hindawi.com/journals/am/2015/960416.pdf · 2019-07-31 · Research Article Study on Strengthening Plan