Short video active defense encryption system based on device fingerprint and dynamic confusion field

Abstract

The invention relates to the technical field of short video encryption, and discloses a short video active defense encryption system based on a device fingerprint and a dynamic confusion field, and the key point of the technical scheme is that the system comprises a device fingerprint generation module, a mother video encryption module, a slice encryption module, a behavior recognition and defense module and an encryption logic update regulation and control module. The system generates a unique device fingerprint hash value through a multi-modal feature, generates a dynamic confusion field in combination with a chaotic system and a quantum random number, realizes differential encryption of a mother video and slices, and is embedded with zero-knowledge consanguinity proof to support traceability verification. The behavior recognition and defense module monitors user behaviors in real time and dynamically adjusts a confusion strategy or triggers an active defense mechanism, and the encryption logic updating regulation and control module optimizes the updating frequency according to playing data and reduces the batch crawling risk. According to the invention, the security and anti-attack capability of the short video content can be effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of short video encryption technology, and more specifically to a short video active defense encryption system based on device fingerprint and dynamic obfuscation field. Background Art

[0002] A device fingerprint refers to a device feature or unique identifier that can be used to uniquely identify a device. The device fingerprint system is responsible for collecting user device fingerprints. Device fingerprints encompass multiple dimensions of information. For example, on the Android system, the device fingerprint may include the brand of the user's phone, Android's IMEI, the operating system version, the network Wi-Fi identifier used, the memory capacity, the CPU name, and so on. Collecting this extensive information from user devices as device fingerprints serves as raw material for risk control strategy decisions. This can be used to determine whether a user is an anomaly, thereby preparing for subsequent risk control measures.

[0003] In the existing technology, short video anti-piracy technology mainly relies on static obfuscation encryption, digital watermarking and basic behavior monitoring. Static obfuscation encryption inserts fixed strings or redundant data into the video stream, but it is easy to be extracted and removed by reverse engineering tools; digital watermarking embeds hidden logos in the video or audio, but the watermark is easy to be destroyed and it is difficult to prevent the spread of content; basic behavior monitoring restricts access based on IP address or request frequency, but lacks effective recognition of legitimate requests forged by automated tools. In addition, the existing technology has some limitations: the obfuscation field generation rules are fixed, and attackers can crack the logic through repeated interception and analysis; the encryption scheme is not bound to the characteristics of the terminal device, resulting in the spread of pirated content across devices; relying solely on encryption and post-event tracing, it is difficult to intercept automated copyright behavior in real time; at the same time, it lacks dynamic adaptability and cannot adjust the protection strategy according to the attack behavior, and the defense means are relatively simple. Summary of the Invention

[0004] In view of the shortcomings of the existing technology, the purpose of the present invention is to provide a short video active defense encryption system based on device fingerprint and dynamic obfuscation field, which is used to overcome the above-mentioned defects in the existing technology.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] A short video active defense encryption system based on device fingerprints and dynamic obfuscation fields is characterized by including a device fingerprint generation module, a mother video encryption module, a slice encryption module, a behavior recognition and defense module, and an encryption logic update control module. The device fingerprint generation module collects multimodal feature information from terminal devices and combines it with a deep neural network model to generate a unique and irreversible device fingerprint hash value. The mother video encryption module uses this device fingerprint hash value and the entropy source output by a quantum random number generator to generate a master key seed through a chaotic system and construct a dynamic obfuscation field to embed into the original video stream. The embedding position is determined by a pseudo-random function driven by the device fingerprint hash value. The slice encryption module decomposes the encrypted mother video into multiple slices, generates an independent lightweight obfuscation field for each slice, and injects a zero-knowledge lineage proof structure to support traceability verification. The behavior recognition and defense module monitors user playback behavior characteristics in real time and dynamically adjusts the obfuscation field injection strategy or triggers an active defense mechanism based on the risk level. The encryption logic update control module dynamically adjusts the update frequency of the encryption logic based on the playback data of each slice to reduce the risk of batch crawling.

[0007] The multimodal feature information collected by the device fingerprint generation module includes software features, hardware features and network features. Software features cover the operating system version number, kernel API response delay, browser rendering parameters and trusted execution environment support flag; hardware features include CPU cache hit rate curve, GPU floating-point operation error distribution, battery charge and discharge characteristic curve and acoustic sensor frequency response difference; network features include DNS resolution delay distribution, Wi-Fi channel interference noise spectrum, TCP handshake time sequence and NAT conversion mode characteristics.

[0008] The device fingerprint generation module is configured with a device fingerprint generation strategy, and the device fingerprint generation strategy includes

[0009] Acquiring the multimodal feature information,

[0010] Performing a discrimination evaluation on each of the multimodal feature information to obtain a corresponding feature discrimination score value, wherein the feature discrimination score value is used to represent the degree of difference between the corresponding multimodal feature information on different terminal devices;

[0011] Normalizing the preset adjustment parameters to obtain weight parameters for each multimodal feature information. The adjustment parameters represent the degree of influence of each feature discrimination score on the weight distribution result. The multimodal feature information with a higher feature discrimination score has a lower weight parameter.

[0012] The integration outputs the device fingerprint hash value.

[0013] The above feature information is dynamically weighted and aggregated through the federated learning framework to generate an irreversible and unique device fingerprint hash value. This module uses the adaptive weight distribution formula:

[0014]

[0015] Among them D i represents the discrimination score of the i-th feature, α is a tuning parameter used to control the sensitivity of weight distribution, and n is the total number of features. The resulting device fingerprint hash value is highly robust and resistant to forgery.

[0016] The mother video encryption module (2) is configured with a dynamic obfuscation field generation strategy, including

[0017] Get the device fingerprint hash value,

[0018] The device fingerprint hash value is combined with a preset chaos model to generate a basic sequence with dynamic change characteristics, wherein the chaos model is used to ensure the irregularity of the generated sequence.

[0019] A feature data segment is extracted from the basic sequence as the dynamic obfuscation field.

[0020] The dynamic obfuscation field generated by the mother video encryption module comes from the improved Logistic chaotic system, and its core iterative formula is:

[0021] x n+1 =r·x n ·(1-x n )+β·H, where x n is the current chaotic state value, r is the chaotic system parameter, β is the adjustment factor, and H is the numerical mapping of the device fingerprint hash value. This formula combines the device fingerprint hash value with the entropy source output by the quantum random number generator to generate an obfuscation field in the form of a variable-length binary string, with a field unit length ranging from 50ms to 200ms. The injection position of the obfuscation field is determined by the pseudorandom function $f(H,t)$, where $t$ is a timestamp variable, ensuring that the encrypted content generated for the same video on different devices is completely different.

[0022] The slice encryption module generates a lightweight obfuscation field for each video slice, which is no longer than 5% of the original slice data and embeds a zero-knowledge lineage proof structure generated based on the zk-SNARK protocol. This structure includes the encryption key derivation link, device fingerprint hash value, slice index, and timestamp information, supporting the verification of slice source relationships without revealing the original key. The slice encryption process uses a layered encryption algorithm:

[0023]

[0024] Where C is the encrypted slice data, E(K,P) indicates that the original slice data P is encrypted using the master key seed K, and F(H,I) is the output result of the pseudo-random function based on the device fingerprint hash value H and the slice index I, ensuring that the encryption logic of each slice is independent and unpredictable.

[0025] The Behavior Identification and Defense Module consists of a behavior identification submodule, a risk assessment submodule, and a dynamic defense submodule. The behavior identification submodule collects data such as mouse trajectory, click frequency, window switching behavior, and CPU usage changes during playback, and assesses the risk level of user behavior using a support vector machine classification model. The risk assessment submodule matches pre-set security policies based on behavioral characteristics, while the dynamic defense submodule adjusts the obfuscation field injection strategy based on the risk level: for low-risk behavior, the obfuscation field length is shortened to 40% of the default value; for medium-risk behavior, fake keyframes are inserted as decoy content; for high-risk behavior, logic bomb code is activated, triggering abnormal player termination.

[0026] The encryption logic update control module dynamically adjusts the update frequency of the encryption logic based on the playback volume of each segment. Specifically, it uses the exponentially weighted moving average algorithm to calculate the update priority score:

[0027] S t =λ·V t +(1-λ)·S t-1 , where S t-1 Score the current update priority, V t is the number of views of the current segment, and λ is a smoothing coefficient, ranging from 0 to 1. When the score is higher than the preset threshold, the encryption logic update cycle is delayed for at least 24 hours; when the score is lower than the threshold, the update operation is triggered first to reduce the risk of being crawled in batches.

[0028] The system also includes a playback behavior collection submodule that records user playback behavior data, including playback start and end time, cumulative viewing times, concurrent playback volume, and average playback duration. These data are used to generate encryption update priority scores through a multidimensional clustering algorithm to drive the scheduling and update strategy of the slice encryption logic. Dynamic position function T n (f0) is used to determine the injection position of the obfuscated field, and its iterative formula is:

[0029] T n (f0)=f0+γ·H·I n

[0030] Among them, T n (f0) represents the position value after the nth iteration, f0 is the initial position, γ is the adjustment factor, and I is the slice index, which ensures that each encrypted content has a differentiated position structure in different devices or playback rounds.

[0031] The extended binding mechanism of the zero-knowledge proof-of-lineage structure binds the device fingerprint hash value, slice index, timestamp, and video unique identifier during the generation process, in addition to the encryption key derivation link, to support judicial-grade traceability verification. The loading path verification mechanism verifies that the video player's loading order, caching strategy, and playback control behavior of slices comply with preset policies. When abnormal behavior is detected, it triggers defensive measures such as slice freezing or encryption policy reset. The attack behavior feedback optimization module aggregates abnormal behavior records uploaded by the user end and reversely updates the weight parameters and obfuscation strategy strength in the federated learning model, realizing the system's self-learning defense capabilities against new attack paths. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 : Schematic diagram of the structure of the device fingerprint generation module.

[0033] Figure 2 : Workflow diagram of the mother video encryption module.

[0034] Figure 3 : Schematic diagram of the layered encryption algorithm of the slice encryption module.

[0035] Figure 4 : Functional block diagram of the behavior recognition and defense module. DETAILED DESCRIPTION

[0036] The present invention provides a short video active defense encryption system based on device fingerprint and dynamic obfuscation field, and its specific implementation method is described in conjunction with the accompanying drawings. Figures 1 to 4 A detailed description is given. The system includes a device fingerprint generation module, a mother video encryption module, a slice encryption module, a behavior recognition and defense module, and an encryption logic update control module. Each module works together to achieve efficient encryption and active defense of short video content. The device fingerprint generation module collects multimodal feature information of the terminal device and combines it with a deep neural network model to generate a unique and irreversible device fingerprint hash value; the mother video encryption module uses the device fingerprint hash value and the entropy source output by the quantum random number generator to generate a master key seed through a chaotic system, and constructs a dynamic obfuscation field to embed into the original video stream. The embedding position is determined by a pseudo-random function driven by the device fingerprint hash value; the slice encryption module decomposes the encrypted mother video into multiple slices, generates an independent lightweight obfuscation field for each slice, and injects a zero-knowledge lineage proof structure to support traceability verification; the behavior recognition and defense module monitors the user's playback behavior characteristics in real time, dynamically adjusts the obfuscation field injection strategy or triggers the active defense mechanism according to the risk level; the encryption logic update control module dynamically adjusts the update frequency of the encryption logic based on the playback data of each slice to reduce the risk of being crawled in batches.

[0037] First, the multimodal feature information of the terminal device is collected through the device fingerprint generation module. This information includes software features, hardware features, and network features. Software features include operating system version number, kernel API response delay, browser rendering parameters, and trusted execution environment support flags; hardware features include CPU cache hit rate curve, GPU floating point operation error distribution, battery charge and discharge characteristic curve, and acoustic sensor frequency response difference; network features include DNS resolution delay distribution, Wi-Fi channel interference noise spectrum, TCP handshake time sequence, and NAT conversion mode features. Figure 1 As shown in the figure, the collected multimodal feature information is dynamically weighted and aggregated through the federated learning framework, and the adaptive weight distribution formula is used.

[0038] Among them D i represents the discrimination score of the i-th feature, α is a tuning parameter used to control the sensitivity of weight distribution, and n is the total number of features. This formula generates an irreversible and unique device fingerprint hash value, ensuring that each terminal device is uniquely identified and highly robust and resistant to counterfeiting.

[0039] In the mother video encryption module, the device fingerprint hash value and the entropy source output by the quantum random number generator (QRNG) are used to generate the master key seed MasterSeed through the improved Logistic chaotic system, and a dynamic obfuscation field is constructed and embedded in the original video stream. The core iterative formula of the improved Logistic chaotic system is x n+1 =r·x n ·(1-x n )+β·H, where x n is the current chaotic state value, r is the chaotic system parameter, β is the adjustment factor, and H is the numerical mapping of the device fingerprint hash value. This formula combines the device fingerprint hash value with the entropy source output by the quantum random number generator to generate a variable-length binary string obfuscation field, with a field unit length ranging from 50ms to 200ms. Figure 2 As shown in Figure 1, the injection location of the dynamic obfuscation field is determined by a pseudorandom function F(H,I), where t is a timestamp variable. This ensures that the encrypted content generated for the same video on different devices is completely different. This process not only enhances the diversity of the encrypted content but also significantly increases the difficulty of cracking.

[0040] The slice encryption module decomposes the encrypted mother video into multiple slice segments, generates an independent lightweight obfuscation field for each slice segment and injects a zero-knowledge lineage proof structure to support traceability verification. The length of the lightweight obfuscation field does not exceed 5% of the original slice data, and is embedded in a zero-knowledge lineage proof structure generated based on the zk-SNARK protocol. This structure contains the encryption key derivation link, device fingerprint hash value, slice index and timestamp information, and supports verifying the source relationship of the slice without leaking the original key. Figure 3 As shown, the slice encryption process adopts a layered encryption algorithm

[0041] Where C is the encrypted slice data, E(K,P) indicates that the original slice data P is encrypted using the master key seed K, and F(H,I) is the output of a pseudo-random function based on the device fingerprint hash value H and the slice index I, ensuring that the encryption logic of each slice is independent and unpredictable. In addition, the dynamic position function

[0042] T n (f0)=f0+γ·H·I n ,

[0043] Among them, T n (f0) represents the position value after the nth iteration, f0 is the initial position, γ is the adjustment factor, and I is the slice index, which ensures that each encrypted content has a differentiated position structure in different devices or playback rounds.

[0044] The behavior recognition and defense module includes a behavior recognition submodule, a risk assessment submodule, and a dynamic defense submodule. It monitors the user's playback behavior characteristics in real time and dynamically adjusts the obfuscation field injection strategy or triggers the active defense mechanism according to the risk level. The behavior recognition submodule collects data such as mouse trajectory, click frequency, window switching behavior, and CPU usage changes during the user's playback process, and evaluates the user's behavior risk level through the support vector machine (SVM) classification model. Figure 4 As shown, the risk assessment submodule matches pre-set security policies based on behavioral characteristics, while the dynamic defense submodule adjusts the obfuscation field injection strategy based on risk level: for low-risk behavior, the obfuscation field length is shortened to 40% of the default value; for medium-risk behavior, fake keyframes are inserted as decoy content; for high-risk behavior, logic bomb code is activated, triggering abnormal player termination. The loading path verification mechanism verifies that the video player's slice loading order, caching strategy, and playback control behavior comply with pre-set policies. Detecting abnormal behavior triggers defense measures such as freezing slices or resetting encryption policies.

[0045] The encryption logic update control module dynamically adjusts the update frequency of the encryption logic according to the playback volume of each segment, and specifically uses the exponentially weighted moving average (EWMA) algorithm to calculate the update priority score. The update priority score formula is St =λ\V t +(1-λ)\S t-1 , where S t Score the current update priority, V t is the number of plays of the current slice, and λ is the smoothing coefficient, ranging from 0 to 1. When the score is higher than the preset threshold, the encryption logic update cycle is delayed by at least 24 hours; when the score is lower than the threshold, the update operation is triggered first to reduce the risk of being crawled in batches. The playback behavior collection submodule records user playback behavior data, including playback start and end time, cumulative number of views, concurrent playback volume, and average playback duration. This data is used to generate an encryption update priority score through a multidimensional clustering algorithm to drive the scheduling and update strategy of the slice encryption logic.

[0046] The attack behavior feedback optimization module aggregates abnormal behavior records uploaded by users and reversely updates the weight parameters and obfuscation strategy strength in the federated learning model, enabling the system's self-learning defense against new attack paths. The extended binding mechanism of the zero-knowledge lineage proof structure, in addition to the encryption key derivation link, also binds the device fingerprint hash value, slice index, timestamp, and video unique identifier during the generation process, supporting judicial-grade traceability verification. This design not only effectively prevents the dissemination of unauthorized content but also provides a complete chain of evidence to support legal prosecution when necessary. The loading path verification mechanism verifies that the video player's loading order, caching strategy, and playback control behavior comply with pre-set policies. Detecting abnormal behavior triggers defense measures such as freezing slices or resetting encryption policies. The attack behavior feedback optimization module aggregates abnormal behavior records uploaded by users and reversely updates the weight parameters and obfuscation strategy strength in the federated learning model, enabling the system's self-learning defense against new attack paths.

[0047] In summary, the present invention realizes the full life cycle protection of short video content through the coordinated operation of the device fingerprint generation module, the mother video encryption module, the slice encryption module, the behavior recognition and defense module, and the encryption logic update control module. From the generation of device fingerprints to the construction of dynamic obfuscation fields, to slice encryption and behavior monitoring, the entire system demonstrates excellent security and flexibility both in terms of technology and practical applications. It can be seen from the above specific implementation methods that the system can not only effectively deal with traditional attack methods, but also has strong adaptability and scalability, and can be widely used in various short video platforms and content distribution scenarios, providing strong protection for users and content creators.

[0048] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions based on the principles of the present invention are within the scope of protection of the present invention. It should be noted that improvements and modifications that do not depart from the principles of the present invention are within the scope of protection of the present invention.

Claims

1. A short video active defense encryption system based on device fingerprint and dynamic obfuscation field, characterized by: include The device fingerprint generation module collects multimodal feature information of the terminal device and generates a device fingerprint hash value. A mother video encryption module, which uses the device fingerprint hash value and the chaos model to generate a dynamic obfuscation field, and embeds the dynamic obfuscation field into the original video stream. The embedding position is determined by the dynamic position function driven by the device fingerprint hash value to form an encrypted mother video. The slice encryption module decomposes the encrypted mother video into multiple slice segments, generates an independent slice obfuscation field for each slice segment, and embeds it into the slice segment video stream to form an encrypted slice video. At the same time, it embeds an association certificate, which indicates the association relationship between the encrypted slice video and the encrypted mother video. Behavior recognition and defense module, which monitors user playback behavior characteristics in real time and dynamically adjusts the obfuscated field injection strategy or triggers active defense mechanisms based on risk levels. The encryption logic update control module dynamically adjusts the update frequency of the slice obfuscation field according to the playback data of each slice segment.

2. The short video active defense encryption system based on device fingerprint and dynamic obfuscation field according to claim 1 is characterized by: The multimodal feature information collected by the device fingerprint generation module includes software feature information, hardware feature information and network feature information. Based on the federated learning model, each multimodal information is aggregated according to the weight to obtain the device fingerprint hash value, wherein the software feature information includes the operating system version number, kernel API response delay, browser rendering parameters and trusted execution environment support flag; the hardware feature information includes the CPU cache hit rate curve, GPU floating-point operation error distribution, battery charge and discharge characteristic curve and acoustic sensor frequency response difference; the network feature information includes DNS resolution delay distribution, Wi-Fi channel interference noise spectrum, TCP handshake time sequence and NAT conversion mode characteristics.

3. The short video active defense encryption system based on device fingerprint and dynamic obfuscation field according to claim 2 is characterized by: The device fingerprint generation module is configured with a device fingerprint generation strategy, and the device fingerprint generation strategy includes Acquiring the multimodal feature information, Performing a discrimination evaluation on each of the multimodal feature information to obtain a corresponding feature discrimination score value, wherein the feature discrimination score value is used to represent the degree of difference between the corresponding multimodal feature information on different terminal devices; Normalizing the preset adjustment parameters to obtain weight parameters for each multimodal feature information. The adjustment parameters represent the degree of influence of each feature discrimination score on the weight distribution result. The multimodal feature information with a higher feature discrimination score has a lower weight parameter. The integration outputs the device fingerprint hash value.

4. The short video active defense encryption system based on device fingerprint and dynamic obfuscation field according to claim 1 is characterized by: The mother video encryption module is configured with a dynamic obfuscation field generation strategy, including Get the device fingerprint hash value, The device fingerprint hash value is combined with a preset chaos model to generate a basic sequence with dynamic change characteristics, wherein the chaos model is used to ensure the irregularity of the generated sequence. A feature data segment is extracted from the basic sequence as the dynamic obfuscation field.

5. The short video active defense encryption system based on device fingerprint and dynamic obfuscation field according to claim 1 is characterized by: The slice encryption module is configured with an associated proof embedding strategy, including Obtain an encryption key derivation link corresponding to the encrypted slice video, where the encryption key derivation link represents the derivation relationship between the slice encryption key and the mother video encryption key. Obtain the device fingerprint hash value, the slice index corresponding to the current slice segment, and the timestamp when the slice was generated, and generate a lineage proof structure, which is used to verify the association between the encrypted slice video and the encrypted mother video. Embed the proof-of-lineage structure into the segmented video stream.

6. The short video active defense encryption system based on device fingerprint and dynamic obfuscation field according to claim 5 is characterized by: When the slice encryption module uses a layered encryption algorithm to encrypt each slice segment, it first obtains the original slice data; then uses the core encryption information to encrypt the original slice data to obtain the first encrypted data; simultaneously, based on the device fingerprint hash value generated by the device fingerprint generation module and the slice index corresponding to the current slice segment, it generates unique random data corresponding to the slice segment through a pseudo-random function; then, it fuses the first encrypted data with the unique random data to obtain the encrypted slice data. Through this process, the encrypted slice data is simultaneously associated with the core encryption information, the device fingerprint hash value, and the slice index, achieving layered encryption protection for the slice segment.

7. The short video active defense encryption system based on device fingerprint and dynamic obfuscation field according to claim 1 is characterized by: The encryption logic update control module is used to dynamically adjust the update frequency of the slice obfuscation fields corresponding to each slice segment. Its control logic is as follows: the update frequency is determined based on the playback volume of each slice segment. The update frequency is set lower for slices with higher playback volume to reduce the risk of illegal crawling of the update logic due to frequent updates; the update frequency can be relatively increased for slices with lower playback volume. At the same time, the encryption logic update control module is linked to the dynamic obfuscation field adjustment mechanism of the mother video encryption module. When the mother video encryption module makes a fixed adjustment to the dynamic obfuscation field, the slice obfuscation field of each slice segment is updated synchronously with the adjustment to maintain the dynamic and relevant nature of the encryption logic.

8. The short video active defense encryption system based on device fingerprint and dynamic obfuscation field according to claim 1 is characterized by: The behavior recognition and defense module includes a behavior recognition submodule, a risk assessment submodule and a dynamic defense submodule. The behavior recognition submodule collects data such as mouse trajectory, click frequency, window switching behavior and CPU occupancy change during user playback and evaluates the user behavior risk level through a support vector machine classification model.

9. The short video active defense encryption system based on device fingerprint and dynamic obfuscation field according to claim 7 is characterized by: The dynamic defense submodule adjusts the obfuscation field injection strategy according to the risk level, shortens the obfuscation field length to 40% of the default value under low-risk behavior, inserts fake key frames as bait content under medium-risk behavior, and activates logic bomb code to trigger abnormal player termination under high-risk behavior.

10. The short video active defense encryption system based on device fingerprint and dynamic obfuscation field according to claim 1 is characterized by: The zero-knowledge lineage proof structure extended binding mechanism is bound to the device fingerprint hash value, slice index, timestamp and video unique identifier in addition to the encryption key derivation link during the generation process.

Images