A criminal investigation evidence preservation, modification, upgrade storage system

Abstract

The present application belongs to the field of material evidence management and data security technology, and discloses a material evidence storage, modification, upgrading and storage system for criminal investigation, which comprises a material evidence input module, a hash chain construction module, a material evidence modification module, a material evidence upgrading module, an integrity verification module, a permission management module and a storage medium. Through dynamic salt value generation and hash chain structure, each operation of the material evidence is linked to an unalterable node sequence, realizing full-process traceability and tamper resistance. Combined with digital signature and regular integrity verification, data tampering is automatically detected and an alarm is given. At the same time, based on digital signature verification, identity and permission strategy table control access, and hash chain protection of operation logs, fine access control and security audit are realized, solving the technical problems of traditional hash algorithm vulnerability, operation history loss, tampering difficulty and extensive permission management.

Description

Technical Field

[0001] This invention belongs to the field of physical evidence management and data security technology, and in particular relates to a storage system for preserving, modifying, and upgrading physical evidence used in criminal investigation. Background Technology

[0002] Physical evidence serves as crucial evidence in criminal investigations, and the security and traceability of its preservation, modification, and upgrading processes directly impact the accuracy of case characterization. With the diversification of physical evidence types (such as electronic evidence, biological evidence, and video evidence), higher demands are placed on physical evidence storage systems. Traditional physical evidence management systems primarily rely on database records and file storage, and suffer from the following technical issues requiring improvement: First, hash algorithms are limited in application and lack the ability to trace operational history. Existing systems typically calculate a hash value only once when physical evidence is stored for integrity verification, but cannot record the history of subsequent modifications, upgrades, or other operations. When physical evidence is altered, the relationship between the old and new versions is lost, making it impossible to form a complete operational chain. This makes it difficult to trace the evolution of physical evidence, and a single hash value is vulnerable to rainbow table attacks, resulting in insufficient security.

[0003] Second, access control is lax, and operation logs are easily tampered with. Traditional systems often use simple username and password authentication, lacking fine-grained access control levels. Different levels of security evidence (Top Secret, Confidential, Secret, Internal) cannot receive differentiated access control. Furthermore, operation logs are stored in ordinary database records, lacking cryptographic protection. Internal personnel can easily tamper with or delete logs, making it difficult to trace violations and detect tampering of evidence data in a timely manner. Summary of the Invention

[0004] To address the above issues and overcome the shortcomings of existing technologies, this invention provides a storage system for the preservation, modification, and upgrading of physical evidence used in criminal investigations. Through dynamic salt value generation and a hash chain structure, each operation on the physical evidence is linked into an immutable sequence of nodes, achieving full-process traceability and tamper-proofing. Combined with digital signatures and periodic integrity checks, it automatically detects data tampering and issues alarms. Simultaneously, it verifies identity based on digital signatures and controls access through a permission policy table, while protecting operation logs with a hash chain, achieving refined access control and security auditing. This solves the technical problems of traditional hash algorithms being vulnerable to attacks, lacking operation history, being difficult to detect tampering, and having inefficient permission management.

[0005] The technical solution adopted in this invention is as follows: a storage system for preserving, modifying, and upgrading physical evidence for criminal investigation, comprising a physical evidence input module, a hash chain construction module, a physical evidence modification module, a physical evidence upgrade module, an integrity verification module, an access control module, and a storage medium; The physical evidence entry module acquires the original data and metadata of the physical evidence, extracts the feature values ​​of the physical evidence, and calculates the original hash value using the SHA-256 hash algorithm combined with dynamic salt value, outputs the physical evidence ID and the original hash value, and sends the physical evidence ID and the original hash value to the hash chain construction module. The hash chain construction module receives the physical evidence ID and the original hash value, reads the current timestamp from the system clock, obtains the current operator's identity from the permission management module, and reads the previous hash value from the storage medium (if there is no previous node, the previous hash value is set to a constant of all zeros). After concatenating the above information, it calculates the hash value of the current node using the SHA-256 algorithm, adds the operator's digital signature, constructs the first node of the hash chain, and outputs the initial record of the hash chain; then, it sends the initial record of the hash chain to the storage medium. The evidence modification module receives the evidence modification request, verifies the modifier's permissions, reads the latest hash chain node of the evidence from the storage medium to obtain the previous hash value, calculates the modification hash value for the modified evidence data and metadata, then calls the hash chain construction module to generate a new hash chain node, outputs the modification record and the updated hash chain; and then sends the modification record to the storage medium. The evidence upgrade module receives the evidence upgrade request, verifies the upgrader's authority, reads the latest hash chain node of the evidence from the storage medium to obtain the previous hash value, calculates the upgrade hash value for the upgraded evidence data and metadata, extracts the upgrade feature value, then calls the hash chain construction module to generate a new hash chain node, outputs the upgrade record and the updated hash chain; and then sends the upgrade record to the storage medium. The integrity verification module periodically reads physical evidence data and the complete hash chain from the storage medium, recalculates the hash value node by node, verifies the digital signature and chain continuity, detects anomalies such as hash tampering, invalid signature or chain breakage, and outputs an integrity verification report; then the integrity verification report is sent to the access control module. The permission management module receives the integrity verification report and the user's access request. It verifies the validity of the user's digital signature and determines whether the user has the operation permission according to the preset permission policy table. It outputs the result of verification pass or access denied and generates an operation log. Then, it sends the operation log to the storage medium. The storage medium receives and stores the initial hash chain record from the hash chain construction module, the modification record from the evidence modification module, the upgrade record from the evidence upgrade module, the operation log from the permission management module, as well as the original evidence data, the modified data, the upgraded data, and the integrity verification report.

[0006] As a preferred technical solution of this scheme, the dynamic salt value is obtained by concatenating the timestamp of the evidence extraction time, the identity of the extractor, and the case number, and then hashing them again.

[0007] As a preferred technical solution of this scheme, the hash value of the hash chain node is calculated by concatenating the physical evidence ID, the original hash value, the timestamp, the operator's identity identifier, the previous hash value and the operation type, and then calculating it using the SHA-256 algorithm.

[0008] As a preferred technical solution of this scheme, the modified hash value is calculated by concatenating the modified physical evidence data, the modified metadata, the dynamic salt value generated at the time of modification, and the previous hash value, and then calculating it using the SHA-256 algorithm.

[0009] As a preferred technical solution of this scheme, the permission management module adopts an identity verification mechanism based on digital signature and sets differentiated operation permissions for physical evidence of different security levels.

[0010] The beneficial effects of the present invention after adopting the above structure are as follows: (1) This invention uses a dynamic salt value generation algorithm to generate different hash values ​​for the same physical evidence at different times, by different operators, and in different cases. Combined with a hash chain structure, each operation (entry, modification, upgrade) is linked into an immutable node sequence, which solves the technical problems of traditional hash algorithms being easily attacked by rainbow tables and unable to record operation history. This invention achieves full-process traceability and anti-tampering of physical evidence operations.

[0011] (2) This invention binds digital signatures to hash chain nodes, making the identity and operation content of each operator undeniable. Combined with the integrity verification module, it periodically recalculates hashes, verifies signatures and chain continuity, solving the technical problem that it is difficult to detect when physical evidence data is tampered with, and realizing automated verification of physical evidence integrity and abnormal alarm.

[0012] (3) This invention verifies user identity based on digital signature and controls access according to permission policy table through permission management module, combined with hash chain protection of operation log, solves the technical problems of crude permission management and easy log tampering in traditional physical evidence system, and realizes refined access control and security audit. Attached Figure Description

[0013] The accompanying drawings are provided to further understand the present invention and form part of the specification. They are used together with the embodiments of the present invention to explain the invention and do not constitute a limitation thereof.

[0014] Figure 1 This is a flowchart of the physical evidence entry and hash chain construction process of the criminal investigation physical evidence preservation, modification, and upgrade storage system proposed in this invention. Figure 2 This is a flowchart of the evidence modification and hash chain update process of the criminal investigation evidence preservation, modification, and upgrade storage system proposed in this invention. Detailed Implementation

[0015] Example 1, see Figures 1-2 This invention provides a system for preserving, modifying, and upgrading physical evidence used in criminal investigations, comprising an evidence entry module, a hash chain construction module, an evidence modification module, an evidence upgrade module, an integrity verification module, an access control module, and a storage medium, and performs data transmission and processing in the following order: The physical evidence entry module acquires the original data and metadata of the physical evidence, extracts the feature values ​​of the physical evidence, and calculates the original hash value using the SHA-256 hash algorithm combined with dynamic salt value, outputting the physical evidence ID and the original hash value; then the physical evidence ID and the original hash value are sent to the hash chain construction module. The hash chain construction module receives the physical evidence ID and the original hash value, reads the current timestamp from the system clock, obtains the current operator's identity from the permission management module, and reads the previous hash value from the storage medium (if there is no previous node, the previous hash value is set to a constant of all zeros). After concatenating the above information, it calculates the hash value of the current node using the SHA-256 algorithm, adds the operator's digital signature, constructs the first node of the hash chain, and outputs the initial record of the hash chain; then, it sends the initial record of the hash chain to the storage medium. The evidence modification module receives an evidence modification request (including evidence ID, modifier's identity, modification timestamp, and modified evidence data). After verifying the modifier's permissions, it reads the latest hash chain node of the evidence from the storage medium to obtain the previous hash value, calculates the modification hash value for the modified evidence data and metadata, and then calls the hash chain construction module to generate a new hash chain node (operation type "modification"). It outputs the modification record and the updated hash chain, and then sends the modification record to the storage medium. The evidence upgrade module receives an evidence upgrade request (including evidence ID, upgrader's identity identifier, upgrade timestamp, and upgraded evidence data). After verifying the upgrader's permissions, it reads the latest hash chain node of the evidence from the storage medium to obtain the previous hash value, calculates the upgrade hash value from the upgraded evidence data and metadata, extracts the upgrade feature value, and then calls the hash chain construction module to generate a new hash chain node (operation type "upgrade"), outputs the upgrade record and the updated hash chain, and then sends the upgrade record to the storage medium. The integrity verification module periodically reads physical evidence data and the complete hash chain from the storage medium, recalculates the hash value node by node, verifies the digital signature and chain continuity, detects anomalies such as hash tampering, invalid signature or chain breakage, and outputs an integrity verification report; then the integrity verification report is sent to the access control module. The permission management module receives the integrity verification report and the user's access request (including the user's digital signature, request timestamp, physical evidence ID, and request operation type), verifies the validity of the user's digital signature, determines whether the user has operation permissions based on the preset permission policy table, outputs the result of verification pass or access denied, and generates an operation log; then the operation log is sent to the storage medium. The storage medium receives and stores the initial hash chain record from the hash chain construction module, the modification record from the physical evidence modification module, the upgrade record from the physical evidence upgrade module, the operation log from the permission management module, as well as the original physical evidence data, the modified data, the upgraded data, and the integrity verification report, forming a traceable and tamper-proof physical evidence storage data system.

[0016] Example 2, based on the above examples, involves the evidence entry module acquiring the original data and metadata of the evidence, extracting the feature values ​​of the evidence, and calculating the original hash value using the SHA-256 hash algorithm combined with a dynamic salt value. Specifically, this includes: Obtain the original data of the physical evidence, including physical evidence image files, physical evidence description text, physical evidence 3D scan data, and physical evidence biometric data; obtain the metadata of the physical evidence, including physical evidence number, extraction time, extraction location, name of the extractor, and case number.

[0017] The physical evidence entry module first generates a dynamic salt value, which is obtained by concatenating the timestamp of the physical evidence extraction time, the identity identifier of the extractor, and the case number, and then hashing them again. It is represented as follows: in, This is the system timestamp of the time when the physical evidence was extracted. In order to extract human identification, Assign a case number, This represents a string concatenation operation. This dynamic salt value allows the same piece of evidence to generate different hash values ​​at different times, by different operators, and in different cases, thus enhancing its resistance to rainbow table attacks.

[0018] Then, the original data, metadata, and salt value are concatenated and hashed to output a 256-bit original hash value. The evidence entry module outputs the evidence ID and the original hash value, and sends the evidence ID and the original hash value to the hash chain construction module.

[0019] Example 3, based on the above examples, involves a hash chain construction module that receives the evidence ID and the original hash value, and combines them with the timestamp, operator identification, and the previous hash value to construct the head node of the evidence's hash chain. Specifically, this includes: For newly entered evidence (without a previous hash value), the hash chain construction module sets the previous hash value to an all-zero constant, constructs the hash input string for the current node, concatenates the evidence ID, original hash value, timestamp, operator identification, previous hash value, and operation type, and then uses the SHA-256 algorithm to calculate the hash value of the current node, represented as: in, As a unique identifier for physical evidence, This is the original hash value output in Example 2. The time when the operation occurred. For operator identification, It is the hash value of the previous node (the first node is a constant of all zeros). For the operation type (entry, modification, or upgrade), this formula binds all operation-related information into a whole, and any tampering with historical node data will cause the hash values ​​of all subsequent nodes to be inconsistent.

[0020] The hash chain construction module also attaches the operator's digital signature, forms a hash chain node record, outputs the initial hash chain record, and sends the initial hash chain record to the storage medium.

[0021] Example 4, based on the above examples, involves the evidence modification module receiving an evidence modification request, obtaining the modified evidence data, calculating the modification hash value, and calling the hash chain construction module to generate a new hash chain node. Specifically, this includes: The evidence modification module receives modification requests, which include the evidence ID, the modifier's identity identifier, the modification timestamp, and the modified evidence data. The module first verifies whether the modifier has sufficient authorization; if authorization is insufficient, the modification is rejected and an exception is logged.

[0022] After successful verification, the evidence modification module reads the latest hash chain node of the evidence from the storage medium to obtain the latest previous hash value. Then, the evidence modification module calculates the modified hash value for the modified evidence data and metadata using the following formula: in, The revised physical evidence data, This is the modified metadata (including the reason for modification and the modification time). The dynamic salt value generated at the time of modification is obtained by hashing the modified timestamp, the ID of the person who modified the modification, and the ID of the physical evidence. To modify the hash value of the latest hash chain node, this formula binds the modified data to the previous node, ensuring that the modification operation is linked to the original hash chain.

[0023] The physical evidence modification module calls the hash chain construction module, inputs the modified hash value and the operation type "modify", generates a new hash chain node, outputs the modification record and the updated hash chain, and sends the modification record to the storage medium.

[0024] Example 5, based on the above examples, involves the evidence upgrade module receiving an evidence upgrade request, obtaining the upgraded evidence data, extracting upgrade feature values, calculating the upgrade hash value, and calling the hash chain construction module to generate an upgrade node. Specifically, this includes: The evidence upgrade module receives an upgrade request, which includes the evidence ID, the upgrader's identity, the upgrade timestamp, and the upgraded evidence data. The difference between upgrade and modification is that upgrade refers to the complete replacement of evidence with a higher-quality version due to technological advancements or standard updates (e.g., upgrading from standard definition to high definition), while modification refers to the correction of partial information on existing evidence.

[0025] The evidence upgrade module first verifies whether the upgrader has upgrade authority. Upon successful verification, it reads the latest hash chain node of the evidence from the storage medium to obtain the previous hash value. The evidence upgrade module performs hash calculations on the upgraded evidence data and metadata, and simultaneously extracts upgrade feature values, including the resolution change before and after the upgrade, format conversion identifier, and version number.

[0026] The evidence upgrade module calls the hash chain construction module, with the following input parameters: evidence ID, upgrade hash value, upgrade timestamp, upgrader's identity identifier, previous hash value, and operation type (value is "upgrade"). The module also appends and stores the upgrade feature value in the node record. The hash chain construction module generates a new hash chain node and returns it to the evidence upgrade module.

[0027] The evidence upgrade module outputs an upgrade record and an updated hash chain. The upgrade record includes the version number before upgrade, the version number after upgrade, the upgrade feature value, the upgrader, and the upgrade time. The evidence upgrade module then sends the upgrade record to a storage medium.

[0028] Example 6, based on the above examples, involves an integrity verification module that periodically verifies the physical evidence data and hash chain in the storage medium to check whether the hash value of each node is continuous and consistent with the previous node. Specifically, this includes: The integrity verification module starts the verification task according to a preset verification cycle (e.g., 2:00 AM daily). For each piece of evidence in the storage medium, the integrity verification module performs the following steps: The first step is to read the complete hash chain of the evidence and traverse it node by node, starting from the first node. For each node, the verification module recalculates the hash input string of that node (using the timestamp, operator ID, previous hash value, operation type, and corresponding version of the evidence data recorded in the node), and calculates the recalculated hash value using the SHA-256 algorithm.

[0029] The second step is to compare the recalculated hash value with the current node hash value stored in the node. If they do not match, the node is marked as "hash tampered".

[0030] The third step is to verify the validity of the node signature. The operator's public key recorded in the node is used to verify the current node's hash value and signature. If the verification fails, it is marked as "invalid signature".

[0031] The fourth step is to verify whether the previous hash value of the current node is equal to the current hash value of the previous node. If they are not equal, it is marked as "chain broken".

[0032] The fifth step is to further verify whether the differences in physical evidence data before and after the modification are consistent with the difference description in the record for the modified and upgraded nodes. If they are inconsistent, they are marked as "data inconsistency".

[0033] After traversing all nodes, the integrity verification module summarizes all anomaly markers and generates an integrity verification report. This report includes the evidence ID, verification time, verification result (normal / abnormal), a list of abnormal nodes, and the anomaly type. The integrity verification module then sends the integrity verification report to the access control module and triggers an anomaly alarm.

[0034] Example 7: Based on the above examples, the access control module receives user access requests, verifies user identity and operation permissions, and outputs a result indicating successful or denied access. Specifically, this includes: The access control module pre-stores a user identity database and an access control policy table. The user identity database records the user's ID, name, job title, digital certificate, and public key; the access control policy table defines the authorization for different job titles to different levels of physical evidence security (Top Secret, Confidential, Secret, Internal) and different operation types (view, modify, upgrade, delete).

[0035] The access management module receives user access requests, which include the user's digital signature, request timestamp, physical evidence ID, and the requested operation type. The access management module first verifies the validity of the user's digital signature by decrypting it using the user's public key and comparing the request content with the original signature. If they do not match, access is denied.

[0036] After successful verification, the access control module queries the security classification label of the evidence (automatically determined or manually labeled based on the nature of the case during evidence entry) and checks the access control policy table according to the user's job title to determine whether the user has the permission to perform the requested operation type for the security classification evidence. If the user has permission, the module outputs a successful verification result and records the operation log; if the user does not have permission, the module outputs an access denied result and records the unauthorized access attempt log.

[0037] The access control module also writes all operation logs (including login, viewing, modification, upgrade, deletion, and verification) to the operation log area of ​​the storage medium in real time. The log records include the operator, operation time, operation type, physical evidence ID, operation result, and client IP address. The operation log area itself is also protected by a hash chain structure to prevent log tampering.

[0038] Example 8: This example is based on the above examples. The system uses an improved hash algorithm to achieve complete closed-loop management of evidence storage, modification, and upgrade. The specific process is as follows: When evidence is entered, the evidence feature value and dynamic salt value are extracted, the original hash value is calculated, the head node of the hash chain is constructed and stored; when evidence is modified, the modified hash value is calculated, a new hash chain node is generated, and the node records the differences before and after the modification; when evidence is upgraded, the upgrade hash value is calculated and the upgrade feature value is attached, and a new hash chain node is generated; during integrity verification, the hash chain is traversed, the hash is recalculated node by node, the signature and chain continuity are verified, and a verification report is output; during access management, the user's identity is verified based on the digital signature, and access is controlled according to the access policy table.

[0039] Through the collaborative work of the above modules, the system achieves full-process traceability, tamper-proofing, and fine-grained access control for physical evidence operations. It solves the problems of traditional physical evidence preservation systems, such as the use of a single hash algorithm, inability to record operation history, and coarse access management, and significantly improves the security and reliability of criminal investigation physical evidence management.

Claims

1. A system for preserving, modifying, and upgrading physical evidence used in criminal investigation, characterized in that: It includes a physical evidence entry module, a hash chain construction module, a physical evidence modification module, a physical evidence upgrade module, an integrity verification module, an access control module, and a storage medium; The physical evidence entry module obtains the original data and metadata of the physical evidence, extracts the feature value, calculates the original hash value using the SHA-256 algorithm combined with the dynamic salt value, and outputs the physical evidence ID and the original hash value to the hash chain construction module. The hash chain construction module receives the physical evidence ID and the original hash value, reads the current timestamp, the operator's identity identifier and the previous hash value, concatenates them to calculate the current node hash value, attaches a digital signature to construct the first node of the hash chain, and outputs the initial record of the hash chain to the storage medium. The physical evidence modification module receives the modification request, verifies the permissions, reads the latest hash chain node to obtain the previous hash value, calculates the modified hash value, calls the hash chain construction module to generate a new node, and outputs the modification record to the storage medium. The physical evidence upgrade module receives the upgrade request, verifies the permissions, reads the latest hash chain node to obtain the previous hash value, calculates the upgrade hash value and extracts the upgrade feature value, calls the hash chain construction module to generate a new node, and outputs the upgrade record to the storage medium. The integrity verification module periodically reads the physical evidence data and hash chain, recalculates the hash value node by node, verifies the signature and chain continuity, detects anomalies, and outputs an integrity verification report to the access control module. The permission management module receives integrity verification reports and user access requests, verifies user digital signatures and operation permissions, outputs verification results, and generates operation logs to the storage medium. The storage medium receives and stores the hash chain initial record, modification record, upgrade record, operation log, original physical evidence data, modified data, upgraded data, and integrity verification report.

2. The system for preserving, modifying, and upgrading physical evidence for criminal investigation as described in claim 1, characterized in that: The dynamic salt value is obtained by concatenating the timestamp of the evidence extraction time, the identity of the extractor, and the case number, and then hashing them again.

3. The system for preserving, modifying, and upgrading physical evidence for criminal investigation as described in claim 2, characterized in that: The hash value of the hash chain node is calculated by concatenating the physical evidence ID, original hash value, timestamp, operator identity identifier, previous hash value, and operation type, and then using the SHA-256 algorithm.

4. The system for preserving, modifying, and upgrading physical evidence for criminal investigation as described in claim 3, characterized in that: The modified hash value is calculated by concatenating the modified physical evidence data, the modified metadata, the dynamic salt value generated at the time of modification, and the previous hash value, and then using the SHA-256 algorithm.

5. A system for preserving, modifying, and upgrading physical evidence for criminal investigation as described in claim 4, characterized in that: The access control module adopts a digital signature-based identity verification mechanism and sets differentiated operation permissions for physical evidence of different security levels.

6. A system for preserving, modifying, and upgrading physical evidence for criminal investigation as described in claim 5, characterized in that: The feature values ​​extracted by the evidence entry module include the color histogram features of the evidence image, the keyword set of the evidence text, and the contour feature point set of the three-dimensional scan of the evidence.

7. A system for preserving, modifying, and upgrading physical evidence for criminal investigation as described in claim 6, characterized in that: When the integrity verification module detects an anomaly, it marks the abnormal node and the anomaly type in the integrity verification report and triggers an anomaly alarm.

8. A system for preserving, modifying, and upgrading physical evidence for criminal investigation as described in claim 7, characterized in that: The operation log includes the operator, operation time, operation type, physical evidence ID, operation result, and client IP address, and the operation log is protected using a hash chain structure.

Images