A watermark embedding method, traceability method and device for structured database

Abstract

The present application discloses a watermark embedding method, a traceability method and a device for a structured database, which are used to solve the problem that the watermark of the current solution cannot resist the attack of primary key deletion and the bypass attack caused by downloading data in small batches. The present application combines the master key, the identifier corresponding to each receiving device and the data of the attribute combination to generate the first watermark bit value corresponding to each receiving device, and embeds the first watermark bit value into the embeddable watermark field of the structured database of each receiving device. The attribute combination uses at least one unchangeable field. When tracing the leaked database, a first watermark bit sequence consisting of the first watermark bit values ​​of different rows is determined for each receiving device; a second bit sequence is obtained from the embeddable watermark field of the leaked database; and the receiving device with the data leakage behavior is determined and traced by comparing the first watermark bit sequence of each receiving device with the second watermark bit sequence.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a watermark embedding method, a source tracing method, and a device for a structured database. Background Art

[0002] Key enterprise asset data is typically stored as structured data in databases or big data platforms. As a new production factor, the demand for data exchange within and between enterprises is increasing, increasing the risk of data exposure and leakage. Tracing the source of a data breach is a key component of enterprise data security. Structured data watermarking (also known as database watermarking, hereinafter referred to as data watermarking) has garnered widespread attention and research in the industry in recent years as an effective technical tool for tracing and accountability. Currently, data watermarking techniques include methods based on data distortion, which embed watermark information by performing distorted encoding on the original numerical data. However, this method associates the watermark embedding order with the primary key of the data table. Attackers can obtain the primary key by downloading the data table and delete or replace it. This prevents the watermark from being extracted in the original order during watermark tracing. Consequently, this method's watermarking is less robust and cannot resist primary key deletion attacks, resulting in poor traceability. Furthermore, data watermarking technology can also add fake rows or columns to the original data table through pseudo-row and pseudo-column methods. However, this method is susceptible to watermark bypass attacks. Attackers can bypass watermark embedding through the watermark embedding mechanism, thereby obtaining data without watermark embedding, causing the traceability function to fail. Therefore, this method has poor robustness. Summary of the Invention

[0003] The embodiments of the present application provide a watermark embedding method, a traceability method, and a device for a structured database, which are used to solve the problem that the watermark of a structured database cannot resist primary key deletion attacks and bypass attacks of small batch downloads during transmission.

[0004] In a first aspect, an embodiment of the present application provides a watermark embedding method for a structured database, comprising:

[0005] Obtaining a structured database, and determining an attribute combination and an embeddable watermark field from a plurality of fields included in the structured database; the structured database includes N rows of data, and the structured database is to be sent to a plurality of receiving devices; the attribute combination includes at least one unchangeable field, and the embeddable watermark field includes at least one field with error tolerance;

[0006] generating a watermark bit value for the i-th row in the structured database based on a master key for generating an embedded watermark, a first identifier, and data in a field included in the i-th row attribute combination in the structured database; i is less than or equal to N and greater than 0; the first identifier is used to identify a first receiving device, the first receiving device being any one of the multiple receiving devices;

[0007] Adjusting data included in at least one field in the embeddable watermark field in the i-th row of the structured database according to the watermark bit value in the i-th row;

[0008] The structured database after data adjustment is sent to the first receiving device.

[0009] Based on the above scheme, when embedding watermarks in structured databases, instead of relying on primary keys, we use attribute combinations within the structured database to replace the primary key functionality. Using the primary key and attribute combinations, we embed the receiving device's identification information into the database, completing the watermark embedding process. This method's attribute combinations include fields with meaningful data that attackers typically don't delete, thus preventing primary key deletion attacks. Furthermore, this method's embedding mechanism embeds watermark bits into each database row based on the data within the attribute combinations, making it resistant to watermark bypass attacks.

[0010] In one possible implementation, generating the watermark bit value of the i-th row in the structured database based on the master key used to generate the embedded watermark, the first identifier, and the data in the field included in the attribute combination of the i-th row in the structured database includes:

[0011] A hash operation is performed on the master key, the first identifier, and data in fields included in the attribute combination of the i-th row in the structured database to obtain a watermark bit value of the i-th row in the structured database.

[0012] In a possible implementation, the watermark bit value of the i-th row in the structured database satisfies the condition shown in the following formula:

[0013] w i =(hash(K∥ID∥value i ))mod2;

[0014] Among them, w i is the watermark bit value of the i-th row in the structured database, ID is the identification information of the first receiving device, value i is the character string corresponding to the data in the fields included in the attribute combination of the i-th row in the structured database, and K is the master key.

[0015] Based on the above scheme, the embodiment of the present application obtains the watermark bit value of the i-th row by performing a hash operation on the master key, the first identifier, and the data in the fields included in the i-th row attribute combination, no longer relying on the primary key, and can avoid primary key deletion attacks.

[0016] In a possible implementation, adjusting data included in at least one field in the embeddable watermark field in the i-th row of the structured database according to the watermark bit value in the i-th row includes:

[0017] A first field is selected from the embeddable watermark fields in the i-th row, and data included in the first field in the i-th row is adjusted according to the watermark bit value in the i-th row.

[0018] In some embodiments, the first field satisfies the following conditions:

[0019] M i =(hash(K∥ID∥value i ))modl i +1;

[0020] Among them, l i is the total number of watermark fields that can be embedded in the i-th row, M i Indicates that the first field is in l i The locations where the watermark fields can be embedded are arranged in a set order, M i Less than or equal to l i And M i Greater than 0, ID is the identification information of the first receiving device, value i is the character string corresponding to the data in the fields included in the i-th row attribute combination in the structured database, and K is the master key of the structured database.

[0021] Based on the above scheme, the data included in the first field corresponding to each row can be adjusted according to the watermark bit value of the row. Since the watermark bit value is embedded, it can be embedded in any download record. There is no need to record that the size of the download record must be greater than the length of the receiving device identification information, thereby avoiding the problem of bypassing the watermark attack by downloading in batches.

[0022] In a possible implementation, adjusting the data included in the first field of the i-th row according to the watermark bit value of the i-th row includes:

[0023] When the attribute of the first field is a numerical attribute, modifying the bit value of the first set position of the first field to the watermark bit value of the i-th row;

[0024] When the attribute of the first field is a text attribute and the watermark bit value of the i-th row is a first value, an invisible character is added to the second set position of the first field; when the attribute of the first field is a text attribute and the watermark bit value of the i-th row is a second value, the invisible character is not added to the first field.

[0025] Based on the above solution, when adjusting the data included in the first field according to the watermark bit value, different embedding methods can be used according to the attributes of the data included in the first field. When the attribute of the data included in the first field is text and invisible characters are embedded, the original format can be restored when the watermark is extracted.

[0026] In a second aspect, an embodiment of the present application provides a watermark traceability method for a structured database, comprising:

[0027] Acquire a second structured database, where the second structured database is a structured database in which data leakage occurs after a watermark is embedded in the first structured database, the first structured database includes r receiving devices, and the first structured database includes N rows of data;

[0028] Acquire an attribute combination and a field that can be embedded in the watermark when embedding the watermark in the first structured database; the attribute combination includes at least one unchangeable field, and the field that can be embedded in the watermark includes at least one field with error tolerance capability;

[0029] Using the identifiers of the r receiving devices, the master key used to generate the embedded watermark, and the data in the fields included in the attribute combination of the i-th row in the first structured database, respectively, to generate first watermark bit values ​​corresponding to the r receiving devices, so as to obtain first watermark bit sequences corresponding to the r receiving devices, respectively; wherein i is less than or equal to N and i is greater than 0;

[0030] extracting second watermark bit values ​​from N rows of data included in the embeddable watermark field included in the second structured database to obtain a second bit sequence;

[0031] The receiving device corresponding to the first watermark bit sequence having the highest similarity to the second watermark bit sequence among the first watermark bit sequences corresponding to the r receiving devices is determined as the receiving device with data leakage behavior.

[0032] In one possible implementation, the method of using the identifiers of the r receiving devices, the master key for generating the embedded watermark, and the data in the field included in the attribute combination of the i-th row in the first structured database to generate the first watermark bit values ​​corresponding to the r receiving devices, respectively, to obtain the first watermark bit sequences corresponding to the r receiving devices, respectively, includes:

[0033] A hash operation is performed on the master key, the first identifier, and data in the fields included in the i-th row attribute combination in the first structured database to obtain the first watermark bit value in the i-th row of the first structured database to obtain the first watermark bit sequence; the first identifier is the identifier of the first receiving device among the r receiving devices.

[0034] In some embodiments, the first watermark bit value in the i-th row of the first structured database satisfies the condition shown in the following formula:

[0035] w i =(hash(K∥ID∥value i ))mod2;

[0036] Among them, w i is the watermark bit value of the i-th row in the first structured database, ID is the identification information of the first receiving device, value i is the character string corresponding to the data in the fields included in the i-th row attribute combination in the first structured database, and K is the master key.

[0037] In a possible implementation, extracting second watermark bit values ​​from N rows of data included in the embeddable watermark field included in the second structured database includes:

[0038] Determine the first field in the embeddable watermark field in the i-th row of the first structured database corresponding to the r receiving devices respectively, and extract the second watermark bit value from the first field in the i-th row of the second structured database to obtain the second bit sequence corresponding to the r receiving devices respectively.

[0039] In some embodiments, the first field satisfies the condition described in the following formula:

[0040] M i =(hash(K∥ID∥value i ))modl i +1;

[0041] Among them, l i is the total number of watermark embeddable fields in row i of the first structured database, M i Indicates that the first field is in l i The locations where the watermark fields can be embedded are arranged in a set order, M i Less than or equal to l i And M i Greater than 0, ID is the identification information of the first receiving device, value iis the character string corresponding to the data in the fields included in the attribute combination of the i-th row in the structured database, and K is the master key.

[0042] In a possible implementation, extracting the second watermark bit value from the first field in the i-th row of the second structured database includes:

[0043] When the attribute of the first field is a numerical attribute, extracting the bit value of the first set position of the data included in the first field of the i-th row as the second watermark bit value;

[0044] When the attribute of the first field is a text attribute and the second set position of the first field includes invisible characters, the second watermark bit value is a first value; when the attribute of the first field is a text attribute and the second set position of the first field does not include invisible characters, the second watermark bit value is a second value.

[0045] In a third aspect, an embodiment of the present application provides a watermark embedding device for a structured database, comprising an acquisition unit, a processing unit, and a sending unit;

[0046] The acquisition unit is configured to acquire a structured database and determine an attribute combination and an embeddable watermark field from a plurality of fields included in the structured database; the structured database includes N rows of data, and the structured database is to be sent to a plurality of receiving devices; the attribute combination includes at least one unchangeable field, and the embeddable watermark field includes at least one field with error tolerance capability;

[0047] The processing unit is configured to generate a watermark bit value for the i-th row of the structured database based on a master key for generating an embedded watermark, a first identifier, and data in fields included in the i-th row attribute combination in the structured database; i is less than or equal to N and greater than 0; the first identifier is used to identify a first receiving device, the first receiving device being any one of the multiple receiving devices; and adjust data included in at least one field in the i-th row of the structured database that can be embedded with a watermark according to the watermark bit value of the i-th row;

[0048] The sending unit is configured to send the structured database after data adjustment to the first receiving device.

[0049] In one possible implementation, the processing unit, when generating the watermark bit value of the i-th row in the structured database based on the master key used to generate the embedded watermark, the first identifier, and the data in the fields included in the i-th row attribute combination in the structured database, is specifically used to: perform a hash operation on the master key, the first identifier, and the data in the fields included in the i-th row attribute combination in the structured database to obtain the watermark bit value of the i-th row in the structured database.

[0050] In some embodiments, the watermark bit value of the i-th row in the structured database satisfies the condition shown in the following formula:

[0051] w i =(hash(K∥ID∥value i ))mod2;

[0052] Among them, w i is the watermark bit value of the i-th row in the structured database, ID is the identification information of the first receiving device, value i is the character string corresponding to the data in the fields included in the attribute combination of the i-th row in the structured database, and K is the master key.

[0053] In one possible implementation, when the processing unit adjusts data included in at least one field in the embeddable watermark field in the i-th row of the structured database according to the watermark bit value in the i-th row, it is specifically configured to:

[0054] A first field is selected from the embeddable watermark fields in the i-th row, and data included in the first field in the i-th row is adjusted according to the watermark bit value in the i-th row.

[0055] In some embodiments, the first field satisfies the following conditions:

[0056] M i =(hash(K∥ID∥value i ))modl i +1;

[0057] Among them, l i is the total number of watermark fields that can be embedded in the i-th row, M i Indicates that the first field is in l i The locations where the watermark fields can be embedded are arranged in a set order, M i Less than or equal to l i And M i Greater than 0, ID is the identification information of the first receiving device, value iis the character string corresponding to the data in the fields included in the i-th row attribute combination in the structured database, and K is the master key of the structured database.

[0058] In a possible implementation, the processing unit, when adjusting the data included in the first field of the i-th row according to the watermark bit value of the i-th row, is specifically configured to:

[0059] When the attribute of the first field is a numerical attribute, modifying the bit value of the first set position of the first field to the watermark bit value of the i-th row;

[0060] When the attribute of the first field is a text attribute and the watermark bit value of the i-th row is a first value, an invisible character is added to the second set position of the first field; when the attribute of the first field is a text attribute and the watermark bit value of the i-th row is a second value, the invisible character is not added to the first field.

[0061] In a fourth aspect, an embodiment of the present application provides a watermark tracing device for a structured database, comprising an acquisition unit and a processing unit;

[0062] The acquiring unit is configured to acquire a second structured database, where the second structured database is a structured database in which data leakage occurs after a watermark is embedded in the first structured database, the first structured database includes r receiving devices, and the first structured database includes N rows of data;

[0063] The processing unit is configured to obtain an attribute combination and a field that can be embedded in the watermark when embedding the watermark in the first structured database; the attribute combination includes at least one unchangeable field, and the field that can be embedded in the watermark includes at least one field with error tolerance capability;

[0064] The processing unit is further configured to use the identifiers of the r receiving devices, the master key for generating the embedded watermark, and the data in the field included in the attribute combination of the i-th row in the first structured database to generate first watermark bit values ​​corresponding to the r receiving devices, respectively, to obtain first watermark bit sequences corresponding to the r receiving devices, respectively; wherein i is less than or equal to N and i is greater than 0;

[0065] The processing unit is further configured to extract second watermark bit values ​​from N rows of data included in the embeddable watermark field included in the second structured database to obtain a second bit sequence; and determine the receiving device corresponding to the first watermark bit sequence having the highest similarity with the second watermark bit sequence among the first watermark bit sequences corresponding to the r receiving devices as the receiving device that has engaged in data leakage.

[0066] In one possible implementation, the processing unit, when using the identifiers of the r receiving devices, the master key for generating the embedded watermark, and the data in the field included in the attribute combination of the i-th row in the first structured database, to generate the first watermark bit values ​​corresponding to the r receiving devices, respectively, to obtain the first watermark bit sequences corresponding to the r receiving devices, is specifically configured to:

[0067] A hash operation is performed on the master key, the first identifier, and data in the fields included in the i-th row attribute combination in the first structured database to obtain the first watermark bit value in the i-th row of the first structured database to obtain the first watermark bit sequence; the first identifier is the identifier of the first receiving device among the r receiving devices.

[0068] In some embodiments, the first watermark bit value in the i-th row of the first structured database satisfies the condition shown in the following formula:

[0069] w i =(hash(K∥ID∥value i ))mod2;

[0070] Among them, w i is the watermark bit value of the i-th row in the first structured database, ID is the identification information of the first receiving device, value i is the character string corresponding to the data in the fields included in the i-th row attribute combination in the first structured database, and K is the master key.

[0071] In a possible implementation, when extracting the second watermark bit values ​​from the N rows of data included in the embeddable watermark field included in the second structured database, the processing unit is specifically configured to:

[0072] Determine the first field in the embeddable watermark field in the i-th row of the first structured database corresponding to the r receiving devices respectively, and extract the second watermark bit value from the first field in the i-th row of the second structured database to obtain the second bit sequence corresponding to the r receiving devices respectively.

[0073] In some embodiments, the first field satisfies the condition described in the following formula:

[0074] M i =(hash(K∥ID∥value i ))modl i +1;

[0075] Among them, l i is the total number of watermark embeddable fields in row i of the first structured database, M iIndicates that the first field is in l i The locations where the watermark fields can be embedded are arranged in a set order, M i Less than or equal to l i And M i Greater than 0, ID is the identification information of the first receiving device, value i is the character string corresponding to the data in the fields included in the attribute combination of the i-th row in the structured database, and K is the master key.

[0076] In a possible implementation, when extracting the second watermark bit value from the first field in the i-th row of the second structured database, the processing unit is specifically configured to:

[0077] When the attribute of the first field is a numerical attribute, extracting the bit value of the first set position of the data included in the first field of the i-th row as the second watermark bit value;

[0078] When the attribute of the first field is a text attribute and the second set position of the first field includes invisible characters, the second watermark bit value is a first value; when the attribute of the first field is a text attribute and the second set position of the first field does not include invisible characters, the second watermark bit value is a second value.

[0079] In a fifth aspect, an embodiment of the present application provides a watermark embedding device for a structured database, comprising a memory and a processor;

[0080] The memory is used for storing program instructions;

[0081] The processor is configured to call the program instructions stored in the memory and execute the method described in the first aspect and different implementations of the first aspect according to the obtained program.

[0082] In a sixth aspect, an embodiment of the present application provides a watermark tracing device for a structured database, comprising a memory and a processor;

[0083] The memory is used for storing program instructions;

[0084] The processor is configured to call the program instructions stored in the memory and execute the method described in the second aspect and different implementations of the second aspect according to the obtained program.

[0085] In a seventh aspect, an embodiment of the present application provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the method described in the first aspect and different implementation methods of the first aspect.

[0086] In addition, the technical effects brought about by any implementation method of the second to seventh aspects can be referred to the technical effects brought about by the first aspect and different implementation methods of the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] Figure 1 A schematic diagram of an application scenario of a watermark embedding method and a traceability method for a structured database provided in an embodiment of the present application;

[0088] Figure 2 A schematic diagram of a watermarking scheme for a structured database provided in an embodiment of the present application;

[0089] Figure 3 A flow chart of a watermark embedding method for a structured database provided in an embodiment of the present application;

[0090] Figure 4 A flow chart of a watermark tracing method for a structured database provided in an embodiment of the present application;

[0091] Figure 5 A schematic diagram of a watermark embedding device for a structured database provided in an embodiment of the present application;

[0092] Figure 6 A schematic diagram of a watermark traceability device for a structured database provided in an embodiment of the present application;

[0093] Figure 7 A schematic diagram of another watermark embedding device for a structured database provided in an embodiment of the present application;

[0094] Figure 8 A schematic diagram of another watermark tracing device for a structured database provided in an embodiment of the present application. DETAILED DESCRIPTION

[0095] The following will be combined with the accompanying drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Generally, the components of the embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations.

[0096] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for protection, but merely represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present application.

[0097] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0098] Currently, data watermarking technologies can be divided into two categories. One is the data distortion-based watermarking method, which primarily targets the numerical attributes of a data table. The watermark embedding rules are associated with the primary key of the data table. According to the watermark embedding rules, the original numerical data is distortedly encoded to embed the watermark information. However, in practical applications, the primary key is a unique ID, often a sequential index or a random string, and does not contain valuable information. When an attacker gains access to a database, they can obtain the primary key value and delete or replace it. After the attacker launches an attack, during the watermark traceability process, the deleted or replaced primary key value makes it impossible to extract the correct watermark information in the original order, resulting in inaccurate traceability. Therefore, this method is not resistant to primary key deletion attacks. Another method is the pseudo-row and pseudo-column data watermarking method. This method adds the watermark information to the original database by forging new rows or columns according to the pseudo-row or pseudo-column generation rules. This method requires that the database table has sufficient embedding space for rows or columns; otherwise, watermark embedding will fail. In addition, attackers can bypass the watermark embedding through the watermark embedding mechanism, such as downloading in batches, thereby obtaining data without watermark embedding, making the embedding and traceability functions of the watermark system invalid.

[0099] In response to the above problems, the embodiments of the present application provide a method for embedding structured data watermarks, a method for tracing the source, and a device. By using the attribute combination in the database to replace the function of the primary key, the embedded watermark bits are determined by the recipient's identification information, the master key, and the attribute combination. And through the watermark embedding algorithm, the watermark bits are hidden in the original database, which can avoid primary key deletion attacks. In addition, when embedding, the watermark bit value is calculated based on the data included in the attribute combination of each row, and the fields of each row that can be embedded with the watermark are modified, thereby avoiding attackers from implementing watermark bypass attacks by downloading in batches. When data leakage occurs in the database, relevant detection and tracing can be completed on the leaked database based on the watermark extraction algorithm and the master key.

[0100] like Figure 1 As shown, an application scenario of a watermark embedding method and a traceability method for a structured database includes multiple terminal devices 110 and a server 120. Figure 1 While three terminal devices 110 are used as an example, the number of terminal devices 110 is not limited. Terminal devices 110 may be mobile phones, tablet computers, personal computers, etc. Server 120 may be implemented as a single server or a server cluster consisting of multiple servers. Server 120 may be implemented as a physical server or a virtual server.

[0101] In one possible application scenario, the owner of a structured database uploads the structured database to be watermarked and the master key to a server via terminal device 110, and requests server 120 to save the user's terminal device identification information to the structured database. After receiving the structured database and master key, server 120 generates a watermark bit value to be embedded in the structured database based on the user's terminal device identification information and embeds the watermark bit value into the structured database. The watermarked database is then sent to terminal device 110 for display, allowing the user to view the watermarked database via terminal device 110. Specifically, the unchangeable data and error-tolerant fields in the structured database can be determined based on the user's data characteristics. The fields corresponding to the unchangeable data in the structured database are referred to as attribute combinations, and the error-tolerant fields are designated as watermark-embeddable fields. Subsequently, for each row in the structured database to be watermarked, a hash operation is performed based on the data in each field of the attribute combination, the master key, and the receiving device identification, to obtain the watermark bit value for that row. The watermark bit value is then embedded into the designated location in the row. In addition, when a structured database is leaked, the server 120 calculates the watermark bit sequence of each receiving device, and then extracts the watermark bit sequence from the leaked structured database according to the watermark embedding rules, and compares it with the watermark bit sequences of each receiving device. The receiving device corresponding to the watermark bit sequence with the highest similarity is determined as the subject of the final leaked data, completing the traceability and accountability.

[0102] It should be noted that the above application scenarios are only for the purpose of facilitating relevant personnel to understand the principles of this application, and do not constitute a limitation on the application scenarios of the implementation methods of this application.

[0103] The watermarking scheme framework of the structured database proposed in the embodiment of this application is as follows: Figure 2As shown, it includes a watermark embedding end and a watermark extraction end, which correspond to the two processing processes of the watermark system, namely the watermark embedding process, and the watermark extraction and tracing process. For the watermark embedding end, the watermark identification information w of the recipient (such as the employee ID who downloaded the structured database, or the organization ID that received the structured database) is hidden in the original structured database D through the watermark embedding algorithm, and the structured database Dw embedded with the watermark is output. In order to ensure security, the master key K is used in the embedding process proposed in this application. For the watermark extraction end, the structured database Dw embedded with the watermark may be subject to watermark attacks after leakage, and there will be slight differences from the structured database before the attack. The structured database after the attack is represented by Dw'. In order to determine the subject of the leakage (an employee or a receiving organization), the watermark extraction algorithm and the master key K can be used to complete the relevant detection of the watermark on the structured database Dw' after the attack, determine the subject of the leakage, and complete the tracing and accountability.

[0104] The present invention provides a method for embedding watermarks in a structured database. Figure 3 The process of the watermark embedding method for a structured database is exemplarily shown. The process can be executed by the server 120. For the convenience of description, the subsequent description of the server 120 will no longer use digital identification as an example.

[0105] 301 , obtaining a structured database, and determining an attribute combination and an embeddable watermark field from a plurality of fields included in the structured database.

[0106] The structured database includes N rows of data and is to be sent to multiple receiving devices. The attribute combination includes at least one unchangeable field, and the embeddable watermark field includes at least one field with error tolerance. In some embodiments, the receiving device may be a terminal device used by employees of the structured database or a service terminal of the organization receiving the structured database. As an example, the structured database is shown in Table 1 and is to be sent to multiple receiving devices. The structured database includes a total of six rows of data. The attribute combination and embeddable watermark field in the multiple fields of the structured database can be determined based on the different data characteristic requirements of the receiving devices.

[0107] In some scenarios, when the first receiving device needs to accurately analyze the data in the columns containing gender, occupation, and region in Table 1, the data corresponding to the three fields of gender, occupation, and region cannot be changed. The first receiving device uses the name for manual queries and performs an approximate data analysis on the data in the columns containing age, weekly work hours, and credit card spending, which can tolerate a certain degree of error. Therefore, the data included in the three fields of gender, occupation, and region can be included as data included in the attribute combination. Since invisible characters can be embedded in the set position of the name, the name can be restored to its original format during extraction. To improve the unique identification of the attribute combination, the "name" field can be added to the attribute combination. Therefore, the attribute combination can include data from the four fields of name, gender, occupation, and region. After determining the attribute combination fields, the three fields of age, weekly work hours, and credit card spending remain. The data included in these three fields can tolerate a certain degree of error. Therefore, the three fields of age, weekly work hours, and credit card spending can be used as fields that can be embedded in watermarks. In addition, since invisible characters can be embedded in the set position of the name, the original format of the name can be restored when extracted, the four fields of name, age, weekly working hours and credit card consumption can be used as fields for embedding watermarks.

[0108] Table 1

[0109]

[0110] 302. Generate a watermark bit value for the i-th row in the structured database based on the master key used to generate the embedded watermark, the first identifier, and data in the fields included in the i-th row attribute combination in the structured database.

[0111] Wherein, i is less than or equal to N and greater than 0, and the first identifier is used to identify the first receiving device, which is any receiving device among multiple receiving devices. As an example, the database owner can randomly generate a string as the master key K of the database. In order to improve the security of the database, the database master key can be set to a string of 128 bits or longer. As an example, the receiving devices of the structured database include r, and the identification information of the r receiving devices can be respectively represented as {ID1, ID2, ..., ID r The first receiving device mentioned above is one of the r receiving devices. For example, if the first receiving device is the first receiving device, the identification information is ID1; for another example, if the first receiving device is the jth receiving device, the identification information is ID j . j is an integer less than or equal to r and greater than or equal to 1.

[0112] It should be understood that when the structured database includes r receiving devices, the operations performed for the first receiving device are performed separately for each receiving device, such as executing steps 302-304 for each receiving device. That is, the watermark bit value of each row of the structured data is determined using the identification information of each receiving device. Taking the i-th row as an example, for the r receiving devices, the watermark bit value of the i-th row of the first receiving device is generated using the master key, the identification information of the first receiving device, and the data in the fields included in the i-th row attribute combination in the structured database; the watermark bit value of the i-th row of the second receiving device is generated using the master key, the identification information of the second receiving device, and the data in the fields included in the i-th row attribute combination in the structured database, and so on.

[0113] In some embodiments, the database includes a total of N rows of data, and the watermark bit value corresponding to the row is calculated for each of the N rows of data in the database. Taking the watermark bit value of the i-th row of the j-th receiving device as an example, when calculating the watermark bit value corresponding to the i-th row, the data in the field included in the attribute combination is first converted into binary characters. When the data attribute in the field included in the attribute combination is a text attribute, the data of the text attribute can be converted into ASCII code, and the binary characters corresponding to the data in the field included in the attribute combination are connected in a set order to obtain the binary characters corresponding to the attribute combination. Then, the master key, the identification information corresponding to the j-th receiving device, and the binary characters corresponding to the i-th row of the attribute combination are connected, and a hash operation is performed on the connected string to obtain the watermark bit value of the i-th row. The identification information corresponding to the j-th receiving device is represented by ID j Indicates that j≤r and j is a positive integer, the master key is represented by K, and the binary string corresponding to the fields included in the attribute combination of the i-th row is represented by value i Represented by, then the embeddable watermark bit value of the jth receiving device in the i-th row of the structured database is for:

[0114]

[0115] Here, ∥ is a connection symbol used to connect the master key, the identification information corresponding to the j-th receiving device, and the binary string of data included in the attribute combination.

[0116] In some embodiments, when the attribute combination in the i-th row includes y fields, the binary characters corresponding to the y fields included in the attribute combination are represented by value i,1 ,value i,2 ,……,value i,y Indicates that the binary string value corresponding to the field included in the attribute combination of row i is i =value i,1∥value i,2 ∥…∥value i,y As an example, as shown in Table 1, there are 6 rows of data in the current data table, in which the attribute combination includes 4 fields: name, gender, occupation, and region. When calculating the watermark bit value of the i-th row, first determine the binary string corresponding to the fields included in the attribute combination of the i-th row. For example, when the attributes of the data included in the three fields of name, gender, and occupation in the attribute combination are text attributes, convert the data of the text attribute into ASCII code, and connect the 4 fields included in the attribute combination in the set order to obtain the binary string value corresponding to the fields included in the attribute combination of the i-th row. i As an example, the values ​​corresponding to the four fields included in the attribute combination can be expressed as {value i,1 ,value i,2 ,value i,3 ,value i,4}, i≤6. Connect the binary characters corresponding to the four fields included in the attribute combination, and connect them with the master key and the first identification of the first receiving device, and determine the watermark bit value of the i-th row according to the hash algorithm. For example, the identification information corresponding to the j-th receiving device is represented by ID j Indicates that the master key is represented by K, and the values ​​corresponding to the fields included in the attribute combination are represented by value i,1 ,value i,2 ,value i,3 ,value i,4 The embeddable watermark bit value of the jth receiving device in the i-th row of the structured database is represented by for:

[0117] In other embodiments, a hash operation may be performed on the master key, the first identifier, and the data in the fields included in multiple rows of attribute combinations to obtain the watermark bit value for the data included in the row of the attribute combination in the structured database. For example, a hash operation may be performed on the master key, the first identifier, and the data in the fields included in m rows of attribute combinations in the structured database to obtain the watermark bit value corresponding to the m rows of data in the structured database.

[0118] 303. Adjust data included in at least one field in the watermark embeddable field in the i-th row of the structured database according to the watermark bit value in the i-th row.

[0119] In some embodiments, the data of a certain field in the field that can be embedded in the watermark of each row in the structured database can be adjusted according to the watermark bit value of each row, or the data of all fields included in the field that can be embedded in the watermark of each row can be adjusted according to the watermark bit value of each row, or the data of any combination of fields included in the field that can be embedded in the watermark of each row can be adjusted according to the watermark bit value of each row. This application does not limit this. Taking the adjustment of the data included in the first field in the field that can be embedded in the watermark of the i-th row in the structured database according to the watermark bit value as an example, when there are l in the structured database, i When there is an embeddable watermark field, the first field is determined by performing a hash operation on the value of the master key, the first identifier and the attribute combination. i The positions of the embedded watermark fields are arranged in a set order. The identification information corresponding to the jth receiving device is represented by ID j Indicates that the master key is represented by K, and the binary string corresponding to the fields included in the attribute combination is represented by value i Indicates that the first field is in l i The positions of the embeddable watermark fields arranged in the set order are represented by M i Indicates that the first field satisfies the following formula: M i =(hash(K∥ID j ∥value i ))modl i +1.

[0120] In some embodiments, when the attribute combination of the i-th row includes y fields, the binary characters corresponding to the data of the y fields can be represented as value i,1 ,value i,2 ,……,value i,y , then value i =value i,1 ∥value i,2 ∥…∥value i,y .

[0121] In other embodiments, when multiple rows of data in a structured database correspond to a watermark bit value, any field, set field or all fields in the watermark field that can be embedded in the multiple rows of data corresponding to the watermark bit value can be adjusted according to the watermark bit value. This application does not limit this.

[0122] In some embodiments, after determining a field in a structured database that can be watermarked, the data included in the corresponding row's watermarked field is adjusted based on the watermark bit value. Specifically, if the data included in the adjusted watermarked field is a numeric attribute, the data included in the field is converted into a binary number, and the bit at the set position of the binary number is replaced with the watermark bit value. For example, adjusting the first field in the i-th row of the watermarked field based on the watermark bit value in the i-th row is performed. Assuming that the data table has six rows, as shown in Table 1, and the watermark bit value in the first row is 0, if the first field in the watermarked field is determined to be the age field, and the data included in the age field in the first row is 23, which is a numeric attribute, 23 is converted into binary characters, namely, 10111. Assuming that the set position of the field is adjusted to the second-to-last bit, the second-to-last bit of the binary character 10111 corresponding to 23 is adjusted to 0. The adjusted binary character is 10101, and the value of the field after watermarking is 21.

[0123] In some scenarios, when the attribute of the data included in the adjusted embeddable field is a text attribute, invisible characters such as spaces, carriage returns, etc. can be added to the set position of the field. For example, a carriage return is embedded when the watermark bit value is 1, and not when the watermark bit value is 0. Similarly, a carriage return may not be embedded when the watermark bit value is 1, and may be embedded when the watermark bit value is 0. The specific embedding rules are not limited in this application. When adding invisible characters to the set position of the text attribute field, the set position can be before the text value, in the middle of the text value, or after the text value. This application does not limit this. For example, when the data included in the first field is "Zhang San", the attribute of the data is a text attribute. When the watermark bit value is 1, a space can be embedded in the middle of the text value of the field to obtain the field "Zhang San" embedded with the watermark. When the watermark bit value is 0, no space is embedded in the field, that is, "Zhang San".

[0124] 304: Send the structured database after data adjustment to the first receiving device.

[0125] Based on the above scheme, watermark embedding no longer relies on a primary key. Instead, it uses a combination of attributes in a structured database to replace the primary key. Using the primary key and the attribute combination, the receiving device's identification information is embedded into the database, completing the watermark embedding process within the structured database. This method's attribute combination includes fields with meaningful data compared to the primary key data, which attackers typically don't delete. This prevents primary key deletion attacks and ensures that the watermark extraction end can correctly extract the watermark bits.

[0126] When a data leak occurs in a structured database, it is necessary to trace the source to identify the subject of the leak. Figure 3Based on the watermark embedding method described in steps 301-304, the embodiment of the present application also provides a watermark tracing method for a structured database, such as Figure 4 The watermark traceability process may be executed by a server, and the watermark traceability process may include the following steps 401-405.

[0127] 401. Obtain a second structured database, where the second structured database is a structured database in which data leakage occurs after a watermark is embedded in the first structured database.

[0128] The first structured database includes r receiving devices, and the first structured database includes N rows of data. The second structured database is generated when data leakage occurs after the first structured database is embedded with a watermark.

[0129] 402. Obtain a combination of attributes used when embedding a watermark in the first structured database and a field that can be embedded in the watermark.

[0130] In some embodiments, the attribute combination includes at least one unchangeable field in the first structured database, and the embeddable watermark field includes at least one error-tolerant field in the first structured database. Different receiving devices have different attribute combinations and embeddable watermark fields, so the attribute combinations and embeddable watermark fields corresponding to r receiving devices are obtained.

[0131] 403. Use the identifiers of the r receiving devices, the master key for generating the embedded watermark, and the data in the fields included in the i-th row attribute combination in the first structured database to generate the i-th row first watermark bit values ​​corresponding to the r receiving devices respectively, to obtain the first watermark bit sequences corresponding to the r receiving devices respectively, where i is less than or equal to N and i is greater than 0.

[0132] Taking the determination of the first watermark bit sequence of the first receiving device as an example, a hash operation can be performed on the master key, the first identifier, and the data in the fields included in the attribute combination of the i-th row in the first structured database to obtain the first watermark bit value in the i-th row of the first structured database to obtain the first watermark bit sequence. The first identifier is the identifier of the first receiving device among the r receiving devices. Taking the j-th receiving device as an example, the first watermark bit value in the i-th row of the first structured database satisfies the condition shown in the following formula:

[0133] in, is the watermark bit value of row i in the first structured database of the jth receiving device, ID j is the identification information of the jth receiving device, j≤r and j is a positive integer, value iis the character string corresponding to the data in the fields included in the i-th row attribute combination in the first structured database, and K is the primary key.

[0134] In some embodiments, after determining the first watermark bit values ​​for the i-th row corresponding to each of the r receiving devices, the first field in the i-th row that can be embedded with the watermark is determined for each of the r receiving devices based on the identifiers of the r receiving devices, the master key, and the data in the fields included in the i-th row attribute combination in the first structured database, and the location of the first field that can be embedded with the watermark is determined. Taking the j-th receiving device as an example, the first field satisfies the condition described in the following formula:

[0135]

[0136] Among them, l i is the total number of watermark-embeddable fields in row i of the first structured database, Indicates that the first field is in l i The locations where the watermark fields can be embedded are arranged in a set order, M i Less than or equal to l i And M i Greater than 0, ID j is the identification information of the jth receiving device, j≤r and j is a positive integer, value i is the string corresponding to the data in the fields included in the attribute combination of the i-th row in the structured database, and K is the primary key.

[0137] 404 : Extract second watermark bit values ​​from the N rows of data included in the embeddable watermark field included in the second structured database to obtain a second bit sequence.

[0138] In some embodiments, after determining the first field in the embeddable watermark field in the i-th row of the first structured database corresponding to the r receiving devices, a second watermark bit value is extracted from the first field in the i-th row of the second structured database to obtain a second bit sequence corresponding to the r receiving devices. For example, when the embeddable watermark field in the i-th row of the first structured database corresponding to the j-th receiving device is the first field, the second watermark bit value is extracted from the set position of the first embeddable watermark field in the second structured database. Similarly, the second watermark bit value of each row in the second structured database is extracted from the set position of the first embeddable watermark field in each row to obtain the second bit sequence.

[0139] In some embodiments, when extracting the second watermark bit value from the first field of each row in the second structured database, the second watermark bit value may be extracted from a fixed position in the first field to obtain a second bit sequence. For example, the second watermark bit value may be extracted from the bth-to-last bit in the first field of each row to obtain the second bit sequence. For example, b = 2. For another example, b = 1.

[0140] In some embodiments, when extracting the second watermark bit value from the second structured database, when the attribute of the first field is a numerical attribute, the second watermark bit value of the first set position of the first field is extracted. When the attribute of the first field is a text attribute, when the second set position of the first field includes an invisible character, the second watermark bit value is a first numerical value; when the second set position of the first field does not include an invisible character, the second watermark bit value is a second numerical value. As an example, when the set position of the first field of the text attribute includes an invisible character, the second watermark bit value is 1; when the second set position of the first field does not include an invisible character, the second watermark bit value is 0.

[0141] 405 : Determine the receiving device corresponding to the first watermark bit sequence having the highest similarity to the second watermark bit sequence among the first watermark bit sequences corresponding to the r receiving devices as the receiving device with data leakage behavior.

[0142] In some embodiments, the first watermark bit sequences corresponding to r receiving devices are compared with the second watermark bit sequences corresponding to r receiving devices, and the receiving device corresponding to the first watermark bit sequence having the highest similarity between the first watermark bit sequence and the second watermark bit sequence is determined to be the receiving device that has engaged in data leakage.

[0143] In other embodiments, when the second bit sequence is extracted from a fixed set position in the first field of each row in the second structured database, only one second bit sequence is extracted. The first watermark bit sequences corresponding to the r receiving devices are respectively compared with the second bit sequence, and the receiving device corresponding to the first watermark bit sequence having the highest similarity to the second watermark bit sequence is determined as the receiving device that has engaged in data leakage.

[0144] In some embodiments, to improve the efficiency of traceability detection, a certain amount of data can be randomly sampled from the structured database for watermark traceability. For example, if the structured database contains 1000 rows of data, 200 data can be randomly sampled for watermark traceability. The watermark traceability method is consistent with the above method and will not be repeated here.

[0145] Based on the same technical concept, the embodiment of the present application provides a watermark embedding device 500 for a structured database, such as Figure 5The apparatus 500 can execute each step of the watermark embedding method, which will not be described in detail here to avoid repetition. The apparatus 500 includes an acquisition unit 501, a processing unit 502 and a sending unit 503.

[0146] The acquisition unit 501 is configured to acquire a structured database and determine an attribute combination and an embeddable watermark field from a plurality of fields included in the structured database; the structured database includes N rows of data and is to be sent to a plurality of receiving devices; the attribute combination includes at least one unchangeable field, and the embeddable watermark field includes at least one field with error tolerance capability;

[0147] The processing unit 502 is configured to generate a watermark bit value for the i-th row of the structured database based on a master key for generating an embedded watermark, a first identifier, and data in fields included in the i-th row attribute combination in the structured database; i is less than or equal to N and greater than 0; the first identifier is used to identify a first receiving device, the first receiving device being any receiving device among the multiple receiving devices; and adjust data included in at least one field in the i-th row of the structured database that can be embedded with watermarks based on the watermark bit value in the i-th row.

[0148] The sending unit 503 is configured to send the structured database after data adjustment to the first receiving device.

[0149] In one possible implementation, the processing unit 502, when generating the watermark bit value of the i-th row in the structured database based on the master key used to generate the embedded watermark, the first identifier, and the data in the fields included in the i-th row attribute combination in the structured database, is specifically used to: perform a hash operation on the master key, the first identifier, and the data in the fields included in the i-th row attribute combination in the structured database to obtain the watermark bit value of the i-th row in the structured database.

[0150] In some embodiments, the watermark bit value of the i-th row in the structured database satisfies the condition shown in the following formula:

[0151] w i =(hash(K∥ID∥value i ))mod2;

[0152] Among them, w i is the watermark bit value of the i-th row in the structured database, ID is the identification information of the first receiving device, value i is the character string corresponding to the data in the fields included in the attribute combination of the i-th row in the structured database, and K is the master key.

[0153] In one possible implementation, when adjusting the data included in at least one field in the embeddable watermark field in the i-th row of the structured database according to the watermark bit value in the i-th row, the processing unit 502 is specifically configured to: select a first field from the embeddable watermark field in the i-th row, and adjust the data included in the first field in the i-th row according to the watermark bit value in the i-th row.

[0154] In some embodiments, the first field satisfies the following conditions:

[0155] M i =(hash(K∥ID∥value i ))modl i +1;

[0156] Among them, l i is the total number of watermark fields that can be embedded in the i-th row, M i Indicates that the first field is in l i The locations where the watermark fields can be embedded are arranged in a set order, M i Less than or equal to l i And M i Greater than 0, ID is the identification information of the first receiving device, value i is the character string corresponding to the data in the fields included in the i-th row attribute combination in the structured database, and K is the master key of the structured database.

[0157] In a possible implementation, when adjusting the data included in the first field of the i-th row according to the watermark bit value of the i-th row, the processing unit 502 is specifically configured to:

[0158] When the attribute of the first field is a numerical attribute, the bit value of the first set position of the first field is modified to the watermark bit value of the i-th row; when the attribute of the first field is a text attribute and the watermark bit value of the i-th row is a first numerical value, an invisible character is added to the second set position of the first field; when the attribute of the first field is a text attribute and the watermark bit value of the i-th row is a second numerical value, the invisible character is not added to the first field.

[0159] Based on the same technical concept, the embodiment of the present application provides a watermark tracing device 600 for a structured database, such as Figure 6 The apparatus 600 can execute each step in the above watermark tracing method, which will not be described in detail here to avoid repetition. The apparatus 600 includes an acquisition unit 601 and a processing unit 602.

[0160] The acquiring unit 601 is configured to acquire a second structured database, where the second structured database is a structured database in which data leakage occurs after a watermark is embedded in the first structured database, the first structured database includes r receiving devices, and the first structured database includes N rows of data;

[0161] The processing unit 602 is configured to obtain an attribute combination and a field that can be embedded in the watermark when embedding the watermark in the first structured database; the attribute combination includes at least one unchangeable field, and the field that can be embedded in the watermark includes at least one field with error tolerance capability;

[0162] The processing unit 602 is further configured to use the identifiers of the r receiving devices, the master key for generating the embedded watermark, and the data in the field included in the attribute combination of the i-th row in the first structured database to generate first watermark bit values ​​corresponding to the r receiving devices, respectively, to obtain first watermark bit sequences corresponding to the r receiving devices, respectively; wherein i is less than or equal to N and i is greater than 0;

[0163] The processing unit 602 is further configured to extract second watermark bit values ​​from the N rows of data included in the embeddable watermark field included in the second structured database to obtain a second bit sequence; and determine the receiving device corresponding to the first watermark bit sequence having the highest similarity with the second watermark bit sequence among the first watermark bit sequences corresponding to the r receiving devices as the receiving device that has engaged in data leakage.

[0164] In some embodiments, the processing unit 602, when using the identifiers of the r receiving devices, the master key for generating the embedded watermark, and the data in the field included in the attribute combination of the i-th row in the first structured database to generate the first watermark bit values ​​corresponding to the r receiving devices, respectively, to obtain the first watermark bit sequences corresponding to the r receiving devices, is specifically configured to:

[0165] A hash operation is performed on the master key, the first identifier, and data in the fields included in the i-th row attribute combination in the first structured database to obtain the first watermark bit value in the i-th row of the first structured database to obtain the first watermark bit sequence; the first identifier is the identifier of the first receiving device among the r receiving devices.

[0166] In some embodiments, the first watermark bit value in the i-th row of the first structured database satisfies the condition shown in the following formula:

[0167] w i =(hash(K∥ID∥value i ))mod2;

[0168] Among them, w i is the watermark bit value of the i-th row in the first structured database, ID is the identification information of the first receiving device, value i is the character string corresponding to the data in the fields included in the i-th row attribute combination in the first structured database, and K is the master key.

[0169] In some embodiments, when extracting the second watermark bit values ​​from the N rows of data included in the embeddable watermark field included in the second structured database, the processing unit 602 is specifically configured to:

[0170] Determine the first field in the embeddable watermark field in the i-th row of the first structured database corresponding to the r receiving devices respectively, and extract the second watermark bit value from the first field in the i-th row of the second structured database to obtain the second bit sequence corresponding to the r receiving devices respectively.

[0171] In some embodiments, the first field satisfies the condition described in the following formula:

[0172] M i =(hash(K∥ID∥value i ))modl i +1;

[0173] Among them, l i is the total number of watermark embeddable fields in row i of the first structured database, M i Indicates that the first field is in l i The locations where the watermark fields can be embedded are arranged in a set order, M i Less than or equal to l i And M i Greater than 0, ID is the identification information of the first receiving device, value i is the character string corresponding to the data in the fields included in the attribute combination of the i-th row in the structured database, and K is the master key.

[0174] In some embodiments, the processing unit 602, when extracting the second watermark bit value from the first field of the i-th row of the second structured database, is specifically configured to:

[0175] When the attribute of the first field is a numerical attribute, extracting the bit value of the first set position of the data included in the first field of the i-th row as the second watermark bit value;

[0176] When the attribute of the first field is a text attribute and the second set position of the first field includes invisible characters, the second watermark bit value is a first value; when the attribute of the first field is a text attribute and the second set position of the first field does not include invisible characters, the second watermark bit value is a second value.

[0177] Based on the same technical concept, the embodiment of the present application provides a watermark embedding device 700 for a structured database, such as Figure 7 The apparatus 700 can execute each step of the above watermark embedding method. The apparatus 700 includes a memory 701 and a processor 702.

[0178] The memory 701 is used to store program instructions;

[0179] The processor is used to call the program instructions stored in the memory and execute the watermark embedding method for the structured database according to the obtained program.

[0180] Based on the same technical concept, the embodiment of the present application provides a watermark tracing device 800 for a structured database, such as Figure 8 The apparatus 800 can execute each step of the above watermark embedding method. The apparatus 800 includes a memory 801 and a processor 802.

[0181] The memory 801 is used to store program instructions;

[0182] The processor 802 is configured to call the program instructions stored in the memory and execute the watermark tracing method for the structured database according to the obtained program.

[0183] In the embodiments of the present application, the processor may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present application may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0184] As a non-volatile computer-readable storage medium, memory can be used to store non-volatile software programs, non-volatile computer executable programs and modules.Memory can include at least one type of storage medium, for example, can include flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), programmable read-only memory (Programmable Read Only Memory, PROM), read-only memory (Read Only Memory, ROM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), magnetic storage, disk, optical disk, etc. Memory is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory in the embodiment of the present application can also be a circuit or other arbitrarily capable of implementing a storage function, for storing program instructions and / or data.

[0185] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0186] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0187] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0188] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0189] Obviously, those skilled in the art may make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include these modifications and variations.

Claims

1. A watermark embedding method for a structured database, characterized in that: include: Acquire a structured database, and determine an attribute combination and an embeddable watermark field from a plurality of fields included in the structured database; The structured database includes N rows of data, and the structured database is to be sent to multiple receiving devices; the attribute combination includes at least one unchangeable field, and the embeddable watermark field includes at least one field with error tolerance capability; For each row of data in the structured database, respectively executing: generating a watermark bit value for the i-th row in the structured database based on the master key used for generating the embedded watermark, the first identifier, and data in the fields included in the i-th row attribute combination; i is less than or equal to N and greater than 0; the first identifier is used to identify a first receiving device, and the first receiving device is any receiving device among the multiple receiving devices; a first field is selected from the embeddable watermark fields in the i-th row, and data included in the first field in the i-th row is adjusted according to the watermark bit value in the i-th row; wherein the adjustment operation is replacement or addition, and the first field satisfies the condition shown in the following formula: M i =(hash(K||ID||value i ))modl i +1; Among them, l i is the total number of watermark fields that can be embedded in the i-th row, M i Indicates that the first field is in l i The locations where the watermark fields can be embedded are arranged in a set order, M i Less than or equal to l i And M i Greater than 0, ID is the identification information of the first receiving device, value i is the string corresponding to the data in the field included in the i-th row of attribute combination in the structured database, K is the master key of the structured database, and || is a connection symbol used to connect the master key, the identification information corresponding to the first receiving device, and the string corresponding to the data in the field included in the i-th row of attribute combination; The structured database after data adjustment is sent to the first receiving device.

2. The method according to claim 1, wherein The step of generating a watermark bit value in the i-th row of the structured database based on the master key for generating the embedded watermark, the first identifier, and data in the fields included in the i-th row attribute combination in the structured database includes: A hash operation is performed on the master key, the first identifier, and data in fields included in the attribute combination of the i-th row in the structured database to obtain a watermark bit value of the i-th row in the structured database.

3. The method according to claim 1 or 2, wherein: The watermark bit value of the i-th row in the structured database satisfies the following conditions: w i =(hash(K||ID||value i ))mod2; Among them, w i is the watermark bit value of the i-th row in the structured database, ID is the identification information of the first receiving device, value i is the character string corresponding to the data in the fields included in the attribute combination of the i-th row in the structured database, and K is the master key.

4. The method according to claim 1, wherein The adjusting the data included in the first field of the i-th row according to the watermark bit value of the i-th row includes: When the attribute of the first field is a numerical attribute, modifying the bit value of the first set position of the first field to the watermark bit value of the i-th row; When the attribute of the first field is a text attribute and the watermark bit value of the i-th row is a first value, an invisible character is added to a second set position of the first field.

5. A watermark tracing method for a structured database, characterized in that: include: Acquire a second structured database, where the second structured database is a structured database in which data leakage occurs after a watermark is embedded in the first structured database, the first structured database includes r receiving devices, and the first structured database includes N rows of data; Acquire an attribute combination and a field that can be embedded in the watermark when embedding the watermark in the first structured database; the attribute combination includes at least one unchangeable field, and the field that can be embedded in the watermark includes at least one field with error tolerance capability; For each row of data in the first structured database, respectively performing the following steps: using the identifiers of r receiving devices, the master key for generating an embedded watermark, and the data in the fields included in the attribute combination of the i-th row to generate first watermark bit values ​​corresponding to the r receiving devices, and determining first fields in the i-th row for the r receiving devices that can be embedded with a watermark, and determining a first watermark bit sequence corresponding to each receiving device based on the first watermark bit value corresponding to each row of data corresponding to each device; wherein i is less than or equal to N and i is greater than 0; The first field satisfies the following conditions: Among them, l i is the total number of watermark fields that can be embedded in row i, Indicates that the first field is in l i The locations where the watermark fields can be embedded are arranged in a set order. Less than or equal to l i and Greater than 0, ID j is the identification information of the jth receiving device, value i is the string corresponding to the data in the fields included in the i-th row of attribute combination in the first structured database, K is the master key of the first structured database, and || is a connection symbol used to connect the master key, the identification information corresponding to the j-th receiving device, and the string corresponding to the data in the fields included in the i-th row of attribute combination in the first structured database; Based on each receiving device, respectively performing: based on each row of the first field that can be embedded with a watermark, respectively extracting second watermark bit values ​​from N rows of data included in the embeddable watermark field included in the second structured database to obtain a second bit sequence; The receiving device corresponding to the first watermark bit sequence having the highest similarity to the second bit sequence among the first watermark bit sequences corresponding to the r receiving devices is determined as the receiving device with data leakage behavior.

6. A watermark embedding device for a structured database, characterized in that: include: An acquisition unit, configured to acquire a structured database and determine an attribute combination and an embeddable watermark field from a plurality of fields included in the structured database; The structured database includes N rows of data, and the structured database is to be sent to multiple receiving devices; the attribute combination includes at least one unchangeable field, and the embeddable watermark field includes at least one field with error tolerance capability; A processing unit is configured to perform, for each row of data in the structured database, the following operations: generating a watermark bit value for the i-th row in the structured database based on a master key for generating an embedded watermark, a first identifier, and data in fields included in the attribute combination of the i-th row in the structured database; i is less than or equal to N and greater than 0; the first identifier is used to identify a first receiving device, the first receiving device being any receiving device among the multiple receiving devices; selecting a first field from the embeddable watermark fields in the i-th row, and adjusting data included in the first field of the i-th row according to the watermark bit value of the i-th row; wherein the adjustment operation is replacement or addition, and the first field satisfies the condition shown in the following formula: M i =(hash(K||ID||value i ))modl i +1; Among them, l i is the total number of watermark fields that can be embedded in the i-th row, M i Indicates that the first field is in l i The locations where the watermark fields can be embedded are arranged in a set order, M i Less than or equal to l i And M i Greater than 0, ID is the identification information of the first receiving device, value i is the string corresponding to the data in the fields included in the i-th row of attribute combination in the structured database, K is the master key of the structured database, and || is a connection symbol used to connect the master key, the identification information corresponding to the first receiving device, and the string corresponding to the data in the fields included in the i-th row of attribute combination; A sending unit is configured to send the structured database after data adjustment to the first receiving device.

7. A watermark tracing device for a structured database, characterized in that: include: Acquisition unit and processing unit; The acquiring unit is configured to acquire a second structured database, where the second structured database is a structured database in which data leakage occurs after a watermark is embedded in the first structured database, the first structured database includes r receiving devices, and the first structured database includes N rows of data; The processing unit is configured to obtain an attribute combination and a field that can be embedded in the watermark when embedding the watermark in the first structured database; the attribute combination includes at least one unchangeable field, and the field that can be embedded in the watermark includes at least one field with error tolerance capability; The processing unit is further configured to, for each row of data in the first structured database, respectively perform the following steps: using the identifiers of the r receiving devices, the master key for generating the embedded watermark, and the data in the fields included in the attribute combination of the i-th row to generate first watermark bit values ​​corresponding to the r receiving devices, and determining a first field in the i-th row for each of the r receiving devices that can be embedded with a watermark, and determining a first watermark bit sequence corresponding to each receiving device based on the first watermark bit value corresponding to each row of data corresponding to each device; wherein i is less than or equal to N and i is greater than 0; The first field satisfies the following conditions: Among them, l i is the total number of watermark fields that can be embedded in row i, Indicates that the first field is in l i The locations where the watermark fields can be embedded are arranged in a set order. Less than or equal to l i and Greater than 0, ID j is the identification information of the jth receiving device, value i is the string corresponding to the data in the fields included in the i-th row of attribute combination in the first structured database, K is the master key of the first structured database, and || is a connection symbol used to connect the master key, the identification information corresponding to the j-th receiving device, and the string corresponding to the data in the fields included in the i-th row of attribute combination in the first structured database; The processing unit is further configured to execute, based on each receiving device, the following steps: based on each row of the first field in which the watermark can be embedded, extracting second watermark bit values ​​from N rows of data included in the embeddable watermark field included in the second structured database to obtain a second bit sequence; and determining, among the first watermark bit sequences corresponding to the r receiving devices, the receiving device corresponding to the first watermark bit sequence having the highest similarity to the second bit sequence as a receiving device that has engaged in data leakage.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 5.

Images