Data watermarking method and data security analysis method and device

Abstract

The present invention provides a data watermark adding method and a data security analysis method and device. The data watermark adding method includes: obtaining network data to be transmitted; adding a first watermark and a second watermark to the network data to obtain watermarked network data; sending the watermarked network data to a target device; wherein the first watermark includes a digital verification watermark and a transmission chain complexity value; the second watermark includes a node quantity value, a processing attribute value and a unique data identifier; by adding a digital verification watermark, a transmission chain complexity value; a node quantity value, a processing attribute value and a unique data identifier watermark to the network data passing through the gateway, the digital watermark in the network data can be extracted during subsequent security analysis, and anomalies in the data transmission process can be identified, so as to respond from the perspective of the data transmission chain, protect the network data security in terms of the data transmission link, and more comprehensively improve network security.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data watermarking method and a data security analysis method and device. Background Art

[0002] With the development of attack technologies and the diversification of attack methods, the application of network attack defense is becoming increasingly widespread, and information security protection is receiving increasing attention. The numerous security incidents that have occurred in recent years, such as those involving the exploitation of security vulnerabilities to invade information systems, demonstrate that attack methods are constantly evolving, becoming more innovative, diverse, and complex. Network security threats have evolved from simple virus threats to new trends such as hacker penetration, ransomware, and mining software, increasing the harm they cause. As long as an attacker discovers an exploitable vulnerability, they can break through external defenses, penetrate into the local area network, and cause damage.

[0003] Existing technologies generally use professional prevention and control software such as firewalls to protect network security. However, using firewalls to protect network security is not comprehensive enough.

[0004] Therefore, how to provide a data security solution that can protect network data security in terms of data transmission links and more comprehensively improve network security is a technical problem that needs to be urgently solved by those skilled in the art. Summary of the Invention

[0005] The present invention provides a data watermarking method and a data security analysis method and device, which protect network data security in terms of data transmission links and improve network security more comprehensively.

[0006] In a first aspect, the present invention provides a data watermarking method, applied to a gateway, comprising:

[0007] Get the network data to be transmitted;

[0008] Adding a first watermark and a second watermark to the network data to obtain watermarked network data;

[0009] sending the watermarked network data to a target device;

[0010] Among them, the first watermark includes a digital verification watermark and a transmission chain complexity value; the second watermark includes a node quantity value, a processing attribute value and a unique data identifier; the digital verification watermark is used to verify the integrity of the network data; the transmission chain complexity value is used to measure the complexity of the transmission link of the network data; the node quantity value is the number value of all network nodes that the network data currently passes through; the processing attribute value is an expression value of whether the current network node processes the network data; and the unique data identifier is used to uniquely identify the network data.

[0011] In one embodiment, adding a first watermark to the network data includes:

[0012] Obtain the size value M of the network data;

[0013] Performing a hash transformation on the size value M to obtain a hash value;

[0014] Encrypting the hash value using a symmetric key to obtain a digital verification watermark;

[0015] The length of the digital verification watermark is a positive integer multiple of 8 bytes.

[0016] In one embodiment, adding a first watermark to the network data includes:

[0017] If the network data is data generated by the current gateway as a source, the number of nodes p=1;

[0018] If the network data is not generated by gateway A, add one to the original number of network nodes to obtain the current number of nodes;

[0019] The transmission chain complexity value is determined by the formula H=log2P.

[0020] In one embodiment, adding a second watermark to the network data includes:

[0021] If the current node is a forwarding node for the network data, the processing attribute value is 0;

[0022] If the current node is the source node of the network data, or the current node repairs the network data after acquiring the network data, the processing attribute value is 1.

[0023] In one embodiment, it further includes:

[0024] Combining the first watermark and the second watermark into two-dimensional watermark information;

[0025] The digital verification watermark in the first watermark is at the front and the transmission chain complexity value is at the back; the node quantity value in the second watermark is at the front, the processing attribute value is in the middle and the unique data identifier is at the back.

[0026] In a second aspect, an embodiment of the present invention provides a data security analysis method for analyzing watermarked network data generated by the data watermarking method described in the first aspect, comprising:

[0027] Obtain the watermark network data to be detected;

[0028] Parsing the watermark network data to obtain a digital verification watermark, a transmission chain complexity value, a node quantity value, a processing attribute value, and a unique data identifier;

[0029] Performing a decryption process in the symmetric encryption on the digital verification watermark to obtain a hash value, and obtaining its corresponding size value M based on the hash value;

[0030] Whether the watermark network data is secure is determined based on the size value M and the current size value of the watermark network data.

[0031] In one embodiment, determining whether the watermark network data is secure based on the size value M and the current size value of the watermark network data includes:

[0032] Obtaining a current size value N of the watermark network data, and when the transmission chain complexity value H=0, when |NM| is equal to a preset difference value, determining that the watermark network data is secure;

[0033] In the case that the transmission chain complexity value H≠0, when |NM| is less than the preset difference value divided by the transmission chain complexity value H, the data is determined to be secure.

[0034] In one embodiment, it further includes:

[0035] If the flag of the processing attribute value is 1, it is determined that an abnormality occurs in the watermark network data after being processed by the previous node, an abnormality occurs during the processing of the previous node, or an abnormality occurs during the transmission of the watermark network data;

[0036] Issue corresponding alarms for the previous node and the transmission path from the previous node to the current node;

[0037] If the flag of the processing attribute value is 0, it is determined that the watermark network data has not been processed at the previous node, and it is determined that an abnormality occurs during the transmission of the watermark network data;

[0038] Corresponding alarms are issued for all transmission paths from the previous node to the current node.

[0039] In a third aspect, an embodiment of the present invention provides a data watermarking device, which is applied to a gateway and includes:

[0040] A data acquisition module, used to acquire network data to be transmitted;

[0041] a watermark adding module, configured to add a first watermark and a second watermark to the network data to obtain watermarked network data;

[0042] A data sending module, used for sending the watermark network data to a target device;

[0043] Among them, the first watermark includes a digital verification watermark and a transmission chain complexity value; the second watermark includes a node quantity value, a processing attribute value and a unique data identifier; the digital verification watermark is used to verify the integrity of the network data; the transmission chain complexity value is used to measure the complexity of the transmission link of the network data; the node quantity value is the number value of all network nodes that the network data currently passes through; the processing attribute value is an expression value of whether the current network node processes the network data; and the unique data identifier is used to uniquely identify the network data.

[0044] In one embodiment, the watermark adding module includes:

[0045] A size obtaining unit, configured to obtain a size value M of the network data;

[0046] A hash transformation unit, configured to perform a hash transformation on the size value M to obtain a hash value;

[0047] An encryption unit, configured to encrypt the hash value using a symmetric key to obtain a digital verification watermark;

[0048] The length of the digital verification watermark is a positive integer multiple of 8 bytes.

[0049] In one embodiment, the watermark adding module includes:

[0050] A first node quantity determining unit, configured to: if the network data is data generated by the current gateway as a source, the node quantity p=1;

[0051] a second node number determination unit, configured to add one to the original number of network nodes to obtain the current number of nodes if the network data is not data generated by gateway A as a source;

[0052] The complexity determination unit is used to determine the transmission chain complexity value through the formula H=log2P.

[0053] In one embodiment, the watermark adding module includes:

[0054] a first attribute value determining unit, configured to process the attribute value as 0 if the current node is a forwarding node for the network data;

[0055] The second attribute value determining unit is configured to set the processing attribute value to 1 if the current node is the source node of the network data or the current node repairs the network data after acquiring the network data.

[0056] In one embodiment, it further includes:

[0057] a two-dimensional watermark generating module, configured to combine the first watermark and the second watermark into two-dimensional watermark information;

[0058] A watermark position determination module is used to determine that the digital verification watermark in the first watermark is at the front and the transmission chain complexity value is at the back; the node quantity value in the second watermark is at the front, the processing attribute value is in the middle and the unique data identifier is at the back.

[0059] In a fourth aspect, an embodiment of the present invention provides a data security analysis device for analyzing watermarked network data generated by the data watermarking method described in the first aspect, comprising:

[0060] A watermark data acquisition module is used to obtain the watermark network data to be detected;

[0061] A watermark parsing module, configured to parse the watermark network data to obtain a digital verification watermark, a transmission chain complexity value, a node quantity value, a processing attribute value, and a unique data identifier;

[0062] A size value parsing module, configured to perform a decryption process in the symmetric encryption on the digital verification watermark to obtain a hash value, and obtain its corresponding size value M based on the hash value;

[0063] The security determination module is used to determine whether the watermark network data is safe based on the size value M and the current size value of the watermark network data.

[0064] In one embodiment, the security determination module includes:

[0065] A first security determination unit is configured to obtain a current size value N of the watermark network data, and determine that the watermark network data is secure when |NM| is equal to a preset difference value when the transmission chain complexity value H=0;

[0066] The second security determination unit is configured to determine data security when |NM| is less than a preset difference value divided by the transmission chain complexity value H when the transmission chain complexity value H≠0.

[0067] In one embodiment, it further includes:

[0068] A first alarm module is configured to, if the flag of the processing attribute value is 1, determine that an abnormality occurs in the watermark network data after being processed by the previous node, determine that an abnormality occurs during the processing of the previous node, or determine that an abnormality occurs during the transmission of the watermark network data; and issue a corresponding alarm for the previous node and the transmission path from the previous node to the current node;

[0069] The second alarm module is used to determine that the watermark network data has not been processed at the previous node if the identification of the processing attribute value is 0, and determine that an abnormality has occurred during the transmission of the watermark network data; and to issue a corresponding alarm for the transmission path from the previous node to the current node.

[0070] In a fifth aspect, the present invention provides an electronic device comprising a memory and a memory storing a computer program, wherein when the processor executes the program, the steps of the data watermark adding method described in the first aspect or the data security analysis method described in the second aspect are implemented.

[0071] In a sixth aspect, the present invention provides a processor-readable storage medium, which stores a computer program, and the computer program is used to enable the processor to execute the steps of the data watermark adding method described in the first aspect or the data security analysis method described in the second aspect.

[0072] The present invention provides a data watermarking method and a data security analysis method and device, which add a digital verification watermark, a transmission chain complexity value, a node quantity value, a processing attribute value and a unique data identification watermark to the network data passing through the gateway, so that the digital watermark in the network data can be extracted during subsequent security analysis. The data is security analyzed based on the digital watermark. This is not only a supplement to existing analysis solutions such as firewalls, but also can identify anomalies in the data transmission process so as to respond from the perspective of the data transmission chain, protect the network data security in the data transmission link, and more comprehensively improve network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0074] Figure 1 A flow chart of a data watermarking method provided by an embodiment of the present invention;

[0075] Figure 2 A flowchart of a data security analysis method provided by an embodiment of the present invention;

[0076] Figure 3 A schematic diagram of the structure of a data watermarking device provided by an embodiment of the present invention;

[0077] Figure 4 A schematic diagram of the structure of a data security analysis device provided by an embodiment of the present invention;

[0078] Figure 5 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0079] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0080] The following combination Figure 1 The data watermarking method of the present invention is described. Figure 1 A schematic flow chart of a data watermarking method provided in an embodiment of the present invention.

[0081] In a specific embodiment of the present invention, the present invention provides a data watermarking method, which is applied to a gateway, comprising:

[0082] Step 110: Obtain network data to be transmitted;

[0083] In the embodiments of the present invention, the network data to be transmitted must first be acquired. After acquiring the network data to be transmitted, conventional methods can generally be used to perform security checks on the network data, such as by using antivirus software. For the gateway, the network data can be source data generated by the gateway or data sent to the gateway by other network devices.

[0084] For example, in one embodiment, network data can be uplink data or downlink data. Taking the network topology as an example, if gateway A transmits data B to local server C, this data transmission link involves a process of analyzing data B transmitted by gateway A (for gateway A, data B is uplink data) and a process of analyzing data B received by local server C (for local server C, data B is downlink data).

[0085] Step 120: adding a first watermark and a second watermark to the network data to obtain watermarked network data;

[0086] After the gateway receives the network data, a first watermark and a second watermark can be added to the network data, wherein the first watermark includes a digital verification watermark and a transmission chain complexity value; the second watermark includes a node quantity value, a processing attribute value and a unique data identifier; the digital verification watermark is used to verify the integrity of the network data; the transmission chain complexity value is used to measure the complexity of the transmission link of the network data; the node quantity value is the number value of all network nodes that the network data currently passes through; the processing attribute value is an expression value of whether the current network node processes the network data; and the unique data identifier is used to uniquely identify the network data.

[0087] Step 130: Send the watermark network data to the target device;

[0088] After the network data has been security checked and watermarked, the watermarked network data can be sent to the target device. For example, if gateway A transmits data B to local server C, this data transmission link involves the process of analyzing data B transmitted by gateway A (for gateway A, data B is uplink data) and data B received by local server C (for local server C, data B is downlink data). Then local server C is the target device. After gateway A adds a watermark to the network data to obtain the watermarked network data, it can send the watermarked network data to local server C.

[0089] In one embodiment, in order to obtain the digital verification watermark in the first watermark, the size value M of the network data can be first obtained; the size value M can be hashed to obtain a hash value; the hash value can be encrypted using a symmetric key to obtain a digital verification watermark; wherein the length of the digital verification watermark is a positive integer multiple of 8 bytes.

[0090] Specifically, a hash is a function that transforms an input of arbitrary length into an output of fixed length through a hashing algorithm. This output is the hash value. This conversion is a compression mapping, meaning that the space of hash values ​​is typically much smaller than the space of inputs. Different inputs may hash to the same output, making it impossible to uniquely identify an input value from the hash value. Simply put, it is a function that compresses a message of arbitrary length into a message digest of a fixed length. In this embodiment of the present invention, the hash transformation is performed on the size of network data, not the network data itself.

[0091] In another embodiment of the present invention, in order to obtain the transmission chain complexity value in the first watermark, if the network data is data generated by the current gateway as the source, the number of nodes p = 1; if the network data is not data generated by gateway A as the source, the current number of nodes is obtained by adding one to the original number of network nodes; the transmission chain complexity value is determined by the formula H = log2P.

[0092] That is, if data B is data generated by gateway A as a source, then p=1.

[0093] If data B is not generated by gateway A, for example, data B is sent by other terminals to gateway A and forwarded by gateway A, or data B is sent by other terminals to gateway A and processed by gateway A, then p = p0 + 1.

[0094] In this embodiment of the present invention, H is used to measure the complexity of a data transmission link. A more complex link indicates a greater security risk, and thus a higher transmission link complexity. A simpler link requires less security analysis, and thus has a lower transmission link complexity. Here, p0 is the total number of nodes passed before gateway A. This data can be obtained from the second watermark of data sent by other terminals, i.e., p0 = the first bit value of the second watermark.

[0095] In another embodiment of the present invention, to obtain a processing attribute value, if the current node is a forwarding node for the network data, the processing attribute value is 0; if the current node is the source node for the network data, or if the current node has repaired the network data after receiving it, the processing attribute value is 1. The data identifier can be a unique identifier for the data derived based on the source node identifier of the data. The processing attribute value is: if the current node is only a forwarding node for data B, i.e., it has not processed data B, the processing attribute value is 0. If the current node is the source node for data B, or if the current node received data B and repaired it, the processing attribute value is 1.

[0096] Regarding the number of nodes: If the current node is the source node of data B, the number of nodes is 1. If the current node is not the source node of data B, for example, the current node is the data B obtained after receiving and repairing the data, the number of nodes is the number of nodes of the received data (i.e., p0) + 1.

[0097] Based on the above embodiment, the first watermark and the second watermark can also be combined into two-dimensional watermark information; the digital verification watermark in the first watermark is in the front, and the transmission chain complexity value is in the back; the node quantity value in the second watermark is in the front, the processing attribute value is in the middle, and the unique data identifier is in the back.

[0098] Please refer to Figure 2 , Figure 2 A flowchart of a data security analysis method provided by an embodiment of the present invention.

[0099] In another specific embodiment of the present invention, an embodiment of the present invention provides a data security analysis method for analyzing watermarked network data generated by the data watermarking method described in the first aspect, comprising:

[0100] Step 210: Obtain watermark network data to be detected;

[0101] Step 220: Parse the watermark network data to obtain a digital verification watermark, a transmission chain complexity value, a node quantity value, a processing attribute value, and a unique data identifier;

[0102] Step 230: performing a decryption process in the symmetric encryption on the digital verification watermark to obtain a hash value, and obtaining its corresponding size value M based on the hash value;

[0103] Step 240: Determine whether the watermark network data is secure based on the size value M and the current size value of the watermark network data.

[0104] In this embodiment, after receiving the watermarked network data, the target device obtains the digital watermark of data B and performs a security analysis based on the digital watermark. The target device obtains the second watermark of data B and parses the digital verification watermark and transmission link complexity H contained in the first watermark. The target device decrypts the digital verification watermark using symmetric encryption to obtain a hash value, which is then used to determine its corresponding value, M. The target device obtains the size of the received data B. If H = 0, the target device determines that the data is secure if |size of received data B - M| = a preset difference value. If H ≠ 0, the target device determines that the data is secure if |size of received data B - M| < a preset difference / H.

[0105] In one embodiment, determining whether the watermark network data is secure based on the size value M and the current size value of the watermark network data includes:

[0106] Obtaining a current size value N of the watermark network data, and when the transmission chain complexity value H=0, when |NM| is equal to a preset difference value, determining that the watermark network data is secure;

[0107] In the case that the transmission chain complexity value H≠0, when |NM| is less than the preset difference value divided by the transmission chain complexity value H, the data is determined to be secure.

[0108] In another embodiment of the present invention, if the identification of the processing attribute value is 1, it is determined that an abnormality occurs in the watermark network data after being processed by the previous node, it is determined that an abnormality occurs during the processing of the previous node, or an abnormality occurs during the transmission of the watermark network data; a corresponding alarm is made for the previous node and the transmission path from the previous node to the current node; if the identification of the processing attribute value is 0, it is determined that the watermark network data has not been processed at the previous node, it is determined that an abnormality occurs during the transmission of the watermark network data; a corresponding alarm is made for the entire transmission path from the previous node to the current node.

[0109] That is to say, when the data is not safe, risk tracing is performed and an alarm is issued. Specifically, if the second bit of the second watermark is marked as 1, it means that the data has an abnormality after being processed by the previous node. The abnormality may have occurred during the processing of the previous node, or it may have occurred during the transmission of data B. Therefore, a corresponding alarm is issued for the previous node and the entire transmission path from the previous node to the current node. If the second bit of the second watermark is marked as 0, it means that the data has not been processed at the previous node, but is only forwarded. The abnormality may have occurred during the transmission of data B. Therefore, a corresponding alarm is issued for the entire transmission path from the previous node to the current node.

[0110] The data security analysis method provided by the embodiment of the present invention adds a digital verification watermark, a transmission chain complexity value, a node quantity value, a processing attribute value, and a unique data identification watermark to the network data passing through the gateway, thereby extracting the digital watermark in the network data during subsequent security analysis and judgment. The data is security analyzed based on the digital watermark. This is not only a supplement to existing analysis solutions such as firewalls, but also can identify anomalies in the data transmission process so as to respond from the perspective of the data transmission chain, protect the network data security in terms of the data transmission link, and more comprehensively improve network security.

[0111] The data watermark adding device provided by the present invention is described below. The data watermark adding device described below and the data watermark adding method described above can refer to each other.

[0112] Please refer to Figure 3 , Figure 3 A schematic diagram of the structure of a data watermarking device provided in an embodiment of the present invention.

[0113] In another specific embodiment of the present invention, an embodiment of the present invention provides a data watermark adding device 300, which is applied to a gateway and includes:

[0114] The data acquisition module 310 is used to acquire network data to be transmitted;

[0115] A watermark adding module 320 is used to add a first watermark and a second watermark to the network data to obtain watermarked network data;

[0116] A data sending module 330 is used to send the watermark network data to a target device;

[0117] Among them, the first watermark includes a digital verification watermark and a transmission chain complexity value; the second watermark includes a node quantity value, a processing attribute value and a unique data identifier; the digital verification watermark is used to verify the integrity of the network data; the transmission chain complexity value is used to measure the complexity of the transmission link of the network data; the node quantity value is the number value of all network nodes that the network data currently passes through; the processing attribute value is an expression value of whether the current network node processes the network data; and the unique data identifier is used to uniquely identify the network data.

[0118] In one embodiment, the watermark adding module includes:

[0119] A size obtaining unit, configured to obtain a size value M of the network data;

[0120] A hash transformation unit, configured to perform a hash transformation on the size value M to obtain a hash value;

[0121] An encryption unit, configured to encrypt the hash value using a symmetric key to obtain a digital verification watermark;

[0122] The length of the digital verification watermark is a positive integer multiple of 8 bytes.

[0123] In one embodiment, the watermark adding module includes:

[0124] A first node quantity determining unit, configured to: if the network data is data generated by the current gateway as a source, the node quantity p=1;

[0125] a second node number determination unit, configured to add one to the original number of network nodes to obtain the current number of nodes if the network data is not data generated by gateway A as a source;

[0126] The complexity determination unit is used to determine the transmission chain complexity value through the formula H=log2P.

[0127] In one embodiment, the watermark adding module includes:

[0128] a first attribute value determining unit, configured to process the attribute value as 0 if the current node is a forwarding node for the network data;

[0129] The second attribute value determining unit is configured to set the processing attribute value to 1 if the current node is the source node of the network data or the current node repairs the network data after acquiring the network data.

[0130] In one embodiment, it further includes:

[0131] a two-dimensional watermark generating module, configured to combine the first watermark and the second watermark into two-dimensional watermark information;

[0132] A watermark position determination module is used to determine that the digital verification watermark in the first watermark is at the front and the transmission chain complexity value is at the back; the node quantity value in the second watermark is at the front, the processing attribute value is in the middle and the unique data identifier is at the back.

[0133] The data security analysis device provided by the present invention is described below. The data security analysis device described below and the data security analysis method described above can be referenced to each other.

[0134] Please refer to Figure 4 , Figure 4 A schematic diagram of the structure of a data security analysis device provided in an embodiment of the present invention.

[0135] In another specific embodiment of the present invention, an embodiment of the present invention provides a data security analysis device 400 for analyzing watermarked network data generated by the data watermarking method described in the first aspect, including:

[0136] The watermark data acquisition module 410 is used to obtain the watermark network data to be detected;

[0137] The watermark parsing module 420 is used to parse the watermark network data to obtain a digital verification watermark, a transmission chain complexity value, a node quantity value, a processing attribute value, and a unique data identifier;

[0138] The size value parsing module 430 is used to perform a decryption process in the symmetric encryption on the digital verification watermark to obtain a hash value, and obtain its corresponding size value M based on the hash value;

[0139] The security determination module 440 is configured to determine whether the watermark network data is secure based on the size value M and the current size value of the watermark network data.

[0140] In one embodiment, the security determination module includes:

[0141] A first security determination unit is configured to obtain a current size value N of the watermark network data, and determine that the watermark network data is secure when |NM| is equal to a preset difference value when the transmission chain complexity value H=0;

[0142] The second security determination unit is configured to determine data security when |NM| is less than a preset difference value divided by the transmission chain complexity value H when the transmission chain complexity value H≠0.

[0143] In one embodiment, it further includes:

[0144] A first alarm module is configured to, if the flag of the processing attribute value is 1, determine that an abnormality occurs in the watermark network data after being processed by the previous node, determine that an abnormality occurs during the processing of the previous node, or determine that an abnormality occurs during the transmission of the watermark network data; and issue a corresponding alarm for the previous node and the transmission path from the previous node to the current node;

[0145] The second alarm module is used to determine that the watermark network data has not been processed at the previous node if the identification of the processing attribute value is 0, and determine that an abnormality has occurred during the transmission of the watermark network data; and to issue a corresponding alarm for the transmission path from the previous node to the current node.

[0146] The embodiments of the present invention provide a data watermark adding device and a data security analysis device, which add a digital verification watermark, a transmission chain complexity value, a node quantity value, a processing attribute value and a unique data identification watermark to the network data passing through the gateway, thereby extracting the digital watermark in the network data during subsequent security analysis and judgment, and performing security analysis on the data based on the digital watermark. This is not only a supplement to existing analysis solutions such as firewalls, but also can identify anomalies in the data transmission process, so as to respond from the perspective of the data transmission chain, protect the network data security in terms of the data transmission link, and more comprehensively improve network security.

[0147] Figure 5 An example of a physical structure diagram of an electronic device is shown below. Figure 5 As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 may call the computer program in the memory 530 to execute the steps of the data watermarking method or the data security analysis method described in the above embodiment, for example, including:

[0148] Acquire network data to be transmitted; add a first watermark and a second watermark to the network data to obtain watermarked network data; send the watermarked network data to a target device; wherein the first watermark includes a digital verification watermark and a transmission chain complexity value; the second watermark includes a node quantity value, a processing attribute value and a unique data identifier; the digital verification watermark is used to verify the integrity of the network data; the transmission chain complexity value is used to measure the complexity of the transmission link of the network data; the node quantity value is the number value of all network nodes that the network data currently passes through; the processing attribute value is an expression value of whether the current network node processes the network data; and the unique data identifier is used to uniquely identify the network data.

[0149] Or obtain watermark network data to be detected; parse the watermark network data to obtain a digital verification watermark, a transmission chain complexity value, a node quantity value, a processing attribute value, and a unique data identifier; perform decryption processing in symmetric encryption on the digital verification watermark to obtain a hash value, and obtain its corresponding size value M based on the hash value; determine whether the watermark network data is secure based on the size value M and the current size value of the watermark network data.

[0150] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0151] On the other hand, the present invention further provides a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions. When the program instructions are executed by a computer, the computer is capable of performing the steps of the data watermarking method or the data security analysis method described in the above embodiments, including:

[0152] Acquire network data to be transmitted; add a first watermark and a second watermark to the network data to obtain watermarked network data; send the watermarked network data to a target device; wherein the first watermark includes a digital verification watermark and a transmission chain complexity value; the second watermark includes a node quantity value, a processing attribute value and a unique data identifier; the digital verification watermark is used to verify the integrity of the network data; the transmission chain complexity value is used to measure the complexity of the transmission link of the network data; the node quantity value is the number value of all network nodes that the network data currently passes through; the processing attribute value is an expression value of whether the current network node processes the network data; and the unique data identifier is used to uniquely identify the network data.

[0153] Or obtain watermark network data to be detected; parse the watermark network data to obtain a digital verification watermark, a transmission chain complexity value, a node quantity value, a processing attribute value, and a unique data identifier; perform decryption processing in symmetric encryption on the digital verification watermark to obtain a hash value, and obtain its corresponding size value M based on the hash value; determine whether the watermark network data is secure based on the size value M and the current size value of the watermark network data.

[0154] On the other hand, an embodiment of the present application further provides a processor-readable storage medium, wherein the processor-readable storage medium stores a computer program, wherein the computer program is configured to cause the processor to execute the steps of the data watermarking method or the data security analysis method provided in the above embodiments, for example, including:

[0155] Acquire network data to be transmitted; add a first watermark and a second watermark to the network data to obtain watermarked network data; send the watermarked network data to a target device; wherein the first watermark includes a digital verification watermark and a transmission chain complexity value; the second watermark includes a node quantity value, a processing attribute value and a unique data identifier; the digital verification watermark is used to verify the integrity of the network data; the transmission chain complexity value is used to measure the complexity of the transmission link of the network data; the node quantity value is the number value of all network nodes that the network data currently passes through; the processing attribute value is an expression value of whether the current network node processes the network data; and the unique data identifier is used to uniquely identify the network data.

[0156] Or obtain watermark network data to be detected; parse the watermark network data to obtain a digital verification watermark, a transmission chain complexity value, a node quantity value, a processing attribute value, and a unique data identifier; perform decryption processing in symmetric encryption on the digital verification watermark to obtain a hash value, and obtain its corresponding size value M based on the hash value; determine whether the watermark network data is secure based on the size value M and the current size value of the watermark network data.

[0157] The processor-readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO)), optical storage (such as CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (such as ROMs, EPROMs, EEPROMs, non-volatile memories (NANDFLASH), solid-state drives (SSDs)), etc.

[0158] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0159] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0160] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A data watermarking method, applied to a gateway, characterized in that: include: Get the network data to be transmitted; Adding a first watermark and a second watermark to the network data to obtain watermarked network data; sending the watermarked network data to a target device; The first watermark includes a digital verification watermark and a transmission chain complexity value; the second watermark includes a node quantity value, a processing attribute value, and a unique data identifier; the digital verification watermark is used to verify the integrity of the network data; the transmission chain complexity value is used to measure the complexity of the transmission link of the network data; the node quantity value is the number of all network nodes currently passed by the network data; the processing attribute value is an expression value of whether the current network node processes the network data; and the unique data identifier is used to uniquely identify the network data. Adding a first watermark to the network data includes: If the network data is data generated by the current gateway as a source, the number of nodes p=1; If the network data is not data generated by the current gateway as a source, then add one to the original number of network nodes to obtain the current number of nodes; The transmission chain complexity value is determined by the formula H=log2P; Adding a second watermark to the network data includes: If the current node is a forwarding node for the network data, the processing attribute value is 0; If the current node is the source node of the network data, or the current node repairs the network data after obtaining the network data, the processing attribute value is 1; Adding a first watermark to the network data includes: Obtain the size value M of the network data; Performing a hash transformation on the size value M to obtain a hash value; Encrypting the hash value using a symmetric key to obtain a digital verification watermark; Wherein, the length of the digital verification watermark is a positive integer multiple of 8 bytes; The size value M and the size value N of the watermark network data are used to: In the case where the transmission chain complexity value H=0, when |NM| is equal to the preset difference value, it is determined that the watermark network data is secure; In the case that the transmission chain complexity value H≠0, when |NM| is less than the preset difference value divided by the transmission chain complexity value H, the data is determined to be secure.

2. The data watermarking method according to claim 1, characterized in that: Also includes: Combining the first watermark and the second watermark into two-dimensional watermark information; The digital verification watermark in the first watermark is at the front and the transmission chain complexity value is at the back; In the second watermark, the node quantity value is at the front, the processing attribute value is in the middle, and the unique data identifier is at the back.

3. A data security analysis method for analyzing watermarked network data generated by the data watermarking method according to any one of claims 1 to 2, characterized in that: include: Obtain the watermark network data to be detected; Parsing the watermark network data to obtain a digital verification watermark, a transmission chain complexity value, a node quantity value, a processing attribute value, and a unique data identifier; Performing a decryption process in the symmetric encryption on the digital verification watermark to obtain a hash value, and obtaining its corresponding size value M based on the hash value; Determining whether the watermark network data is secure based on the size value M and the current size value of the watermark network data; The determining whether the watermark network data is safe based on the size value M and the current size value of the watermark network data includes: Obtaining a current size value N of the watermark network data, and when the transmission chain complexity value H=0, when |NM| is equal to a preset difference value, determining that the watermark network data is secure; In the case that the transmission chain complexity value H≠0, when |NM| is less than the preset difference value divided by the transmission chain complexity value H, the data is determined to be secure.

4. The data security analysis method according to claim 3, characterized in that: Also includes: If the flag of the processing attribute value is 1, it is determined that an abnormality occurs in the watermark network data after being processed by the previous node, an abnormality occurs during the processing of the previous node, or an abnormality occurs during the transmission of the watermark network data; Issue corresponding alarms for the previous node and the transmission path from the previous node to the current node; If the flag of the processing attribute value is 0, it is determined that the watermark network data has not been processed at the previous node, and it is determined that an abnormality occurs during the transmission of the watermark network data; Corresponding alarms are issued for all transmission paths from the previous node to the current node.

5. A data watermark adding device, applied to a gateway, characterized in that: include: A data acquisition module, used to acquire network data to be transmitted; a watermark adding module, configured to add a first watermark and a second watermark to the network data to obtain watermarked network data; A data sending module, used for sending the watermark network data to a target device; The first watermark includes a digital verification watermark and a transmission chain complexity value; the second watermark includes a node quantity value, a processing attribute value, and a unique data identifier; the digital verification watermark is used to verify the integrity of the network data; the transmission chain complexity value is used to measure the complexity of the transmission link of the network data; the node quantity value is the number of all network nodes currently passed by the network data; the processing attribute value is an expression value of whether the current network node processes the network data; and the unique data identifier is used to uniquely identify the network data. Adding a first watermark to the network data includes: If the network data is data generated by the current gateway as a source, the number of nodes p=1; If the network data is not data generated by the current gateway as a source, then add one to the original number of network nodes to obtain the current number of nodes; The transmission chain complexity value is determined by the formula H=log2P; Adding a second watermark to the network data includes: If the current node is a forwarding node for the network data, the processing attribute value is 0; If the current node is the source node of the network data, or the current node repairs the network data after obtaining the network data, the processing attribute value is 1; Adding a first watermark to the network data includes: Obtain the size value M of the network data; Performing a hash transformation on the size value M to obtain a hash value; Encrypting the hash value using a symmetric key to obtain a digital verification watermark; Wherein, the length of the digital verification watermark is a positive integer multiple of 8 bytes; The size value M and the size value N of the watermark network data are used to: In the case where the transmission chain complexity value H=0, when |NM| is equal to the preset difference value, it is determined that the watermark network data is secure; In the case that the transmission chain complexity value H≠0, when |NM| is less than the preset difference value divided by the transmission chain complexity value H, the data is determined to be secure.

6. A data security analysis device for analyzing watermarked network data generated by the data watermarking method according to any one of claims 1 to 2, characterized in that: include: A watermark data acquisition module is used to obtain the watermark network data to be detected; A watermark parsing module, configured to parse the watermark network data to obtain a digital verification watermark, a transmission chain complexity value, a node quantity value, a processing attribute value, and a unique data identifier; A size value parsing module is used to perform a decryption process in the symmetric encryption on the digital verification watermark to obtain a hash value, and obtain its corresponding size value M based on the hash value; A security determination module, configured to determine whether the watermark network data is secure based on the size value M and the current size value of the watermark network data; The determining whether the watermark network data is safe based on the size value M and the current size value of the watermark network data includes: Obtaining a current size value N of the watermark network data, and when the transmission chain complexity value H=0, when |NM| is equal to a preset difference value, determining that the watermark network data is secure; In the case that the transmission chain complexity value H≠0, when |NM| is less than the preset difference value divided by the transmission chain complexity value H, the data is determined to be secure.

7. An electronic device comprising a processor and a memory storing a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the data watermark adding method according to any one of claims 1 to 2, or implements the steps of the data security analysis method according to any one of claims 3 to 4.

8. A processor-readable storage medium, characterized in that: The processor-readable storage medium stores a computer program, which is used to enable the processor to execute the steps of the data watermark adding method according to any one of claims 1 to 2, or execute the steps of the data security analysis method according to any one of claims 3 to 4.

Images