Blockchain-based document forensics method and device

Abstract

This invention provides a method and apparatus for document forensics based on blockchain. The method involves acquiring the peer-to-peer mesh structure of the blockchain and a file query request including the target file type; decomposing the peer-to-peer mesh structure, which includes multiple nodes, to obtain a tree-like decomposition structure; acquiring the mapping relationship between nodes reflecting the corresponding file type; determining the target node corresponding to the target file type based on the target file type and the mapping relationship; constructing a file query index based on the target node and the tree-like decomposition structure; and determining the shortest query path for the file required to respond to the file query request based on the file query index. This invention uses a tree-like decomposition structure to represent the peer-to-peer mesh structure of the blockchain and further combines the tree-like decomposition structure to construct the file query index, adaptively optimizing the path and method of query forensics and improving the efficiency of query forensics.

Description

Technical Field

[0001] This invention belongs to the field of network technology, and in particular relates to a method, apparatus, electronic device and readable storage medium for document forensics based on blockchain. Background Technology

[0002] Blockchain is a cutting-edge technology for ensuring information security. It is a chain composed of multiple blocks, each storing specific information, linked together in chronological order of their creation. This chain is stored on all servers; as long as even one server in the entire system is operational, the entire blockchain is secure. These servers, known as nodes in the blockchain system, provide storage space and computing power for the entire blockchain.

[0003] In existing technologies, the process of querying files is complex and lengthy when conducting secure file forensics based on blockchain, which seriously affects query efficiency. Summary of the Invention

[0004] This invention provides a blockchain-based document forensics method, apparatus, electronic device, and readable storage medium to solve the technical problem of low query efficiency in existing blockchain-based secure document forensics.

[0005] In a first aspect, the present invention provides a document forensics method based on blockchain, the method comprising:

[0006] Obtain the peer-to-peer mesh structure of the blockchain, as well as file query requests including the target query file type, and decompose the peer-to-peer mesh structure including multiple nodes to obtain a tree-like decomposition structure;

[0007] Obtain the mapping relationship used to reflect the nodes corresponding to the queried file type;

[0008] Based on the target query file type and the mapping relationship, determine the target node corresponding to the target query file type;

[0009] Based on the target node and the tree-like decomposition structure, construct a file query index;

[0010] Based on the file query index, determine the shortest query path for the file required to respond to the file query request.

[0011] Secondly, the present invention provides a blockchain-based document forensics device, the device comprising:

[0012] The first acquisition module is used to acquire the peer-to-peer network structure of the blockchain, as well as file query requests including the target query file type, and decompose the peer-to-peer network structure including multiple nodes to obtain a tree-like decomposition structure.

[0013] The second acquisition module is used to acquire the mapping relationship of nodes that reflect the queried file type;

[0014] The mapping module is used to determine the target node corresponding to the target query file type based on the target query file type and the mapping relationship;

[0015] The construction module is used to construct a file query index based on the target node and the tree-like decomposition structure;

[0016] The query module is used to determine the shortest query path for the file to be queried in response to the file query request, based on the file query index.

[0017] Thirdly, the present invention provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that the processor implements the above-described blockchain-based document forensics method when executing the program.

[0018] Fourthly, the present invention provides a readable storage medium that, when the instructions in the storage medium are executed by the processor of an electronic device, enables the electronic device to execute the aforementioned blockchain-based document forensics method.

[0019] In this embodiment of the invention, a tree-like decomposition structure is used to represent the peer-to-peer network structure of the blockchain. Furthermore, by determining the candidate set composed of target nodes during evidence collection, and combining it with the tree-like decomposition structure to construct a file query index, a multi-type repeatable query method is realized to collect evidence on relevant data, which facilitates effective management of business security status. Since this invention has adaptively optimized the path and method of query evidence collection, the entire query evidence collection process can greatly reduce the amount of data transmission and computational complexity. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating the steps of a blockchain-based document forensics method provided in an embodiment of the present invention.

[0022] Figure 2 This is a schematic diagram of a blockchain structure provided in an embodiment of the present invention;

[0023] Figure 3This is a flowchart illustrating the specific steps of a blockchain-based document forensics method provided by an embodiment of the present invention.

[0024] Figure 4 This is an implementation scenario diagram provided by an embodiment of the present invention;

[0025] Figure 5 This is a schematic diagram of a tree-like decomposition structure provided in an embodiment of the present invention;

[0026] Figure 6 This is a schematic diagram of a file query index based on a tree-like decomposition structure provided by an embodiment of the present invention;

[0027] Figure 7 This is a schematic diagram of a query node set provided in an embodiment of the present invention;

[0028] Figure 8 This is an overall flowchart of a blockchain-based document forensics method provided in an embodiment of the present invention;

[0029] Figure 9 This is a structural diagram of a blockchain-based document forensics device provided in an embodiment of the present invention;

[0030] Figure 10 This is a structural diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0031] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0032] Figure 1 This is a flowchart illustrating the steps of a blockchain-based document forensics method provided in an embodiment of the present invention, as follows: Figure 1 As shown, the method may include:

[0033] Step 101: Obtain the peer-to-peer mesh structure of the blockchain, as well as the file query request including the target query file type, and decompose the peer-to-peer mesh structure including multiple nodes to obtain a tree-like decomposition structure.

[0034] Optionally, the query file includes: evaluation element data extracted from the evaluation data file generated by the corresponding node, wherein the evaluation element data is data that has been digitally signed and hashed and uploaded to the blockchain according to the query file type.

[0035] In this embodiment of the invention, the peer-to-peer mesh structure of the blockchain can be specifically referred to as follows. Figure 2 , Figure 2 This is a schematic diagram of a blockchain structure provided by an embodiment of the present invention. The peer-to-peer mesh structure includes 7 nodes: v1, v2, v3, v4, v5, v6, and v7. The query files generated by v1 and v2 belong to the same query file type c1; the query file generated by v3 belongs to the same query file type c2; the query files generated by v4 and v5 belong to the same query file type c3; the query file generated by v6 belongs to the same query file type c4; and the query file generated by v7 belongs to the same query file type c5. The lines connecting the nodes are called edges, which reflect the association between the nodes. The length of the edge reflects the distance between the nodes, such as the distance between v4 and v3 being 2.

[0036] In a practical application scenario, inspection units and security assessment units can connect to the blockchain as regulatory nodes, while other business construction departments and business operation units can act as ledger nodes. All security assessment data collected at every stage of the business lifecycle includes pre-project review reports, construction plan review reports, technical solution demonstration reports, new technology and new business assessment reports, classification and compliance assessment reports, filing reports, graded protection assessment reports, data security risk assessment reports, as well as rectification plans and rectification review records. Key data information includes assessment evidence, assessment plans, assessment item records, and assessment reports; this data can be used for subsequent querying and evidence collection. Key assessment points can be extracted from each assessment data file to form assessment element data. After digitally signing the assessment element data using the key owned by the assessment unit, the assessment element data can be hashed and uploaded to the blockchain according to different assessment element types. That is, each node in the blockchain has query files containing assessment element data; the query file types can be various, and relevant query files can be obtained during document evidence collection.

[0037] Specifically, in the actual calculation process, for the data representation of a peer-to-peer mesh structure, we can define each node in the peer-to-peer mesh structure of the blockchain as G = {V, E}, where V = {vID, x, y, type}. G is the set of all nodes in the blockchain, where type marks the file content to which the node belongs. Its value can be empty (reflecting that the node is a regular node, not a file ledger node), single (reflecting that the node belongs to a single file's ledger node), or multiple (reflecting that the node belongs to multiple files' ledger nodes). E = {eID, vID1, vID2, w} is the set of all edges in G, where vID1 and vID2 are the IDs of the two endpoint nodes in edge eID, and w is the weight (distance) of the edge, representing the data transmission cost (distance or time) of the edge.

[0038] Furthermore, the file query request Q{vID,k,typeList} initiated by the user during the evidence collection process can include: the number of returned results k, the starting query node vID, and the target query file type set typeList. Here, the number of returned results k represents the number of results required for this query evidence collection (the value of k is defined by the user), the starting query node reflects the node that is first traversed during blockchain evidence collection, and the target query file type set includes the types of query files to be searched.

[0039] In this embodiment of the invention, to improve the efficiency and accuracy of forensic investigation, the goal is to find the shortest query path for each node in the blockchain in the shortest possible time. To achieve this, this embodiment decomposes the peer-to-peer network structure into a tree-like decomposition structure. This tree-like decomposition structure organizes the nodes using a distributed tree-like index structure, thereby establishing the blockchain's query data structure. In data forensics applications, especially in distributed environments for data verification, this structure significantly reduces data transmission volume and computational complexity.

[0040] The process of obtaining a tree-like decomposition structure from a tree involves each node in the tree-like decomposition structure being composed of a node in the blockchain and its neighboring nodes. There are multiple node cut sets in the tree, which divide the blockchain into multiple disconnected subgraphs. The fastest path between any two nodes in different subgraphs will pass through a node in the node cut set, thereby establishing a tree-like decomposition structure file.

[0041] Step 102: Obtain the mapping relationship used to reflect the nodes corresponding to the queried file types.

[0042] In this embodiment of the invention, the blockchain predefines the query file type corresponding to each node, such as for... Figure 2 The blockchain structure, whose defined nodes correspond to different query file types, is shown in Table 1:

[0043]

[0044]

[0045] Table 1

[0046] Furthermore, in this embodiment of the invention, an inverted index can be performed on Table 1 to obtain the mapping relationship of nodes reflecting the queried file type, as shown in Table 2:

[0047] c1 v1, v2 c2 v3 c3 v4, v5 c4 v6 c5 v7

[0048] Table 2

[0049] The purpose of an inverted index is to obtain the node information corresponding to each queried file type. During subsequent evidence collection, the corresponding node set can be found based on the target queried file type entered by the user, and this node set can serve as the candidate set for the user's query.

[0050] Step 103: Determine the target node corresponding to the target query file type based on the target query file type and the mapping relationship.

[0051] In this embodiment of the invention, based on the mapping relationship of nodes corresponding to the query file types obtained in step 102 above, the target node corresponding to the target query file type can be determined from the mapping relationship according to the target query file type in the file query request initiated by the user during evidence collection. For example, assuming that the target query file types include: c1, c2, c5, then according to Table 2, the corresponding target nodes can be determined to include: v1, v2, v3, v7.

[0052] Step 104: Construct a file query index based on the target node and the tree-like decomposition structure.

[0053] In this embodiment of the invention, after determining the candidate node set for user query evidence collection consisting of the target node, a corresponding file query index can be constructed for the target node in a tree-like decomposition structure. The file query index includes k (number of returned results) nodes in the blockchain that are closest to the target node. This allows for subsequent combination of the representation of the shortest query path for node queries in the tree-like decomposition structure and the file query index reflecting the proximity of multiple other nodes to the target node, ultimately outputting the k nodes with the optimal query path as the evidence collection result.

[0054] Step 105: Based on the file query index, determine the shortest query path for the file required to respond to the file query request.

[0055] In this embodiment of the invention, by combining the representation of the shortest query path for node query in the tree decomposition structure, and the file query index reflecting the multiple other nodes closest to the target node, the k nodes with the optimal query path are finally output as the evidence collection result, that is, the topological path of the k nodes finally determined in the blockchain, which is the path traversed in the blockchain during this query evidence collection.

[0056] In summary, the embodiments of the present invention employ a tree-like decomposition structure to represent the peer-to-peer network structure of the blockchain. Furthermore, by determining the candidate set composed of target nodes during evidence collection, and combining it with the tree-like decomposition structure to construct a file query index, a multi-type repeatable query method is achieved to collect evidence on relevant data. This facilitates effective management of business security status. Because the present invention adaptively optimizes the query and evidence collection path and method, the entire query and evidence collection process can significantly reduce data transmission volume and computational complexity.

[0057] Figure 3 This is a flowchart illustrating the specific steps of a blockchain-based document forensics method provided in this embodiment of the invention. Figure 3 As shown, the method may include:

[0058] Step 201: Obtain the peer-to-peer mesh structure of the blockchain, as well as the file query request including the target query file type, and select the root node of the tree-like decomposition structure from multiple nodes of the peer-to-peer mesh structure.

[0059] In this embodiment of the invention, reference is made to Figure 4 , Figure 4 This is an implementation scenario diagram provided by an embodiment of the present invention, including an application layer, a data layer, and a network layer. Regarding the network layer, the blockchain is a distributed system built on the Transmission Control Protocol (TCP) / Internet Protocol (IP) and peer-to-peer (P2P) networks. The blockchain does not rely on centralized server nodes to forward messages; instead, every node participates in message forwarding. Therefore, P2P networks have higher security than traditional networks; an attack on any single node will not affect the entire network, and all nodes store the state information of the entire system.

[0060] At the application layer, the blockchain can provide nodes with the ability to extract evaluation element data from their evaluation documents and upload the signature hash to the chain. In addition, in the subsequent evidence collection process, the blockchain also supports users to initiate evidence collection requests, thereby triggering the blockchain's evidence collection process and finding the corresponding documents from the blockchain to achieve evidence collection. Furthermore, when the blockchain is frequently adjusted and changed according to business changes and requirements, the embodiments of the present invention can monitor and warn of the security status of each stage in a timely manner, and track and update the security status changes caused by changes in business requirements by introducing timestamps and blockchain consensus synchronization mechanisms.

[0061] For the data layer, this embodiment of the invention hashes and uploads the evaluation element data owned by each node in the P2P network onto the blockchain. That is, at the data level, evaluation element data can be extracted from the query files of each node, and after digitally signing the evaluation element data using the key owned by its evaluation unit, it is hashed and uploaded to the blockchain according to different types. This embodiment of the invention decomposes the peer-to-peer network structure including multiple nodes into a tree-like decomposition structure (H2H index structure), and constructs a blockchain through the distributed tree index structure, thereby building a distributed operation fingerprint ledger. Each node can use a consensus algorithm to maintain the consistency of the ledger database in the network. By introducing timestamps and a blockchain consensus synchronization mechanism, changes in security status caused by changes in business requirements are tracked and early warnings are updated. This ensures that consensus is reached among individuals without mutual trust in the absence of central control. It guarantees that the operation fingerprint of the data is tamper-proof, cannot be forged, and is traceable. Finally, each node in the blockchain can find the corresponding candidate set for the target query file type required by the user input by classifying nodes. Through the multi-type k-nearest neighbor (KNN) query algorithm constructed in this invention, the evidence collection process of querying multiple types of evaluation element data in the mesh nodes can be realized.

[0062] For this step, when decomposing the peer-to-peer network structure, it is first necessary to determine the root node of the tree-like decomposition structure. The root node should be a node that is passed through by all kinds of query paths in the blockchain as much as possible (equivalent to the most important traffic center node). A root node that meets this requirement can improve the query efficiency and response speed during subsequent evidence collection and query, and reduce the computational complexity.

[0063] Optionally, step 201 may specifically include:

[0064] Sub-step 2011: Obtain the node cut set of the point-to-point mesh structure, wherein the node cut set contains at least one node used as a cut point.

[0065] Sub-step 2012: Based on the length of the edges between the nodes, select the node with the most intersections with the nodes in the node cut set and the shortest average path with the nodes in the node cut set from the plurality of nodes as the root node.

[0066] In this embodiment of the invention, regarding sub-steps 2011-2012, the process of determining the root node involves: firstly, obtaining the node cut sets of the point-to-point network structure. A node cut set is a collection of multiple cut nodes. After deleting the cut nodes and corresponding edges included in the node cut set from the point-to-point network structure, the point-to-point network structure is divided into multiple disconnected subgraphs. For example, Figure 2In the diagram, {v2, v3, v4} is a node cut set. After removing the cut nodes from this node cut set from the point-to-point network structure, the network is divided into three disconnected subgraphs: {v1}, {v7}, and (v5, v6). Since these three cut nodes in the node cut set divide the point-to-point network structure into multiple disconnected subgraphs, the shortest path between nodes in these subgraphs must pass through a node in the node cut set. Therefore, the shortest path between two points can be found using a tree-like decomposition structure. Furthermore, in this embodiment of the invention, the node with the most intersections with nodes in the node cut set and the shortest average path with nodes in the node cut set can be selected from multiple nodes as the root node based on the length of the edges between nodes.

[0067] Reference Figure 2 The node that satisfies the condition of having the most intersections with nodes in the cut set and having the shortest average path with nodes in the cut set is v4. It can be seen that v4 is a traffic hub node, and all query paths in the blockchain will likely pass through v4.

[0068] Step 202: Based on the length of the edges between the nodes, from the remaining nodes, select the descendant nodes of the tree decomposition structure in sequence according to the rule of the shortest distance to the root node and the rule of different query file types, thereby forming the tree decomposition structure.

[0069] In this point-to-point mesh structure, the length of the edge between nodes is used to reflect the distance between the nodes.

[0070] In this embodiment of the invention, for Figure 2 The peer-to-peer network structure of the blockchain shown can be decomposed into the following: Figure 5 The tree-like decomposition structure shown is Figure 5 This is a schematic diagram of a tree-like decomposition structure provided in an embodiment of the present invention. The tree-like decomposition structure has a tree width of 2 and a tree height of 4, and its first layer is the root node v4.

[0071] For the second layer of the tree-like decomposition structure, according to the rule of the shortest distance to the root node and the rule of different query file types, we can first select the node v3 (distance 2) that belongs to a different query file type from v4 and is closest to v4, so that v3 becomes a child node of v4. In addition, the v3 node can also be associated with its ancestor node v4, so that when the subsequent query traverses to the v3 node, it can be located and returned to its ancestor node based on its associated node v4.

[0072] For the third layer of the tree decomposition structure, according to the rule of the shortest distance from the root node and the rule of different query file types, v6, which is of a different type than v3, can be selected as a child node of v4, and v2 (distance 3), which is closer to v4, can be selected as another child node of v4. At the same time, v6 can be associated with its ancestor nodes v3 and v4; v2 can also be associated with its ancestor nodes v3 and v4.

[0073] For the fourth level of the tree-like decomposition structure, based on the rule of shortest distance to the root node and the rule of different query file types, we can select two adjacent nodes v1 and v7 of v2 as its child nodes, and select the adjacent node v5 of v6 as its child node. Simultaneously, v7 can be associated with its ancestor nodes v2 and v4; v1 can also be associated with its ancestor nodes v2 and v3, and v5 can be associated with its ancestor nodes v4 and v6. The purpose of the tree-like decomposition structure is to find the shortest query path for any node in the shortest time.

[0074] Step 203: Obtain a mapping table that reflects the query file type corresponding to the node.

[0075] Step 204: Perform an inverted index on the mapping table to obtain the mapping relationship used to reflect the nodes corresponding to the queried file types.

[0076] Regarding steps 203-204, this embodiment of the invention can perform an inverted index on the mapping relationship table reflecting the query file type corresponding to the node to obtain the mapping relationship used to reflect the node corresponding to the query file type. The specific process can be referred to Tables 1-2 above. The purpose of the inverted index is to obtain the node information corresponding to each query file type. During subsequent evidence collection, the node set corresponding to the target query file type input by the user can be found, and this node set can serve as the candidate set for the user query.

[0077] Step 205: Determine the target node corresponding to the target query file type based on the target query file type and the mapping relationship.

[0078] For details, please refer to step 103 above; it will not be repeated here.

[0079] Step 206: Based on the length of the edges between the nodes, find the k closest second target nodes to each first target node from all target nodes in the tree decomposition structure, and arrange the k second target nodes according to their distance to form the set of neighboring continuous index nodes of the first target node.

[0080] The file query request also includes: the number of results to be returned, k; and the length of the edge between nodes in the point-to-point mesh structure, which reflects the distance between the nodes.

[0081] Step 207: After completing the construction of the set of neighboring consecutive index nodes of all first target nodes in the tree decomposition structure, the file query index is obtained.

[0082] Assuming, based on Figure 2 The file query request for the blockchain structure includes the target query file types as {c1, c2, c5}. According to Table 2, v1 and v2 corresponding to c1, v3 corresponding to c2, and v7 corresponding to c5 can be used as target nodes to form the candidate node set (v1, v2, v3, v7) for this query.

[0083] After determining the candidate node set, based on steps 206-207, refer to Figure 6 , Figure 6 This is a schematic diagram of a file query index based on a tree-like decomposition structure provided by an embodiment of the present invention. If the number of returned results k=3, the k closest second target nodes to each first target node can be found from all target nodes (v1, v2, v3, v7) in the tree-like decomposition structure. The k second target nodes are then arranged according to their distance and used as the set of adjacent continuous index nodes of the first target node.

[0084] For example, from Figure 6 The tree-like decomposition structure begins by calculating the set of K-Continuous-Nearest Neighbor (KCNN) index nodes at the bottom layer. For each first target node u, the shortest distance from nodes in the candidate node set of the first target node needs to be calculated. Based on the calculated shortest distance, for each first target node, k second target nodes with the shortest distance to the first target node are retained. These are denoted as the KCNN index nodes of the first target node. This process continues until the KCNN index nodes of all first target nodes have been calculated, resulting in the file query index. For example, Figure 6 In this context, assuming we start building KCNN from v7, where v7 has no child nodes, its KCNN is only...<v7,0> Continuing the calculation upwards, we reach v2. The intersection of v2 with its child nodes and the candidate node set is {v2, v7, v1}, so its KCNN result is...<v2,0> ,<v1,1> ,<v7,2> Similarly, the calculation can be performed sequentially.

[0085] Step 208: Obtain the starting query node and the ancestor node of the starting query node in the file query index, and form a query node set by combining the set of adjacent continuous index nodes of the starting query node and the set of adjacent continuous index nodes of the ancestor node.

[0086] The file query request also includes: the starting query node.

[0087] In this embodiment of the invention, for Figure 2 The file query request in the blockchain, assuming the starting query node is v2, after constructing such a... Figure 6 After determining the set of neighboring consecutive index nodes for each target node in the tree-like decomposition structure shown, the next step is to select the set of neighboring consecutive index nodes for the starting query node, and the set of neighboring consecutive index nodes for the ancestor nodes of the starting query node, thus forming a structure as follows: Figure 7 The diagram shows the set of query nodes. The set of neighboring consecutive index nodes of the query starting node v2 is v2,0 (0 means the distance between v2 and the query starting node v2 is 0), v1,1 (1 means the distance between v1 and the query starting node v2 is 0), and v7,2 (2 means the distance between v7 and the query starting node v2 is 2). The set of neighboring consecutive index nodes of the ancestor node v3 is v3,0 (0 means the distance between v3 and the ancestor node v3 is 0), v1,3 (3 means the distance between v1 and the ancestor node v3 is 3), and v2,4 (4 means the distance between v2 and the ancestor node v3 is 4). The set of neighboring consecutive index nodes of the ancestor node v4 is v3,2, (2 means the distance between v3 and the ancestor node v4 is 2), v2,3 (3 means the distance between v2 and the ancestor node v4 is 3), and v7,4 (4 means the distance between v7 and the ancestor node v4 is 4).

[0088] Step 209: Based on the selection rule of minimizing the query distance to the starting query node and the length of the edge between the nodes, select k third target nodes with the smallest query distance from all the second target nodes included in the query node set.

[0089] Step 210: Use the topological path between the k third target nodes as the shortest query path for the query file required in response to the file query request.

[0090] After constructing such Figure 7 Following the query node set shown, the first column of the query node set contains the starting query node v2, its parent node v3, and the root node v4. The left sides of v2, v3, and v4 correspond to their respective sets of adjacent consecutive index nodes, forming a 3-row, 4-column data structure. In this embodiment of the invention, based on the selection rule of minimizing the query distance to the starting query node, k third target nodes with the smallest query distances are sequentially selected from all second target nodes (nodes included in the sets of adjacent consecutive index nodes) included in the query node set. Finally, the topological path between these k third target nodes is taken as the shortest query path for the file required to respond to the file query request.

[0091] Optionally, the method further includes:

[0092] Step 211: Calculate the first distance between the second target node and the starting query node.

[0093] Step 212: Calculate the second distance between the ancestor node corresponding to the second target node and the starting query node.

[0094] Step 213: The sum of the first distance and the second distance is used as the query distance.

[0095] Specifically, based on steps 211-213, refer to Figure 7 The specific implementation of selecting k third target nodes with the smallest query distance from all second target nodes included in the query node set is as follows: First, find the second column of KCNN as {<v3,2> ,<v3,0> ,<v2,0> The query distance is calculated as follows: the first distance between the second target node and the starting query node, and the second distance between the ancestor node corresponding to the second target node and the starting query node. Therefore, the query distances calculated from the second column of data are {3+2,4+0,0}, indicating that the node closest to node v2 is {v2}. Then...<v2,0> Delete it, and the second column will become {<v3,2> ,<v3,0> ,<v1,1> At this point, the query distance is {3+2,4+0,0+1}, which means finding {v1} in {v3,v3,v1} that is closest to v2. Finally, then...<v1,1> Delete it, and the second column will become {<v3,2> ,<v3,0> ,<v7,2> In the sequence {V3,V1,V7}, the closest value to V2 is {v7}, so the final result is {v2,v1,v7}. Ultimately, the topological path formed by v2, v1, and v7 can be used as the shortest query path for the file required in response to the file query request.

[0096] In this embodiment of the invention, the overall implementation process of the blockchain-based document forensics method can be referred to... Figure 8 , Figure 8This is an overall flowchart of a blockchain-based file forensics method provided by an embodiment of the present invention. First, the embodiment of the present invention constructs a TEN* index (file query index) using an H2H index file (tree-like decomposition structure) and a candidate set (composed of target nodes). Then, the user inputs a query point v (starting query node), a set of file points (target query file type set), and a value k (number of returned results k). Then, the KCNN (nearest neighbor contiguous index node set) of the query point (starting query node) and the ancestor node of the query point is found from the TEN* index (file query index). Then, the k smallest dist(u, v) (equivalent to k third target nodes) are found from the KCNN. Finally, the topological path between the k third target nodes is used as the shortest query path for the query file required in response to the file query request and the result is output.

[0097] The advantages of this invention also include: efficient and verifiable security assessment data, meaning that both the data recorded in the assessment and the key data generated after processing and analysis have hash values, ensuring the authenticity and validity of the original assessment data and enabling efficient querying. Furthermore, the key elements of the security assessment data are trustworthy and traceable, meaning that the assessment information and assessment data hashes are uploaded to the blockchain. Utilizing the tamper-proof and traceability capabilities of the distributed ledger, the consistency verification of the assessment data is quickly completed by comparing the hash of the data to be assessed with the hash on the blockchain, ensuring the authenticity and validity of the assessment data.

[0098] In summary, the embodiments of the present invention employ a tree-like decomposition structure to represent the peer-to-peer network structure of the blockchain. Furthermore, by determining the candidate set composed of target nodes during evidence collection, and combining it with the tree-like decomposition structure to construct a file query index, a multi-type repeatable query method is achieved to collect evidence on relevant data. This facilitates effective management of business security status. Because the present invention adaptively optimizes the query and evidence collection path and method, the entire query and evidence collection process can significantly reduce data transmission volume and computational complexity.

[0099] Figure 9 This is a structural diagram of a blockchain-based document forensics device provided in an embodiment of the present invention. The device may include:

[0100] The first acquisition module 301 is used to acquire the peer-to-peer mesh structure of the blockchain, as well as file query requests including the target query file type, and decompose the peer-to-peer mesh structure including multiple nodes to obtain a tree-like decomposition structure.

[0101] The second acquisition module 302 is used to acquire the mapping relationship of the nodes that reflect the type of the queried file;

[0102] The mapping module 303 is used to determine the target node corresponding to the target query file type based on the target query file type and the mapping relationship;

[0103] Module 304 is used to construct a file query index based on the target node and the tree-like decomposition structure;

[0104] The query module 305 is used to determine the shortest query path for the query file required in response to the file query request based on the file query index.

[0105] Optionally, the length of the edge between nodes in the point-to-point mesh structure is used to reflect the distance between the nodes;

[0106] The first acquisition module 301 includes:

[0107] The root node submodule is used to select the root node of the tree-like decomposition structure from the plurality of nodes;

[0108] The descendant node submodule selects descendant nodes of the tree decomposition structure from the remaining nodes according to the rule of the shortest distance to the root node and the rule of different query file types, based on the length of the edges between the nodes, thereby forming the tree decomposition structure.

[0109] Optionally, the root node submodule includes:

[0110] A cut point set unit is used to obtain the node cut set of the point-to-point mesh structure, wherein the node cut set contains at least one node used as a cut point.

[0111] The selection unit is used to select the node with the most intersections with the nodes in the node cut set and the shortest average path with the nodes in the node cut set from the plurality of nodes, based on the length of the edges between the nodes.

[0112] Optionally, the second acquisition module 302 includes:

[0113] The mapping acquisition submodule is used to acquire a mapping relationship table that reflects the query file type corresponding to the node;

[0114] The inverted index submodule is used to perform an inverted index on the mapping relationship table to obtain the mapping relationship that reflects the node corresponding to the queried file type.

[0115] Optionally, the file query request further includes: the number of returned results k; and the length of the edges between nodes in the point-to-point mesh structure, used to reflect the distance between the nodes.

[0116] The construction module 304 includes:

[0117] The filtering and construction submodule is used to find the k closest second target nodes to each first target node from all target nodes in the tree decomposition structure based on the length of the edges between the nodes, and arrange the k second target nodes according to the distance to form the set of neighboring continuous index nodes of the first target node.

[0118] The completion submodule is used to construct the set of adjacent continuous index nodes of all first target nodes in the tree decomposition structure, and then obtain the file query index.

[0119] Optionally, the file query request may further include: a starting query node;

[0120] The query module 305 includes:

[0121] The combination submodule is used to obtain the starting query node in the file query index and the ancestor node of the starting query node, and to form a query node set by combining the set of adjacent continuous index nodes of the starting query node and the set of adjacent continuous index nodes of the ancestor node.

[0122] The selection submodule is used to select k third target nodes with the smallest query distance from all second target nodes included in the query node set, based on the selection rule of the minimum query distance to the starting query node and the length of the edge between the nodes.

[0123] The response submodule is used to take the topological path between the k third target nodes as the shortest query path for the query file required in response to the file query request.

[0124] Optionally, the device further includes:

[0125] The first calculation module is used to calculate the first distance between the second target node and the starting query node;

[0126] The second calculation module is used to calculate the second distance between the ancestor node corresponding to the second target node and the starting query node;

[0127] The summation module is used to sum the first distance and the second distance as the query distance.

[0128] Optionally, the query file includes: evaluation element data extracted from the evaluation data file generated by the corresponding node, wherein the evaluation element data is data that has been digitally signed and hashed and uploaded to the blockchain according to the query file type.

[0129] In summary, the embodiments of the present invention employ a tree-like decomposition structure to represent the peer-to-peer network structure of the blockchain. Furthermore, by determining the candidate set composed of target nodes during evidence collection, and combining it with the tree-like decomposition structure to construct a file query index, a multi-type repeatable query method is achieved to collect evidence on relevant data. This facilitates effective management of business security status. Because the present invention adaptively optimizes the query and evidence collection path and method, the entire query and evidence collection process can significantly reduce data transmission volume and computational complexity.

[0130] The present invention also provides an electronic device, see [link to relevant documentation]. Figure 10 It includes: a processor 901, a memory 902, and a computer program 9021 stored in the memory and executable on the processor. When the processor executes the program, it implements the blockchain-based document forensics method of the foregoing embodiments.

[0131] The present invention also provides a readable storage medium that, when the instructions in the storage medium are executed by the processor of an electronic device, enables the electronic device to perform the blockchain-based document forensics method of the foregoing embodiments.

[0132] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0133] It should be noted that all information and data obtained in the embodiments of the present invention were obtained with the authorization of the information / data holder.

[0134] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, this invention is not directed to any particular programming language. It should be understood that the contents of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention.

[0135] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0136] Similarly, it should be understood that, in order to simplify the invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof. However, this disclosure should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the following claims, inventive aspects lie in fewer than all features of a single foregoing disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into this detailed description, wherein each claim itself is a separate embodiment of the invention.

[0137] Those skilled in the art will understand that modules in the device of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiments can be combined into a single module, unit, or component, and further, they can be divided into multiple sub-modules, sub-units, or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination can be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or device so disclosed. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0138] The various component embodiments of the present invention can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the sorting device according to the present invention. The present invention can also be implemented as a device or apparatus program for performing part or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0139] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0140] The user information (including but not limited to user device information, user personal information, etc.) and related data involved in this invention are all information authorized by the user or by the parties.

[0141] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0142] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0143] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A blockchain-based document forensics method, characterized in that, The method includes: Obtain the peer-to-peer mesh structure of the blockchain, as well as file query requests including the target query file type, and decompose the peer-to-peer mesh structure including multiple nodes to obtain a tree-like decomposition structure; Obtain the mapping relationship used to reflect the nodes corresponding to the queried file type; Based on the target query file type and the mapping relationship, determine the target node corresponding to the target query file type; Based on the target node and the tree-like decomposition structure, construct a file query index; Based on the file query index, determine the shortest query path for the file required to respond to the file query request; The length of the edge between nodes in the point-to-point mesh structure is used to reflect the distance between the nodes; The process of decomposing a point-to-point network structure comprising multiple nodes to obtain a tree-like decomposition structure includes: Select the root node of the tree-like decomposition structure from the plurality of nodes; Based on the length of the edges between the nodes, from the remaining nodes, descendant nodes of the tree decomposition structure are selected sequentially according to the rule of the shortest distance to the root node and the rule of different query file types, thereby forming the tree decomposition structure.

2. The method according to claim 1, characterized in that, Selecting the root node of the tree-like decomposition structure from the plurality of nodes includes: Obtain the node cut set of the point-to-point mesh structure, wherein the node cut set contains at least one node used as a cut point; Based on the length of the edges between the nodes, the node with the most intersections with the nodes in the node cut set and the shortest average path with the nodes in the node cut set is selected as the root node.

3. The method according to claim 1, characterized in that, The step of obtaining the mapping relationship used to reflect the nodes corresponding to the queried file type includes: Obtain a mapping table that reflects the query file type corresponding to the node; An inverted index is performed on the mapping table to obtain the mapping relationship used to reflect the nodes corresponding to the queried file types.

4. The method according to claim 1, characterized in that, The file query request also includes: the number of returned results k; and the length of the edges between nodes in the point-to-point mesh structure, used to reflect the distance between the nodes. The step of constructing a file query index based on the target node and the tree-like decomposition structure includes: Based on the length of the edges between the nodes, find the k closest second target nodes to each first target node from all target nodes in the tree decomposition structure, and arrange the k second target nodes according to their distance to form the set of neighboring consecutive index nodes of the first target node. After constructing the set of neighboring consecutive index nodes of all first target nodes in the tree-like decomposition structure, the file query index is obtained.

5. The method according to claim 4, characterized in that, The file query request also includes: a starting query node; Determining the shortest query path for the file required to respond to the file query request based on the file query index includes: Obtain the starting query node and the ancestor node of the starting query node in the file query index, and form a query node set by combining the set of adjacent continuous index nodes of the starting query node and the set of adjacent continuous index nodes of the ancestor node. Based on the selection rule of minimizing the query distance to the starting query node and the length of the edge between the nodes, k third target nodes with the smallest query distance are selected sequentially from all the second target nodes included in the query node set. The topological path between the k third target nodes is taken as the shortest query path for the query file required in response to the file query request.

6. The method according to claim 5, characterized in that, The method further includes: Calculate the first distance between the second target node and the starting query node; Calculate the second distance between the ancestor node corresponding to the second target node and the starting query node; The sum of the first distance and the second distance is taken as the query distance.

7. The method according to any one of claims 1-6, characterized in that, The query file includes: evaluation element data extracted from the evaluation data file generated by the corresponding node. The evaluation element data is data that has been digitally signed and hashed and uploaded to the blockchain according to the query file type.

8. A blockchain-based document forensics device, characterized in that, The device includes: The first acquisition module is used to acquire the peer-to-peer network structure of the blockchain, as well as file query requests including the target query file type, and decompose the peer-to-peer network structure including multiple nodes to obtain a tree-like decomposition structure. The second acquisition module is used to acquire the mapping relationship of nodes that reflect the queried file type; The mapping module is used to determine the target node corresponding to the target query file type based on the target query file type and the mapping relationship; The construction module is used to construct a file query index based on the target node and the tree-like decomposition structure; The query module is used to determine the shortest query path for the file to be queried in response to the file query request, based on the file query index. The first acquisition module includes: The root node submodule is used to select the root node of the tree-like decomposition structure from the plurality of nodes; The descendant node submodule selects descendant nodes of the tree decomposition structure from the remaining nodes according to the rule of the shortest distance to the root node and the rule of different query file types, based on the length of the edges between the nodes, thereby forming the tree decomposition structure.

9. An electronic device, characterized in that, include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method as described in any one of claims 1-7.

10. A readable storage medium, characterized in that, When the instructions in the storage medium are executed by the processor of the electronic device, the electronic device is able to perform the method described in any one of claims 1-7.

Images