Picture processing method, server, client and system

Abstract

The invention discloses a picture processing method, a server, a client and a system, and relates to the technical field of information security. A specific embodiment of the method comprises the steps of obtaining a picture access request sent by a client, wherein the picture access request comprises a first user identifier and a to-be-accessed picture identifier; determining a target encrypted picture stream corresponding to the first user identifier and the picture identifier according to the picture access request; wherein the target encrypted picture stream is obtained by encrypting a picture stream corresponding to the picture identifier for one or more times by using a first symmetric encryption algorithm; and sending the target encrypted picture stream and an encryption keyword corresponding to the first symmetric encryption algorithm to a client, so that the client decrypts the target encrypted picture stream according to the encryption keyword, and renders a target picture according to a decryption result. According to the embodiment, the picture address is prevented from being directly exposed, and the security of the picture information is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an image processing method, a server, a client, and a system. Background Art

[0002] In the transmission process involving private images, the client usually requests the image address from the server, and then the client directly displays the image based on the image address. For example, in the field of online medical care, the client used by the doctor can request the patient's medical image address from the server, and then display the medical image based on the image address.

[0003] However, this way of displaying pictures can easily lead to the exposure of the picture address, causing the pictures to be illegally disseminated, thereby reducing the security of the picture information. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides an image processing method, a server, a client, and a system, which uses a first symmetric encryption to encrypt an image stream once or multiple times to obtain a target encrypted image stream. After obtaining the image access request sent by the client, the target encrypted image stream corresponding to the first user identifier and the image identifier, and the encryption keyword corresponding to the first symmetric encryption algorithm are sent to the client, so that the client can decrypt the target encrypted image stream according to the encryption keyword, and then render the target image according to the decryption result. This avoids directly exposing the image address, and even if other users obtain the encrypted image stream, they cannot access the image information, thereby improving the security of the image information.

[0005] To achieve the above objective, according to one aspect of an embodiment of the present invention, a method for processing an image is provided. When applied to a server, the method for processing an image in an embodiment of the present invention comprises: obtaining an image access request sent by a client, wherein the image access request comprises a first user identifier and an identifier of an image to be accessed;

[0006] Determine, according to the picture access request, a target encrypted picture stream corresponding to the first user identifier and the picture identifier; wherein the target encrypted picture stream is obtained by encrypting the picture stream corresponding to the picture identifier once or multiple times using a first symmetric encryption algorithm;

[0007] The target encrypted image stream and the encryption keyword are sent to the client, so that the client decrypts the target encrypted image stream according to the encryption keyword and renders the target image according to the decryption result; wherein the encryption keyword corresponds to the first symmetric encryption algorithm.

[0008] Optionally, in the case where the target encrypted picture stream is obtained through multiple encryptions, sending the target encrypted picture stream and the encryption keyword to the client comprises:

[0009] Sending the target encrypted picture stream and the encryption keyword of the last encryption to the client, so that the client decrypts the target encrypted picture stream according to the encryption keyword of the last encryption to obtain an intermediate encrypted picture stream;

[0010] Obtaining a decryption request sent by the client according to the intermediate encrypted image stream;

[0011] The encryption keyword corresponding to the intermediate encrypted image stream is sent to the client according to the decryption request.

[0012] Optionally, sending the encryption keyword corresponding to the intermediate encrypted image stream to the client according to the decryption request includes:

[0013] The following steps are executed in a loop until each encrypted keyword is sent to the client:

[0014] Obtaining a decryption request sent by the client, where the decryption request includes the intermediate encrypted image stream and the first user identifier;

[0015] Verifying the user identity according to the first user identifier;

[0016] If the verification passes, an encryption keyword corresponding to the intermediate encrypted picture stream is determined, and the encryption keyword is sent to the client.

[0017] Optionally, the picture access request further includes verification information, where the verification information is obtained by encrypting the second user identifier and the current time period using a second symmetric encryption algorithm; and determining, according to the picture access request, a target encrypted picture stream corresponding to the user identifier and the picture identifier to be accessed, includes:

[0018] Decrypting the verification information using the second symmetric encryption algorithm to obtain the second user identifier and the current time period;

[0019] Verifying whether the first user identifier and the second user identifier match;

[0020] If the verification is successful, it is determined whether there is a target encrypted picture stream corresponding to the current time period.

[0021] Optionally, determining, according to the picture access request, a target encrypted picture stream corresponding to the first user identifier and the picture identifier includes:

[0022] Determine whether the encrypted image stream stored on the server contains the target encrypted image stream;

[0023] In the case that the target encrypted picture stream is not stored in the server, a picture stream corresponding to the picture identifier is obtained, and the picture stream and the current time period are encrypted using the first symmetric encryption algorithm to obtain the target encrypted picture stream.

[0024] Optionally, the method further comprises:

[0025] Encrypting the picture streams corresponding to the multiple picture identifiers respectively according to a preset period to obtain the encrypted picture streams corresponding to the multiple picture identifiers respectively;

[0026] Determine the user ID corresponding to the encrypted image stream according to the preset user authority;

[0027] The user identification and the encrypted picture stream are stored in a cache correspondingly, and the expired encrypted picture stream in the cache is deleted.

[0028] To achieve the above objective, according to another aspect of an embodiment of the present invention, a method for processing an image is provided. When applied to a client, the method for processing an image in an embodiment of the present invention comprises: sending an image access request to a server, the image access request comprising a first user identifier and an identifier of an image to be accessed;

[0029] Receive a target encrypted picture stream corresponding to the first user identifier and the picture identifier, and an encryption keyword corresponding to a first symmetric encryption algorithm, returned by the server according to the picture access request; wherein the target encrypted picture stream is obtained by encrypting the picture stream corresponding to the picture identifier once or multiple times using the first symmetric encryption algorithm;

[0030] The target encrypted picture stream is decrypted according to the encryption keyword, and the target picture is rendered according to the decryption result.

[0031] Optionally, in a case where the target encrypted picture stream is obtained through multiple encryptions, decrypting the target encrypted picture stream according to the encryption keyword includes:

[0032] Obtaining the target encrypted picture stream and the last encrypted encryption keyword sent by the server, and decrypting the target encrypted picture stream using the last encrypted encryption keyword to obtain an intermediate encrypted picture stream;

[0033] A decryption request is generated according to the intermediate encrypted picture stream and the first user identifier, and the decryption request is sent to a server, so that the server sends an encryption keyword corresponding to the intermediate encrypted picture stream according to the decryption request.

[0034] To achieve the above purpose, according to another aspect of an embodiment of the present invention, a server for processing pictures is provided. A server for processing pictures in an embodiment of the present invention comprises: a request acquisition module, a first picture stream processing module and a picture stream sending module; wherein:

[0035] The request acquisition module is used to acquire a picture access request sent by a client, wherein the picture access request includes a first user identifier and a picture identifier to be accessed;

[0036] The first picture stream processing module is used to determine, according to the picture access request, a target encrypted picture stream corresponding to the first user identifier and the picture identifier; wherein the target encrypted picture stream is obtained by encrypting the picture stream corresponding to the picture identifier once or multiple times using a first symmetric encryption algorithm;

[0037] The image stream sending module is used to send the target encrypted image stream and encryption keyword to the client, so that the client decrypts the target encrypted image stream according to the encryption keyword and renders the target image according to the decryption result; wherein the encryption keyword corresponds to the first symmetric encryption algorithm.

[0038] To achieve the above object, according to another aspect of an embodiment of the present invention, a client for processing pictures is provided. A client for processing pictures in an embodiment of the present invention comprises: a request sending module, a picture stream receiving module and a second picture stream processing module; wherein:

[0039] The request sending module is used to send a picture access request to the server, wherein the picture access request includes a first user identifier and a picture identifier to be accessed;

[0040] The picture stream receiving module is used to receive the target encrypted picture stream corresponding to the first user identifier and the picture identifier, and the encryption keyword corresponding to the first symmetric encryption algorithm, which are returned by the server according to the picture access request; wherein the target encrypted picture stream is obtained by encrypting the picture stream corresponding to the picture identifier once or multiple times using the first symmetric encryption algorithm;

[0041] The second image stream processing module is used to decrypt the target encrypted image stream according to the encryption keyword and render the target image according to the decryption result.

[0042] To achieve the above object, according to another aspect of the present invention, a system for processing images is provided. A system for processing images in the present invention comprises: a server for processing images provided in any of the above aspects and a client for processing images provided in any of the above aspects.

[0043] To achieve the above purpose, according to another aspect of an embodiment of the present invention, an electronic device for processing a picture is provided. An electronic device for processing a picture according to an embodiment of the present invention comprises: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement a method for processing a picture according to an embodiment of the present invention.

[0044] To achieve the above object, according to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. A computer-readable storage medium according to an embodiment of the present invention stores a computer program, which, when executed by a processor, implements a method for processing a picture according to an embodiment of the present invention.

[0045] An embodiment of the above invention has the following advantages or beneficial effects: the image stream is encrypted once or multiple times using the first symmetric encryption to obtain a target encrypted image stream. After obtaining the image access request sent by the client, the target encrypted image stream corresponding to the first user identifier and the image identifier, and the encryption keyword corresponding to the first symmetric encryption algorithm are sent to the client, so that the client can decrypt the target encrypted image stream according to the encryption keyword, and then render the target image according to the decryption result. This avoids directly exposing the image address, and even if other users obtain the encrypted image stream, they cannot access the image information, thereby improving the security of the image information.

[0046] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0048] Figure 1 is a schematic diagram of main steps of applying a method for processing an image to a server according to an embodiment of the present invention;

[0049] Figure 2 is a schematic diagram of main steps of applying a method for processing an image to a client according to an embodiment of the present invention;

[0050] Figure 3 is a schematic diagram of main modules of a server for processing pictures according to an embodiment of the present invention;

[0051] Figure 4 is a schematic diagram of main modules of a client for processing pictures according to an embodiment of the present invention;

[0052] Figure 5 is a schematic diagram of main steps of an application method of a system for processing pictures according to an embodiment of the present invention;

[0053] Figure 6 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0054] Figure 7 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0055] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0056] It should be pointed out that the embodiments of the present invention and the technical features therein may be combined with each other without conflict.

[0057] Figure 1 FIG. 1 is a schematic diagram of the main steps of a method for processing a picture according to an embodiment of the present invention. Figure 1 As shown, a method for processing a picture according to an embodiment of the present invention, when applied to a server, mainly comprises the following steps:

[0058] Step S101: obtaining a picture access request sent by a client, wherein the picture access request includes a first user identifier and an identifier of a picture to be accessed.

[0059] In this step, the client can carry the first user identifier and the identifier of the picture to be accessed, and initiate a picture access request to the server through the websocket to request the server to obtain the picture.

[0060] Step S102: Determine a target encrypted picture stream corresponding to the first user identifier and the picture identifier according to the picture access request; wherein the target encrypted picture stream is obtained by encrypting the picture stream corresponding to the picture identifier once or multiple times using a first symmetric encryption algorithm.

[0061] In order to avoid the exposure of the image address and improve the security of the image information, the server can encrypt the image streams corresponding to the pre-stored multiple image identifiers according to the preset period, or it can encrypt the image stream corresponding to the image identifier to be accessed after receiving the image access request. It can be understood that if the image stream is encrypted after receiving the image access request, after generating the encrypted image stream corresponding to the current image access request, the encrypted image stream can also be stored in the cache or server. If a subsequent image access request requests the same image resource again, if the encrypted image stream in the cache or server is not invalid, then the corresponding encrypted image stream can be directly obtained from the cache or server, thereby improving the response efficiency of the image access request.

[0062] In one embodiment of the present invention, in order to improve the response efficiency of the image access request, the server encrypts the image streams corresponding to the pre-stored multiple image identifiers according to a preset period to obtain the encrypted image streams corresponding to the multiple image identifiers. And according to the preset user authority, the user identifier corresponding to the encrypted image stream is determined, and the user identifier and the encrypted image stream are stored in the cache accordingly. Therefore, after receiving the image access request, it can be directly determined from the cache whether there is a target encrypted image stream corresponding to the first user identifier and the image identifier to be accessed. If the target encrypted image stream exists in the cache, the image access request can be directly responded to according to the target encrypted image stream in the cache, thereby improving the response efficiency of the image access request.

[0063] Specifically, during the encryption process, the server can read the locally stored image files (different image files correspond to different image identifiers) through Python, and then convert the image files into array data through the openCV cross-platform computer vision library and cv2 library functions to form an unencrypted image stream. Then, the server can use the first symmetric encryption algorithm to encrypt these unencrypted image streams to form encrypted image streams corresponding to different image files. Among them, the first symmetric encryption algorithm can be an AES (Advanced Encryption Standard) encryption algorithm, a DES (Data Encryption Standard) encryption algorithm, an RC4 (Rivest Cipher 4) encryption algorithm, a Rabbit encryption algorithm, or a 3DES (Triple DES) encryption algorithm. For example, in one embodiment of the present invention, the unencrypted image stream can be symmetrically encrypted by the RC4 encryption algorithm to obtain an encrypted image binary. Specifically, ARC4.new can be used to obtain an encrypted object (i.e., the array data corresponding to the unencrypted image), and then the encrypted binary can be obtained by ARC4.Encrypt. The encrypted binary can then be saved in redis or other cache services, or directly saved in the server. It can be understood that if the image streams corresponding to multiple pre-stored image identifiers are encrypted according to a preset period, then after the encrypted stream is encrypted in the current period and stored in the cache, the expired encrypted image stream in the cache (such as the encrypted image stream formed by encryption in the previous period) can be deleted to save cache resources.

[0064] During the encryption process, the server can determine the number of encryptions corresponding to different image files according to the preset encryption strategy. For example, the preset encryption strategy can be the same number of encryptions corresponding to different image files, such as 1 time, 2 times or multiple times; the preset encryption strategy can also be: according to the user permissions corresponding to different image files, it corresponds to different encryption times, such as 3 times for image files corresponding to high-level user permissions, 2 times for image files corresponding to medium-level user permissions, and 1 time for image files corresponding to low-level user permissions. During multiple encryptions, the server can use multiple different first symmetric encryption algorithms to encrypt the image stream, or it can use the same first symmetric encryption algorithm to encrypt the image stream. For example, when the number of encryptions is 3, the server can use the RC4 encryption algorithm for each encryption, or it can use the RC4 encryption algorithm to encrypt the array data corresponding to the image file for the first encryption to obtain a first intermediate result, and then use the AES encryption algorithm to encrypt the first intermediate result to obtain a second intermediate result, and finally use the DES encryption algorithm to encrypt the second intermediate result to obtain an encrypted image stream. It is understandable that, during each encryption, the server may store the encryption keyword and the encrypted image stream accordingly, so as to decrypt the encrypted image stream according to the corresponding encryption keyword later.

[0065] In addition, in the embodiment of the present invention, the user identifier corresponding to the encrypted image stream can also be determined according to the preset user authority, so that users with different authorities can access different image information. For example, according to the user authority, the encrypted image stream with sensitive information can only be viewed by high-level users. In this way, different encrypted image streams can be graded according to user authority, and specific users can be specified for some sensitive images, thereby limiting the download and dissemination of images, and further improving the security of image information.

[0066] In an embodiment of the present invention, in order to improve the security of image access, when initiating an image access request, the client may carry verification information in addition to the first user identifier and the image identifier to be accessed. The verification information is obtained by encrypting the second user identifier and the current time period using a second symmetric encryption algorithm. After receiving the image access request, the server may verify the user identity and user authority based on the verification information. Only when the verification is successful can it be determined whether there is a corresponding target encrypted image stream, thereby further improving the security of the image information.

[0067] Among them, the second symmetric encryption algorithm can be the same as the above-mentioned first symmetric encryption algorithm, or it can be different from the above-mentioned first symmetric encryption algorithm. For example, the first symmetric encryption algorithm and the second symmetric encryption algorithm can both be RC4 encryption algorithms. For another example, the first symmetric encryption algorithm can be the RC4 encryption algorithm, and the second symmetric encryption algorithm can be the DES encryption algorithm. Specifically, after obtaining the image access request sent by the client, the server can use the second symmetric encryption algorithm to decrypt the verification information to obtain the second user identifier and the current time period; verify whether the first user identifier and the second user identifier match; if the verification is successful, determine whether there is a target encrypted image stream corresponding to the current time period.

[0068] In this embodiment, the image access request may carry three parameters: a first user identifier (such as a user pin), an image identifier to be accessed (such as an image unique ID), and verification information generated by encrypting the second user identifier and the current time period (such as 5 minutes as a time period) through a second symmetric encryption algorithm (such as an RC4 encryption algorithm). During normal access, the first user identifier and the second user identifier should correspond to the same user, while during illegal access, the first user identifier may be tampered with or the client may use the user identifier of a puppet user to initiate an image access request. Therefore, after receiving the image access request, the server may verify the user identity by verifying whether the first user identifier and the second user identifier match, for example, by determining whether the first user identifier and the second user identifier are the same, or by determining whether the first user identifier (such as a user's mobile phone number) and the second user identifier (such as a user's ID number) correspond to the same user to determine whether the two match. In addition, the second user identifier may also be a user identifier that is valid in the current time period, so that the user can be verified to have the right to access the image resource by verifying whether the second user identifier is valid and whether it matches the first user identifier. If the verification is successful, it is determined whether there is a target encrypted image stream corresponding to the current time period corresponding to the user.

[0069] Here, if the server encrypts the image stream in advance according to a preset period, that is, the cache or server stores encrypted image streams corresponding to multiple image files, then it can be directly determined from the cache or server whether there is an encrypted image stream corresponding to the user. For example, the current time period is 1min, and the time of initiating the image access request is 12:00, then the accessible resource corresponding to the image access request should be the encrypted image stream between 12:00 and 12:01. At this time, the server can determine from the cache or locally whether there is a target encrypted image stream corresponding to the time period and user identifier. If so, the target encrypted image stream in the cache and the encryption keyword corresponding to the target encrypted image stream can be directly sent to the client. If the cache or server does not store the corresponding target encrypted image stream locally, the server can obtain the image stream corresponding to the image identifier, and use the first symmetric encryption algorithm to encrypt the image stream and the current time period to obtain the target encrypted image stream. For example, if the server has not updated the encrypted encrypted image stream according to the preset period (5 minutes), and the time period of the encrypted image stream generated in the previous period does not belong to 12:00-12:01, then the server can use the first symmetric encryption algorithm (such as the RC4 encryption algorithm) to encrypt the array data of the original image file and the current time period (1 minute) to generate an encrypted image stream that can be accessed in a short period of time, and return the encrypted image stream that can be accessed in a short period of time as the target encrypted image stream to the client, so that the user corresponding to the client can view the corresponding image file in a short period of time, thereby further improving the security of the image information. It can be understood that the generation of a short-term accessible encrypted image stream in this embodiment is only an example. In actual applications, short-term or long-term accessible encrypted image streams can also be generated according to different user permissions. The specific period can be set according to the actual application scenario and user permissions.

[0070] Step S103: Send the target encrypted image stream and encryption keyword to the client, so that the client decrypts the target encrypted image stream according to the encryption keyword and renders the target image according to the decryption result; wherein the encryption keyword corresponds to the first symmetric encryption algorithm.

[0071] In an embodiment of the present invention, if the target encrypted image stream is single-encrypted, then after the server sends the corresponding encryption keyword of the target encrypted image stream to the client, the client can decrypt the target encrypted image stream according to the encryption keyword, thereby obtaining the decrypted image stream, and then can draw the image through canvas and render it for display to the user of the client.

[0072] If the target encrypted image stream is obtained through multiple encryptions, the server will first send the target encrypted image stream and the encryption keyword of the last encryption to the client after verifying the user's identity and permissions. The client can decrypt the target encrypted image stream according to the encryption keyword of the last encryption to obtain the intermediate encrypted image stream. The client then initiates a decryption request to the server based on the intermediate encrypted image stream and its user ID. The server verifies the user's identity and permissions based on the decryption request, and then sends the encryption keyword corresponding to the intermediate encrypted image stream to the client.

[0073] Specifically, when the server sends the encryption keyword corresponding to the intermediate encrypted image stream, it can loop the following steps until each encrypted encryption keyword is sent to the client: obtain the decryption request sent by the client, the decryption request including the intermediate encrypted image stream and the first user identifier; verify the user identity according to the first user identifier; if the verification passes, determine the encryption keyword corresponding to the intermediate encrypted image stream, and send the encryption keyword to the client.

[0074] Among them, when verifying the user identity according to the first user identifier, the user identity verification can be achieved by verifying whether the first user identifier matches the second user identifier in the image access request. After receiving the encryption keyword each time, the client can use the encryption keyword to decrypt the intermediate encrypted image stream to obtain the decrypted image stream. If it is the final decryption (such as obtaining the final Base64 image stream), the canvas is used to draw the image to render and display the image.

[0075] It is worth mentioning that in this embodiment, if the target encrypted image stream is an encrypted image stream that is accessible in a short period of time and generated by the server according to the image access request, and the encrypted image stream that is accessible in a short period of time is obtained through multiple encryptions, then when the client initiates a decryption request based on the intermediate encrypted image stream, the server can also verify the validity of the intermediate encrypted image stream according to the timestamp carried by the decryption request. If the validity of the intermediate encrypted image stream has expired, the server refuses to send the encryption keyword corresponding to the intermediate encrypted image stream. This limits the user's download and access to the image, realizes image access for specific users and specific times, and further improves the security of image information.

[0076] In addition, in an embodiment of the present invention, if the target encrypted image stream returned by the server to the client has expired or the image needs to be immediately blocked and deleted, the server can issue an image processing instruction through the webscoket, so that the client can achieve real-time deletion or restriction of image information according to the image processing instruction, thereby performing real-time deletion or access restriction operations on images that need to be restricted immediately, thereby further improving the security of the image information.

[0077] According to a method for processing pictures according to an embodiment of the present invention, it can be seen that the picture stream is encrypted once or multiple times using the first symmetric encryption to obtain a target encrypted picture stream. After obtaining the picture access request sent by the client, the target encrypted picture stream corresponding to the first user identifier and the picture identifier, and the encryption keyword corresponding to the first symmetric encryption algorithm are sent to the client, so that the client can decrypt the target encrypted picture stream according to the encryption keyword, and then render the target picture according to the decryption result. Thereby, direct exposure of the picture address is avoided, and even if other users obtain the encrypted picture stream, they cannot access the picture information, thereby improving the security of the picture information. When the method for processing pictures provided by the embodiment of the present invention is applied to the field of online medical care, the illegal dissemination of privacy pictures such as patient diagnosis and treatment pictures and patient information pictures caused by the exposure of the picture address can be avoided, thereby improving the security of the picture information while also protecting user privacy and improving user experience.

[0078] Figure 2 FIG. 1 is a schematic diagram of the main steps of a method for processing a picture according to an embodiment of the present invention. Figure 2 As shown, a method for processing a picture according to an embodiment of the present invention, when applied to a client, mainly comprises the following steps:

[0079] Step S201: sending a picture access request to a server, wherein the picture access request includes a first user identifier and an identifier of a picture to be accessed.

[0080] In this step, the client can carry the first user identifier and the identifier of the picture to be accessed, and initiate a picture access request to the server through the websocket to request the server to obtain the picture.

[0081] Step S202: Receive the target encrypted picture stream corresponding to the first user identifier and the picture identifier, and the encryption keyword corresponding to the first symmetric encryption algorithm, which are returned by the server according to the picture access request; wherein the target encrypted picture stream is obtained by encrypting the picture stream corresponding to the picture identifier once or multiple times using the first symmetric encryption algorithm.

[0082] In order to avoid exposure of the image address and improve the security of the image information, the server can encrypt the image streams corresponding to multiple pre-stored image identifiers according to a preset period, or it can encrypt the image stream corresponding to the image identifier to be accessed after receiving the image access request.

[0083] In one embodiment of the present invention, in order to improve the response efficiency of the image access request, the server encrypts the image streams corresponding to the pre-stored multiple image identifiers according to a preset period to obtain the encrypted image streams corresponding to the multiple image identifiers. And according to the preset user authority, the user identifier corresponding to the encrypted image stream is determined, and the user identifier and the encrypted image stream are stored in the cache accordingly. Therefore, after receiving the image access request, it can be directly determined from the cache whether there is a target encrypted image stream corresponding to the first user identifier and the image identifier to be accessed. If the target encrypted image stream exists in the cache, the image access request can be directly responded to according to the target encrypted image stream in the cache, thereby improving the response efficiency of the image access request.

[0084] Specifically, during the encryption process, the server can read the locally stored image files (different image files correspond to different image identifiers) through Python, and then convert the image files into array data through the openCV cross-platform computer vision library and cv2 library functions to form an unencrypted image stream. Then, the server can use the first symmetric encryption algorithm to encrypt these unencrypted image streams to form encrypted image streams corresponding to different image files. Among them, the first symmetric encryption algorithm can be an AES (Advanced Encryption Standard) encryption algorithm, a DES (Data Encryption Standard) encryption algorithm, an RC4 (Rivest Cipher 4) encryption algorithm, a Rabbit encryption algorithm, or a 3DES (Triple DES) encryption algorithm. For example, in one embodiment of the present invention, the unencrypted image stream can be symmetrically encrypted by the RC4 encryption algorithm to obtain an encrypted image binary. Specifically, ARC4.new can be used to obtain an encrypted object (i.e., the array data corresponding to the unencrypted image), and then the encrypted binary can be obtained by ARC4.Encrypt. The encrypted binary can then be saved in redis or other cache services, or directly saved in the server. It can be understood that if the image streams corresponding to multiple pre-stored image identifiers are encrypted according to a preset period, then after the encrypted stream is encrypted in the current period and stored in the cache, the expired encrypted image stream in the cache (such as the encrypted image stream formed by encryption in the previous period) can be deleted to save cache resources.

[0085] During the encryption process, the server can determine the number of encryptions corresponding to different image files according to the preset encryption strategy. For example, the preset encryption strategy can be the same number of encryptions corresponding to different image files, such as 1 time, 2 times or multiple times; the preset encryption strategy can also be: according to the user permissions corresponding to different image files, it corresponds to different encryption times, such as 3 times for image files corresponding to high-level user permissions, 2 times for image files corresponding to medium-level user permissions, and 1 time for image files corresponding to low-level user permissions. During multiple encryptions, the server can use multiple different first symmetric encryption algorithms to encrypt the image stream, or it can use the same first symmetric encryption algorithm to encrypt the image stream. For example, when the number of encryptions is 3, the server can use the RC4 encryption algorithm for each encryption, or it can use the RC4 encryption algorithm to encrypt the array data corresponding to the image file for the first encryption to obtain a first intermediate result, and then use the AES encryption algorithm to encrypt the first intermediate result to obtain a second intermediate result, and finally use the DES encryption algorithm to encrypt the second intermediate result to obtain an encrypted image stream. It is understandable that, during each encryption, the server may store the encryption keyword and the encrypted image stream accordingly, so as to decrypt the encrypted image stream according to the corresponding encryption keyword later.

[0086] In addition, in the embodiment of the present invention, the user identifier corresponding to the encrypted image stream can also be determined according to the preset user authority, so that users with different authorities can access different image information. For example, according to the user authority, the encrypted image stream with sensitive information can only be viewed by high-level users. In this way, different encrypted image streams can be graded according to user authority, and specific users can be specified for some sensitive images, thereby limiting the download and dissemination of images, and further improving the security of image information.

[0087] In an embodiment of the present invention, in order to improve the security of image access, when initiating an image access request, the client may carry verification information in addition to the first user identifier and the image identifier to be accessed. The verification information is obtained by encrypting the second user identifier and the current time period using a second symmetric encryption algorithm. After receiving the image access request, the server may verify the user identity and user authority based on the verification information. Only when the verification is successful can it be determined whether there is a corresponding target encrypted image stream, thereby further improving the security of the image information.

[0088] Among them, the second symmetric encryption algorithm can be the same as the above-mentioned first symmetric encryption algorithm, or it can be different from the above-mentioned first symmetric encryption algorithm. For example, the first symmetric encryption algorithm and the second symmetric encryption algorithm can both be RC4 encryption algorithms. For another example, the first symmetric encryption algorithm can be the RC4 encryption algorithm, and the second symmetric encryption algorithm can be the DES encryption algorithm. Specifically, after obtaining the image access request sent by the client, the server can use the second symmetric encryption algorithm to decrypt the verification information to obtain the second user identifier and the current time period; verify whether the first user identifier and the second user identifier match; if the verification is successful, determine whether there is a target encrypted image stream corresponding to the current time period.

[0089] In this embodiment, the image access request may carry three parameters: a first user identifier (such as a user pin), an identifier of the image to be accessed (such as a unique ID of the image), and verification information generated by encrypting the second user identifier and the current time period (such as 5 minutes as a time period) through a second symmetric encryption algorithm (hereinafter taking the RC4 encryption algorithm as an example). During normal access, the first user identifier and the second user identifier should correspond to the same user, while during illegal access, the first user identifier may be tampered with or the client may use the user identifier of a puppet user to initiate an image access request. Therefore, after receiving the image access request, the server may verify the user identity by verifying whether the first user identifier and the second user identifier match, for example, by determining whether the first user identifier and the second user identifier are the same, or by determining whether the first user identifier (such as a user's mobile phone number) and the second user identifier (such as a user's ID number) correspond to the same user to determine whether the two match. If the verification is successful, it is then determined whether there is a target encrypted image stream corresponding to the current time period corresponding to the user.

[0090] Here, if the server encrypts the image stream in advance according to a preset period, that is, the cache or server stores encrypted image streams corresponding to multiple image files, then it can be directly determined from the cache or server whether there is an encrypted image stream corresponding to the user. For example, the current time period is 1min, and the time of initiating the image access request is 12:00, then the accessible resource corresponding to the image access request should be the encrypted image stream between 12:00 and 12:01. At this time, the server can determine from the cache or locally whether there is a target encrypted image stream corresponding to the time period and user identifier. If so, the target encrypted image stream in the cache and the encryption keyword corresponding to the target encrypted image stream can be directly sent to the client. If the cache or server does not store the corresponding target encrypted image stream locally, the server can obtain the image stream corresponding to the image identifier, and use the first symmetric encryption algorithm to encrypt the image stream and the current time period to obtain the target encrypted image stream. For example, if the server has not updated the encrypted encrypted image stream according to the preset period (5 minutes), and the time period of the encrypted image stream generated in the previous period does not belong to 12:00-12:01, then the server can use the first symmetric encryption algorithm (such as the RC4 encryption algorithm) to encrypt the array data of the original image file and the current time period (1 minute) to generate an encrypted image stream that can be accessed in a short period of time, and return the encrypted image stream that can be accessed in a short period of time as the target encrypted image stream to the client, so that the corresponding user of the client can view the corresponding image file in a short time, thereby further improving the security of the image information.

[0091] Step S203: decrypt the target encrypted image stream according to the encryption keyword, and render the target image according to the decryption result.

[0092] In an embodiment of the present invention, if the target encrypted image stream is single-encrypted, then after the server sends the corresponding encryption keyword of the target encrypted image stream to the client, the client can decrypt the target encrypted image stream according to the encryption keyword, thereby obtaining the decrypted image stream, and then can draw the image through canvas and render it for display to the user of the client.

[0093] If the target encrypted image stream is obtained through multiple encryptions, the server will first send the target encrypted image stream and the encryption keyword of the last encryption to the client after verifying the user's identity and permissions. The client can decrypt the target encrypted image stream according to the encryption keyword of the last encryption to obtain the intermediate encrypted image stream. The client then initiates a decryption request to the server based on the intermediate encrypted image stream and its user ID. The server verifies the user's identity and permissions based on the decryption request, and then sends the encryption keyword corresponding to the intermediate encrypted image stream to the client.

[0094] Specifically, when the server sends the encryption keyword corresponding to the intermediate encrypted image stream, it can loop the following steps until each encrypted encryption keyword is sent to the client: obtain the decryption request sent by the client, the decryption request including the intermediate encrypted image stream and the first user identifier; verify the user identity according to the first user identifier; if the verification passes, determine the encryption keyword corresponding to the intermediate encrypted image stream, and send the encryption keyword to the client.

[0095] Among them, when verifying the user identity according to the first user identifier, the user identity verification can be achieved by verifying whether the first user identifier matches the second user identifier in the image access request. After receiving the encryption keyword each time, the client can use the encryption keyword to decrypt the intermediate encrypted image stream to obtain the decrypted image stream. If it is the final decryption (such as obtaining the final Base64 image stream), the canvas is used to draw the image to render and display the image.

[0096] It is worth mentioning that in this embodiment, if the target encrypted image stream is an encrypted image stream that is accessible in a short period of time and generated by the server according to the image access request, and the encrypted image stream that is accessible in a short period of time is obtained through multiple encryptions, then when the client initiates a decryption request based on the intermediate encrypted image stream, the server can also verify the validity of the intermediate encrypted image stream according to the timestamp carried by the decryption request. If the validity of the intermediate encrypted image stream has expired, the server refuses to send the encryption keyword corresponding to the intermediate encrypted image stream. This limits the user's download and access to the image, realizes image access for specific users and specific times, and further improves the security of image information.

[0097] According to a method for processing pictures according to an embodiment of the present invention, it can be seen that the picture stream is encrypted once or multiple times using the first symmetric encryption to obtain a target encrypted picture stream. After obtaining the picture access request sent by the client, the target encrypted picture stream corresponding to the first user identifier and the picture identifier, and the encryption keyword corresponding to the first symmetric encryption algorithm are sent to the client, so that the client can decrypt the target encrypted picture stream according to the encryption keyword, and then render the target picture according to the decryption result. Thereby, direct exposure of the picture address is avoided, and even if other users obtain the encrypted picture stream, they cannot access the picture information, thereby improving the security of the picture information. When the method for processing pictures provided by the embodiment of the present invention is applied to the field of online medical care, the illegal dissemination of privacy pictures such as patient diagnosis and treatment pictures and patient information pictures caused by the exposure of the picture address can be avoided, thereby improving the security of the picture information while also protecting user privacy and improving user experience.

[0098] Figure 3FIG. 1 is a schematic diagram of the main modules of a server for processing pictures according to an embodiment of the present invention. Figure 3 As shown, a server 300 for processing pictures in an embodiment of the present invention includes: a request acquisition module 301, a first picture stream processing module 302 and a picture stream sending module 303; wherein,

[0099] The request acquisition module 301 is used to acquire a picture access request sent by a client, wherein the picture access request includes a first user identifier and a picture identifier to be accessed;

[0100] The first picture stream processing module 302 is used to determine, according to the picture access request, a target encrypted picture stream corresponding to the first user identifier and the picture identifier; wherein the target encrypted picture stream is obtained by encrypting the picture stream corresponding to the picture identifier once or multiple times using a first symmetric encryption algorithm;

[0101] The image stream sending module 303 is used to send the target encrypted image stream and encryption keyword to the client, so that the client decrypts the target encrypted image stream according to the encryption keyword and renders the target image according to the decryption result; wherein the encryption keyword corresponds to the first symmetric encryption algorithm.

[0102] In one embodiment of the present invention, when the target encrypted picture stream is obtained through multiple encryptions, the picture stream sending module 303 is used to send the target encrypted picture stream and the encryption keyword of the last encryption to the client, so that the client decrypts the target encrypted picture stream according to the encryption keyword of the last encryption to obtain an intermediate encrypted picture stream; obtains a decryption request sent by the client according to the intermediate encrypted picture stream; and sends the encryption keyword corresponding to the intermediate encrypted picture stream to the client according to the decryption request.

[0103] In one embodiment of the present invention, the image stream sending module 303 is used to loop the following steps until the encryption keyword for each encryption is sent to the client: obtain a decryption request sent by the client, the decryption request including the intermediate encrypted image stream and the first user identifier; verify the user identity based on the first user identifier; if the verification passes, determine the encryption keyword corresponding to the intermediate encrypted image stream, and send the encryption keyword to the client.

[0104] In one embodiment of the present invention, the image access request also includes verification information, which is obtained by encrypting the second user identifier and the current time period using a second symmetric encryption algorithm; the first image stream processing module is used to decrypt the verification information using the second symmetric encryption algorithm to obtain the second user identifier and the current time period; verify whether the first user identifier and the second user identifier match; and if the verification passes, determine whether there is a target encrypted image stream corresponding to the current time period.

[0105] In one embodiment of the present invention, the picture stream sending module 303 is used to determine whether the encrypted picture stream stored on the server side is the same as the target encrypted picture stream; if the target encrypted picture stream is not stored on the server side, obtain the picture stream corresponding to the picture identifier, and use the first symmetric encryption algorithm to encrypt the picture stream and the current time period to obtain the target encrypted picture stream.

[0106] In one embodiment of the present invention, the first image stream processing module 302 is further used to encrypt the image streams corresponding to multiple image identifiers according to a preset period to obtain encrypted image streams corresponding to the multiple image identifiers; determine the user identifier corresponding to the encrypted image stream according to preset user permissions; store the user identifier and the encrypted image stream in a cache, and delete expired encrypted image streams in the cache.

[0107] Figure 4 FIG. 1 is a schematic diagram of the main modules of a client for processing pictures according to an embodiment of the present invention. Figure 4 As shown, a client 400 for processing pictures according to an embodiment of the present invention includes: a request sending module 401, a picture stream receiving module 402 and a second picture stream processing module 403; wherein,

[0108] The request sending module 401 is used to send a picture access request to the server, wherein the picture access request includes a first user identifier and a picture identifier to be accessed;

[0109] The picture stream receiving module 402 is used to receive the target encrypted picture stream corresponding to the first user identifier and the picture identifier, and the encryption keyword corresponding to the first symmetric encryption algorithm, which are returned by the server according to the picture access request; wherein the target encrypted picture stream is obtained by encrypting the picture stream corresponding to the picture identifier once or multiple times using the first symmetric encryption algorithm;

[0110] The second image stream processing module 403 is used to decrypt the target encrypted image stream according to the encryption keyword and render the target image according to the decryption result.

[0111] In one embodiment of the present invention, when the target encrypted picture stream is obtained through multiple encryptions, the second picture stream processing module 403 is used to obtain the target encrypted picture stream and the encryption keyword of the last encryption sent by the server, and use the encryption keyword of the last encryption to decrypt the target encrypted picture stream to obtain an intermediate encrypted picture stream; generate a decryption request according to the intermediate encrypted picture stream and the first user identifier, and send the decryption request to the server, so that the server sends the encryption keyword corresponding to the intermediate encrypted picture stream according to the decryption request.

[0112] According to a server and client for processing pictures according to an embodiment of the present invention, it can be seen that the picture stream is encrypted once or multiple times using the first symmetric encryption to obtain a target encrypted picture stream. After obtaining the picture access request sent by the client, the target encrypted picture stream corresponding to the first user identifier and the picture identifier, and the encryption keyword corresponding to the first symmetric encryption algorithm are sent to the client, so that the client can decrypt the target encrypted picture stream according to the encryption keyword, and then render the target picture according to the decryption result. This avoids direct exposure of the picture address, and even if other users obtain the encrypted picture stream, they cannot access the picture information, thereby improving the security of the picture information. When the client and server for processing pictures provided by the embodiment of the present invention are applied to the field of online medical care (such as the client is the client used by the doctor, and the server is the corresponding background server), it can avoid the illegal dissemination of privacy pictures such as patient diagnosis and treatment pictures and patient information pictures due to the exposure of the picture address, thereby improving the security of the picture information while also protecting the user privacy and improving the user experience.

[0113] In addition, an embodiment of the present invention further provides a system for processing images, including a server for processing images provided by any of the above embodiments and a client for processing images provided by any of the above embodiments. The following takes the example that both the first symmetric encryption algorithm and the second symmetric encryption algorithm are RC4 encryption algorithms, and the image stream is encrypted twice using the RC4 encryption algorithm to illustrate the workflow of the system for processing images provided by an embodiment of the present invention. In the system for processing images, SDKs may be provided for the server and the client, respectively, wherein the server SDK mainly handles the user identification verification and the encryption process of the image resources. The client SDK mainly provides the process of providing the user identification to the server for verification and decryption of the image resources to obtain the image data.

[0114] like Figure 5 As shown, when the system provided by the embodiment of the present invention is used to process the picture, the following steps may be mainly included:

[0115] Step S501: The server obtains an unencrypted image stream.

[0116] Here, the server can read the locally stored image files through Python (different image files correspond to different image tags), and then convert the image files corresponding to each image tag into array data through the openCV cross-platform computer vision library and cv2 library functions, forming unencrypted image streams corresponding to each image tag.

[0117] Step S502: the server performs symmetrical encryption on the image stream twice using the RC4 encryption algorithm according to a preset period to obtain encrypted image streams corresponding to each image identifier.

[0118] Here, the server symmetrically encrypts the image through the Python RC4 encryption algorithm and the encryption keyword key1 to obtain an intermediate encrypted image stream, and then encrypts the intermediate encrypted image stream using the Python RC4 encryption algorithm and the encryption keyword key2 to obtain the final encrypted image stream (i.e., image binary).

[0119] Step S503: The server stores the user identifier, encrypted image stream and encrypted keyword in the cache accordingly according to the user's authority.

[0120] Step S504: The server receives and sends a picture access request.

[0121] The image access request carries three parameters: the first user identifier (such as user pin), the image identifier to be accessed (such as the unique ID of the image), and the verification information generated by encrypting the second user identifier and the current time period (such as 5 minutes as a time period) through the RC4 encryption algorithm. The client accesses the server through websocket to carry these three parameters from the cookie or HTTPHeader or Body.

[0122] Step S505: The server uses the RC4 encryption algorithm to decrypt the verification information, and queries the cache based on the decryption result to see whether there is a target encrypted image stream accessible to the first user identifier. If so, execute step S509; otherwise, execute step S506.

[0123] After receiving the image access request, the server can obtain the second image identifier and the current time period through the RC4 decryption algorithm, and verify the legitimacy of the user. If the verification passes, the target encrypted image stream can be sent to the client through websocket.

[0124] Step S506: Encrypt the image stream corresponding to the image identifier and the current time period twice using the RC4 encryption algorithm to obtain a target encrypted image stream, and execute step S507.

[0125] Step S507: The server sends the target encrypted image stream and the last encrypted encryption keyword to the client.

[0126] Here, the server sends the target encrypted image stream and key2 to the client.

[0127] Step S508: The client decrypts the target encrypted image stream according to the encryption keyword of the last encryption to obtain an intermediate encrypted image stream.

[0128] Here, after the client obtains the encrypted image binary stream and the outermost encryption keyword (key2) sent by the server through the webscoket downlink message, it can call its SDK to implement the encrypted image binary stream conversion Buffer method (Buffer is a special object that stores binary data) to obtain the converted encrypted image Buffer stream. Then the client calls the SDK to use the outermost encryption keyword (key2) to perform RC4 symmetric decryption on the encrypted image Buffer stream to obtain the intermediate encrypted image stream.

[0129] Step S509: the client sends a decryption request to the server according to the intermediate encrypted image stream and the first user identifier.

[0130] Step S510: The server verifies the intermediate encrypted image stream and the first user identifier according to the decryption request. If the verification passes, step S511 is executed; otherwise, step S512 is executed.

[0131] Step S511: The server determines the encryption keyword corresponding to the intermediate encrypted image stream, and sends the encryption keyword to the client, so that the client executes step S513.

[0132] Here, if the verification passes, the server sends the encryption keyword key1 corresponding to the intermediate encrypted image stream to the client.

[0133] Step S512: Send a prompt message to the client to deny access to the image.

[0134] Step S513: The client decrypts the intermediate encrypted image stream and renders the target image according to the decryption result.

[0135] Similar to the outermost decryption, the client calls the SDK to use the encryption keyword key1 to perform RC4 symmetric decryption on the intermediate encrypted image Buffer stream, and outputs the Base64 image stream after decryption. The client then calls the Base64 image stream conversion method implemented in the SDK, and finally draws the image through canvas to achieve the rendering display of the target image.

[0136] According to the above embodiment, the server implements multi-layer encryption of the image stream, and can generate short-term or long-term accessible encrypted image streams for different users. Other users or illegal users cannot access the image information even if they obtain the encrypted image stream in time, thus realizing personal privacy during the transmission of the image, so that other people cannot obtain, preview, or download and save personal images, thereby realizing short-term or long-term access to the image for specific users and groups. For images that need to be restricted immediately, real-time deletion and update and other image access restriction operations can be performed to restrict users from downloading and accessing the images, thereby improving the security of the image information. When the image processing system provided by the embodiment of the present invention is applied to the field of online medical care, it can avoid the illegal dissemination of privacy images such as patient diagnosis and treatment images and patient information images due to the exposure of the image address, thereby improving the security of the image information while also protecting user privacy and improving the user experience.

[0137] Figure 6 An exemplary system architecture 600 is shown to which a method for processing a picture or an apparatus for processing a picture according to an embodiment of the present invention can be applied.

[0138] like Figure 6 As shown, system architecture 600 may include terminal devices 601, 602, 603, network 604 and server 605. Network 604 is used to provide a medium for communication links between terminal devices 601, 602, 603 and server 605. Network 604 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0139] The user can use the terminal devices 601, 602, 603 to interact with the server 605 through the network 604 to receive or send messages, etc. Various communication client applications can be installed on the terminal devices 601, 602, 603, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0140] The terminal devices 601 , 602 , and 603 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers, etc.

[0141] The server 605 may be a server that provides various services, such as a background management server that provides support for shopping websites browsed by users using the terminal devices 601, 602, and 603. The background management server may analyze and process the received data such as the image access request, and feed back the processing result (such as the encrypted image stream) to the terminal device.

[0142] It should be understood that Figure 6The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0143] Reference below Figure 7 , which shows a schematic diagram of the structure of a computer system 700 of a terminal device suitable for implementing an embodiment of the present invention. Figure 7 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0144] like Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0145] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0146] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above-mentioned functions defined in the system of the present invention are executed.

[0147] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0148] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0149] The modules involved in the embodiments of the present invention may be implemented in software or hardware. The modules described may also be provided in a processor. For example, they may be described as follows: a processor includes a request acquisition module, a first image stream processing module, and an image stream sending module. The names of these modules do not, in some cases, constitute limitations on the modules themselves. For example, the request acquisition module may also be described as a "module for obtaining image access requests."

[0150] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs. When the above one or more programs are executed by a device, the device includes: obtaining a picture access request sent by a client, the picture access request including a first user identifier and a picture identifier to be accessed; according to the picture access request, determining a target encrypted picture stream corresponding to the first user identifier and the picture identifier; wherein the target encrypted picture stream is obtained by encrypting the picture stream corresponding to the picture identifier one or more times using a first symmetric encryption algorithm; sending the target encrypted picture stream and the encryption keyword to the client, so that the client decrypts the target encrypted picture stream according to the encryption keyword, and renders the target picture according to the decryption result; wherein the encryption keyword corresponds to the first symmetric encryption algorithm.

[0151] According to the technical solution of the embodiment of the present invention, the image stream is encrypted once or multiple times using the first symmetric encryption to obtain a target encrypted image stream. After obtaining the image access request sent by the client, the target encrypted image stream corresponding to the first user identifier and the image identifier, and the encryption keyword corresponding to the first symmetric encryption algorithm are sent to the client, so that the client can decrypt the target encrypted image stream according to the encryption keyword, and then render the target image according to the decryption result. This avoids directly exposing the image address, and even if other users obtain the encrypted image stream, they cannot access the image information, thereby improving the security of the image information.

[0152] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for processing a picture, characterized in that: Applied to the server, including: Acquire a picture access request sent by a client, wherein the picture access request includes a first user identifier and an identifier of a picture to be accessed; Determine, according to the picture access request, a target encrypted picture stream corresponding to the first user identifier and the picture identifier; wherein the target encrypted picture stream is obtained by encrypting the picture stream corresponding to the picture identifier once or multiple times using a first symmetric encryption algorithm; The target encrypted image stream and the encryption keyword are sent to the client, so that the client decrypts the target encrypted image stream according to the encryption keyword and renders the target image according to the decryption result; wherein the encryption keyword corresponds to the first symmetric encryption algorithm.

2. The method according to claim 1, characterized in that In the case where the target encrypted picture stream is obtained through multiple encryptions, sending the target encrypted picture stream and the encryption keyword to the client comprises: Sending the target encrypted picture stream and the encryption keyword of the last encryption to the client, so that the client decrypts the target encrypted picture stream according to the encryption keyword of the last encryption to obtain an intermediate encrypted picture stream; Obtaining a decryption request sent by the client according to the intermediate encrypted image stream; The encryption keyword corresponding to the intermediate encrypted image stream is sent to the client according to the decryption request.

3. The method according to claim 2, characterized in that The sending, according to the decryption request, the encryption keyword corresponding to the intermediate encrypted image stream to the client, comprises: The following steps are executed in a loop until each encrypted keyword is sent to the client: Obtaining a decryption request sent by the client, wherein the decryption request includes an intermediate encrypted image stream and the first user identifier; Verifying the user identity according to the first user identifier; If the verification passes, an encryption keyword corresponding to the intermediate encrypted picture stream is determined, and the encryption keyword is sent to the client.

4. The method according to claim 1, characterized in that: The picture access request also includes verification information, where the verification information is obtained by encrypting the second user identifier and the current time period using a second symmetric encryption algorithm; and determining, according to the picture access request, a target encrypted picture stream corresponding to the user identifier and the picture identifier to be accessed, including: Decrypting the verification information using the second symmetric encryption algorithm to obtain the second user identifier and the current time period; Verifying whether the first user identifier and the second user identifier match; If the verification is successful, it is determined whether there is a target encrypted picture stream corresponding to the current time period.

5. The method according to claim 4, characterized in that The step of determining, according to the picture access request, a target encrypted picture stream corresponding to the first user identifier and the picture identifier, comprises: Determine whether the encrypted image stream stored on the server contains the target encrypted image stream; In the case that the target encrypted picture stream is not stored in the server, a picture stream corresponding to the picture identifier is obtained, and the picture stream and the current time period are encrypted using the first symmetric encryption algorithm to obtain the target encrypted picture stream.

6. The method according to any one of claims 1 to 5, characterized in that: Also includes: Encrypting the picture streams corresponding to the multiple picture identifiers respectively according to a preset period to obtain the encrypted picture streams corresponding to the multiple picture identifiers respectively; Determine the user ID corresponding to the encrypted image stream according to the preset user authority; The user identification and the encrypted picture stream are stored in a cache correspondingly, and the expired encrypted picture stream in the cache is deleted.

7. A method for processing a picture, characterized in that: Applied to the client, including: Sending a picture access request to the server, wherein the picture access request includes a first user identifier and a picture identifier to be accessed; Receive a target encrypted picture stream corresponding to the first user identifier and the picture identifier, and an encryption keyword corresponding to a first symmetric encryption algorithm, returned by the server according to the picture access request; wherein the target encrypted picture stream is obtained by encrypting the picture stream corresponding to the picture identifier once or multiple times using the first symmetric encryption algorithm; The target encrypted picture stream is decrypted according to the encryption keyword, and the target picture is rendered according to the decryption result.

8. The method according to claim 7, characterized in that In the case where the target encrypted picture stream is obtained through multiple encryption, decrypting the target encrypted picture stream according to the encryption keyword includes: Obtaining the target encrypted picture stream and the last encrypted encryption keyword sent by the server, and decrypting the target encrypted picture stream using the last encrypted encryption keyword to obtain an intermediate encrypted picture stream; A decryption request is generated according to the intermediate encrypted picture stream and the first user identifier, and the decryption request is sent to a server, so that the server sends an encryption keyword corresponding to the intermediate encrypted picture stream according to the decryption request.

9. A server for processing pictures, characterized in that: include: Request acquisition module, first picture stream processing module and picture stream sending module; wherein, The request acquisition module is used to acquire a picture access request sent by a client, wherein the picture access request includes a first user identifier and a picture identifier to be accessed; The first picture stream processing module is used to determine, according to the picture access request, a target encrypted picture stream corresponding to the first user identifier and the picture identifier; wherein the target encrypted picture stream is obtained by encrypting the picture stream corresponding to the picture identifier once or multiple times using a first symmetric encryption algorithm; The image stream sending module is used to send the target encrypted image stream and encryption keyword to the client, so that the client decrypts the target encrypted image stream according to the encryption keyword and renders the target image according to the decryption result; wherein the encryption keyword corresponds to the first symmetric encryption algorithm.

10. A client for processing pictures, characterized in that: include: A request sending module, a picture stream receiving module and a second picture stream processing module; wherein, The request sending module is used to send a picture access request to the server, wherein the picture access request includes a first user identifier and a picture identifier to be accessed; The picture stream receiving module is used to receive the target encrypted picture stream corresponding to the first user identifier and the picture identifier, and the encryption keyword corresponding to the first symmetric encryption algorithm, which are returned by the server according to the picture access request; wherein the target encrypted picture stream is obtained by encrypting the picture stream corresponding to the picture identifier once or multiple times using the first symmetric encryption algorithm; The second image stream processing module is used to decrypt the target encrypted image stream according to the encryption keyword and render the target image according to the decryption result.

11. A system for processing pictures, characterized in that: include: The image processing server of claim 9 and the image processing client of claim 10.

12. An electronic device for processing pictures, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method as claimed in any one of claims 1-6 or 7-8.

13. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1-6 or 7-8 is implemented.

Images