Data tracing method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of data security, and discloses a data tracing method and device, computer equipment and a storage medium, and the method comprises the steps: detecting a file viewing request of a user, and obtaining initial file information and user identification information according to the file viewing request; obtaining an initial file according to the initial file information, and performing incremental update signature operation on the initial file based on the user identification information to generate an update file; returning the update file to the user; and when it is detected that the update file is leaked, positioning a leakage source according to the update file. According to the embodiment of the invention, traceability marking is carried out on the file by using an incremental updating digital signature mode, the original content of the file is not influenced, the method is not only suitable for common files, but also suitable for files of financial scenes such as electronic contracts and electronic bills with digital signatures or electronic signatures, and the security in the file propagation process is improved.

Description

Technical Field

[0001] The present invention relates to the fields of data security and financial technology, and in particular to a data tracing method, device, computer equipment and storage medium. Background Art

[0002] The banking industry refers to the main body of the modern financial industry and the hub of the national economy. From the perspective of customer demand, both credit customers and retail customers have put forward higher requirements for bank digital services; from the perspective of business model, using digital technology to gain insight into customers, discover customers, serve customers, and create a sustainable business model is a must-answer question for improving core competitiveness.

[0003] There are a huge amount of documents to be signed in the operation and management activities of banks. Whether it is the signing of internal documents of the bank or the signing of documents between the bank and external institutions (suppliers / partners), they all face problems such as low efficiency, high risk, high cost and inconvenient management.

[0004] By stamping PDF files with secure electronic seals, electronic, centralized, streamlined and standardized management of seals can be achieved, providing efficient services to head offices, branches and other institutions at all levels, improving risk management levels and reducing corporate operating costs.

[0005] However, in the prior art, there are scenarios where many people in a company circulate a document with an electronic signature. When there are many people involved in the circulation process, confidential document leaks may occur. When a file leak occurs, it is necessary to trace the leaked file. This requires adding the traceability information to the file when the file is obtained at the source. Traditional traceability methods generally include: adding the traceability information to the original file as a picture or text watermark. This method is generally only used for picture files and will destroy the original image. Or use a file steganography tool to embed the traceability information in the header or tail of the file. This method is only used for ordinary files, and the files steganographically written using this method can easily be separated from the source file by using some file separation tools, thus failing to achieve the traceability effect.

[0006] For some documents that have been electronically signed or have electronic seals, adding watermarks will destroy the legitimacy of the original electronic seals, making the original document content unreliable. Using file steganography will also destroy the structure of the file, making it impossible to open. Summary of the invention

[0007] In view of the above-mentioned deficiencies in the prior art, the present invention provides a data tracing method, apparatus, computer equipment and storage medium, aiming to solve the problem in the prior art that file tracing may destroy the legitimacy of the original electronic signature or destroy the structure of the file, resulting in the inability to open the file.

[0008] The technical solution of the present invention is as follows:

[0009] A first embodiment of the present invention provides a data tracing method, the method comprising:

[0010] Detecting a file viewing request from a user, and acquiring initial file information and user identification information according to the file viewing request;

[0011] Acquire an initial file according to the initial file information, perform an incremental update signature operation on the initial file based on the user identification information, and generate an update file;

[0012] Returning the update file to the user;

[0013] When it is detected that the update file is leaked, the leak source is located according to the update file.

[0014] Another embodiment of the present invention provides a data tracing device, the device comprising:

[0015] A data acquisition module, used to detect a file viewing request from a user, and acquire initial file information and user identification information according to the file viewing request;

[0016] A signature update module, used to obtain an initial file according to the initial file information, perform an incremental update signature operation on the initial file based on the user identification information, and generate an update file;

[0017] A data sending module, used for returning the update file to the user;

[0018] The source tracing module is used to locate the leakage source according to the update file when detecting that the update file is leaked.

[0019] Another embodiment of the present invention provides a computer device, the computer device comprising at least one processor; and

[0020] a memory communicatively connected to the at least one processor; wherein,

[0021] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the steps of the above-mentioned data tracing method.

[0022] Another embodiment of the present invention further provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by one or more processors, the one or more processors can perform the steps of the above-mentioned data tracing method.

[0023] Beneficial effects: The data tracing method of the embodiment of the present invention can detect the user's file viewing request, obtain the initial file information and user identification information according to the file viewing request; obtain the initial file according to the initial file information, perform an incremental update signature operation on the initial file based on the user identification information, and generate an update file; return the update file to the user; when it is detected that the update file is leaked, the source of the leak is located according to the update file. The embodiment of the present invention uses the incremental update digital signature method to mark the file for tracing, and the tracing information can be displayed only in the signature detail information, which will not affect the original content of the file. It is not only applicable to ordinary files, but also to files in financial scenarios such as electronic contracts and electronic bills with digital signatures or electronic seals, which improves the security of the file transmission process. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0025] Figure 1 A schematic diagram of an application environment of an embodiment of a data tracing method of the present invention;

[0026] Figure 2 A flow chart of a preferred embodiment of a data tracing method of the present invention;

[0027] Figure 3 for Figure 2 A flowchart of a specific embodiment of step S100;

[0028] Figure 4 for Figure 2 A flowchart of a specific embodiment of step S200;

[0029] Figure 5 for Figure 2 A flowchart of another specific embodiment of step S200;

[0030] Figure 6 for Figure 5 A flowchart of a specific embodiment of step S212;

[0031] Figure 7 for Figure 2 A flowchart of a specific embodiment of step S400;

[0032] Figure 8A flowchart of another specific application embodiment of a data tracing method of the present invention;

[0033] Fig. 9 A schematic diagram of functional modules of a preferred embodiment of a data tracing device of the present invention;

[0034] Fig.10 A structural schematic diagram of a preferred embodiment of a computer device of the present invention;

[0035] Fig.11 Another structural schematic diagram of a preferred embodiment of a computer device of the present invention. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and effect of the present invention clearer and more specific, the present invention is further described in detail below. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0037] The embodiments of the present invention are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0038] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is merely a way of distinguishing the objects of the same attributes when describing them in the embodiments of the present application. Here, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0039] The data tracing method provided in the embodiment of the present invention can be applied in Figure 1In an application environment, the client detects the user's file viewing request, obtains the initial file information and user identification information according to the file viewing request; obtains the initial file according to the initial file information, performs an incremental update signature operation on the initial file based on the user identification information, and generates an update file; returns the update file to the user; when the update file is detected to be leaked, the leak source is located according to the update file. In the present invention, the file is traced by using the incremental update digital signature method, and the traceability information can be displayed only in the signature detail information, which will not affect the original content of the file. It is not only applicable to ordinary files, but also to files in financial scenarios such as electronic contracts and electronic bills with digital signatures or electronic seals, which improves the security of the file transmission process. Among them, the client can be but not limited to various personal computers, laptops, smart phones, tablet computers and portable wearable devices. The server can be implemented by an independent server or a server cluster composed of multiple servers. The present invention is described in detail below through specific embodiments.

[0040] In view of the above problems, the present invention provides a data tracing method. Figure 2 , Figure 2 This is a flow chart of a preferred embodiment of a data tracing method of the present invention. Figure 2 As shown, it includes:

[0041] Step S100: Detecting a file viewing request from a user, and obtaining initial file information and user identification information according to the file viewing request.

[0042] The data tracing method in the embodiment of the present invention is applied to a server for tracing the data. The server can incrementally update the signature of the file to be viewed based on the file viewing request uploaded by the client. If the file is leaked, the leakage source of the leaked file is located based on the incremental update signature.

[0043] The data tracing method of the embodiment of the present invention can trace the leakage of electronic files in the financial industry. Electronic files include but are not limited to ordinary electronic files, electronic contracts with digital signatures or electronic seals, electronic bills and other files in financial scenarios. Electronic file formats include but are not limited to PDF, WORD and other formats.

[0044] When a user wants to view a certain file and requests the server to obtain a PDF file, the user sends a file viewing request to the server. The file viewing request sent needs to carry the user's accurate personal information, which is recorded as the user ID. Taking Ping An Bank as an example, the user's UM account number can be used as the user ID. The UM account number is the employee number within Ping An Bank, and each person has a unique employee number.

[0045] File information includes but is not limited to the file name, file introduction, etc.

[0046] If the file is a signed PDF file, before step S100, that is, detecting a file viewing request from a user, and obtaining initial file information and user identification information according to the file viewing request, the following steps are also included:

[0047] Use the digital signature tool to electronically sign the original PDF file to obtain a signed PDF file.

[0048] Taking the PDF file as an example, after obtaining the initial PDF file, a digital signature tool is used to perform an electronic signature operation on the file to obtain a signed PDF file containing an electronic signature. The signed PDF file is stored in a database on the server.

[0049] Stamping PDF files is a technology that adds electronic signatures or seals to PDF documents. It combines cryptography and digital certificates to ensure the security, integrity and non-repudiation of electronic documents. Stamping PDF files is to sign PDF documents with digital certificates to verify the identity of the signer and ensure that the document has not been tampered with during transmission, thereby improving the legal validity of electronic documents.

[0050] The signed PDF file can be used for: Identity verification: verify the true identity of the signer to prevent identity fraud. Data integrity: ensure that the document has not been tampered with during transmission, and maintain the originality and accuracy of the data. Non-repudiation: provide evidence of the signing behavior to prevent the signer from denying his signing behavior. Legal effect: According to relevant laws and regulations, PDF electronic signatures have the same legal effect as handwritten signatures and paper seals.

[0051] The implementation method of signing a PDF file is as follows:

[0052] Use PDF editing software: PDF editing software provides comprehensive PDF processing functions, including electronic stamping. Users can create and apply electronic stamps through the "Certificate" and "Digital Signature" functions under the "Tools" menu.

[0053] Online electronic seal generator: Users only need to visit the relevant website in the browser, upload the official seal image or enter relevant information, and select the seal style to generate the electronic seal image. Then, use the "Insert Image" function of the PDF editing software to insert the electronic seal image into the specified position of the PDF file.

[0054] Smart stamping software: The software provides a more intelligent stamping solution. These software usually have functions such as one-click stamping, automatic adjustment of size and position, etc., which improves the efficiency and accuracy of stamping.

[0055] Image editing software: For users who have a certain foundation in image processing, they can use image editing software such as Photoshop to create a custom electronic seal. By drawing a circle, adding text and patterns, users can make an electronic seal that meets their needs and insert it into a PDF file.

[0056] Digital signature tools are software or hardware solutions used to generate and verify digital signatures. These tools play an important role in network security, e-commerce, file transfer and other fields, ensuring the integrity, authenticity and non-repudiation of data.

[0057] The digital signature tool of the embodiment of the present invention takes the CA certificate as an example. The CA certificate (Certificate Authority) is a type of digital certificate issued by an authoritative certification body (CA). If it is only used for verification within the company, it does not need to gain the trust of external users and can also be directly generated by code. It is used to identify the authenticity and integrity of an identity and is usually used for identity authentication in network communications and security protection of data transmission.

[0058] CA certificates are the technical basis for digital signatures and proof of online entity identity. They can prove the identity of an entity and the legitimacy of its public key, and at the same time prove the matching relationship between the entity and the public key. In network communications, CA certificates are used to confirm the identities of both parties in communication and prevent identity disguise and man-in-the-middle attacks. CA certificates can also implement data encryption: using public and private keys to encrypt and decrypt data to protect the security of information during transmission. CA certificates can also be used for digital signatures: verifying the integrity of information and the authenticity of the source through digital signature technology to ensure that the information has not been tampered with. As a trusted third-party organization, CA certificates provide authentication services for entities in the network and help establish mutual trust. CA certificates establish a secure connection between the website and the user's browser through the SSL / TLS protocol to protect user data from eavesdropping and tampering. In some systems, CA certificates can be used to control access rights to specific resources.

[0059] In this embodiment, the CA certificate is used for PDF signing, which enhances the credibility of the traceability signature.

[0060] Among them, Figure 3 As shown, in step S100, a file viewing request of a user is detected, and initial file information and user identification information are obtained according to the file viewing request, including:

[0061] Step S101: Detecting a file viewing request from a user and receiving initial file query information sent by the user;

[0062] Step S102: parse the initial file query information to obtain initial file information and user identification information.

[0063] After receiving the file viewing request sent by the user through the client, the server receives the initial file query information sent by the user through the client, and parses the initial file query information through a data parsing algorithm to obtain the initial file information to be viewed and the user identification information.

[0064] Data parsing is the process of converting raw data into a structured, readable data format. Data parsing methods include the following:

[0065] Data analysis based on file formats includes:

[0066] CSV (Comma-Separated Values) parsing is a simple text format used to represent data tables. Data is separated by commas, which is easy to read and edit and suitable for simple data tables. It can be parsed and generated using a text editor, spreadsheet software, or CSV library in a programming language.

[0067] JSON (JavaScript Object Notation) is a lightweight data exchange format. JSON parsing represents data in the form of key-value pairs, which has good readability and scalability and is widely used in Web applications. Applications can use JSON libraries in JavaScript or JSON libraries in other programming languages ​​for parsing and generation.

[0068] XML parsing method: XML (eXtensible Markup Language) is a markup language used to describe structured data. It has flexible scalability and readability and is suitable for complex data structures and documents. It is widely used in areas such as Web services, data exchange, and configuration files, and can be parsed and generated using an XML parser.

[0069] Data analysis based on text processing includes:

[0070] Regular expression parsing: Regular expression is an expression language used to match text patterns. It has powerful text processing capabilities and can perform operations such as text segmentation, search, and replacement. In data parsing, regular expressions can be used to match patterns and extract raw data.

[0071] Data parsing based on database: For structured data, it can be stored in the database and parsed and processed using the database query language. The database provides efficient query and data processing functions and supports complex data analysis and processing tasks. Data retrieval and analysis are performed using database query languages ​​such as SQL.

[0072] Step S200: acquiring an initial file according to the initial file information, performing an incremental update signature operation on the initial file based on the user identification information, and generating an update file.

[0073] Taking the initial file as a signed PDF file as an example, after the server obtains the signed PDF file according to the user's request information, it performs an incremental update signature operation on the signed PDF file based on the user's identification information. This operation will add an extra signature to the PDF file, which contains traceability information (such as the user's UM account, etc.) and the certificate information during the signing operation, but will not affect the validity of the original electronic signature in the PDF.

[0074] Incremental update signature is a combined concept involving incremental update technology and digital signature technology.

[0075] Incremental update means that when performing an update operation, only the parts that need to be changed are updated, and the parts that do not need to be updated or have been updated will not be updated repeatedly. This update method is faster than a full update because it reduces the amount of processing. The concept of incremental update has a wide range of applications, including software updates, database updates, virus database updates for antivirus software, etc.

[0076] A digital signature is a technique used to verify the integrity and authenticity of a message. It encrypts the message using a private key to generate a unique signature, which can then be transmitted along with the message. The recipient can verify the signature using a public key to ensure that the message has not been tampered with during transmission and that it is indeed from the claimed sender.

[0077] In the incremental update scenario, digital signatures can be used to ensure the integrity and source authenticity of the incremental update package. Specifically, when the software or database needs to be updated, an incremental update package containing the updated content can be generated and signed with a private key. This signature can then be transmitted to the recipient together with the incremental update package.

[0078] After receiving the incremental update package, the receiver can use the public key to verify the signature. If the verification is successful, it means that the incremental update package has not been tampered with during transmission and is indeed from the claimed sender (such as a software developer or database administrator). In this way, the receiver can safely apply this incremental update package to update the software or database.

[0079] Incremental update signatures can improve update efficiency: by updating only the areas that need to be changed, the size of the update package and the transmission time are reduced, thereby improving update efficiency.

[0080] Ensure update security: Use digital signatures to ensure the integrity and source authenticity of incremental update packages, preventing malicious attacks and tampering.

[0081] In summary, incremental update signature is a secure update method that combines incremental update technology and digital signature technology. It can not only improve update efficiency, but also ensure the security and integrity of updates. In scenarios such as software updates and database updates, incremental update signature has broad application prospects.

[0082] Among them, Figure 4 As shown, step S200, that is, obtaining an initial file according to the initial file information, performing an incremental update signature operation on the initial file based on the user identification information, and generating an update file, includes:

[0083] Step S201, obtaining the initial file according to the initial file information;

[0084] Step S202: Generate an incremental update signature based on the user identification information;

[0085] Step S203: Add the incremental update signature to the initial file to generate an update file.

[0086] First, the initial file is obtained based on the initial file information such as the file name, and a traceable source mark is generated based on the user's account information and other user identifiers. The traceability mark is an incremental update signature. This incremental update signature is added to the initial file to be viewed to generate an update file that can be used for traceability.

[0087] Among them, the initial file is the initial PDF file, such as Figure 5 As shown, step S200 is to obtain an initial file according to the initial file information, perform an incremental update signature operation on the initial file based on the user identification information, and generate an update file, including:

[0088] Step S211, obtaining the initial PDF file according to the initial file information;

[0089] Step S212: perform an incremental update signature operation on the initial PDF file using a PDF editing tool, a digital signature tool, and user identification information to generate an updated PDF file.

[0090] According to the file information to be viewed, the initial PDF file to be viewed is obtained from the database, and the signed PDF file is incrementally updated and signed using PDF editing tools, digital signature tools, and user identification information to generate an updated signed PDF file. Incremental update signature of PDF: PDF files support incremental update signatures, which allows any PDF to add some new signatures at the end of the file as a modification to the PDF. Such modifications will not affect the verification and legitimacy of the original signature in the PDF. In this solution, an incremental update signature is required to mark the PDF with traceability information.

[0091] Among them, Figure 6 As shown, step S212, i.e., using the PDF editing tool, the digital signature tool and the user identification information to perform an incremental update signature operation on the initial PDF file to generate an updated PDF file, includes:

[0092] Step S2121: Generate an incremental update signature corresponding to the user identification information based on a digital signature tool;

[0093] Step S2122: Add the incremental update signature to a specified position of the initial PDF file based on a PDF editing tool to generate an updated PDF file.

[0094] The user identification information is incrementally updated with a signature based on the CA certificate, and the initial PDF file is edited using the open source tool PDFBox, and the incremental update signature is added to a specified position of the initial PDF file to generate an updated PDF file, wherein the specified position may be the end of the PDF file or other positions.

[0095] Among them, the open source tool PDFBox is an open source tool developed in Java language for various processing of PDF files. It supports services developed in Java language to reference its SDK, call methods in its SDK, and perform incremental update signature operations on PDF files.

[0096] PDFBox is a pure Java class library for developers to read and create PDF documents. It is also an open source project under the BSD license.

[0097] PDFBox can parse PDF files into data structures that can be processed by programs, including pages, text, images, fonts, colors, etc. PDFBox can extract text content and images from PDF files, allowing developers to further process and analyze this data. PDFBox is particularly useful for parsing tables in PDF files. It can extract the structure and content of the table, making it easier for developers to process and analyze the table data. PDFBox can modify the content of PDF files, including adding, deleting, and replacing elements such as pages, text, and images, allowing developers to customize and adjust PDF files as needed. DFBox can also be used to create new PDF files, including adding elements such as pages, text, images, and tables, which is very useful for generating PDF reports and documents containing dynamic data. PDFBox can be used to extract and analyze text, images, and metadata in PDF files, which is very useful for scenarios that require processing and analysis of large numbers of documents, such as document search, data mining, etc. DFBox can be used to generate PDF reports containing dynamic data. Developers can control the content and format of the report through code to achieve highly customized report generation. PDFBox can convert PDF files to other formats, such as text, images, HTML, etc., making it easier to convert PDF files to other formats for further processing and analysis.

[0098] Step S300: Return the update file to the user.

[0099] The server sends the updated file with the traceability mark to the user terminal. The sending method includes but is not limited to network-based data transmission, physical connection-based data transmission, wireless technology-based data transmission, and database or application system-based data transmission. The user can select the corresponding data transmission method according to the needs.

[0100] There are many ways to send data to the terminal. Here are some common methods:

[0101] The network-based data transmission method is as follows:

[0102] Email: Users can send data as attachments to the target terminal via email. After receiving the email, the target terminal user can download and view the data in the attachment.

[0103] Cloud storage service: With cloud storage service, users can upload data to the cloud. On the target terminal, users only need to log in to the same cloud storage account and download the required data.

[0104] FTP (File Transfer Protocol) or SSH (Secure Shell Protocol): These protocols provide a secure and efficient way to transfer files, and are suitable for scenarios where large amounts of files need to be transferred frequently. Users can upload data to a specified server or terminal through an FTP client or SSH client.

[0105] Dedicated data transfer software: Dedicated data transfer software can easily transfer data between different terminals. These software usually support multiple data types, such as documents, pictures, music, videos, etc., and can migrate installed applications.

[0106] The data transmission method based on physical connection is as follows:

[0107] USB storage device: Use a USB storage device such as a USB flash drive or a mobile hard disk to copy data from the source terminal to the storage device. Then connect the storage device to the target terminal and copy the data to the storage medium of the target terminal.

[0108] Data cable connection: For some devices, such as smartphones, cameras, etc., you can use a data cable to connect them to a computer or other terminal. Through the data cable connection, data in the device can be transferred to a computer or other terminal.

[0109] The data transmission methods based on wireless technology are as follows:

[0110] Bluetooth: Bluetooth is a short-range wireless communication technology that can be used to transfer data between devices. Through a Bluetooth connection, users can send data from a source terminal to a target terminal.

[0111] Wi-Fi Direct: Wi-Fi Direct is a wireless technology that allows direct communication between devices. With Wi-Fi Direct, users can send data from a source terminal to a target terminal without a network.

[0112] Near Field Communication (NFC): NFC is a short-range wireless communication technology commonly used for data transfer between smartphones and other devices. Through NFC connection, users can transfer data from one phone to another phone or other NFC-enabled device.

[0113] The data transmission methods based on database or application system are as follows:

[0114] Database export / import: Users can export data from the source database table to a specific file format (such as CSV, Excel, etc.). Then on the target terminal, use the corresponding tools or applications to import the data into the target database.

[0115] API interface: Applications can exchange data through the API interface. Users can write code or call the API interface to send data from the source application to the target application.

[0116] Third-party data synchronization services: Some third-party services provide data synchronization functions, allowing users to synchronize data between different devices or applications. Through these services, users can automatically synchronize data from the source terminal to the target terminal.

[0117] In summary, there are many ways to send data to the terminal, and users can choose the appropriate transmission method according to actual needs. When choosing a transmission method, factors such as data type, size, transmission speed, security, and cost need to be considered.

[0118] Step S400: When it is detected that the update file is leaked, the leak source is located according to the update file.

[0119] When a PDF file is accidentally leaked, you can obtain the updated file and directly view the incremental update signature in the updated file in the last signature on the updated file, locate the person who viewed the updated file, and then trace the source. Through traceability tracking, you can ensure the authenticity of the data and improve the security of file access.

[0120] Among them, Figure 7 As shown, step S400, that is, when the update file is detected to be leaked, the leak source is located according to the update file, including:

[0121] Step S401: When it is detected that the update file is leaked, the update file is parsed to obtain user identification information in the update file;

[0122] Step S402: Locate the leakage source based on the user identification information.

[0123] When a PDF file is accidentally leaked, you can directly check the traceability information (user's UM account, etc.) in the last signature on the PDF to trace the source. Through traceability tracking, the authenticity of the data can be ensured: by tracing the origin and evolution of the data, the authenticity and reliability of the data can be verified. Improve data quality: Through data traceability, errors and anomalies in the data can be discovered and corrected, and the quality of the data can be improved. Support decision-making: Data traceability provides reliable data support for decision-making and helps make more informed decisions. Ensure data security: Through data traceability, the flow and use of data can be tracked, and security risks such as data leakage can be discovered and prevented in a timely manner.

[0124] Among them, Figure 8As shown, step S400, that is, when the update file is detected to be leaked, after locating the leak source according to the update file, further includes:

[0125] Step S501, obtaining the serial number corresponding to the incremental update signature in the update file;

[0126] Step S502: Verify the credibility of the certificate of the update file based on the serial number.

[0127] The server can also verify whether it is the certificate serving itself based on the serialNumber serial number in the certificate information in the signature used for traceability in the leaked file, so as to ensure the credibility of the traceability signature. Each certificate has its own unique serial number. When tracing the source, the serial number can be queried to determine the certificate service provider corresponding to the serial number. If the certificate service provider corresponding to the serial number is the service provider selected by the server, the current serial number is credible. If the certificate service provider corresponding to the serial number is not the service provider selected by the server, the current serial number is untrustworthy and the credibility of traceability is also low. Taking the serial number of the CA certificate as an example, the CA certificate serial number refers to a string of codes composed of a random combination of numbers and letters used to prove the uniqueness and legitimacy of the digital certificate. Ensure the authenticity and validity of the digital certificate and prevent the certificate from being forged or tampered with.

[0128] The serial number generation methods of CA certificates include but are not limited to random number generation and hash algorithm generation. The random number generation method generates random numbers based on a certain seed and random algorithm, and then converts the random numbers into hexadecimal representation. The hash algorithm generation method performs a hash operation on the certificate information and then encodes the operation result into a hexadecimal representation. Hash algorithms usually use algorithms such as SHA-1 or SHA-256.

[0129] Compared with the prior art, the data tracing method of the embodiment of the present invention has the following technical advantages:

[0130] Using digital signatures to mark PDF files for traceability can display the traceability information only in the signature details without affecting the original content of the PDF file.

[0131] Using incremental update of digital signatures to trace the origin of PDF files will not affect the validity and legality of the original digital signatures and electronic seals in the PDF files. This makes this solution applicable not only to ordinary PDF files, but also to PDF files in financial scenarios such as electronic contracts and electronic bills with digital signatures or electronic seals.

[0132] When using incremental update digital signatures, CA certificates are used to ensure that when tracing the source of a file, the digital signature of the traceability mark can be viewed and the legitimacy of the signature can be verified based on the certificate information of the digital signature.

[0133] It should be noted that there is not necessarily a certain order between the above-mentioned steps. A person skilled in the art can understand, based on the description of the embodiments of the present invention, that in different embodiments, the above-mentioned steps may have different execution orders, that is, they may be executed in parallel, may be executed interchangeably, and so on.

[0134] Another embodiment of the present invention provides a data tracing device, which corresponds one-to-one to the data tracing method in the above embodiment. Fig. 9 As shown, the device 1 comprises:

[0135] The data acquisition module 100 is used to detect a file viewing request from a user and obtain initial file information and user identification information according to the file viewing request;

[0136] The signature update module 200 is used to obtain an initial file according to the initial file information, perform an incremental update signature operation on the initial file based on the user identification information, and generate an update file;

[0137] A data sending module 300, used to return the update file to the user;

[0138] The source tracing module 400 is used to locate the leakage source according to the update file when it is detected that the update file is leaked.

[0139] The specific implementation method is shown in the method embodiment, which will not be described in detail here.

[0140] In one embodiment, the data acquisition module 100 is specifically used for:

[0141] Detecting a file viewing request from a user, and receiving initial file query information sent by the user;

[0142] The initial file query information is parsed to obtain initial file information and user identification information.

[0143] The specific implementation method is shown in the method embodiment, which will not be described in detail here.

[0144] In one embodiment, the signature update module 200 is specifically used to:

[0145] Acquire the initial file according to the initial file information;

[0146] generating an incremental update signature based on the user identification information;

[0147] The incremental update signature is added to the initial file to generate the update file.

[0148] The specific implementation method is shown in the method embodiment, which will not be described in detail here.

[0149] In one embodiment, the initial file is a PDF file, and the signature update module 200 is further used to:

[0150] Acquire the initial PDF file according to the initial file information;

[0151] An incremental update signature operation is performed on the initial PDF file using a PDF editing tool, a digital signature tool and the user identification information to generate an updated PDF file.

[0152] The specific implementation method is shown in the method embodiment, which will not be described in detail here.

[0153] In one embodiment, the signature update module 200 is further configured to:

[0154] Generate an incremental update signature corresponding to the user identification information based on a digital signature tool;

[0155] The incremental update signature is added to a designated position of the initial PDF file based on a PDF editing tool to generate the updated PDF file.

[0156] The specific implementation method is shown in the method embodiment, which will not be described in detail here.

[0157] In one embodiment, the traceability module 400 is further used to:

[0158] When it is detected that the update file is leaked, the update file is parsed to obtain user identification information in the update file;

[0159] The leakage source is located based on the user identification information.

[0160] The specific implementation method is shown in the method embodiment, which will not be described in detail here.

[0161] In one embodiment, the device further comprises a certificate credibility verification module, the certificate credibility verification module is used to:

[0162] Obtaining a serial number corresponding to the incremental update signature in the update file;

[0163] The credibility of the certificate of the update file is verified based on the serial number.

[0164] The specific implementation method is shown in the method embodiment, which will not be described in detail here.

[0165] The present invention provides a data tracing device, which uses an incremental update digital signature method to mark the source of a file. The tracing information can be displayed only in the signature detail information without affecting the original content of the file. The device is suitable not only for ordinary files, but also for files in financial scenarios such as electronic contracts and electronic bills with digital signatures or electronic seals, thereby improving the security of the file transmission process.

[0166] Another embodiment of the present invention provides a computer device, which may be a server, and its internal structure diagram may be as shown in Fig.10 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external client through a network connection. When the computer program is executed by the processor, it realizes a function or step on the server side of a data tracing method.

[0167] In one embodiment, a computer device is provided. The computer device may be a client, and its internal structure diagram may be as follows: Fig.11 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a client side of a data tracing method.

[0168] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program:

[0169] Detecting a file viewing request from a user, and acquiring initial file information and user identification information according to the file viewing request;

[0170] Acquire an initial file according to the initial file information, perform an incremental update signature operation on the initial file based on the user identification information, and generate an update file;

[0171] Returning the update file to the user;

[0172] When it is detected that the update file is leaked, the leak source is located according to the update file.

[0173] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0174] Detecting a file viewing request from a user, and acquiring initial file information and user identification information according to the file viewing request;

[0175] Acquire an initial file according to the initial file information, perform an incremental update signature operation on the initial file based on the user identification information, and generate an update file;

[0176] Returning the update file to the user;

[0177] When it is detected that the update file is leaked, the leak source is located according to the update file.

[0178] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or computer device can refer to the relevant descriptions on the server side and the client side in the aforementioned method embodiment. To avoid repetition, they will not be described one by one here.

[0179] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchl ink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0180] The embodiments described above are merely illustrative, in which the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0181] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a general hardware platform, and of course can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can exist in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0182] It should be noted that if software tools or components other than those of our company appear in the embodiments of the present application, they are only used for illustrative purposes and do not represent actual use.

[0183] Conditional language such as "can," "can," "might," or "may," among other things, unless specifically stated otherwise or otherwise understood within the context as used, is generally intended to convey that particular embodiments can include (while other embodiments do not) particular features, elements, and / or operations. Thus, such conditional language is also generally intended to imply that features, elements, and / or operations are anyway required for one or more embodiments or that one or more embodiments must include logic for determining, with or without input or prompting, whether such features, elements, and / or operations are included or will be performed in any particular embodiment.

[0184] What has been described herein in this specification and the accompanying drawings includes examples that can provide data traceability methods and devices. Of course, it is not possible to describe every conceivable combination of elements and / or methods for the purpose of describing the various features of the present disclosure, but it is recognized that many other combinations and permutations of the disclosed features are possible. Therefore, it is obvious that various modifications can be made to the present disclosure without departing from the scope or spirit of the present disclosure. In addition, or in an alternative, other embodiments of the present disclosure may be apparent from consideration of this specification and the accompanying drawings and from the practice of the present disclosure as presented herein. It is intended that the examples set forth in this specification and the accompanying drawings are considered to be illustrative and not restrictive in all respects. Although specific terms are employed herein, they are used in a general and descriptive sense and are not used for limiting purposes.

Claims

1. A data tracing method, characterized in that , the method comprises: Detecting a file viewing request from a user, and acquiring initial file information and user identification information according to the file viewing request; Acquire an initial file according to the initial file information, perform an incremental update signature operation on the initial file based on the user identification information, and generate an update file; Returning the update file to the user; When it is detected that the update file is leaked, the leak source is located according to the update file.

2. The data tracing method according to claim 1, characterized in that: The detecting of a file viewing request from a user and obtaining initial file information and user identification information according to the file viewing request includes: Detecting a file viewing request from a user, and receiving initial file query information sent by the user; The initial file query information is parsed to obtain initial file information and user identification information.

3. The data tracing method according to claim 1, characterized in that: The acquiring the initial file according to the initial file information, performing an incremental update signature operation on the initial file based on the user identification information, and generating an update file includes: Acquire the initial file according to the initial file information; generating an incremental update signature based on the user identification information; The incremental update signature is added to the initial file to generate the update file.

4. The data tracing method according to claim 1, characterized in that: If the initial file is an initial PDF file, the initial file is obtained according to the initial file information, and an incremental update signature operation is performed on the initial file based on the user identification information to generate an update file, including: Acquire the initial PDF file according to the initial file information; An incremental update signature operation is performed on the initial PDF file using a PDF editing tool, a digital signature tool and the user identification information to generate an updated PDF file.

5. The data tracing method according to claim 4, characterized in that: The step of performing an incremental update signature operation on the initial PDF file by using a PDF editing tool, a digital signature tool and the user identification information to generate an updated PDF file includes: Generate an incremental update signature corresponding to the user identification information based on a digital signature tool; The incremental update signature is added to a designated position of the initial PDF file based on a PDF editing tool to generate the updated PDF file.

6. The data tracing method according to claim 1, characterized in that: When the update file is detected to be leaked, locating the leak source according to the update file includes: When it is detected that the update file is leaked, the update file is parsed to obtain user identification information in the update file; The leakage source is located based on the user identification information.

7. The data tracing method according to claim 1, characterized in that: When the update file is detected to be leaked, after locating the leak source according to the update file, the method further includes: Obtaining a serial number corresponding to the incremental update signature in the update file; The credibility of the certificate of the update file is verified based on the serial number.

8. A data tracing device, characterized in that: The device comprises: A data acquisition module, used to detect a file viewing request from a user, and acquire initial file information and user identification information according to the file viewing request; A signature update module, used to obtain an initial file according to the initial file information, perform an incremental update signature operation on the initial file based on the user identification information, and generate an update file; A data sending module, used for returning the update file to the user; The source tracing module is used to locate the leakage source according to the update file when detecting that the update file is leaked.

9. A computer device, characterized in that: The computer device comprises at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the steps of the data tracing method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by one or more processors, the one or more processors can execute the steps of the data tracing method described in any one of claims 1-7.

Images