Cloud collaborative evidence collection data protection method, device and equipment and medium

Abstract

The invention relates to the technical field of data monitoring, in particular to a cloud collaborative forensics data protection method, device and equipment and a medium, and the method comprises the steps: obtaining forensics data, determining collaborative node information corresponding to data forming nodes, collecting monitoring standard information, and monitoring and checking the collaborative node information based on the monitoring standard information. Performing abnormal screening updating on the auditing information, performing root hash value calculation on the auditing information to obtain a root hash value, determining updated cooperative node information, determining updated evidence obtaining data based on the updated cooperative node information, obtaining a storage path, and forming a verification block chain according to the root hash value and the storage path. And determining an access permission and access data content, determining access viewing information based on the access permission and the access data content, determining access viewing data corresponding to the evidence obtaining data, and sending the access viewing data to the user terminal. The authenticity of evidence obtaining data is improved.

Description

Technical Field

[0001] The present application relates to the field of data monitoring technology, and in particular to a cloud-based collaborative forensic data protection method, device, equipment and medium. Background Art

[0002] In the process of handling criminal cases, evidence collection is one of the key links in case handling. Generally, evidence collection terminals are used to extract data from suspects' mobile phones, tablets and other electronic devices. The data obtained from evidence collection is generally stored in the evidence collection terminal. However, this data is easily tampered with, resulting in the problem of low authenticity of the evidence data. Summary of the invention

[0003] In order to ensure the authenticity of forensic data and achieve effective monitoring of the storage and reading activities of forensic data, the present application provides a cloud-based collaborative forensic data protection method, device, equipment and medium.

[0004] In the first aspect, the present application provides a cloud-based collaborative forensic data protection method, which adopts the following technical solutions: A cloud-based collaborative forensic data protection method, comprising: Acquire forensic data, and determine the coordination node information corresponding to the cloud data formation node based on the forensic data; Collecting monitoring standard information corresponding to each of the collaborative node information, monitoring and auditing the collaborative node information based on the monitoring standard information, and obtaining audit information corresponding to each of the collaborative node information; Performing abnormal screening and updating on the audit information, and calculating the root hash value of the updated audit information to obtain the root hash value corresponding to the updated audit information; Determining to update the coordination node information corresponding to the updated review information, and determining to update the forensic data based on the updated coordination node information; Acquire a storage path corresponding to the updated forensic data, where the storage path is a storage path corresponding to the updated forensic data during the data formation and circulation process; Forming a verification blockchain according to the root hash value and the storage path, wherein the verification blockchain includes at least one block, and each block corresponds to each data node; When access request information is detected, the access permission and access data content are determined according to the access request information, wherein the access permission is used to indicate the block range that the user can access to the verification blockchain; Access review information is determined based on the access authority and the access data content, access review data corresponding to the forensic data is determined according to the access review information, and the access review data is sent to the user terminal.

[0005] In a possible implementation manner, determining the access review information based on the access permission and the access data content includes: Determining at least one accessible block according to the access rights; Obtaining monitoring data content corresponding to the at least one accessible block according to a storage path corresponding to each block in the verification blockchain; According to the correspondence between the access data content and the access feature, determining the data content to be accessed corresponding to the access data content from the monitored data content of at least one accessible block; The access viewing information corresponding to the access authority is determined based on the content of the data to be accessed.

[0006] In one possible implementation, the method further includes: According to the verification blockchain, the number of accessible blocks corresponding to the access rights is obtained in real time; According to the access rights and the corresponding relationship between the access rights and the access blocks and the number of accessible blocks corresponding to the current moment, determining whether the number of accessible blocks has changed; If so, update the corresponding relationship between the access data content and the access feature, determine the access data content of at least one access block corresponding to the access feature according to the verification blockchain, and judge the access block corresponding to the access data content to determine whether the current access block is an accessible block; If not, an access authorization instruction is generated and sent to a user device that has access rights to the access block. After receiving the accessible instruction returned by the user device, a verification code and time validity information corresponding to the verification code are generated based on the access request information, the collaborative node information and the current time information.

[0007] In a possible implementation, the generating a verification code and time validity information corresponding to the verification code according to the access request information, the coordination node information and the current time information includes: Determine the user data to be accessed, the access permission required, and the data content to be accessed according to the access request information; Respectively extracting user information features in the user data to be accessed, permission features in the access permission required, and data content features in the data content to be accessed, and adding the user information features, the permission features, and the data content features to a preset security code according to a preset weight ratio to obtain a verification code corresponding to the access request information; According to the coordination node information and the node corresponding to the current time information, predict the required flow time and application time when the flow is transferred from the node corresponding to the current time information to the node corresponding to the next block to be accessed; The validity information of the verification code is determined according to the current time information, the required circulation time and the application time.

[0008] In a possible implementation, the user information feature, the permission feature, and the data content feature are added to a preset security code according to a preset weight ratio to obtain a verification code corresponding to the access request information, and then further includes: Obtaining an access record of the verification code within a preset time period, wherein the access record is used to indicate an access time and an access account number for accessing the verification code within the preset time period; Determining whether the verification code has access anomalies according to the access time and access account within a preset time period; When there is an access anomaly, perform at least one parameter splicing based on the positional relationship between the monitoring information corresponding to the verification code and the user information corresponding to the requesting user data, obtain a parameter key corresponding to each parameter splicing, and record each splicing process to obtain a splicing rule corresponding to each splicing process; Allocate a usage time for each splicing rule according to the timeliness information to obtain a usage time corresponding to each splicing rule; When receiving the access request information again, parsing the access request information to obtain access parameters, and recording the re-access time when the access request information is received again; Determine the target splicing rule corresponding to the re-access moment according to the usage durations corresponding to the respective splicing rules, perform parameter splicing on the access parameter and the monitoring information corresponding to the verification code according to the target splicing rule to obtain a monitoring information key; Based on the target splicing rule and the usage duration corresponding to each splicing rule, the monitoring information key is restored, and the restored monitoring information key is matched with the parameter key. If the match is successful, the verification code is fed back to the terminal device corresponding to the user information.

[0009] In a possible implementation, performing at least one parameter splicing based on the positional relationship between the monitoring information corresponding to the verification code and the user information corresponding to the request user data to obtain a parameter key corresponding to each parameter splicing includes: Determine a random value according to a random number algorithm; Determine the hash address of the monitoring information corresponding to the verification code in the blockchain according to the mapping relationship between the hash value and the monitoring information; Determine respective numbers corresponding to the random value, the hash address, and the user information, and arrange the respective numbers corresponding to the random value, the hash address, and the user information to generate a plurality of number sequences; The random value, the hash address and the user information are parameter-concatenated according to each numbering sequence to obtain a parameter key corresponding to each numbering sequence.

[0010] In a possible implementation, judging whether the verification code has access anomaly according to the access time and the access account within a preset time period includes: Determine whether the access time and access account within a preset time period meet preset conditions, and when the preset conditions are met, determine that there is an access anomaly in the verification code; The preconditions include at least one of the following: The number of accesses from the same access account within a preset time period is higher than a first preset threshold; The security level corresponding to the access account is lower than the preset security level; The number of different access accounts within the preset access time period exceeds a second preset threshold.

[0011] In the second aspect, the present application provides a cloud-based collaborative forensics data protection device, which adopts the following technical solutions: A forensic acquisition module, used to acquire forensic data and determine the coordination node information corresponding to the cloud data formation node based on the forensic data; A node audit module is used to collect monitoring standard information corresponding to each of the collaborative node information, monitor and audit the collaborative node information based on the monitoring standard information, and obtain audit information corresponding to each of the collaborative node information; A hash calculation module is used to perform abnormal screening and update on the audit information, and perform root hash value calculation on the updated audit information to obtain a root hash value corresponding to the updated audit information; A forensic update module, used to determine to update the coordination node information corresponding to the updated review information, and to determine to update the forensic data based on the updated coordination node information; A path acquisition module, used to acquire a storage path corresponding to the updated forensic data, wherein the storage path is a storage path corresponding to the updated forensic data during the data formation and circulation process; A blockchain generation module, configured to form a verification blockchain according to the root hash value and the storage path, wherein the verification blockchain includes at least one block, and each block corresponds to each data node; A request determination module, configured to determine access rights and access data content according to access request information when access request information is detected, wherein the access rights are used to indicate a range of blocks that the user can access to the verification blockchain; The data sending module is used to determine access review information based on the access permission and the access data content, determine the access review data corresponding to the forensic data according to the access review information, and send the access review data to the user terminal.

[0012] In a possible implementation, the data sending module determines the access viewing information based on the access permission and the access data content, including: Determining at least one accessible block according to the access rights; Obtaining monitoring data content corresponding to the at least one accessible block according to a storage path corresponding to each block in the verification blockchain; According to the correspondence between the access data content and the access feature, determining the data content to be accessed corresponding to the access data content from the monitored data content of at least one accessible block; The access viewing information corresponding to the access authority is determined based on the content of the data to be accessed.

[0013] In another possible implementation, the device further includes: an accessible acquisition module, a data monitoring module, a block determination module, and a checksum generation module, wherein: The accessible acquisition module is used to obtain the number of accessible blocks corresponding to the access rights in real time according to the verification blockchain; The data monitoring module is used to determine whether the number of accessible blocks has changed according to the access rights and the corresponding relationship between the access rights and the access blocks and the number of accessible blocks corresponding to the current moment; The block determination module is configured to, if yes, update the corresponding relationship between the access data content and the access feature, determine the access data content of at least one access block corresponding to the access feature according to the verification blockchain, and determine the access block corresponding to the access data content to determine whether the current access block is an accessible block; The verification generation module is used to generate an access authorization instruction if not, and send the access authorization instruction to a user device that has access rights to the access block. After receiving the accessible instruction returned by the user device, a verification code and time validity information corresponding to the verification code are generated according to the access request information, the collaborative node information and the current time information.

[0014] In another possible implementation, when the verification generation module generates the verification code and the timeliness information corresponding to the verification code according to the access request information, the coordination node information and the current time information, it is specifically used to: Determine the user data to be accessed, the access permission required, and the data content to be accessed according to the access request information; Respectively extracting user information features in the user data to be accessed, permission features in the access permission required, and data content features in the data content to be accessed, and adding the user information features, the permission features, and the data content features to a preset security code according to a preset weight ratio to obtain a verification code corresponding to the access request information; According to the coordination node information and the node corresponding to the current time information, predict the required flow time and application time when the flow is transferred from the node corresponding to the current time information to the node corresponding to the next block to be accessed; The validity information of the verification code is determined according to the current time information, the required circulation time and the application time.

[0015] In another possible implementation, the device further includes: a record acquisition module, an abnormality judgment module, a parameter splicing module, a duration allocation module, a moment recording module, a key acquisition module, and a key matching module, wherein: The record acquisition module is used to acquire the access record of the verification code within a preset time period, and the access record is used to indicate the access time and access account of the verification code within the preset time period; The abnormality judgment module is used to judge whether the verification code has access abnormality according to the access time and access account within a preset time period; The parameter splicing module is used to perform at least one parameter splicing based on the positional relationship between the monitoring information corresponding to the verification code and the user information corresponding to the requesting user data when an access anomaly occurs, obtain a parameter key corresponding to each parameter splicing, and record each splicing process to obtain a splicing rule corresponding to each splicing process; A duration allocation module, used to allocate a usage duration to each splicing rule according to the timeliness information, and obtain the usage duration corresponding to each splicing rule; A time recording module, for parsing the access request information to obtain access parameters when the access request information is received again, and recording the re-access time when the access request information is received again; A key acquisition module is used to determine the target splicing rule corresponding to the re-access moment according to the usage durations corresponding to the respective splicing rules, and to perform parameter splicing on the access parameter and the monitoring information corresponding to the verification code according to the target splicing rule to obtain a monitoring information key; The key matching module is used to restore the monitoring information key based on the target splicing rule and the usage duration corresponding to each splicing rule, match the restored monitoring information key with the parameter key, and if the match is successful, feed back the verification code to the terminal device corresponding to the user information.

[0016] In another possible implementation, the parameter splicing module performs at least one parameter splicing based on the positional relationship between the monitoring information corresponding to the verification code and the user information corresponding to the request user data to obtain a parameter key corresponding to each parameter splicing, specifically for: Determine a random value according to a random number algorithm; Determine the hash address of the monitoring information corresponding to the verification code in the blockchain according to the mapping relationship between the hash value and the monitoring information; Determine respective numbers corresponding to the random value, the hash address, and the user information, and arrange the respective numbers corresponding to the random value, the hash address, and the user information to generate a plurality of number sequences; The random value, the hash address and the user information are parameter-concatenated according to each numbering sequence to obtain a parameter key corresponding to each numbering sequence.

[0017] In another possible implementation, when the abnormality determination module determines whether there is an access abnormality in the verification code according to the access time and the access account within a preset time period, the abnormality determination module is specifically configured to: Determine whether the access time and access account within a preset time period meet preset conditions, and when the preset conditions are met, determine that there is an access anomaly in the verification code; The preconditions include at least one of the following: The number of accesses from the same access account within a preset time period is higher than a first preset threshold; The security level corresponding to the access account is lower than the preset security level; The number of different access accounts within the preset access time period exceeds a second preset threshold.

[0018] In a third aspect, the present application provides a cloud-based collaborative forensics data protection device, which adopts the following technical solutions: A cloud-based collaborative forensics data protection device, the electronic device comprising: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the above-mentioned cloud-based collaborative forensic data protection method.

[0019] In a fourth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium includes: a computer program that can be loaded by a processor and execute the above-mentioned cloud-based collaborative forensic data protection method.

[0020] In summary, the present application includes at least one of the following beneficial technical effects: After the forensic data is collected, the collaborative node information corresponding to the data formation node is determined based on the forensic data, so that subsequent viewers can view the forensic data in a targeted manner. It is also convenient for subsequent forensic data to be abnormal. The corresponding information responsible person and the original data of the node can be restored based on the collaborative node information. Then, the monitoring standard information corresponding to each collaborative node information is collected respectively, and the collaborative node information is monitored and audited according to the monitoring standard information to obtain the audit information corresponding to each collaborative node information. In order to determine whether there is an abnormality in the current audit information, the audit information is screened and updated for abnormalities, and the root hash value of the updated audit information is calculated to obtain the root hash value corresponding to the updated review information. Then, the updated collaborative node information corresponding to the updated review information is determined, and the updated forensic data is determined based on the updated collaborative node information. Then, the storage path corresponding to the updated forensic data is obtained. The storage path is the storage path corresponding to the updated forensic data during the data formation flow process. Then, a verification blockchain is formed according to the root hash value and the storage path. The verification blockchain contains at least one block, and each block corresponds to each data node. Then, when access request information is monitored, the access permission and the access data content are determined according to the access request information. The access permission is used to characterize the block range that the user can access the verification blockchain. Then, based on the access permission and the access data content, the access view information is determined, and the access view data corresponding to the forensic data is determined according to the access view information, and the access view data is sent to the user terminal. Therefore, when the user needs to view the forensic data, the user only needs to send the access request information to the electronic device to obtain the access view data returned by the electronic device. In this process, the user cannot access the source data corresponding to the access view data, and can only obtain the access view data sample data, thereby protecting the security of the forensic data to the greatest extent. At the same time, the forensic data is organized in the form of a blockchain, which is also convenient for reducing the amount of data in the process of transmitting data to the cloud and reducing the cost of forensics. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a schematic diagram of the architecture of a cloud-based collaborative forensic data protection method in an embodiment of the present application; Figure 2 It is a structural diagram of a cloud-based collaborative forensics data protection device in an embodiment of the present application; Figure 3 It is a structural schematic diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0022] The following is combined with Figure 1-3 This application is described in further detail.

[0023] After reading this specification, those skilled in the art may make non-creative modifications to this embodiment as needed, but such modifications are protected by patent law as long as they are within the scope of the claims of this application.

[0024] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0025] The embodiment of the present application provides a cloud-based collaborative forensic data protection method, which is executed by an electronic device, which can be a server or a terminal device, wherein the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. The terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiment of the present application.

[0026] refer to Figure 1 , Figure 1 : is a flow chart of a cloud collaborative forensics data protection method in an embodiment of the present application, the method comprising: Step S10: Acquire forensic data, and determine the collaborative node information corresponding to the data forming node based on the forensic data.

[0027] For the embodiments of the present application, evidence data refers to data collected during the handling of a criminal case. In a digital environment, evidence data may include but is not limited to log files, network traffic records, system operation records, etc., which are usually used for post-analysis to confirm whether a criminal case occurred and how it occurred. A data formation node refers to a specific link or device that generates or processes evidence data. For example, in a network environment, a data formation node may be a server, a router, or a specific network application. Collaborative node information is used to represent the specific details of a data formation node, including but not limited to the node's IP address, MAC address, device model, operating system information, etc., which helps to identify the node's identity and its location in the network.

[0028] Specifically, forensic data is obtained from various data sources (such as log files, monitoring equipment, network equipment, etc.). These data may include timestamps, operation records, data transmission records, etc. Next, the electronic device will conduct an in-depth analysis of these data, and determine which specific node generated or processed these data by comparing timestamps, data content, data sources, etc. Finally, based on the analysis results, the collaborative node information of each data formation node can be determined.

[0029] The specific implementation method includes: electronic devices use network monitoring tools to capture network traffic data, which usually contains the IP address and MAC address of the node that sends and receives data, so as to determine the network identity of the node that formed the data. In addition, forensic data can also be obtained by viewing the log files of the system or application. These log files usually record the time, content and collaborative node information of the data operation. By analyzing this information, the specific details of the node that formed the data can be determined.

[0030] Step S11: Collect monitoring standard information corresponding to each collaborative node information, monitor and audit the collaborative node information based on the monitoring standard information, and obtain audit information corresponding to each collaborative node information.

[0031] For the embodiments of the present application, monitoring standard information refers to data or rules used to evaluate whether collaborative node information meets specific standards or requirements. These standards involve multiple aspects such as node performance, security, and compliance, such as the normal range of network traffic, the timeliness of security updates, and the compliance of system configuration. Audit information is used to indicate the results of monitoring and auditing collaborative node information, including whether the node meets the monitoring standards, and detailed information on any anomalies or problems.

[0032] Specifically, the monitoring standard information corresponding to each collaborative node information is collected. This includes retrieving relevant information from the knowledge base, industry standards or internal corporate policies. Then, based on the collected monitoring standard information, each collaborative node information is reviewed one by one to check whether they meet the predetermined standards or requirements. This process includes technical means such as data comparison, pattern recognition, and anomaly detection. Finally, the audit information corresponding to each collaborative node information is generated. This audit information will be used for subsequent decision support, problem location or formulation of improvement measures.

[0033] Specifically, the electronic device retrieves monitoring standards related to collaborative node information from an industry standard database or an enterprise's internal knowledge management system. Then, using automated scripts or dedicated software tools, these standards are applied to the collaborative node information to perform automated compliance checks and generate audit reports.

[0034] Step S12: Perform abnormal screening and update on the audit information, and calculate the root hash value of the updated audit information to obtain the root hash value corresponding to the updated audit information.

[0035] Specifically, a hash algorithm is used to calculate the sub-hash value corresponding to each monitoring data type in the audit information of the node, and then the root hash value corresponding to the node is calculated through the Merkle tree algorithm and each sub-hash value contained in the audit information of the node. The root hash value is used to facilitate viewing of all the audit information contained in the node. For example: when the audit information corresponding to node A contains multiple steps, each step may also contain sub-steps, and each step or sub-step corresponds to step monitoring data or sub-step monitoring data, and each step corresponds to a different process monitoring data type, and each sub-step corresponds to a different sub-process monitoring data type.

[0036] The root hash value corresponding to each node is associated with the storage space of the audit information of the node. The root hash value of the node is convenient for determining the storage space corresponding to the audit information of the node from the association between the root hash value and the storage address. Therefore, the root hash value is convenient for viewing all the audit information corresponding to the node. The process of establishing the association between the root hash value and the storage address includes determining the data volume according to the audit information corresponding to the node, and then determining the target storage space from the free storage space of the cloud-based collaborative forensics data protection device according to the data volume, and binding the target storage space to the root hash value.

[0037] Step S13: determining to update the coordination node information corresponding to the updated review information, and determining to update the forensic data based on the updated coordination node information.

[0038] For the embodiments of the present application, updating the collaborative node information refers to updating or correcting the original collaborative node information of the data forming node based on the review information after the update process. For example, determine the updated collaborative node information corresponding to the review information after the update process. This requires checking and updating the original collaborative node information one by one according to the abnormalities and corrections in the review information. For example, if it is found that the device model record of a node is incorrect, it is necessary to make corresponding corrections in the collaborative node information. If the IP address of a node is found to be incorrect in the review information, the corresponding collaborative node information needs to be updated. The purpose of this step is to ensure the accuracy and consistency of the forensic data and the collaborative node information, so as to provide reliable support for subsequent investigations, analysis or legal proceedings.

[0039] Step S14: Obtain the storage path corresponding to the updated forensic data.

[0040] Among them, the storage path is the storage path corresponding to the updated forensic data during the data formation and circulation process.

[0041] Step S15: Form a verification blockchain based on the root hash value and the storage path.

[0042] The verification blockchain contains at least one block, and each block corresponds to each data node.

[0043] Specifically, the process of forming a verification blockchain may include the following steps: create a new block, and use the root hash value and storage path of the data as part of the block; hash the content of the block to obtain a block hash value; if this is the first block (i.e., the genesis block), it has no hash value reference of the previous block. Otherwise, the hash value of the previous block is also included in the current block to form a chain structure. Add the newly created block to the end of the verification blockchain. This process can be repeated for each data node, thus forming a verification blockchain containing multiple blocks. Each block records the root hash value and storage path of the corresponding data node, ensuring the traceability and integrity verification capabilities of the forensic data.

[0044] Step S16: When access request information is detected, the access permission and access data content are determined according to the access request information.

[0045] Among them, access rights are used to represent the range of blocks that users can access to verify the blockchain.

[0046] Step S17: Determine access review information based on the access authority and the access data content, determine access review data corresponding to the forensic data according to the access review information, and send the access review data to the user terminal.

[0047] Specifically, at least one accessible block is determined based on the access rights, and the monitoring data content corresponding to the at least one accessible block is obtained based on the storage path corresponding to each block in the verification blockchain. According to the correspondence between the access data content and the access feature, the data content to be accessed corresponding to the access data content is determined from the monitoring data content of at least one accessible block, and the access view information corresponding to the access rights is determined for the data content to be accessed.

[0048] For the embodiment of the present application, after the forensic data is collected, the collaborative node information corresponding to the data formation node is determined based on the forensic data, so that subsequent viewers can view the forensic data in a targeted manner, and it is also convenient for subsequent forensic data to be abnormal. The corresponding information responsible person and the node original data restoration can be known based on the collaborative node information, and then the monitoring standard information corresponding to each collaborative node information is collected respectively, and the collaborative node information is monitored and audited according to the monitoring standard information to obtain the audit information corresponding to each collaborative node information. In order to determine whether there is an abnormality in the current audit information, the audit information is screened and updated for abnormalities, and the root hash value of the updated audit information is calculated to obtain the root hash value corresponding to the updated review information. Then, the updated collaborative node information corresponding to the updated review information is determined, and the updated forensic data is determined based on the updated collaborative node information. Then, the storage path corresponding to the updated forensic data is obtained. The storage path is the corresponding path of the updated forensic data during the data formation flow process. A storage path is obtained, and then a verification blockchain is formed according to the root hash value and the storage path. The verification blockchain contains at least one block, and each block corresponds to each data node. Then, when access request information is monitored, the access permission and the access data content are determined according to the access request information. The access permission is used to characterize the block range that the user can access the verification blockchain. Then, based on the access permission and the access data content, access view information is determined, and the access view data corresponding to the forensic data is determined according to the access view information, and the access view data is sent to the user terminal. Therefore, when the user needs to view the forensic data, the user only needs to send the access request information to the electronic device to obtain the access view data returned by the electronic device. In this process, the user cannot access the source data corresponding to the access view data, and can only obtain the access view data sample data, thereby protecting the security of the forensic data to the greatest extent. At the same time, the forensic data is organized in the form of a blockchain, which is also convenient for reducing the amount of data in the process of transmitting data to the cloud and reducing the cost of forensics.

[0049] Furthermore, the method also includes: obtaining the number of accessible blocks corresponding to the access rights in real time according to the verification blockchain; judging whether the number of accessible blocks has changed according to the access rights and the corresponding relationship between the access rights and the access blocks and the number of accessible blocks corresponding to the current moment; if so, updating the corresponding relationship between the detected access data content and the access characteristics, determining the access data content corresponding to the access characteristics of at least one access block according to the verification blockchain, and judging the access block corresponding to the access data content to determine whether the current access block is an accessible block; if not, generating an access authorization instruction, and sending the access authorization instruction to a user device with access rights to the access block, and after receiving the accessible instruction returned by the user device, generating a verification code and timeliness information corresponding to the verification code according to the access request information, the collaborative node information and the current time information.

[0050] Specifically, the user data to be accessed, the access rights required, and the data content to be accessed are determined based on the access request information, and the user information features in the user data to be accessed, the permission features in the access rights required, and the data content features in the data content to be accessed are extracted respectively, and the user information features, the permission features, and the data content features are added to the preset security code according to a preset weight ratio to obtain a verification code corresponding to the access request information, and the required flow time and application time from the node corresponding to the current time information to the node corresponding to the next block to be accessed are predicted based on the collaborative node information and the node corresponding to the current time information, and the validity information of the verification code is determined based on the current time information, the required flow time, and the application time.

[0051] In the embodiment of the present application, the verification code can be a QR code or a barcode. Since a QR code can generally accommodate up to 1850 uppercase letters or 2710 numbers or 1108 bytes or 500 Chinese characters, the data capacity corresponding to the QR code is relatively large. In the embodiment of the present application, no specific limitation is made, as long as the access request information can be displayed in the form of a verification code.

[0052] Furthermore, the user information features, permission features and data content features are added to the preset security code according to a preset weight ratio to obtain a verification code corresponding to the access request information, and then it also includes: obtaining an access record of the verification code within a preset time period, the access record is used to characterize the access time and access account of the verification code within the preset time period, judging whether there is an access anomaly in the verification code according to the access time and access account within the preset time period, and when there is an access anomaly, performing at least one parameter splicing based on the positional relationship between the monitoring information corresponding to the verification code and the user information corresponding to the request user data to obtain a parameter key corresponding to each parameter splicing, and recording each splicing process to obtain a splicing rule corresponding to each splicing process, according to The time limit information allocates a usage time for each splicing rule, and obtains the usage time corresponding to each splicing rule. When the access request information is received again, the access request information is parsed to obtain the access parameters, and the re-access time when the access request information is received again is recorded. According to the usage time corresponding to each splicing rule, the target splicing rule corresponding to the re-access time is determined, and the monitoring information corresponding to the access parameters and the verification code is spliced ​​according to the target splicing rule to obtain the monitoring information key. Based on the target splicing rule and the usage time corresponding to each splicing rule, the monitoring information key is restored, and the restored monitoring information key is matched with the parameter key. If the match is successful, the verification code is fed back to the terminal device corresponding to the user information.

[0053] Specifically, based on the positional relationship between the monitoring information corresponding to the verification code and the user information corresponding to the requested user data, at least one parameter splicing is performed to obtain a parameter key corresponding to each parameter splicing, including: determining a random value according to a random number algorithm, determining a hash address of the monitoring information corresponding to the verification code in the blockchain according to a mapping relationship between the hash value and the monitoring information, determining respective corresponding numbers for the random value, the hash address, and the user information, and arranging the respective corresponding numbers of the random value, the hash address, and the user information to generate multiple numbering sequences, and performing parameter splicing on the random value, the hash address, and the user information according to each numbering sequence to obtain a parameter key corresponding to each numbering sequence.

[0054] Specifically, judging whether there is an access anomaly in the verification code according to the access time and the access account within the preset time period includes: judging whether the access time and the access account within the preset time period meet the preset conditions, and when the preset conditions are met, determining that there is an access anomaly in the verification code; wherein the preset conditions include at least one of the following: The number of accesses from the same access account within a preset time period is higher than a first preset threshold; The security level corresponding to the access account is lower than the preset security level; The number of different access accounts within the preset access time period exceeds a second preset threshold.

[0055] The above-mentioned embodiment introduces a cloud-based collaborative forensic data protection method from the perspective of method flow, and the following embodiment introduces a cloud-based collaborative forensic data protection device from the perspective of a virtual module or a virtual unit. For details, please refer to the following embodiments.

[0056] The present application embodiment provides a cloud-based collaborative forensics data protection device, such as Figure 2 As shown, the device may specifically include: The forensic acquisition module 21 is used to acquire forensic data and determine the coordination node information corresponding to the data forming node based on the forensic data; The node audit module 22 is used to collect the monitoring standard information corresponding to each collaborative node information, monitor and audit the collaborative node information based on the monitoring standard information, and obtain the audit information corresponding to each collaborative node information; The hash calculation module 23 is used to perform abnormal screening and update on the audit information, and perform root hash value calculation on the updated audit information to obtain the root hash value corresponding to the updated audit information; The forensic update module 24 is used to determine the updated coordination node information corresponding to the updated review information, and determine the updated forensic data based on the updated coordination node information; A path acquisition module 25 is used to acquire a storage path corresponding to the updated forensic data, where the storage path is the storage path corresponding to the updated forensic data during the data formation and circulation process; A blockchain generation module 26, configured to form a verification blockchain according to the root hash value and the storage path, wherein the verification blockchain includes at least one block, and each block corresponds to each data node; A request determination module 27 is used to determine the access permission and access data content according to the access request information when the access request information is monitored. The access permission is used to indicate the block range that the user can access to verify the blockchain; The data sending module 28 is used to determine access review information based on the access authority and the access data content, determine the access review data corresponding to the forensic data according to the access review information, and send the access review data to the user terminal.

[0057] In a possible implementation of the embodiment of the present application, the data sending module 28 determines the access viewing information based on the access permission and the access data content, including: Determining at least one accessible block according to the access rights; According to the storage path corresponding to each block in the verification blockchain, obtain the monitoring data content corresponding to at least one accessible block; Determine, from the monitored data content of at least one accessible block, data content to be accessed corresponding to the access data content according to the correspondence between the access data content and the access feature; Determine the access information corresponding to the access rights based on the content of the data to be accessed.

[0058] In another possible implementation of the embodiment of the present application, the device 20 further includes: an accessible acquisition module, a data monitoring module, a block determination module, and a verification generation module, wherein: The accessible acquisition module is used to obtain the number of accessible blocks corresponding to the access rights in real time according to the verification blockchain; A data monitoring module, used to determine whether there is a change in the number of accessible blocks according to the access rights and the corresponding relationship between the access rights and the access blocks and the number of accessible blocks corresponding to the current moment; A block determination module, for, if yes, updating the correspondence between the detected access data content and the access feature, determining the access data content corresponding to the access feature of at least one access block according to the verification blockchain, and determining the access block corresponding to the access data content to determine whether the current access block is an accessible block; The verification generation module is used to generate an access authorization instruction if not, and send the access authorization instruction to the user device that has access rights to the access block. After receiving the accessible instruction returned by the user device, a verification code and time information corresponding to the verification code are generated according to the access request information, collaborative node information and current time information.

[0059] In another possible implementation of the embodiment of the present application, when the verification generation module generates a verification code and time validity information corresponding to the verification code according to the access request information, the coordination node information and the current time information, it is specifically used to: Determine the user data to be accessed, the required access rights, and the data content to be accessed based on the access request information; Respectively extract the user information features in the user data to be accessed, the permission features in the access permission required, and the data content features in the data content to be accessed, and add the user information features, the permission features, and the data content features to the preset security code according to a preset weight ratio to obtain a verification code corresponding to the access request information; According to the coordinated node information and the node corresponding to the current time information, predict the required flow time and application time when the flow from the node corresponding to the current time information to the node corresponding to the next block to be accessed; The validity information of the verification code is determined based on the current time information, the required circulation time and the application time.

[0060] In another possible implementation of the embodiment of the present application, the device 20 further includes: a record acquisition module, an abnormality judgment module, a parameter splicing module, a duration allocation module, a moment recording module, a key acquisition module and a key matching module, wherein: A record acquisition module is used to acquire access records of the verification code within a preset time period, where the access records are used to characterize the access time and access account of the verification code within the preset time period; An abnormality judgment module, used to judge whether there is an access abnormality in the verification code according to the access time and access account within a preset time period; A parameter splicing module is used to perform at least one parameter splicing based on the positional relationship between the monitoring information corresponding to the verification code and the user information corresponding to the requesting user data when an access anomaly exists, obtain a parameter key corresponding to each parameter splicing, and record each splicing process to obtain a splicing rule corresponding to each splicing process; A duration allocation module is used to allocate a usage duration to each splicing rule according to the timeliness information, and obtain the usage duration corresponding to each splicing rule; A time recording module, for parsing the access request information to obtain access parameters when the access request information is received again, and recording the re-access time when the access request information is received again; The key acquisition module is used to determine the target splicing rule corresponding to the re-access time according to the usage duration corresponding to each splicing rule, and splice the monitoring information corresponding to the access parameter and the verification code according to the target splicing rule to obtain the monitoring information key; The key matching module is used to restore the monitoring information key based on the target splicing rule and the usage duration corresponding to each splicing rule, and match the restored monitoring information key with the parameter key. If the match is successful, the verification code is fed back to the terminal device corresponding to the user information.

[0061] In another possible implementation of the embodiment of the present application, the parameter splicing module performs at least one parameter splicing based on the positional relationship between the monitoring information corresponding to the verification code and the user information corresponding to the requesting user data to obtain the parameter key corresponding to each parameter splicing, specifically for: Determine a random value according to a random number algorithm; Determine the hash address of the monitoring information corresponding to the verification code in the blockchain according to the mapping relationship between the hash value and the monitoring information; Determine the numbers corresponding to the random value, the hash address, and the user information, and arrange the numbers corresponding to the random value, the hash address, and the user information to generate multiple number sequences; According to each numbering sequence, the random value, hash address and user information are concatenated to obtain the parameter key corresponding to each numbering sequence.

[0062] In another possible implementation of the embodiment of the present application, when the abnormality judgment module judges whether there is an access abnormality in the verification code according to the access time and the access account within the preset time period, it is specifically used to: Determine whether the access time and access account within the preset time period meet the preset conditions, and if the preset conditions are met, determine that there is an access anomaly in the verification code; The preconditions include at least one of the following: The number of visits by the same access account within a preset time period is higher than a first preset threshold; The security level corresponding to the access account is lower than the preset security level; The number of different access accounts within the preset access time period exceeds a second preset threshold.

[0063] An electronic device provided in an embodiment of the present application is introduced below. The electronic device described below and the cloud-based collaborative forensics data protection method described above can be referenced to each other.

[0064] The present application embodiment provides an electronic device, such as Figure 3 As shown, Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, Figure 3 The electronic device 300 shown includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one, and the structure of the electronic device 300 does not constitute a limitation on the embodiments of the present application.

[0065] The processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of the present application. The processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0066] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0067] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0068] The memory 303 is used to store application code for executing the solution of the embodiment of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the content shown in the above method embodiment.

[0069] Among them, electronic devices include but are not limited to: mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 3 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0070] A computer-readable storage medium provided in an embodiment of the present application is introduced below. The computer-readable storage medium described below and the method described above can be referenced to each other.

[0071] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above cloud-based collaborative forensic data protection method are implemented.

[0072] Since the embodiments of the computer-readable storage medium part and the embodiments of the method part correspond to each other, the embodiments of the computer-readable storage medium part refer to the description of the embodiments of the method part.

[0073] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0074] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A cloud-based collaborative forensic data protection method, characterized in that: include: Acquire forensic data, and determine the coordination node information corresponding to the cloud data formation node based on the forensic data; Collecting monitoring standard information corresponding to each of the collaborative node information, monitoring and auditing the collaborative node information based on the monitoring standard information, and obtaining audit information corresponding to each of the collaborative node information; Performing abnormal screening and updating on the audit information, and calculating the root hash value of the updated audit information to obtain the root hash value corresponding to the updated audit information; Determining to update the coordination node information corresponding to the updated review information, and determining to update the forensic data based on the updated coordination node information; Acquire a storage path corresponding to the updated forensic data, where the storage path is a storage path corresponding to the updated forensic data during the data formation and circulation process; Forming a verification blockchain according to the root hash value and the storage path, wherein the verification blockchain includes at least one block, and each block corresponds to each data node; When access request information is detected, the access permission and access data content are determined according to the access request information, wherein the access permission is used to indicate the block range that the user can access to the verification blockchain; Access review information is determined based on the access authority and the access data content, access review data corresponding to the forensic data is determined according to the access review information, and the access review data is sent to the user terminal.

2. A cloud-based collaborative forensic data protection method according to claim 1, characterized in that: The determining of access review information based on the access permission and the access data content includes: Determining at least one accessible block according to the access rights; Obtaining monitoring data content corresponding to the at least one accessible block according to a storage path corresponding to each block in the verification blockchain; According to the correspondence between the access data content and the access feature, determining the data content to be accessed corresponding to the access data content from the monitored data content of at least one accessible block; The access viewing information corresponding to the access authority is determined based on the content of the data to be accessed.

3. A cloud-based collaborative forensic data protection method according to claim 1, characterized in that: The method further comprises: According to the verification blockchain, the number of accessible blocks corresponding to the access rights is obtained in real time; According to the access rights and the corresponding relationship between the access rights and the access blocks and the number of accessible blocks corresponding to the current moment, determining whether the number of accessible blocks has changed; If so, update the corresponding relationship between the access data content and the access feature, determine the access data content of at least one access block corresponding to the access feature according to the verification blockchain, and judge the access block corresponding to the access data content to determine whether the current access block is an accessible block; If not, an access authorization instruction is generated and sent to a user device that has access rights to the access block. After receiving the accessible instruction returned by the user device, a verification code and time validity information corresponding to the verification code are generated based on the access request information, the collaborative node information and the current time information.

4. A cloud-based collaborative forensic data protection method according to claim 3, characterized in that: The generating of the verification code and the timeliness information corresponding to the verification code according to the access request information, the coordination node information and the current time information includes: Determine the user data to be accessed, the access permission required, and the data content to be accessed according to the access request information; Respectively extracting user information features in the user data to be accessed, permission features in the access permission required, and data content features in the data content to be accessed, and adding the user information features, the permission features, and the data content features to a preset security code according to a preset weight ratio to obtain a verification code corresponding to the access request information; According to the coordination node information and the node corresponding to the current time information, predict the required flow time and application time when the flow is transferred from the node corresponding to the current time information to the node corresponding to the next block to be accessed; The validity information of the verification code is determined according to the current time information, the required circulation time and the application time.

5. A cloud-based collaborative forensic data protection method according to claim 3, characterized in that: The user information feature, the permission feature and the data content feature are added to the preset security code according to a preset weight ratio to obtain a verification code corresponding to the access request information, and then further includes: Obtaining access records of the verification code within a preset time period, wherein the access records are used to indicate access times and access accounts of accesses to the verification code within the preset time period; Determining whether the verification code has access anomalies according to the access time and access account within a preset time period; When there is an access anomaly, perform at least one parameter splicing based on the positional relationship between the monitoring information corresponding to the verification code and the user information corresponding to the requesting user data, obtain a parameter key corresponding to each parameter splicing, and record each splicing process to obtain a splicing rule corresponding to each splicing process; Allocate a usage time for each splicing rule according to the timeliness information to obtain a usage time corresponding to each splicing rule; When receiving the access request information again, parsing the access request information to obtain access parameters, and recording the re-access time when the access request information is received again; Determine the target splicing rule corresponding to the re-access moment according to the usage durations corresponding to the respective splicing rules, perform parameter splicing on the access parameter and the monitoring information corresponding to the verification code according to the target splicing rule to obtain a monitoring information key; Based on the target splicing rule and the usage duration corresponding to each splicing rule, the monitoring information key is restored, and the restored monitoring information key is matched with the parameter key. If the match is successful, the verification code is fed back to the terminal device corresponding to the user information.

6. A cloud-based collaborative forensic data protection method according to claim 5, characterized in that: The performing at least one parameter splicing based on the positional relationship between the monitoring information corresponding to the verification code and the user information corresponding to the request user data to obtain a parameter key corresponding to each parameter splicing includes: Determine a random value according to a random number algorithm; Determine the hash address of the monitoring information corresponding to the verification code in the blockchain according to the mapping relationship between the hash value and the monitoring information; Determine respective numbers corresponding to the random value, the hash address, and the user information, and arrange the respective numbers corresponding to the random value, the hash address, and the user information to generate a plurality of number sequences; The random value, the hash address and the user information are parameter-concatenated according to each numbering sequence to obtain a parameter key corresponding to each numbering sequence.

7. A cloud-based collaborative forensic data protection method according to claim 5, characterized in that: The determining whether the verification code has access anomaly according to the access time and the access account within the preset time period includes: Determine whether the access time and access account within a preset time period meet preset conditions, and when the preset conditions are met, determine that there is an access anomaly in the verification code; The preconditions include at least one of the following: The number of visits by the same access account within a preset time period is higher than a first preset threshold; The security level corresponding to the access account is lower than the preset security level; The number of different access accounts within the preset access time period exceeds a second preset threshold.

8. A cloud-based collaborative forensic data protection device, characterized in that: include: A forensic acquisition module, used to acquire forensic data and determine the coordination node information corresponding to the cloud data formation node based on the forensic data; A node audit module is used to collect monitoring standard information corresponding to each of the collaborative node information, monitor and audit the collaborative node information based on the monitoring standard information, and obtain audit information corresponding to each of the collaborative node information; A hash calculation module is used to perform abnormal screening and update on the audit information, and perform root hash value calculation on the updated audit information to obtain a root hash value corresponding to the updated audit information; A forensic update module, used to determine to update the coordination node information corresponding to the updated review information, and to determine to update the forensic data based on the updated coordination node information; A path acquisition module, used to acquire the storage path corresponding to the updated forensic data, wherein the storage path is the storage path corresponding to the updated forensic data during the data formation and circulation process; A blockchain generation module, configured to form a verification blockchain according to the root hash value and the storage path, wherein the verification blockchain includes at least one block, and each block corresponds to each data node; A request determination module, configured to determine access rights and access data content according to access request information when access request information is detected, wherein the access rights are used to indicate a range of blocks that the user can access to the verification blockchain; The data sending module is used to determine access review information based on the access permission and the access data content, determine the access review data corresponding to the forensic data according to the access review information, and send the access review data to the user terminal.

9. A cloud-based collaborative forensic data protection device, characterized in that: The cloud-based collaborative forensic data protection device includes: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the cloud-based collaborative forensic data protection method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: include: A computer program is stored which can be loaded by a processor and execute the cloud-based collaborative forensic data protection method as described in any one of claims 1-7.

Images