Traceability method, device and equipment based on digital certificate and hidden watermark

Abstract

The invention discloses a tracing method, device and equipment based on a digital certificate and a hidden watermark, and belongs to the technical field of information security. Wherein secret-related files are distributed through an SSLVPN or a terminal security tool; the secret-related file is subjected to hidden watermark processing, the hidden watermark processing is based on opencv time domain or frequency domain watermark addition or extraction, and hidden watermark information comprises signature information of each node in a propagation link; when the file is leaked, multi-level tracing is carried out by extracting signature information in the hidden watermark, and a leakage source and a propagation link are determined; and accessing the confidential file through an SSLVPN (Secure Socket Layer Virtual Private Network) or a terminal security tool, and meanwhile, preventing file downloading and screen capture operations. The invention provides a traceability method, device and equipment based on a digital certificate and a hidden watermark, which not only can protect a document from illegal access and leakage, but also can realize multi-level traceability through signature information in the digital watermark when leakage occurs, so that a leakage source and a propagation link are accurately tracked, and technical support is provided for afterward responsibility investigation.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a traceability method, device and equipment based on digital certificates and hidden watermarks. Background Art

[0002] With the rapid development of information technology, organizations are increasingly relying on electronic documents for information transmission and communication. In order to meet the high security requirements of the notification link, the existing technology uses two main methods to achieve remote viewing and operation: The first is to view files through SSL VPN: Through the SSL VPN gateway device, users can log in to a specific website and view documents online, but users are not allowed to download or take screenshots of documents, thus protecting the security of documents to a certain extent. SSL VPN (Secure Sockets Layer Virtual Private Network) is a security technology that uses the SSL (Secure Sockets Layer) protocol to achieve remote access to the enterprise's internal network.

[0003] The second method is to view files through terminal security tools: such as specially customized WPS software. Users can download encrypted documents and view them in the tool, but users are not allowed to download or take screenshots to prevent information leakage.

[0004] Although these technologies have played a role in preventing illegal downloads and screenshots of documents, they still have security risks. For example, users may leak information by taking pictures of the screen with their mobile phones, which is difficult to prevent and will have serious consequences once the leakage occurs.

[0005] At present, in order to prevent leakage, the existing technology adopts adding plain text watermarks or inscriptions to set grid points on the document to make obvious intellectual property declarations, or adding plain text watermarks or hidden watermarks on the document itself to declare intellectual property rights. However, the main disadvantage of these methods is that they cannot trace the transmission link from the source of the leakage to the leakage point. Therefore, it is difficult to effectively hold accountable when a leakage occurs.

[0006] In addition, existing technologies have limitations in preventing screen capture. Although downloading and screenshot operations can be restricted through technical means, users can still obtain document content through other means, such as using mobile phones to capture the screen. Once such a leak occurs, it will be difficult to control and track, posing a challenge to information security. Summary of the invention

[0007] The present invention aims to solve the problems existing in the above-mentioned prior art and provides a traceability method, device and equipment based on digital certificates and hidden watermarks, which can not only protect documents from illegal access and leakage, but also realize multi-level traceability through the signature information in the digital watermark when leakage occurs, so as to accurately track the source of leakage and the transmission link, and provide technical support for subsequent accountability.

[0008] The technical solution is as follows: On the one hand, a traceability method based on digital certificates and hidden watermarks is provided. Step S1, distributing confidential files through SSLVPN or terminal security tools; Step S2, performing hidden watermark processing on the confidential file, the hidden watermark processing is based on the watermark addition or extraction of the time domain or frequency domain of OpenCV, and the hidden watermark information includes the signature information of each node in the propagation link; when the file is leaked, the signature information in the hidden watermark is extracted to perform multi-level tracing to determine the source of the leak and the propagation link; Step S3, access the confidential file through SSLVPN or terminal security tools, while preventing file downloading and screenshot operations.

[0009] Furthermore, the watermarking of confidential files through SSLVPN includes watermarking service and dewatering service. The watermark information includes the signature of the publisher of the confidential file on the recipient's certificate and related information as well as its own certificate.

[0010] Furthermore, the watermark service is used to embed watermark information in confidential files and is called after the user access authentication plug-in confirms that the user has the authority to access the confidential files. The specific steps of the user access authentication plug-in include: Determine whether there is a watermark currently and determine what frequency domain it occupies; If it is occupied, watermark information is added in the new frequency domain, and the watermark information includes the SSLVPN gateway signature certificate, the current access user certificate, the SSLVPN gateway signature information of the user certificate, the current timestamp and the file URL.

[0011] Furthermore, the watermark decryption service is used to track the file's propagation path and leakage source when the file is leaked. The specific steps include: Extract the information list, each list contains the SSLVPN gateway signature certificate, the current access user certificate, the SSLVPN gateway's signature information for the user certificate, the current time and the file URL; Determine which gateway has been leaked by extracting the gateway device ID from the SSLVPN gateway signature certificate; Determine which user has the file leaked by extracting the certificate CN information from the current access user certificate; The signature information of the user certificate is used by the SSLVPN gateway to verify that it is indeed the watermark added by this gateway service and is not a forged watermark information; The timestamp and URL are used to determine what file was leaked at what point in time.

[0012] Furthermore, confidential files are distributed through terminal security tools and watermarked. The watermark information includes the file sender's own signature on the file receiver's digital certificate and related information as well as his own digital certificate.

[0013] Furthermore, confidential files are distributed and received through terminal security tools, including: The sender of the file uses a USB key to digitally sign; The file sender generates a symmetric key and uses the symmetric key to encrypt the file to form a ciphertext; The file sender obtains the recipient's public key through the LDAP server to create a digital envelope; The sender of the file embeds a digital watermark in the file. The digital watermark information includes the sender's identity information and a timestamp. The file sender sends the encrypted file and digital envelope to the file recipient. The file recipient uses his or her own private key to decrypt the digital envelope, obtains the symmetric key, decrypts the file using the symmetric key, obtains the original file, calculates the new watermark metadata, calls the digital watermark service parameters to add the watermark, obtains the returned new file containing the watermark, adds it to the confidential file cabinet, and views the file.

[0014] Furthermore, confidential documents are distributed through terminal security tools, and the leakage is tracked, including: When it is found that a file may have been leaked by illegal screen capture, the digital watermark service is first called; the digital watermark service is used to extract the hidden watermark metadata from the file; the extracted hidden watermark metadata is verified for authenticity; a propagation link is constructed based on the extracted hidden watermark metadata; the corresponding certificate is queried on LDAP based on the CN item of the last node in the link, and the specific person is queried based on the certificate.

[0015] Furthermore, the digital watermark service includes: adding watermark service, extracting watermark service, watermark metadata storage format, encrypted watermark and anti-counterfeiting watermark.

[0016] On the other hand, a traceability device based on digital certificates and hidden watermarks is provided, comprising: The file receiving module is used to receive confidential files through SSLVPN or terminal security tools; The hidden watermark processing module is used to perform hidden watermark processing on confidential files. The hidden watermark processing is to add or extract watermarks in the time domain or frequency domain based on OpenCV. The hidden watermark information includes the signature information of each node in the propagation link. When a leak occurs, the signature information in the hidden watermark is extracted to perform multi-level tracing to determine the source of the leak and the propagation link. The file viewing module is used to view confidential files through SSLVPN or terminal security tools while preventing downloading and screenshot operations.

[0017] On the other hand, a computer device is provided, comprising a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the computer device is triggered to execute the traceability method based on digital certificates and hidden watermarks.

[0018] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: By performing hidden watermark processing on confidential files, the propagation link of the leaked files can be obtained through the digital certificate mechanism and multi-level signature, and then multi-level traceability can be performed. The hidden watermark information contains the signature information of each node in the propagation link. The signature is verified by the digital certificate, so that it is impossible to forge and deny, and the leaked propagation link is known. When a file is leaked, the propagation path and leakage source of the file can be traced by extracting the hidden watermark information in the file. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0020] Figure 1 A flowchart of a traceability method based on digital certificates and hidden watermarks provided in this application; Figure 2 A flowchart of a digital certificate and hidden watermark traceability method based on SSLVPN provided in Example 1 of the present application; Figure 3 A flowchart of a user access authentication plug-in when accessing confidential files based on SSLVPN provided in an embodiment of the present application; Figure 4 A flowchart of a watermarking service for accessing confidential files based on SSLVPN provided in an embodiment of the present application; Figure 5 A flowchart of a digital certificate and hidden watermark tracing method based on a terminal security tool provided in Example 1 of the present application; Figure 6 A flowchart for tracking leaked files based on terminal security tools; Figure 7The flowchart of sending / receiving confidential files based on terminal security tools. DETAILED DESCRIPTION

[0021] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0022] like Figure 1 As shown, a traceability method based on digital certificates and hidden watermarks is provided, including the following specific steps: Step S1, distribute confidential files through SSLVPN or terminal security tools to ensure the security and integrity of the files during transmission.

[0023] Step S2, perform hidden watermark processing on confidential files, the hidden watermark contains the signature information of each node in the transmission link; the hidden watermark processing is based on the time domain or frequency domain watermark addition or extraction of the opencv algorithm. During the transmission process, the document is processed with hidden watermarks, and the sender's digital certificate and signature information are embedded. When the document is leaked, multi-level traceability is performed through the signature information in the hidden watermark to determine the source of the leak and the transmission link.

[0024] If you view confidential files through SSLVPN, the hidden watermark information includes the publisher of the file's signature on the recipient's certificate and related information, as well as its own certificate. That is, the gateway device in the SSLVPN has its own key or related authorization information for the recipient's certificate and related information, as well as its own certificate.

[0025] If you view confidential files through terminal security tools, the hidden watermark processing is to process the confidential files. The hidden watermark information includes the signature of the document itself, and the digital certificate of the person sending the file at the other end is used to verify the document in the transmission link.

[0026] Step S3, access confidential files through SSLVPN or terminal security tools, and take measures to prevent file downloading and screenshot operations to ensure the security of files during viewing.

[0027] In summary, a traceability method, device and equipment based on digital certificates and hidden watermarks is provided, which can not only protect documents from illegal access and leakage, but also realize multi-level traceability through the signature information in the digital watermark when leakage occurs, so as to accurately track the source of leakage and the transmission link, and provide technical support for subsequent accountability. Through this innovative technology, the security of electronic documents can be significantly improved, especially when dealing with highly sensitive government documents, ensuring the confidentiality and integrity of information, and providing effective tracking and accountability means for leakage incidents.

[0028] Embodiment 1 like Figure 2 As shown, the confidential files are distributed through SSL VPN, and the traceability method of the confidential file digital certificate and hidden watermark based on SSLVPN includes the following steps: 1. Configure SSLVPN server: 1. Set up the login service interface and record the login user information, including: IP port, certificate, login time; 2. Download resource service interface; 3. SSLVPN proxy service; 4. Configure a web resource for watermark protection.

[0029] 2. The user logs in using the SSLVPN client. The user connects to the SSLVPN server through the SSLVPN client and performs identity authentication, downloads authorized WEB resources, and accesses authorized web resources.

[0030] 3. User access authentication plug-in triggering: The SSLVPN server detects a file access request and triggers the user access authentication plug-in. The plug-in checks whether the user has permission to access the resource and determines whether the resource requires watermark protection.

[0031] like Figure 3 As shown, the user access authentication plug-in is triggered. The specific steps are as follows: Step S201, obtaining user information, which includes: IP, port, certificate, and currently visited URL; Step S202: judging whether the user has the authority to access the resource according to the user certificate information; Step S203, if there is permission: determine whether the currently accessed URL is a watermark protection file user access authentication plug-in, then execute step S204 or step S208; Step S210, if there is no permission: the plug-in returns an unauthorized error code, and the proxy service reports an error.

[0032] Step S204: If yes, execute step S205. Step S205: Obtain the byte data of the file of the currently accessed URL, call the file watermarking service to add the following information: the SSLVPN gateway signature certificate, the currently accessed user certificate, the signature information of the SSLVPN gateway on the user certificate, the current time, and the file URL; Step S206: After adding, the newly added file byte data replaces the original returned URL file byte data. Step S207: The plug-in returns to normal.

[0033] Step S208: If not, execute step S209; Step S209: The plug-in returns to normal.

[0034] 4. Document Watermark Service File watermarking services include watermarking services and dewatermarking services. Through these two services, the file propagation path can be obtained, and a certain file is leaked through a certain gateway at a certain point in time. When accessing confidential files through SSL VPN, the hidden watermark information includes the signature of the publisher of the file on the recipient's certificate and related information, as well as its own certificate, that is, the gateway device in the SSL VPN itself signs the certificate of the recipient with key or related authorization information and related information, as well as its own certificate.

[0035] like Figure 4 As shown in the figure, the watermarking service is used to embed watermark information in confidential files. It is called after the user access authentication plug-in confirms that the user has the authority to access the confidential file. The specific steps are as follows: Step S301, determine whether there is a watermark currently, and determine what frequency domain it occupies; Step S302: If there is no watermark and it is occupied, proceed to step S303 Step S303, add information in the new frequency domain, input certificate 1, certificate 2, signature 1, timestamp, URL.

[0036] Step S304, if the file is in picture format, execute step S305, step S305 loads watermark information, watermark password, adds watermark information, executes step S306, and saves the file.

[0037] Step S307: If the file is in pdf format, execute step S308. Step S308, open the PDF, open each page, add the hidden watermark of the time domain, and execute step S309 to save the file; Step S310, when adding the hidden watermark of the time domain, the signature information will be destroyed. If the signature information needs to be supported again, the PDF file needs to be restored, the hidden watermark of the time domain needs to be added, and then the file needs to be saved.

[0038] Dewatermarking service is used to track the file's propagation path and leakage source when the file is leaked. The specific steps include: Extract the information list, each list contains, output certificate 1, certificate 2, signature 1, timestamp, URL; The gateway device ID is extracted from certificate 1 to determine which gateway has been leaked. Certificate 2 is extracted and the CN information of the certificate is used to determine which user has had the file leaked. Signature 1 is used to verify that it is indeed the watermark added by this gateway service and not a forged watermark. The timestamp and URL are used to determine the time point and the file that was leaked.

[0039] Embodiment 2 Send / receive confidential files through terminal security tools. The traceability method of confidential file digital certificates and hidden watermarks based on terminal security tools is as follows: Distributing confidential files through terminal security tools performs hidden watermark processing on confidential files, wherein the hidden watermark information includes the signature of the file sender himself on the digital certificate of the file receiver and related information as well as the digital certificate of the file sender himself.

[0040] like Figure 5 As shown, Figure 5 In the terminal security software (confidential file cabinet), user A is the sender of the file. Figure 5 User B of the terminal security software (confidential file cabinet) is the file recipient.

[0041] The file sender uses the private key in the USBkey to digitally sign the file; the USBkey contains the file sender's encryption certificate, encryption private key, signature interface, and signature verification interface; The file sender generates a symmetric key and uses the symmetric key to encrypt the file to form a ciphertext; The file sender obtains the file receiver's public key through the LDAP server to create a digital envelope; The sender of the file embeds a digital watermark in the confidential file. The digital watermark information includes the sender's identity information and timestamp; The file sender sends the encrypted file and digital envelope to the file receiver. The file receiver uses his own private key to decrypt the digital envelope, obtains the symmetric key, decrypts the file with the symmetric key, obtains the original file, calculates the new watermark metadata, calls the digital watermark service parameters to add the watermark, obtains the returned new file containing the watermark, adds it to the confidential file cabinet, and views the file. The digital watermark service parameters are the file data and watermark metadata.

[0042] like Figure 7As shown, the specific steps are as follows: Step S501, obtain the encryption certificate of user B from the LDAP server, extract the public key in the encryption certificate, generate a random number, Step S502: if there is no true random number in the system, then step S503 is executed, a pop-up box is displayed to tell the user to randomly input a sufficiently random string of characters and to randomly move the mouse pointer on the interface; step S504: hashing the above data; Step S505: If there is a true random number in the system, then execute step S506. Step S506, hash the random number, step S507, obtain the key for symmetric encryption and decryption, step S508, calculate the watermark metadata, step S509 call the digital watermark service parameters to add the watermark, and obtain the returned new file containing the watermark, step S510, call the digital envelope service to generate an envelope file, which has been encrypted and can be transmitted on the network.

[0043] Step S511, send to user B via the network, then execute step S512; or, step S517, upload / publish to the confidential file cabinet server to select the recipient, then execute step S518, wait for user B to receive the file, and delete the file after receiving it.

[0044] Step S512, user B obtains the envelope file from the network and adds it to the local computer; Step S513, use the private key of the own key to decrypt the envelope and obtain the file; Step S513 can also obtain the envelope file through step S519; Step S519, obtain the envelope file through the http / mgtt server; Step S514, calculating new watermark metadata; Step S515, calling the digital watermark service parameters, including the file data and the watermark metadata, to add the watermark, and obtaining the returned new file containing the watermark; Step S516, add to the confidential file cabinet and view the file.

[0045] The file sender user A sends a confidential file. The specific steps are as follows: Obtain the encryption certificate of user B from the LDAP server, extract the public key in the encryption certificate, generate a random number, If there is no true random number in the system, a pop-up window will be displayed to tell the user to randomly enter a sufficiently random string of characters and to randomly move the mouse pointer on the interface; the above data will be hashed; If there is a true random number in the system, the random number is hashed to obtain the key for symmetric encryption and decryption, and the watermark metadata is calculated to include the following structure. The digital watermark service parameters are called to add a watermark, and the returned new file containing the watermark is obtained. The digital envelope service is called to generate an envelope file, which is sent to user B through the network, or uploaded / published to the confidential file cabinet server to select a recipient, and wait for user B to receive the file, and delete the file after receiving it. Among them, the watermark metadata includes the following structure; the digital watermark service parameters include file data and watermark metadata; the digital envelope service includes a new file containing a watermark, the other party's public key, and a symmetric key. The digital watermark service includes a watermarking service, a watermark extraction service, a watermark metadata storage format, an encrypted watermark, and an anti-counterfeiting watermark. The confidential file cabinet server publishes or subscribes through the MQTT / HTTP service.

[0046] The file recipient user B receives the confidential file. The specific steps are as follows: Get the envelope file from the network and add it to the local computer; Get the envelope file through the http / mgtt server, use the private key of your own key to decrypt the envelope to get the file, calculate the new watermark metadata, call the digital watermark service parameters to add the watermark, get the returned new file containing the watermark, add it to the confidential file cabinet, and view the file.

[0047] like Figure 6 As shown in the figure, when a confidential file is leaked, the specific steps are as follows: Step S401: When it is found that the file may be leaked by illegal screen capture, Step S402: call the digital watermark service and use the digital watermark service to extract hidden watermark metadata from the file. Step S403: verify the authenticity of the extracted hidden watermark metadata. Step S404: construct a propagation link based on the retrieved hidden watermark metadata, i.e., sender->[receiver sender]->[receiver / sender]->[receiver / sender]->[receiver / sender], Step S405: query the corresponding certificate on LDAP according to the CN item of the last node of the link, and query the specific person according to the certificate.

[0048] In this embodiment, digital signature and authentication is to combine the identity information of the sender and receiver of the file, generate a signature summary through a hash algorithm, use the RSA algorithm as the encryption and decryption algorithm, and complete the signature and authentication during the data flow process.

[0049] The watermark information embedding algorithm is as follows: Use the digital signature result as watermark information; The lower four bits of the character color channel in the document are used as the embedding space to achieve watermark information embedding and blind extraction.

[0050] The watermark information extraction algorithm is as follows: Extract watermark information from each file to form a flow path; Verify the identity summary corresponding to the signed message, identify the sender and receiver of the document, and obtain the traceability node to form a traceability path.

[0051] The present application provides a traceability device based on digital certificates and hidden watermarks, comprising: The file receiving module is used to receive confidential files through SSLVPN or terminal security tools; The hidden watermark processing module is used to perform hidden watermark processing on confidential files. The hidden watermark processing is to add or extract watermarks in the time domain or frequency domain based on OpenCV. The hidden watermark information includes the signature information of each node in the propagation link. When a leak occurs, the signature information in the hidden watermark is extracted to perform multi-level tracing to determine the source of the leak and the propagation link. The file viewing module is used to view confidential files through SSLVPN or terminal security tools while preventing downloading and screenshot operations.

[0052] The present application provides a computer device, a memory for storing computer program instructions and a processor for executing program instructions, wherein when the computer program instructions are executed by the processor, the computer device is triggered to execute the traceability method based on digital certificates and hidden watermarks.

[0053] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0054] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0055] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A traceability method based on digital certificates and hidden watermarks, characterized by: include, Step S1, distributing confidential files through SSLVPN or terminal security tools; Step S2, performing hidden watermark processing on the confidential file, the hidden watermark processing is based on the watermark addition or extraction of the time domain or frequency domain of OpenCV, and the hidden watermark information includes the signature information of each node in the propagation link; when the file is leaked, the signature information in the hidden watermark is extracted to perform multi-level tracing to determine the source of the leak and the propagation link; The watermarking of confidential files through SSLVPN includes watermarking service and dewatering service. The watermark information includes the signature of the publisher of the confidential file on the recipient's certificate and related information as well as its own certificate. or, Distribute confidential files through terminal security tools to perform watermark processing on confidential files. The watermark information includes the signature of the file sender on the file receiver's digital certificate and related information, as well as the file sender's own digital certificate; Step S3, access the confidential file through SSLVPN or terminal security tools, while preventing file downloading and screenshot operations.

2. The traceability method based on digital certificate and hidden watermark according to claim 1 is characterized in that: The watermarking service for confidential files through SSLVPN is used to embed watermark information in confidential files, and is called after the user access authentication plug-in confirms that the user has the authority to access the confidential files. The specific steps of the user access authentication plug-in include: Determine whether there is a watermark currently and determine what frequency domain it occupies; If it is occupied, watermark information is added in the new frequency domain, and the watermark information includes the SSLVPN gateway signature certificate, the current access user certificate, the SSLVPN gateway signature information of the user certificate, the current timestamp and the file URL.

3. The traceability method based on digital certificate and hidden watermark according to claim 1 is characterized in that: The watermarking service for confidential files through SSLVPN is used to track the file's propagation path and leakage source when the file is leaked. The specific steps include: Extract the information list, each list contains the SSLVPN gateway signature certificate, the current access user certificate, the SSLVPN gateway's signature information for the user certificate, the current time and the file URL; Determine which gateway has been leaked by extracting the gateway device ID from the SSLVPN gateway signature certificate; Determine which user has the file leaked by extracting the certificate CN information from the current access user certificate; The signature information of the user certificate is used by the SSLVPN gateway to verify that it is indeed the watermark added by this gateway service and is not a forged watermark information; The timestamp and URL are used to determine what file was leaked at what point in time.

4. The traceability method based on digital certificate and hidden watermark according to claim 1 is characterized in that: Distribute confidential files through terminal security tools, including: The sender of the file uses a USB key to digitally sign; The file sender generates a symmetric key and uses the symmetric key to encrypt the file to form a ciphertext; The file sender obtains the recipient's public key through the LDAP server to create a digital envelope; The sender of the file embeds a digital watermark in the file. The digital watermark information includes the sender's identity information and a timestamp. The file sender sends the encrypted file and digital envelope to the file recipient. The file recipient uses his or her own private key to decrypt the digital envelope, obtains the symmetric key, decrypts the file using the symmetric key, obtains the original file, calculates the new watermark metadata, calls the digital watermark service parameters to add the watermark, obtains the returned new file containing the watermark, adds it to the confidential file cabinet, and views the file.

5. The traceability method based on digital certificate and hidden watermark according to claim 4 is characterized in that: Distribute confidential documents through terminal security tools and track them after they are leaked, including: When it is found that a file may be leaked by illegal screen capture, the digital watermark service is first called; Extract hidden watermark metadata from files using digital watermarking services; Verify the authenticity of the extracted hidden watermark metadata; A propagation link is constructed based on the extracted hidden watermark metadata; the corresponding certificate is queried on LDAP based on the CN item of the last node in the link, and the specific person is queried based on the certificate.

6. The traceability method based on digital certificate and hidden watermark according to claim 1 is characterized in that: The digital watermark service provided by the terminal security tool includes: adding watermark service, extracting watermark service, watermark metadata storage format, encrypted watermark and anti-counterfeiting watermark.

7. A traceability device based on digital certificates and hidden watermarks, using the traceability method based on digital certificates and hidden watermarks as claimed in any one of claims 1 to 6, characterized in that: The device comprises, The file receiving module is used to receive confidential files through SSLVPN or terminal security tools; Hidden watermark processing module, used to perform hidden watermark processing on confidential files. The hidden watermark processing is to add or extract watermarks in the time domain or frequency domain based on OpenCV. The hidden watermark information includes the signature information of each node in the propagation link. When a file is leaked, the signature information in the hidden watermark is extracted to perform multi-level tracing to determine the source of the leak and the propagation link. The file viewing module is used to view confidential files through SSLVPN or terminal security tools while preventing downloading and screenshot operations.

8. A computer device, characterized in that: The computer device includes a memory for storing computer program instructions and a processor for executing the program instructions, wherein, when the computer program instructions are executed by the processor, the computer device is triggered to execute to implement the traceability method based on digital certificates and hidden watermarks as described in any one of claims 1 to 6.

Images