A Traceability Method, Device and Equipment Based on Digital Certificate and Hidden Watermark

Abstract

The present invention discloses a traceability method, device and equipment based on digital certificates and invisible watermarks, belonging to the field of information security technology. Among them, confidential files are distributed through SSLVPN or terminal security tools; the confidential files are processed with invisible watermarks, and the invisible watermark processing is based on the addition or extraction of watermarks in the time domain or frequency domain of opencv. The invisible watermark information includes the signature information of each node in the propagation link. When the file is leaked, the signature information in the invisible watermark is extracted for multi-level traceability to determine the leakage source and the propagation link; the confidential file is accessed through SSLVPN or terminal security tools, and at the same time, the download and screenshot operations of the file are prevented. The present invention provides a traceability method, device and equipment based on digital certificates and invisible watermarks, which can not only protect the document from illegal access and leakage, but also, when leakage occurs, through the signature information in the digital watermark, realize multi-level traceability, so as to accurately track the leakage source and the propagation link, and provide technical support for post-event accountability.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security, and particularly relates to a traceability method, device and equipment based on digital certificates and hidden watermarks. Background Art

[0002] With the rapid development of information technology, organizations are increasingly relying on electronic documents for information transmission and communication. To meet the notification link with high security requirements, the prior art has adopted two main methods to achieve remote viewing and operation:

[0003] First, view files through SSL VPN: Through an SSL VPN gateway device, users can log in to a specific website to view documents online, but are not allowed to download or screenshot the documents, thus protecting the security of the documents to a certain extent. SSL VPN (Secure Sockets Layer Virtual Private Network) is a security technology that uses the SSL (Secure Sockets Layer) protocol to achieve remote access to an enterprise internal network.

[0004] Second, view files through a terminal security tool: Such as a specially customized WPS software, users can download encrypted documents and view them in this tool, but are not allowed to download or screenshot the documents to prevent information leakage.

[0005] Although these technologies have played a certain role in preventing illegal downloading and screenshotting of documents, they still have security risks. For example, users may leak information by taking pictures of the screen with a mobile phone. This method is difficult to prevent, and once leakage occurs, it will bring serious consequences.

[0006] Currently, to prevent leakage, the prior art has adopted adding plaintext watermarks or setting grid points on the document for obvious intellectual property declarations, or adding plaintext watermarks or hidden watermarks on the file itself to declare intellectual property. However, the main disadvantage of these methods is that they cannot trace the propagation link from the leakage source to the leakage point. Therefore, it is difficult to hold effective accountability when leakage occurs.

[0007] In addition, the existing technologies also have limitations in preventing screen shooting. Although technical means can be used to restrict downloading and screenshotting operations, users can still obtain the document content through other means, such as using a mobile phone to take pictures of the screen. Once this type of leakage occurs, it will be difficult to control and trace, posing a challenge to information security. Summary of the Invention

[0008] The present invention aims to solve the problems existing in the above-mentioned prior art, and provides a traceability method, device and equipment based on digital certificates and invisible watermarks, which can not only protect documents from illegal access and leakage, but also, when leakage occurs, through the signature information in the digital watermark, achieve multi-level traceability, so as to accurately track the leakage source and propagation link, and provide technical support for post-event accountability.

[0009] The technical solution is as follows:

[0010] On the one hand, a traceability method based on digital certificates and invisible watermarks is provided.

[0011] Step S1, distribute classified documents through SSLVPN or terminal security tools;

[0012] Step S2, perform invisible watermark processing on the classified documents. The invisible watermark processing is based on watermark addition or extraction in the time domain or frequency domain of opencv. The invisible watermark information includes the signature information of each node in the propagation link. When the document is leaked, multi-level traceability is performed by extracting the signature information in the invisible watermark to determine the leakage source and propagation link;

[0013] Step S3, access the classified documents through SSLVPN or terminal security tools, and prevent file downloading and screenshot operations at the same time.

[0014] Further, performing invisible watermark processing on classified documents through SSLVPN includes a watermark addition service and a watermark removal service. The invisible watermark information includes the signature of the publisher of the classified document on the certificate and related information of the recipient and its own certificate.

[0015] Further, the watermark service is used to embed watermark information in the classified document and is called after the user access authentication plugin confirms that the user has the right to access the classified document. The specific steps of the user access authentication plugin include:

[0016] Judge whether there is already a watermark currently and determine which frequency domain is specifically occupied;

[0017] If it is occupied, add watermark information in a new frequency domain. The watermark information includes the SSLVPN gateway signature certificate, the current access user certificate, the signature information of the SSLVPN gateway on the user certificate, the current timestamp and the file URL.

[0018] Further, the watermark removal service is used to trace the propagation path and leakage source of the file when the file is leaked. The specific steps include:

[0019] Decrypt the information list, and each list contains the SSLVPN gateway signature certificate, the current access user certificate, the signature information of the SSLVPN gateway on the user certificate, the current time and the file URL;

[0020] The gateway device ID is decoded from the SSLVPN gateway signature certificate to determine which gateway has leaked;

[0021] The certificate CN information is decoded from the current access user certificate to determine which user has had a file leak;

[0022] The signature information of the user certificate by the SSLVPN gateway is used to verify that the watermark is indeed added by this gateway service and not a forged watermark information;

[0023] The timestamp and URL are used to determine at what time point and what file has been leaked.

[0024] Furthermore, confidential files are distributed through the terminal security tool and processed with hidden watermarks. The hidden watermark information includes the signature of the file sender's own digital certificate and related information for the file recipient and the sender's own digital certificate.

[0025] Furthermore, the distribution of confidential files through the terminal security tool includes:

[0026] The file sender uses a USB key for digital signature;

[0027] The file sender generates a symmetric key and uses the symmetric key to encrypt the file to form a ciphertext;

[0028] The file sender obtains the recipient's public key through the LDAP server to create a digital envelope;

[0029] The file sender embeds a digital watermark in the file. The digital watermark information includes the sender's identity information and timestamp;

[0030] The file sender sends the encrypted file and the digital envelope to the file recipient. The file recipient uses their own private key to decrypt the digital envelope to obtain the symmetric key, uses the symmetric key to decrypt the file to obtain the original file, calculates the new watermark metadata, calls the digital watermark service parameters to add a watermark, obtains the returned new file with the watermark, adds it to the confidential file cabinet, and views the file.

[0031] Furthermore, when tracking after a leak occurs in the distribution of confidential files through the terminal security tool, it includes,

[0032] When it is found that a file may be illegally leaked by screen capture, first call the digital watermark service; use the digital watermark service to extract the hidden watermark metadata from the file; perform authenticity verification on the extracted hidden watermark metadata; construct a propagation link based on the extracted hidden watermark metadata; query the corresponding certificate on the LDAP according to the CN item of the last node of the link, and find the specific person according to the certificate.

[0033] Furthermore, digital watermark services include: watermark addition service, watermark extraction service, watermark metadata storage format, encrypted watermark and anti-counterfeiting watermark.

[0034] On the other hand, a traceability device based on digital certificates and hidden watermarks is provided, comprising

[0035] The file receiving module is used to receive confidential files through SSLVPN or terminal security tools;

[0036] A hidden watermark processing module is used to perform hidden watermark processing on confidential documents. The hidden watermark processing is based on OpenCV time domain or frequency domain watermark addition or extraction. The hidden watermark information includes the signature information of each node in the transmission link. In the event of a leak, the signature information in the hidden watermark is extracted to perform multi-level tracing to determine the source of the leak and the transmission link.

[0037] The file viewing module is used to view confidential files through SSLVPN or terminal security tools, while preventing downloading and screenshot operations.

[0038] On the other hand, a computer device is provided, comprising a memory for storing computer program instructions and a processor for executing the program instructions, wherein, when the computer program instructions are executed by the processor, the computer device is triggered to execute the traceability method based on digital certificates and hidden watermarks.

[0039] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0040] Confidential files are watermarked. Using digital certificates and multi-level signatures, the leaked file's distribution chain can be identified and subsequently traced back to its source. The watermark information contains the signature information of each node in the distribution chain. Digital certificates verify the signature, making it impossible to forge or deny the leak, and revealing the leaked distribution chain. When a file is leaked, the watermark information can be extracted to trace the file's distribution path and source. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0042] Figure 1 A flowchart of a traceability method based on digital certificates and hidden watermarks provided in this application;

[0043] Figure 2 Flowchart of the digital certificate and hidden watermark traceability method based on SSLVPN provided in Example 1 of the present application;

[0044] Figure 3Flowchart of the user access authentication plug-in for accessing classified files based on SSLVPN provided by the embodiments of this application;

[0045] Figure 4 Flowchart of the watermarking service for accessing classified files based on SSLVPN provided by the embodiments of this application;

[0046] Figure 5 Flowchart of the digital certificate and invisible watermark traceability method based on the terminal security tool provided by Embodiment 1 of this application;

[0047] Figure 6 Flowchart of tracing after a classified file is leaked based on the terminal security tool;

[0048] Figure 7 Flowchart of sending / receiving classified files based on the terminal security tool. Detailed implementation mode

[0049] Here, the exemplary embodiments will be described in detail, and the examples are shown in the drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementation manners described in the following exemplary embodiments do not represent all implementation manners consistent with the present invention. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0050] As Figure 1 shown, a traceability method based on digital certificates and invisible watermarks is provided, including the following specific steps:

[0051] Step S1, distribute classified files through SSLVPN or the terminal security tool to ensure the security and integrity of the files during transmission.

[0052] Step S2, perform invisible watermark processing on the classified files. The invisible watermark contains the signature information of each node in the propagation link; the invisible watermark processing is based on adding or extracting time-domain or frequency-domain watermarks of the opencv algorithm. During transmission, invisible watermark processing is performed on the document to embed the digital certificate and signature information of the sender. When the document is leaked, multi-level traceability is performed through the signature information in the invisible watermark to determine the leakage source and the propagation link.

[0053] If the classified file is viewed through SSLVPN, the invisible watermark information includes the signature of the publisher of the file on the certificate and related information of the recipient and its own certificate, that is, the signature of the gateway device in SSL VPN on the certificate and related information with key or related authorization information for the recipient and its own certificate.

[0054] If a classified file is viewed through a terminal security tool, the hidden watermark processing is performed on the classified file. Among them, the hidden watermark information includes its own signature of the document and the digital certificate of the sender of the file at the other end for document verification in the propagation link.

[0055] Step S3, access the classified file through SSLVPN or a terminal security tool, and at the same time take measures to prevent file downloading and screenshot operations to ensure the security of the file during the viewing process.

[0056] In summary, a traceability method, device, and equipment based on digital certificates and hidden watermarks are provided. It can not only protect documents from illegal access and leakage, but also, when a leakage occurs, through the signature information in the digital watermark, achieve multi-level traceability, so as to accurately track the leakage source and propagation link, providing technical support for post-event accountability. Through this innovative technology, the security of electronic documents can be significantly improved, especially when dealing with highly sensitive government documents, ensuring the confidentiality and integrity of information, while providing effective means for tracking and holding accountable for leakage incidents.

[0057] Embodiment 1

[0058] As Figure 2 shown, distribute classified files through the SSL VPN method. The traceability method of digital certificates and hidden watermarks for classified files based on SSLVPN includes the following steps:

[0059] I. Configure the SSLVPN server:

[0060] 1. Set up a login service interface to record login user information, where the user information includes: ip port, certificate, login time;

[0061] 2. Download the resource service interface;

[0062] 3. SSLVPN proxy service;

[0063] 4. Configure a certain web resource for watermark protection.

[0064] II. The user uses the SSLVPN client to log in. The user connects to the SSLVPN server through the SSLVPN client and performs identity authentication, downloads the authorized WEB resource, and accesses the authorized web resource.

[0065] III. Trigger the user access authentication plugin: The SSLVPN server detects a file access request and triggers the user access authentication plugin. The plugin checks whether the user has the permission to access the resource and determines whether the resource requires watermark protection.

[0066] As Figure 3 shown, when the user access authentication plugin is triggered, the specific steps are as follows:

[0067] Step S201: Obtain user information, where the user information includes: IP, port, certificate, and the currently accessed URL.

[0068] Step S202: Determine whether the user has the permission to access the resource based on the user certificate information.

[0069] Step S203: If there is permission: Determine whether the currently accessed URL is the user access authentication plugin for the watermark - protected file, and then execute Step S204 or Step S208; Step S210: If there is no permission: The plugin returns an unauthorized error code, and the proxy service reports an error.

[0070] Step S204: If so, then execute Step S205.

[0071] Step S205: Obtain the byte data of the file at the currently accessed URL, and call the file watermark - adding service to add the following information: SSLVPN gateway signature certificate, current access user certificate, SSLVPN gateway's signature information for this user certificate, current time, file URL.

[0072] Step S206: After adding, replace the original returned URL file byte data with the newly added file byte data.

[0073] Step S207: The plugin returns normally.

[0074] Step S208: If not, then execute Step S209.

[0075] Step S209: The plugin returns normally.

[0076] IV. File Watermark Service

[0077] The file watermark service includes a watermark - adding service and a watermark - removing service. Through these two services, the propagation path of the file can be obtained, that is, at a certain time point, through a certain gateway chain, someone leaked a certain file. When accessing a classified file through the SSL VPN method, the hidden watermark information includes the signature of the file publisher for the receiver's certificate and related information, as well as its own certificate, that is, the signature of the gateway device in the SSL VPN for the receiver's certificate and related information with key or relevant authorization information, as well as its own certificate.

[0078] Such as Figure 4 shown, the watermark - adding service is used to embed watermark information in a classified file and is called after the user access authentication plugin confirms that the user has the permission to access the classified file. The specific steps are as follows:

[0079] Step S301: Determine whether there is already a watermark currently, and determine specifically which frequency domain it occupies.

[0080] Step S302, if there is no watermark and it is occupied, proceed to step S303

[0081] Step S303, then add information in the new frequency domain, input Certificate 1, Certificate 2, Signature 1, Timestamp, URL.

[0082] Step S304, if the file is in picture format, then execute step S305. Step S305 loads the watermark information and watermark password, adds the watermark information, and then executes step S306 to save the file.

[0083] Step S307, if the file is in pdf format, then execute step S308

[0084] Step S308, open the pdf, open each page, add the invisible watermark in the time domain, and execute step S309 to save the file;

[0085] Step S310, adding the invisible watermark in the time domain will damage the signature information. If you want to support the signature information again, you need to restore the pdf file, add the invisible watermark in the time domain, and then save the file.

[0086] The watermark removal service is used to trace the propagation path and leakage source of the file when the file is leaked. The specific steps include:

[0087] The decoded information list, each list contains, output Certificate 1, Certificate 2, Signature 1, Timestamp, URL;

[0088] Use Certificate 1 to decode the gateway device id to determine which gateway has leaked, decode Certificate 2, use the certificate CN information to determine which user has leaked the file, Signature 1 is used to verify that the watermark is indeed added by this gateway service and is not a forged watermark information, and Timestamp and URL are used to determine at what time point and what file has been leaked.

[0089] Embodiment 2

[0090] Send / receive confidential files through the terminal security tool, and the tracing method of the digital certificate and invisible watermark of the confidential file based on the terminal security tool is as follows:

[0091] Distribute the confidential file through the terminal security tool and perform invisible watermark processing on the confidential file. Among them, the invisible watermark information includes the signature of the file sender's own digital certificate and related information for the file receiver and the sender's own digital certificate.

[0092] As Figure 5 shown, Figure 5 in the terminal security software (confidential file cabinet) in, user A is the file sender, Figure 5 in the terminal security software (confidential file cabinet) in, user B is the file receiver.

[0093] The file sender uses the private key in the USB key for digital signature; among them, the USB key contains the encryption certificate, encryption private key, signature interface and signature verification interface of the file sender;

[0094] The file sender generates a symmetric key and uses the symmetric key to encrypt the file to form a ciphertext;

[0095] The file sender obtains the public key of the file recipient through the LDAP server to create a digital envelope;

[0096] The file sender embeds a digital watermark in the classified file, and the digital watermark information includes the identity information and timestamp of the sender;

[0097] The file sender sends the encrypted file and the digital envelope to the file recipient. The file recipient uses its own private key to decrypt the digital envelope to obtain the symmetric key, uses the symmetric key to decrypt the file to obtain the original file, calculates new watermark metadata, calls the digital watermark service parameters to add the watermark, obtains the returned new file containing the watermark, adds it to the confidential file cabinet, and views the file. Among them, the digital watermark service parameters are file data and watermark metadata.

[0098] As Figure 7 shown, the specific steps are as follows: Step S501, obtain the encryption certificate of user B from the LDAP server, extract the public key in the encryption certificate, and generate a random number,

[0099] Step S502, if there is no true random number in the system, then execute Step S503, pop up a window to tell the user to randomly input a sufficiently disordered string and randomly shake the mouse pointer on the interface; Step S504, perform a hash hash digest on the above data;

[0100] Step S505, if there is a true random number in the system, then execute Step S506,

[0101] Step S506, perform a hash hash digest on the random number, Step S507, obtain the key for symmetric encryption and decryption, Step S508, calculate the watermark metadata, Step S509 call the digital watermark service parameters to add the watermark, obtain the returned new file containing the watermark, Step S510, call the digital envelope service to generate an envelope file, which is already encrypted and can be transmitted over the network.

[0102] Step S511, send it to user B through the network, then execute Step S512; or, Step S517, upload / publish to the confidential file cabinet server to select the recipient, then execute Step S518, wait for user B to receive the file, and delete the file after receiving it.

[0103] Step S512: User B obtains the envelope file from the network and adds it locally.

[0104] Step S513: Use the private key of its own key to decrypt the envelope to obtain the file. Step S513 can also obtain the envelope file through Step S519. Step S519: Obtain the envelope file through the http / mgtt server.

[0105] Step S514: Calculate new watermark metadata.

[0106] Step S515: Call the digital watermark service parameters, including file data and watermark metadata, to add a watermark and obtain the new file with the watermark returned.

[0107] Step S516: Add it to the secure file cabinet and view the file.

[0108] The file sender User A sends a confidential file. The specific steps are as follows:

[0109] Obtain the encrypted certificate of User B from the LDAP server, extract the public key in the encrypted certificate, and generate a random number.

[0110] If there is no true random number in the system, pop up a window to tell the user to randomly input a sufficiently disordered string of characters and randomly shake the mouse pointer on the interface; perform a hash hash digest on the above data.

[0111] If there is a true random number in the system, perform a hash hash digest on the random number to obtain the symmetric encryption and decryption key, calculate the watermark metadata including the following structure, call the digital watermark service parameters to add a watermark, obtain the new file with the watermark returned, call the digital envelope service to generate an envelope file, send it to User B through the network, or upload / publish it to the secure file cabinet server to select the recipient and wait for User B to receive the file. After receiving, delete the file. Among them, the watermark metadata includes the following structure; the digital watermark service parameters include file data and watermark metadata; the digital envelope service includes the new file with the watermark, the public key of the other party, and the symmetric key. The digital watermark service includes a watermark addition service, a watermark extraction service, a watermark metadata storage format, an encrypted watermark, and an anti-counterfeiting watermark. The secure file cabinet server publishes or subscribes through the MQTT / HTTP service.

[0112] The file recipient User B receives the confidential file. The specific steps are as follows:

[0113] Obtain the envelope file from the network and add it locally.

[0114] Obtain the envelope file through the http / mgtt server, use the private key of its own key to decrypt the envelope to obtain the file, calculate the new watermark metadata, call the digital watermark service parameters to add the watermark, obtain the new file containing the watermark returned, add it to the confidential file cabinet, and view the file.

[0115] As Figure 6 shown, when tracing after a classified file is leaked, the specific steps are as follows:

[0116] Step S401, when it is found that the file may be illegally screen-captured and leaked,

[0117] Step S402, call the digital watermark service, and use the digital watermark service to extract the hidden watermark metadata from the file,

[0118] Step S403, perform authenticity verification on the extracted hidden watermark metadata,

[0119] Step S404, construct a propagation link according to the retrieved hidden watermark metadata, that is, sender -> [receiver sender] -> [receiver / sender] -> [receiver / sender] -> [receiver / sender],

[0120] Step S405, query the corresponding certificate on LDAP according to the CN item of the last node of the link, and query the specific person according to the certificate.

[0121] In this embodiment, digital signature and authentication are to splice and combine the identity information of the file sender and receiver, generate a signature digest through a hash algorithm, use the RSA algorithm as the encryption and decryption algorithm, and complete signature and authentication during the data transfer process.

[0122] The watermark information embedding algorithm is as follows:

[0123] Use the digital signature result as the watermark information;

[0124] Use the lower four bits of the character color channel in the document as the embedding space to realize watermark information embedding and blind extraction.

[0125] The watermark information extraction algorithm is as follows:

[0126] Extract the watermark information in each file to form a transfer path;

[0127] Verify the identity digest corresponding to the signed message, identify the sender and receiver of the document, and obtain the traceability nodes to form a traceability path.

[0128] This application provides a traceability device based on digital certificates and hidden watermarks, including

[0129] A file receiving module, which is used to receive classified files through SSLVPN or terminal security tools;

[0130] The hidden watermark processing module is used to perform hidden watermark processing on confidential files. The hidden watermark processing is the addition or extraction of watermarks in the time domain or frequency domain based on opencv. The hidden watermark information includes the signature information of each node in the propagation link. When leaked, the signature information in the hidden watermark is extracted for multi-level traceability to determine the leakage source and the propagation link.

[0131] The file viewing module is used to view confidential files through SSLVPN or terminal security tools, while preventing download and screenshot operations.

[0132] The present application provides a computer device, including a memory for storing computer program instructions and a processor for executing the program instructions. When the computer program instructions are executed by the processor, the computer device is triggered to execute the traceability method based on digital certificates and hidden watermarks.

[0133] The present invention is described with reference to the flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, and the combination of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate a device for implementing the specified functions in one process Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0134] Although the preferred embodiments of the present invention have been described, those skilled in the art can make additional changes and modifications once they know the basic creative concept. Therefore, the appended claims are intended to be construed to include the preferred embodiments and all changes and modifications falling within the scope of the present invention.

[0135] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention is also intended to include these modifications and variations.

Claims

1. A traceability method based on digital certificates and invisible watermarks, characterized in that: including Step S1: Distribute classified files through SSLVPN or terminal security tools; Step S2: Perform invisible watermarking on classified files. The invisible watermarking is implemented based on the time-domain or frequency-domain algorithm of opencv to add and extract watermarks. Specifically, it includes: Generate dynamic watermark information in SSLVPN or terminal security tools. The dynamic watermark information includes the digital certificate signature chain of each node in the propagation link. Among them, the signature chain of each node is generated by signing the digital certificate of the next recipient by this node and combining its own certificate; the invisible watermarking also includes encrypting the watermark information; Use the frequency-domain algorithm of opencv to embed it into the frequency-domain part of the classified file, where the frequency domain is dynamically adjusted based on the spectral characteristics of the file content; Step S3: Allow users to access the classified files through SSLVPN or terminal security tools, and implement security policies during the access process to prevent file downloading and screenshot operations; When a file screenshot is leaked, perform multi-level traceability by extracting the signature information in the frequency-domain invisible watermark to determine the leakage source and propagation link. Among them, the multi-level traceability includes verifying the authenticity of the extracted invisible watermark metadata, constructing the propagation link according to the extracted invisible watermark metadata, querying the corresponding certificate on LDAP according to the CN item of the last node in the link, and tracing to a specific person according to the certificate; Perform de-watermarking service on classified files through SSLVPN to trace the propagation path and leakage source of the file when the file is leaked. The specific steps include, Solve the information list, and each list contains the SSLVPN gateway signature certificate, the current access user certificate, the signature information of the SSLVPN gateway for this user certificate, the current time, and the file URL; Solve the gateway device ID through the SSLVPN gateway signature certificate to determine which gateway has leaked; Solve the certificate CN information through the current access user certificate to determine which user has leaked the file; Verify through the signature information of the SSLVPN gateway for this user certificate that it is indeed the watermark added by this gateway service, not a forged watermark information; Use the timestamp and URL to determine at what time point and what file has been leaked; Distribute classified files through terminal security tools and perform tracing after a leak, including, When it is found that the file may be illegally screen-captured and leaked, first call the digital watermark service; use the digital watermark service to extract the invisible watermark metadata from the file; verify the authenticity of the extracted invisible watermark metadata; construct the propagation link according to the extracted invisible watermark metadata; query the corresponding certificate on LDAP according to the CN item of the last node in the link, and query to a specific person according to the certificate.

2. The traceability method based on digital certificate and invisible watermark according to claim 1, characterized in that Perform watermarking service on classified files through SSLVPN to embed watermark information into the classified files. It is called after the user access authentication plugin confirms that the user has the right to access the classified files. The specific steps of the user access authentication plugin include: Judge whether there is already a watermark currently and determine what frequency domain it specifically occupies; If it is occupied, watermark information is added in the new frequency domain. The watermark information includes the SSLVPN gateway signature certificate, the current access user certificate, the SSLVPN gateway's signature information for the user certificate, the current timestamp, and the file URL.

3. The traceability method based on digital certificate and invisible watermark according to claim 1, characterized in that, Distributing confidential files through the terminal security tool includes: The file sender uses a USB key for digital signature; The file sender generates a symmetric key and uses the symmetric key to encrypt the file to form a ciphertext; The file sender obtains the recipient's public key through the LDAP server to create a digital envelope; The file sender embeds a digital watermark in the file. The digital watermark information includes the sender's identity information and timestamp; The file sender sends the encrypted file and the digital envelope to the file recipient. The file recipient uses their own private key to decrypt the digital envelope to obtain the symmetric key, uses the symmetric key to decrypt the file to obtain the original file, calculates the new watermark metadata, calls the digital watermark service to add the watermark, obtains the returned new file containing the watermark, adds it to the confidential file cabinet, and views the file.

4. The traceability method based on digital certificates and invisible watermarks according to claim 1, characterized in that The digital watermark service of the terminal security tool includes: watermark addition service, watermark extraction service, watermark metadata storage format, encrypted watermark, and anti-counterfeiting watermark.

5. A traceability device based on digital certificates and hidden watermarks, which adopts the traceability method based on digital certificates and hidden watermarks described in any one of claims 1 to 4, and is characterized in that, The device includes A file receiving module for receiving confidential files through SSLVPN or the terminal security tool; A hidden watermark processing module for performing hidden watermark processing on confidential files. The hidden watermark processing is watermark addition or extraction in the time domain or frequency domain based on opencv. The hidden watermark information includes the sender's digital signature of the recipient's digital certificate and related information and the sender's own digital certificate; When the file is leaked, multi-level tracing is performed by extracting the signature information in the hidden watermark to determine the leakage source and propagation link; performing hidden watermark processing on confidential files through SSLVPN includes a watermark addition service and a watermark removal service. The hidden watermark information includes the sender's digital signature of the recipient's certificate and related information and the sender's own digital certificate; or, performing hidden watermark processing on confidential files when distributing confidential files through the terminal security tool. The hidden watermark information includes the sender's signature of the document and the digital certificate of the file sender at the other end; A file viewing module for viewing confidential files through SSLVPN or the terminal security tool while preventing download and screenshot operations.

6. A computer device, characterized in that, The computer device includes a memory for storing computer program instructions and a processor for executing the program instructions. When the computer program instructions are executed by the processor, the computer device is triggered to execute to implement the traceability method based on digital certificates and hidden watermarks as described in any one of claims 1 to 4.

Images