A document tracing system and method based on reverse proxy and document watermarking

Abstract

The application relates to a document tracing system and method based on reverse proxy and document hidden marks in the technical field of data security, which comprises a business system, a data security gateway, a plurality of PC terminals and an audit server. The data security gateway receives initial network data flow packets, updates initial hidden marks of source data documents in the initial network data flow packets, generates gateway data flow packets based on the updated initial hidden marks, and updates gateway hidden marks of the source data documents in the PC terminals which realize data communication with the data security gateway. The source data documents are updated based on the updated gateway hidden marks. The current PC terminal receives previous PC data documents and updates previous PC hidden marks in the previous PC data documents. The previous PC data documents are updated based on the updated previous PC hidden marks. The audit server performs document tracing based on document unique IDs in the initial hidden marks, and solves the problem that data transmission chains cannot be completely traced in the existing data security protection process.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to a document tracing system and method based on reverse proxy and document hidden mark. BACKGROUND

[0002] In today's high-speed development of informatization and digitization, the data security of enterprise application systems is crucial, as it relates to the core competitiveness and business secrets of enterprises. Currently, the data security protection technologies for enterprise application systems mainly include: 1. encrypting sensitive data to ensure the security of data during transmission and storage; 2. monitoring and defending against external attacks through technologies such as firewalls and intrusion detection systems to protect enterprise networks and data security; 3. intrusion detection and prevention systems (IDS / IPS) can monitor network activities in real time, detect and report potential security threats, and by deploying IDS / IPS, enterprises can timely discover and respond to attacks on enterprise application systems; 4. implement strict access control policies based on employee responsibilities and needs to limit access to sensitive data.

[0003] For enterprise application systems, data security protection technologies can protect data security to some extent, but there are still defects that intentional disclosure behaviors of employees with data access rights may not be traced back. For example, employee A has access rights to application system W and downloads important data from business system W for work use. Employee A violates the rules and sends the important data to employee B, who is unaware of the importance of the data, and then employee B sends the important data to employee C, who discovers the importance and economic value of the data and then sends it outside the enterprise.

[0004] When a data leakage incident occurs, the current DLP data leakage prevention technology solution commonly used by enterprises can only audit that employee C has externally sent the data, but cannot trace back to employee A and employee B who participated in the flow of important data before the important data was leaked, nor can it trace back to the source of the important data, which is business system W. That is, the enterprise cannot conduct safety education and hold employees accountable because it cannot trace the complete chain of responsibility. On the other hand, for the enterprise's data ownership needs, when data is leaked or stolen, it cannot be traced back to the complete chain of responsibility, so it cannot prove that the data was generated and legally owned within the enterprise. SUMMARY

[0005] The present application provides a document tracing system and method based on reverse proxy and document hidden mark to solve the problem of incomplete tracing of data transmission chain in the existing data security protection process.

[0006] To solve the above technical problems, the present application solves them through the following technical solutions:

[0007] A document tracing system based on reverse proxy and document secret mark, comprising a business system, a data security gateway, a plurality of PC terminals and an audit server, the business system and the data security gateway realize data communication, the data security gateway and the plurality of PC terminals realize data communication, and the PC terminals realize data communication with each other;

[0008] The data security gateway is used for receiving initial network data flow packets issued by the business system, and updating initial secret marks of source data documents in the initial network data flow packets; updating the source data documents in the initial network data flow packets based on the updated initial secret marks, and generating gateway data flow packets;

[0009] The PC terminal realizing data communication with the data security gateway is used for receiving the gateway data flow packets, and updating gateway secret marks of source data documents in the gateway data flow packets; updating the source data documents based on the updated gateway secret marks, and generating initial PC data documents;

[0010] When the PC terminals realize data communication with each other, the current PC terminal is used for receiving a previous PC data document issued by a previous PC terminal, and updating a previous PC secret mark in the previous PC data document; updating the previous PC data document based on the updated previous PC secret mark, and obtaining a current PC data document;

[0011] The audit server is used for receiving a document unique ID, operation content and an operation ID corresponding to the operation content sent by each group of PC terminals, and obtaining the document unique ID in the initial secret mark; performing document tracing based on the document unique ID in the initial secret mark.

[0012] Optionally, updating the gateway secret mark of the source data document in the initial network data flow packets, and updating the source data document in the initial network data flow packets based on the updated gateway secret mark, and generating the gateway data flow packets, comprises the following steps:

[0013] Reading the source data document of the initial network data flow packets, and detecting whether the initial secret mark exists in the source data document;

[0014] If it is detected that the initial secret mark exists in the source data document, the initial secret mark is taken as the gateway secret mark, and the source data document containing the initial secret mark is sent to the PC terminal after being generated into the gateway data flow packet;

[0015] If it is detected that the initial secret identifier does not exist in the source data document, a document unique ID and document ownership information are generated based on the source data document; the document unique ID and document ownership information are encrypted to obtain a gateway secret identifier; the gateway secret identifier is inserted into the source data document to generate a gateway data traffic package, and the gateway data traffic package is sent to the PC terminal.

[0016] Optionally, updating the gateway secret identifier of the source data document in the gateway data traffic package comprises the following steps:

[0017] The PC terminal receives the gateway data traffic package and performs gateway secret identifier existence detection on the source data document in the gateway data traffic package.

[0018] If the gateway secret identifier does not exist in the source data document, the gateway data traffic package does not need to be continuously tracked.

[0019] If the gateway secret identifier exists in the source data document, it is determined whether the gateway secret identifier can be decrypted by the enterprise key.

[0020] If the decryption is successful, an operation ID of the PC terminal and operation content corresponding to the operation ID are obtained, the initial PC secret identifier is obtained by encrypting the operation ID in the decrypted gateway secret identifier in combination with the document unique ID and the document ownership information, the operation ID, the operation content corresponding to the operation ID and the document unique ID are sent to the audit server, and the operation content is data receiving or data sending operation content.

[0021] If the decryption fails, the gateway data traffic package does not need to be continuously tracked.

[0022] Optionally, the source data document is updated based on the updated gateway secret identifier, and an initial PC data document is generated, comprising the following steps:

[0023] The initial PC secret identifier is inserted into the source data document to generate the initial PC data document.

[0024] Optionally, the previous PC secret identifier in the previous PC data document is updated, comprising the following steps:

[0025] The current PC terminal receives the previous PC data document and performs previous PC secret identifier existence detection on the previous PC data document.

[0026] If the previous PC secret identifier does not exist in the previous PC data document, the previous PC data document does not need to be continuously tracked.

[0027] If the previous PC secret identifier exists in the previous PC data document, it is determined whether the previous PC secret identifier can be decrypted by the enterprise key.

[0028] If the decryption is successful, the operation ID of the current PC terminal and the operation content corresponding to the operation ID are obtained, the operation ID is added to the previous PC secret identifier after decryption, and the document unique ID and the document ownership information are combined for encryption to obtain the current PC secret identifier; the operation ID, the operation content corresponding to the operation ID, and the document unique ID are sent to the audit server, wherein the operation content is the operation content of data receiving or data sending;

[0029] If the decryption fails, the previous PC data document does not need to be continuously tracked.

[0030] Optionally, the previous PC data document is updated based on the updated previous PC secret identifier to obtain the current PC data document, including the following steps:

[0031] The current PC secret identifier is inserted into the previous PC data document to generate the current PC data document.

[0032] Optionally, the audit server performs document tracing based on the document unique ID in the initial secret identifier, including the following steps:

[0033] According to the document unique ID, the target secret identifier corresponding to the document unique ID is searched in the audit server;

[0034] After the target secret identifier is decrypted, the all operation IDs of the target document on the audit server and the operation content corresponding to the operation ID are searched according to the document unique ID in the target secret identifier;

[0035] The all operation IDs and the operation content corresponding to the operation ID searched are sorted to obtain the flow link of the target document.

[0036] Optionally, the audit server is further configured to display the flow link of the target document in a graphical interface.

[0037] Optionally, the business system is configured to distribute the initial network data flow package based on the data request of the PC terminal.

[0038] A document tracing method based on a reverse proxy and a document secret mark, applied to the document tracing system based on the reverse proxy and the document secret mark.

[0039] Compared with the prior art, the technical scheme provided by the application has the following beneficial effects:

[0040] The present application inserts a secret mark into a source data document, so that a user can record document operation without any code-level modification, and the subsequent trace is facilitated. Meanwhile, the source data document inserted with the secret mark has no trace for the user, and the secret mark will not be lost even if the source data document is copied, moved or renamed, thereby ensuring the reliability of document trace. BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0042] Figure 1 A system framework diagram of a document trace system based on reverse proxy and document secret mark is provided for the first embodiment.

[0043] Figure 2 A data transmission link diagram of a document trace system based on reverse proxy and document secret mark is provided for the first embodiment.

[0044] Figure 3 A processing flow diagram of a data security gateway is provided for the first embodiment.

[0045] Figure 4 A processing flow diagram of a PC terminal is provided for the first embodiment. DETAILED DESCRIPTION

[0046] The present application will be further described in detail below in combination with embodiments. The following embodiments are used to explain the present application but the present application is not limited to the following embodiments.

[0047] Embodiment One

[0048] As shown in Figure 1 A document trace system based on reverse proxy and document secret mark includes a business system, a data security gateway, a plurality of PC terminals and an audit server. The business system and the data security gateway realize data communication, the data security gateway and the plurality of PC terminals realize data communication, and the PC terminals realize data communication with each other, and the plurality of PC terminals realize data communication with the audit server.

[0049] As shown in Figure 2As shown, the business system is used for data request based on PC terminal, and the initial network data flow package is issued to the data security gateway. After the data security gateway receives the initial network data flow package issued by the business system, the initial secret identifier of the source data document in the initial network data flow package is updated. The source data document in the initial network data flow package is updated based on the updated initial secret identifier, and the gateway data flow package is generated. In this embodiment, the network data flow package contains the source data document.

[0050] The initial secret identifier of the source data document in the initial network data flow package is updated, the source data document in the initial network data flow package is updated based on the updated initial secret identifier, and the gateway data flow package is generated. Specifically, the following steps are included. First, the source data document of the initial network data flow package is read, and the existence of the initial secret identifier of the source data document is detected. Since the secret identifier contains the document unique ID and the document ownership information, it is equivalent to marking the source data document. Therefore, the document tracing of the present application is realized by the document flow tracking with the help of the secret identifier. Therefore, before updating the secret identifier each time, it is necessary to detect whether the obtained data document contains the secret identifier, so as to ensure that the flow process of important data can be monitored.

[0051] As shown in Figure 3 If the initial secret identifier exists in the source data document, the initial secret identifier is used as the gateway secret identifier, and the source data document containing the initial secret identifier is generated into the gateway data flow package and sent to the PC terminal.

[0052] If the initial secret identifier does not exist in the source data document, the document unique ID and the document ownership information are randomly generated based on the source data document by using the globally unique identifier GUID. The document unique ID and the document ownership information are encrypted by the enterprise key to obtain the gateway secret identifier. The gateway secret identifier is inserted into the source data document to replace the initial secret identifier in the source data document, so as to generate the gateway data flow package according to the source data document carrying the gateway secret identifier, record that the source data document carrying the gateway secret identifier is generated in the business system, and finally send the gateway data flow package to the PC terminal.

[0053] When detecting whether the initial secret identifier exists in the source data document, whether the initial secret identifier exists in the specific position in the source data document is detected. The specific position refers to the space in the source data document for placing the initial secret identifier. Whether the initial secret identifier exists can be known by detecting whether the data exists in the specific position.

[0054] The PC terminal receives the gateway data flow packet from the data security gateway, updates the gateway secret identifier in the source data document in the gateway data flow packet, updates the source data document based on the updated gateway secret identifier, and generates an initial PC data document.

[0055] Specifically, as shown in the following steps: the PC terminal receives the gateway data flow packet and performs gateway secret identifier existence detection on the source data document in the gateway data flow packet. Figure 4

[0056] If the gateway secret identifier does not exist in the source data document, it indicates that the source data document in the gateway data flow packet is not a confidential file to be protected or tracked by the business system, and the gateway data flow packet does not need to be tracked any more.

[0057] If the gateway secret identifier exists in the source data document, it is determined whether the gateway secret identifier can be decrypted by the enterprise key.

[0058] If the decryption fails, it indicates that the source data document where the gateway secret identifier is located is not an encrypted file that needs to be tracked by the enterprise, but an encrypted file of other enterprises, and thus the gateway data flow packet does not need to be tracked any more.

[0059] If the decryption succeeds, it indicates that the source data document where the gateway secret identifier is located is an encrypted file that needs to be tracked by the enterprise, and since the client program is installed on the PC terminal, the client program has a monitoring strategy that monitors all document receiving and sending operations on the PC terminal, and thus the operation ID of the PC terminal and the operation content corresponding to the operation ID are obtained through the monitoring strategy, where the operation ID and the operation content are in a one-to-one correspondence, the operation content is the operation content of data receiving or data sending, and the operation content includes the operation user, the data source, the download path, the download time, the document name, and the data size.

[0060] Therefore, if the operation content is data receiving, the operation ID corresponding to the data receiving is added to the decrypted gateway secret identifier, and then the initial PC secret identifier is obtained by encrypting the document unique ID and the document ownership information; the initial PC secret identifier is inserted into the source data document to generate an initial PC data document; and the operation ID corresponding to the data receiving, the operation content corresponding to the operation ID, and the document unique ID are sent to the audit server.

[0061] ​If the operation content also sends data, the operation ID corresponding to the data sending is added to the decrypted initial PC secret identifier, and then the document unique ID and the document ownership information are encrypted to obtain a new initial PC secret identifier; the new initial PC secret identifier is inserted into the initial PC data document to generate a new initial PC data document; the operation ID corresponding to the data sending, the operation content corresponding to the operation ID, and the document unique ID are sent to the audit server.

[0062] In addition, if there is data communication between PC terminals, similarly, the current PC terminal receives the previous PC data document issued by the previous PC terminal, and updates the previous PC secret identifier in the previous PC data document; the previous PC data document is updated based on the updated previous PC secret identifier to obtain the current PC data document.

[0063] Specifically, the following steps are included: the current PC terminal receives the previous PC data document, and detects the existence of the previous PC secret identifier in the previous PC data document.

[0064] If the previous PC secret identifier does not exist in the previous PC data document, it indicates that the previous PC data document is not a confidential file to be protected or tracked by the business system, and the previous PC data document does not need to be tracked.

[0065] If the previous PC secret identifier exists in the previous PC data document, it is judged whether the previous PC secret identifier can be decrypted by the enterprise key.

[0066] If the decryption fails, it indicates that the previous PC data document where the previous PC secret identifier is located is not an encrypted file that needs to be circulated and tracked by the enterprise, but an encrypted file of other enterprises, so the previous PC data document does not need to be tracked.

[0067] If the decryption is successful, it indicates that the previous PC data document where the previous PC secret identifier is located is an encrypted file that needs to be circulated and tracked by the enterprise, and the next operation is performed.

[0068] Since the operation content is the operation content of data receiving or data sending, if the operation content is data receiving, the operation ID corresponding to the data receiving is added to the decrypted previous PC secret identifier, and then the document unique ID and the document ownership information are encrypted to obtain the current PC secret identifier; the current PC secret identifier is inserted into the previous PC data document to generate the current PC data document; the operation ID corresponding to the data receiving, the operation content corresponding to the operation ID, and the document unique ID are sent to the audit server.

[0069] If the operation content also sends data, the operation ID corresponding to the data sending is added to the decrypted current PC secret identifier, and then combined with the document unique ID and the document ownership information for encryption to obtain a new current PC secret identifier; the new current PC secret identifier is inserted into the old current PC data document to generate a new current PC data document; the operation ID corresponding to the data sending, the operation content corresponding to the operation ID, and the document unique ID are sent to the audit server.

[0070] The audit server is configured to receive the document unique ID, the operation content, and the operation ID corresponding to the operation content sent by each group of PC terminals, and obtain the document unique ID in the initial secret identifier; and perform document tracing based on the document unique ID in the initial secret identifier.

[0071] The audit server performs document tracing based on the document unique ID in the initial secret identifier, including the following steps: according to the document unique ID, searching for a target secret identifier corresponding to the document unique ID in the audit server; after decrypting the target secret identifier, searching for all operation IDs of the target document on the audit server and the operation content corresponding to the operation ID according to the document unique ID in the target secret identifier; and performing operation sorting on all the operation IDs and the operation content corresponding to the operation ID to obtain the flow link of the target document.

[0072] Specifically, when the target document needs to be traced, the target secret identifier corresponding to the target document is first searched in the initial secret identifier, and then after the target secret identifier is decrypted, all historical operations corresponding to the target secret identifier are queried according to the document unique ID in the target secret identifier, and then all the historical operations are sorted to obtain the flow link, and finally the flow link of the target document is displayed in a graphical interface.

[0073] Thus, the document tracing is completed. The source data document is inserted with the secret identifier, so that the user can record the document operation without any code-level modification, which is convenient for subsequent tracing. Meanwhile, after the source data document is inserted with the secret identifier, there is no trace for the user using the source data document, and the source data document is not aware of the inserted secret identifier during storage, transmission, and use. On the other hand, since the secret identifier is completely integrated with the source data document, the secret identifier will not be lost even if the source data document is copied, moved, or renamed, thereby ensuring the reliability of the document tracing.

[0074] It should be noted that the gateway secret identifier in the present application refers to the secret identifier attached in the data document processed in the data security gateway; the previous PC secret identifier and the current PC secret identifier refer to the secret identifier attached in the data document processed in the PC terminal.

[0075] Further, the embodiment takes an example that employee A has access rights to application system W, downloads important data from business system W for work use, employee A violates the rules and sends the important data to employee B, employee B does not know the importance of the data and sends the important data to employee C, employee C finds that the data is important and has economic value, and then sends the data outside the enterprise.

[0076] First, when employee A downloads network data traffic package from business system W, the source data document in the network data traffic package will first pass through the data security gateway. The data security gateway intercepts the source data document from the network data traffic package based on network traffic analysis and interception technology when it monitors that the source data document is contained in the network data traffic package downloaded from business system W. The data security gateway extracts the source data document from the network data traffic package and checks whether the secret identifier has been attached to the source data document.

[0077] If the secret identifier has not been attached to the document, the data security gateway generates a plaintext secret identifier containing a randomly generated document unique ID and enterprise ownership information, encrypts the plaintext secret identifier using the enterprise unique key, and inserts it into the source data document. Finally, the source data document with the attached secret identifier replaces the original document in the network data traffic package, and the document downloaded by employee A is a document with a secret identifier. At the same time, the data security gateway records that the data document is generated from business system W.

[0078] Since employee A's office PC terminal has installed the client program, when the client program monitors the download and sending behavior of the PC terminal, it first checks whether the source data document contains a secret identifier. If the secret identifier is contained, the enterprise unique key (the enterprise unique key of the client is consistent with that of the data security gateway) is used to decrypt the secret identifier. If the decryption is successful, an operation ID is added to the secret identifier, and the operation content (including operation user, data source, download path, download time, document name, data size, etc.) corresponding to the operation ID1 is sent to the audit server.

[0079] When employee A sends the data to employee B, the client program on employee A's PC terminal monitors that employee A sends the data with a secret identifier, records the operation content and sends it to the audit server; the client program modifies the secret identifier in the data and adds operation ID2 to record employee A's sending action.

[0080] When employee B receives the data from employee A, the office PC of employee B has installed the client program, which monitors that employee B receives the data with the secret mark, at this time, since the operation ID is increased and written every time the secret mark is modified, the previous operation ID is not deleted, therefore the received secret mark has contained two operation IDs (operation ID 1 of employee A downloading the data, operation ID 2 of employee A sending the data), so when employee B receives the document with the secret mark, according to the latest operation ID, it can be determined that the document is sent by employee A, and then the operation content such as data source, receiving way, receiving time, document name, data size, etc. is sent to the audit server.

[0081] Then the client program of employee B modifies the secret mark in the data, and increases operation ID 3 to record the receiving action of employee B in the secret mark.

[0082] When employee B sends the data to employee C, the client program on the PC terminal of employee B monitors that employee B sends the data with the secret mark, and records the sending way, document name, original document, sending time, employee account, etc. to the audit server; the client program modifies the secret mark in the data, and increases operation ID 4 to record the sending action of employee B in the secret mark.

[0083] When employee C receives the data from employee B, the client program on the PC terminal of employee C monitors that employee C receives the data with the secret mark, and determines that the data is sent by employee B to employee C by reading the secret mark in the data, records the operation content such as data source from employee B, receiving way, receiving time, document name, data size, etc., and sends the operation content to the audit server; at the same time, the client program modifies the secret mark in the data, and increases operation ID 5 to record the receiving action of employee C in the secret mark.

[0084] When employee C sends the data to the outside of the enterprise, the client program on the PC terminal of employee C monitors that employee C sends the data with the secret mark, and records the sending way, document name, original document, sending time, employee account, etc. to the audit server, and the client program modifies the secret mark in the data, and increases operation ID 6 to record the sending action of employee C in the secret mark.

[0085] When the enterprise needs to restore the flow link in the future, the audit server reads the secret mark in the source data document, can query all the historical operation information corresponding to the secret mark, and according to the historical operation information, restores the traceability result in a graphical interface, and finally restores the 6 operation IDs of the document.

[0086] The enterprise can determine the whole file leakage process according to the obtained six operation IDs.

[0087] Embodiment two

[0088] A document tracing method based on reverse proxy and document secret mark, specifically comprising the following steps:

[0089] At the data security gateway, an initial network data flow packet issued by a business system is received, and an initial secret mark of a source data document in the initial network data flow packet is updated; the source data document in the initial network data flow packet is updated based on the updated initial secret mark, and a gateway data flow packet is generated;

[0090] At a PC terminal that realizes data communication with the data security gateway, the gateway data flow packet is received, and a gateway secret mark of a source data document in the gateway data flow packet is updated; the source data document is updated based on the updated gateway secret mark, and an initial PC data document is generated;

[0091] When the PC terminal realizes data communication with another PC terminal, the current PC terminal is used to receive a previous PC data document issued by the previous PC terminal, and a previous PC secret mark in the previous PC data document is updated; the previous PC data document is updated based on the updated previous PC secret mark, and a current PC data document is obtained;

[0092] At the audit server, a document unique ID, operation content and operation ID corresponding to the operation content sent by each group of PC terminals are received, and the document unique ID in the initial secret mark is obtained; the document tracing is performed based on the document unique ID in the initial secret mark.

[0093] It should be noted that the document tracing method of the embodiment is applied to the document tracing system based on reverse proxy and document secret mark as described in Embodiment One, and thus will not be repeated in this embodiment.

[0094] The above is only a preferred embodiment of the present application, and is not intended to limit the present application in any form or in essence. It should be noted that those skilled in the art can make some improvements and supplements without departing from the method of the present application, and these improvements and supplements should also be considered as the protection scope of the present application. For those skilled in the art, some minor changes, modifications and equivalent changes made by using the disclosed technical content without departing from the spirit and scope of the present application are equivalent embodiments of the present application; at the same time, any equivalent changes, modifications and evolution of the above-mentioned embodiments according to the essential technology of the present application are still within the scope of the technical solutions of the present application.

Claims

1. A document provenance system based on reverse proxy and document watermarking, characterized in that, The system comprises a business system, a data security gateway, a plurality of PC terminals and an audit server, the business system and the data security gateway are in data communication, the data security gateway and the plurality of PC terminals are in data communication, and the PC terminals are in data communication with each other; The data security gateway is configured to receive an initial network data flow packet issued by the business system, and update an initial secret identifier of a source data document in the initial network data flow packet; The data security gateway is configured to receive an initial network data flow packet issued by the business system, and update an initial secret identifier of a source data document in the initial network data flow packet; The PC terminal in data communication with the data security gateway is configured to receive the gateway data flow packet, and update a gateway secret identifier of a source data document in the gateway data flow packet; update the source data document based on the updated gateway secret identifier, and generate an initial PC data document; When the PC terminals are in data communication with each other, the current PC terminal is configured to receive a previous PC data document issued by a previous PC terminal, and update a previous PC secret identifier in the previous PC data document; update the previous PC data document based on the updated previous PC secret identifier, and obtain a current PC data document; The audit server is configured to receive a document unique ID, operation content and operation ID corresponding to the operation content sent by each group of PC terminals, and obtain the document unique ID in the initial secret identifier; perform document tracing based on the document unique ID in the initial secret identifier.

2. The document provenance system based on reverse proxy and document watermarking of claim 1, wherein, The method for updating the gateway secret identifier of the source data document in the initial network data flow packet, and updating the source data document in the initial network data flow packet based on the updated gateway secret identifier, and generating a gateway data flow packet comprises the following steps: Read the source data document of the initial network data flow packet, and perform initial secret identifier existence detection on the source data document; If the initial secret identifier exists in the source data document, the initial secret identifier is taken as the gateway secret identifier, and the source data document containing the initial secret identifier is generated into a gateway data flow packet and sent to the PC terminal; If the initial secret identifier does not exist in the source data document, a document unique ID and document ownership information are generated based on the source data document; the document unique ID and the document ownership information are encrypted to obtain the gateway secret identifier; the gateway secret identifier is inserted into the source data document to generate a gateway data flow packet, and the gateway data flow packet is sent to the PC terminal.

3. The document provenance system based on reverse proxy and document watermarking of claim 2, wherein, The method for updating the gateway secret identifier of the source data document in the gateway data flow packet comprises the following steps: The PC terminal receives the gateway data flow packet, and performs gateway secret identifier existence detection on the source data document in the gateway data flow packet; If the gateway secret identifier does not exist in the source data document, the gateway data flow packet does not need to be continuously tracked; If the gateway secret identifier exists in the source data document, it is determined whether the gateway secret identifier can be decrypted by an enterprise key; If the decryption is successful, the operation ID of the PC terminal and the operation content corresponding to the operation ID are obtained, the operation ID is added to the decrypted gateway secret identifier, and then the document unique ID and the document ownership information are combined for encryption to obtain an initial PC secret identifier; the operation ID, the operation content corresponding to the operation ID, and the document unique ID are sent to an audit server, wherein the operation content is the operation content of data receiving or data sending; If the decryption fails, the gateway data flow packet does not need to be tracked any more.

4. The document provenance system based on reverse proxy and document watermarking of claim 3, wherein, The source data document is updated based on the updated gateway secret identifier, and an initial PC data document is generated, including the following steps: The initial PC secret identifier is inserted into the source data document to generate the initial PC data document.

5. The document provenance system based on reverse proxy and document watermarking of claim 1, wherein, The previous PC secret identifier in the previous PC data document is updated, including the following steps: The current PC terminal receives the previous PC data document, and detects whether the previous PC secret identifier exists in the previous PC data document; If the previous PC secret identifier does not exist in the previous PC data document, the previous PC data document does not need to be tracked any more; If the previous PC secret identifier exists in the previous PC data document, it is judged whether the previous PC secret identifier can be decrypted by the enterprise key; If the decryption is successful, the operation ID of the current PC terminal and the operation content corresponding to the operation ID are obtained, the operation ID is added to the decrypted previous PC secret identifier, and then the document unique ID and the document ownership information are combined for encryption to obtain a current PC secret identifier; the operation ID, the operation content corresponding to the operation ID, and the document unique ID are sent to an audit server, wherein the operation content is the operation content of data receiving or data sending; If the decryption fails, the previous PC data document does not need to be tracked any more.

6. The document provenance system based on reverse proxy and document watermarking of claim 5, wherein, The previous PC data document is updated based on the updated previous PC secret identifier to obtain a current PC data document, including the following steps: The current PC secret identifier is inserted into the previous PC data document to generate the current PC data document.

7. The document provenance system based on reverse proxy and document watermarking of claim 1, wherein, The audit server performs document tracing based on the document unique ID in the initial secret identifier, including the following steps: According to the document unique ID, a target secret identifier corresponding to the document unique ID is found in the audit server; After the target secret identifier is decrypted, all operation IDs of the target document on the audit server and the operation content corresponding to the operation ID are found according to the document unique ID in the target secret identifier; The found all operation IDs and the operation content corresponding to the operation ID are sorted to obtain the flow link of the target document.

8. The document provenance system based on reverse proxy and document watermarking of claim 7, wherein, The audit server is also used for displaying the flow link of the target document in a graphical interface.

9. The document provenance system based on reverse proxy and document watermarking of claim 1, wherein, The business system is used for issuing an initial network data flow packet based on a data request of a PC terminal.

10. A document provenance method based on reverse proxy and document watermarking, characterized in that, The document tracing method is applied to the document tracing system based on the reverse proxy and the document secret identifier according to any one of claims 1-9.

Images