A data security and privacy protection system and method for intelligent conference rooms

Abstract

The present invention relates to the field of information security technology. The present invention discloses a data security and privacy protection system and method for an intelligent conference room. The system includes multiple modules, which are respectively used for data acquisition, data encryption, data storage, access control and log management. The data acquisition module can obtain audio and video information in the meeting in real time and check the status of the equipment; the data encryption module uses an improved AES algorithm to encrypt the data block by block and regularly replaces the key to prevent leakage; the data storage module uses distributed cloud storage technology to ensure redundant backup and security of the data; the access control module dynamically allocates user permissions based on the role management system; the log management module records data access activities in real time and uses machine learning to monitor abnormal behavior. The present invention enhances the security and traceability of conference data, prevents information leakage and unauthorized access, and provides flexible user permission management and detailed audit logs.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data security and privacy protection system and method for an intelligent conference room. Background Art

[0002] With the rapid development of information technology, the use of smart conference rooms has become increasingly widespread, becoming a crucial venue for corporate information exchange and decision-making. Modern conference rooms are not only equipped with efficient audio and video equipment but also integrate cloud computing, big data, and the Internet of Things (IoT) to facilitate data collection, management, and sharing during meetings. For example, many companies have begun adopting smart conference room management systems to enable intelligent scheduling of meeting schedules, real-time collaboration among participants, and automatic archiving of meeting records. While these technologies have made significant progress in improving work efficiency and collaboration, data security and privacy protection issues have become increasingly prominent, particularly in data collection and storage. Existing solutions mostly focus on the collection and distribution of audio and video data, lacking comprehensive data security management mechanisms such as data encryption, storage security, and access control, exposing sensitive information to the risk of leakage and tampering.

[0003] Common technical deficiencies in the current market include: First, many intelligent conferencing systems fail to utilize sufficiently robust encryption algorithms during data encryption and storage, failing to effectively prevent unauthorized access and malicious attacks. Second, access control mechanisms are often static and unable to dynamically adjust user permissions in real time. This results in inadequate and inflexible security measures when user roles change or external threats emerge. Furthermore, many systems lack effective anomaly monitoring capabilities in log management, preventing comprehensive tracking of user access activity, posing significant risks to data security. Therefore, relevant technologies need to strengthen data privacy protections, and a comprehensive, intelligent solution is urgently needed to address current security challenges. Summary of the Invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a data security and privacy protection system for smart conference rooms, which can effectively solve and reduce the risks of unauthorized access and data leakage through encryption and access control mechanisms; adopt block transmission and integrity verification technology to ensure that audio and video records are not damaged during transmission; implement role-based access control to allow only authorized users to access sensitive data.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a data security and privacy protection system for an intelligent conference room, comprising: a data acquisition module, a data encryption module, a data storage module, an access control module and a log management module;

[0007] The data acquisition module is used to collect audio and video data during the meeting in real time;

[0008] The data encryption module is used to encrypt the collected data to ensure data security;

[0009] The data storage module is used to store the encrypted data securely in the cloud storage platform;

[0010] The access control module is used to manage user access rights and ensure that only authorized users can access data;

[0011] The log management module is used to record data access activities for auditing and tracking.

[0012] As a preferred solution of the data security and privacy protection system for a smart conference room according to the present invention, wherein: the data acquisition module includes: the system receives a startup instruction from the conference management software, the data acquisition module checks the sensor power, connection status and transmission bandwidth of the audio sensor and the video sensor, and when any abnormality or non-compliance with the standard is detected, the system automatically performs adaptive configuration;

[0013] During a meeting, audio and video sensors begin synchronous real-time recording. The video stream recorded by the video sensor is processed using an adaptive compression algorithm. During the recording process, audio and video data are processed in blocks and transmitted piecemeal through the encryption module interface. Each time a data block is transmitted, the system receives a data reception confirmation. If no confirmation signal is received, the system automatically retries the data block transmission.

[0014] When the meeting ends, the user sends a meeting end command through the meeting control interface, the system stops recording and automatically turns off all sensors, saving the current meeting data status.

[0015] As a preferred solution of the data security and privacy protection system of a smart conference room described in the present invention, the data encryption module includes receiving audio and video data blocks from the data acquisition module, denoted as D, and each data block has a different size, specifically D i , i is the data block number;

[0016] The encryption key management submodule generates a random encryption key, denoted as K, and the random number generator generates a seed S:

[0017] K=SeeedRandom(S)

[0018] For each received data block D i , using the improved AES algorithm for encryption, dynamically selecting the number of rounds R, and increasing the number of rounds when the data block size is higher than the threshold:

[0019]

[0020] The encryption result is obtained by the following formula:

[0021] E i =AES(D i ,K,R)

[0022] Among them, E i To encrypt data, AES represents the AES encryption function, receiving data block D i , the key K and the number of rounds R are input;

[0023] After encryption, the encrypted data E is processed by a hash function. i Perform integrity check and generate hash value H i :

[0024] H i =Hash(E i )

[0025] The encrypted data E i and hash value H i Send to the data storage module for storage.

[0026] As a preferred solution of the data security and privacy protection system for a smart conference room described in the present invention, the data encryption module further includes an encryption key management submodule, which generates a random encryption key and periodically replaces it to prevent key leakage;

[0027] Set the time interval for periodic key updates, actively trigger the key reset function, and generate a new random key using the same method:

[0028] K'=SeededRandom(S')

[0029] Each time a key is changed, the system adds a version number to the new key, denoted as V. The new key is denoted as K'(V+1). The previous key is marked as expired after sufficiently secure data transmission. Versions are managed in the following way:

[0030] K(V)→K(V-1)(expire)

[0031] K(V) represents the encryption key of the current version, K(V-1) represents the encryption key of the previous version, and expire indicates that the current version of the key has expired and can no longer be used for encryption or decryption operations.

[0032] Data encryption can continue after rekeying:

[0033] E i=AES(D i ,K',R)

[0034] Among them, E i ' is the encrypted data after reset.

[0035] As a preferred solution of the data security and privacy protection system for a smart conference room described in the present invention, wherein: the data storage module includes using a distributed cloud storage architecture to continuously store the encrypted data on multiple servers;

[0036] Before the meeting begins, the storage architecture is selected through the system configuration panel, allowing users to customize storage priorities based on data type and importance. When receiving encrypted audio and video data blocks, identity authentication is performed, and the system dynamically allocates the data blocks to different cloud servers based on the set priority and storage policy.

[0037] For each encrypted data block, the system further shards it to different storage nodes. The sharding process uses a dynamic sharding algorithm, which allows the shard size to be automatically adjusted during storage, setting small shards for audio blocks and large shards for video blocks. At the same time, each encrypted data piece will be stored in at least three different physical locations.

[0038] After the data is stored, the system automatically triggers an integrity check by calculating the hash value of each data block and comparing it with the value saved when it was stored. If any inconsistency is found, the system immediately triggers an alarm and starts the data recovery process;

[0039] After each meeting, the system executes the cleanup strategy to encrypt and delete data blocks that are no longer needed. At the same time, it meets the data retention time strategy and retains data backups for a set time according to compliance requirements.

[0040] As a preferred solution of the data security and privacy protection system for a smart conference room described in the present invention, the access control module includes: using a role-based access control strategy to grant different access rights according to different user roles, and performing real-time verification each time data is accessed, so that only users who pass the authentication can access the corresponding data interface;

[0041] The roles include administrator, conference participant, and guest. An access permission matrix P is created to define the access relationship between roles and data interfaces:

[0042]

[0043] Among them, rows represent roles, columns represent data interfaces, 1 represents permission, and 0 represents no permission;

[0044] When a user registers or changes roles, the system is responsible for assigning access rights based on the user's identity information and the required role:

[0045] A mn =J n ·P

[0046] Among them, A mn Indicates the access rights of user role n to data interface m, J n The identifier of user role n;

[0047] The system allows dynamic adjustment of user roles based on demand and re-evaluation of access rights. When a user submits an authentication request, the system receives the following verification results based on the enhanced model:

[0048]

[0049] Among them, Z represents the verification score, SA l represents the credibility score of the lth verification feature provided by the user, C l represents the weight score of the lth verification feature, δ is the sensitivity parameter, θ is the set threshold of the verification feature, and x is the total number of feature types involved in the verification. When the verification score is greater than or equal to the minimum verification score set by the system, it means that the identity verification is successful;

[0050] Once authentication is passed, the system will perform access authorization checks based on the access rights matrix and user roles:

[0051] U=A mn ·J n

[0052] Here, U represents the user's ultimate access permission to a specific data interface.

[0053] As a preferred solution of the data security and privacy protection system for a smart conference room described in the present invention, the log management module includes a function of recording all data access activities in real time. When a user attempts to access data, the log management module intercepts the access request through an intelligent interface and records the user identity, access timestamp, and access target type in the current interface.

[0054] All access data is recorded in a hierarchical structure and can be accurately traced in subsequent queries through IDs;

[0055] The log management module also includes a monitoring submodule, which uses machine learning algorithms to analyze the user's historical access data and establish normal access patterns. Each time a user accesses a resource, the monitoring submodule compares the current access with the baseline data in real time. The system triggers an alarm mechanism when the following abnormal behaviors are detected: repeated attempts to access the same resource in a short period of time, access from an unusual geographical location, and access using an unauthorized device;

[0056] Once abnormal behavior is detected, the monitoring submodule will automatically generate an alert message and send it to the administrator via email notification. After any abnormal behavior is confirmed, the detailed information will be recorded in the audit log, and the system administrator will regularly review the behavior patterns and alert records.

[0057] Another object of the present invention is to provide a data security and privacy protection method for an intelligent conference room, which can comprehensively improve the security and privacy protection level of the intelligent conference room, ensure the safe management of sensitive data, and provide users with a safer and more reliable conference environment.

[0058] As a preferred solution of the data security and privacy protection method for a smart conference room described in the present invention, wherein: audio and video data in the meeting are collected in real time by audio and video sensors and stored in a data acquisition module;

[0059] The collected data is transmitted to the encryption module and encrypted using the AES algorithm. The encryption keys are also managed and regularly changed to enhance security.

[0060] The encrypted data is securely stored in a distributed cloud storage platform to ensure data security and availability;

[0061] Verify user identity through role-based permission management and record all data access activities in real time for easy auditing and tracking;

[0062] Monitor access activities, automatically detect abnormal behavior and send alerts to administrators, while providing a user-friendly interface for data access and log query.

[0063] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, it implements the steps of a smart conference room data security and privacy protection system.

[0064] A computer-readable storage medium stores a computer program thereon, characterized in that when the computer program is executed by a processor, it implements the steps of a smart conference room data security and privacy protection system.

[0065] The beneficial effects of the present invention are as follows: through AES encryption and key management mechanisms, the security of conference materials in storage and transmission is ensured, greatly reducing the risk of data leakage and unauthorized access. Block transmission and real-time integrity verification can ensure the stability and consistency of the recorded data, reduce the possibility of data loss or damage, and provide high-quality audio and video recording. The role-based access control mechanism ensures that users can access sensitive data only with authorization, effectively protecting the privacy of users. The user-friendly operation interface and automatically generated meeting summary report make the post-meeting data management and information retrieval process more efficient and convenient, reducing the time and resources required for manual operation. The system has an adaptive configuration and real-time feedback mechanism, which can flexibly adjust data acquisition parameters according to changes in the meeting environment, thereby improving the intelligence level of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be derived from these drawings without inventive efforts. Among them:

[0067] Figure 1 A schematic diagram of the working modules of a smart conference room data security and privacy protection system provided by one embodiment of the present invention.

[0068] Figure 2 A flowchart of a method for protecting data security and privacy in a smart conference room provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0069] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the following detailed description of the specific embodiments of the present invention is given in conjunction with the accompanying drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without creative work should fall within the scope of protection of the present invention.

[0070] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0071] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it constitute a separate or selective embodiment that is mutually exclusive with other embodiments.

[0072] The present invention is described in detail with reference to schematic diagrams. For ease of illustration, cross-sectional views of device structures may be partially enlarged and not to scale when describing embodiments of the present invention. Furthermore, the schematic diagrams are merely illustrative and should not limit the scope of the present invention. Furthermore, in actual production, the three-dimensional dimensions of length, width, and depth should be included.

[0073] Furthermore, in the description of the present invention, it should be noted that the terms "upper, lower, inner, and outer" and other references to orientations or positional relationships are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate and simplify the description of the present invention. They are not intended to indicate or imply that the devices or components referred to must have, be constructed, or operate in a specific orientation, and therefore should not be construed as limiting the present invention. Furthermore, the terms "first, second, or third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0074] In this disclosure, unless otherwise specified or limited, the terms "mounted," "connected," and "connected" should be interpreted broadly. For example, they may refer to fixed, removable, or integral connections. They may also refer to mechanical, electrical, or direct connections, indirect connections through an intermediary, or internal communication between two components. Those skilled in the art will understand the specific meanings of these terms in this disclosure.

[0075] Example 1, with reference to Figure 1 , which is the first embodiment of the present invention, provides a data security and privacy protection system for an intelligent conference room, including: a data acquisition module, a data encryption module, a data storage module, an access control module and a log management module;

[0076] The data acquisition module is used to collect audio and video data during the meeting in real time;

[0077] The data encryption module is used to encrypt the collected data to ensure data security;

[0078] The data storage module is used to store the encrypted data securely in the cloud storage platform;

[0079] The access control module is used to manage user access rights and ensure that only authorized users can access data;

[0080] The log management module is used to record data access activities for auditing and tracking.

[0081] The data acquisition module, the system receives the start-up instruction from the conference management software, the data acquisition module checks the sensor power, connection status and transmission bandwidth of the audio sensor and video sensor, and when any abnormality or non-compliance with the standard is detected, the system automatically performs adaptive configuration;

[0082] It should be noted that the power levels of audio sensors and video sensors are monitored. When the power level is lower than 20%, the system is marked as abnormal. The connection status is evaluated by real-time tracking of signal strength and packet loss rate. When the packet loss rate reaches more than 10%, it is considered that the connection is unstable and the system is marked as abnormal. It is evaluated whether the current network bandwidth can support the real-time transmission of high-quality audio and video data. When the transmission bandwidth is lower than 256Kbps, it is marked as abnormal.

[0083] During a meeting, audio and video sensors begin synchronous real-time recording. The video stream recorded by the video sensor is processed using an adaptive compression algorithm. During the recording process, audio and video data are processed in blocks and transmitted piecemeal through the encryption module interface, rather than transmitting the entire data stream all at once. Each time a data block is transmitted, the system receives a data reception confirmation. If no confirmation signal is received, the system automatically retries the data block transmission.

[0084] When the meeting ends, the user sends a meeting end command through the meeting control interface, the system stops recording and automatically turns off all sensors, saving the current meeting data status.

[0085] The data encryption module receives the audio and video data blocks from the data acquisition module, which are denoted as D. The size of each data block is different, specifically D i , i is the data block number;

[0086] The encryption key management submodule generates a random encryption key, denoted as K, with a key length of 128, 192, or 256 bits. The random number generator generates a seed S:

[0087] K=SeeedRandom(S)

[0088] For each received data block D i , using the improved AES algorithm for encryption, dynamically selecting the number of rounds R, and increasing the number of rounds when the data block size is higher than the threshold:

[0089]

[0090] Since the AES encryption algorithm requires the input data block size to be 128 bits, if the data block length is insufficient, padding will be performed. The length of the data block after padding is L, that is:

[0091]

[0092] Where |L| is the original byte length of the data block D; the encryption result is obtained by the following formula:

[0093] E i =AES(D i ,K,R)

[0094] Among them, E i To encrypt data, AES represents the AES encryption function, receiving data block D i , the key K and the number of rounds R are input;

[0095] After encryption, the encrypted data E is processed by a hash function. i Perform integrity check and generate hash value H i :

[0096] H i =Hash(E i )

[0097] The encrypted data E i and hash value H i Sent to the data storage module for storage, the system records the corresponding key K and hash value H i Perform subsequent verification.

[0098] The data encryption module also includes an encryption key management submodule, which generates a random encryption key and periodically replaces it to prevent key leakage;

[0099] Set the time interval for periodic key updates. Every 30 minutes, the system actively triggers the key reset function. The new key K' is generated using the same method to generate a new random key:

[0100] K'=SeededRandom(S')

[0101] Each time a key is changed, the system adds a version number to the new key, denoted as V. The new key is denoted as K'(V+1). The previous key is marked as expired after sufficiently secure data transmission. Versions are managed in the following way:

[0102] K(V)→K(V-1)(expire)

[0103] K(V) represents the encryption key of the current version, K(V-1) represents the encryption key of the previous version, and expire indicates that the current version of the key has expired and can no longer be used for encryption or decryption operations.

[0104] Data encryption can continue after rekeying:

[0105] E i =AES(D i ,K',R)

[0106] Among them, E i ' is the encrypted data after reset;

[0107] As the key is changed, previously encrypted data will still be decrypted using the old key, but new data will be encrypted using the latest key, without affecting the data processing flow during the key update.

[0108] The data storage module includes, using a distributed cloud storage architecture to continuously store the encrypted data on multiple servers;

[0109] Before the meeting begins, the storage architecture is selected through the system configuration panel, allowing users to customize storage priorities based on data type and importance. When receiving encrypted audio and video data blocks, identity authentication is performed, and the system dynamically allocates the data blocks to different cloud servers based on the set priority and storage policy.

[0110] For each encrypted data block, the system further shards it to different storage nodes. The sharding process uses a dynamic sharding algorithm, which allows the shard size to be automatically adjusted during storage to adapt to the different characteristics of the data content. Small shards are set for audio blocks, while large shards are set for video blocks. At the same time, each encrypted data piece is stored in at least three different physical locations, ensuring data integrity even if one server fails.

[0111] After the data is stored, the system automatically triggers an integrity check by calculating the hash value of each data block and comparing it with the value saved when it was stored. If any inconsistency is found, the system immediately triggers an alarm and starts the data recovery process;

[0112] After each meeting, the system executes the cleanup strategy to encrypt and delete data blocks that are no longer needed. At the same time, it meets the data retention time strategy and retains data backups for a set time according to compliance requirements.

[0113] The access control module includes using a role-based access control strategy to grant different access rights according to different user roles, and performing real-time verification each time data is accessed. Only users who pass the authentication can access the corresponding data interface;

[0114] The roles include: Administrator: has full access rights, including the right to view, modify and delete data; Meeting Participant: can only view meeting data, without the right to modify or delete; Guest: can only access meeting summaries and some public data;

[0115] Create an access permission matrix P to define the access relationship between roles and data interfaces:

[0116]

[0117] The rows represent roles, which are administrator, conference participant, and guest, respectively. The columns represent data interfaces, which are complete data, limited data, and summary data, respectively. 1 represents permission, and 0 represents no permission.

[0118] When a user registers or changes roles, the system is responsible for assigning access rights based on the user's identity information and the required role:

[0119] A mn =J n ·P

[0120] Among them, A mn Indicates the access rights of user role n to data interface m, J n The identifier of user role n;

[0121] The system allows dynamic adjustment of user roles based on demand and re-evaluation of access rights. When a user submits an authentication request, the system receives the following verification results based on the enhanced model:

[0122]

[0123] Among them, Z represents the verification score, SA l represents the credibility score of the lth verification feature provided by the user, C l represents the weight score of the lth verification feature, δ is the sensitivity parameter, θ is the set threshold of the verification feature, and x is the total number of feature types involved in the verification. When the verification score is greater than or equal to the minimum verification score set by the system, it means that the identity verification is successful;

[0124] Once authentication is passed, the system will perform access authorization checks based on the access rights matrix and user roles:

[0125] U=A mn ·J n

[0126] Among them, U represents the user's final access permission to a specific data interface, 1 means accessible, and 0 means inaccessible.

[0127] The log management module records all data access activities in real time. When a user attempts to access data, the log management module intercepts the access request through the intelligent interface and records the user identity, access timestamp and access target type in the current interface;

[0128] All access data is recorded in a hierarchical structure, that is, each access will generate a unique access event ID, which can be accurately traced in subsequent queries;

[0129] The access record structure includes:

[0130] User information: user name, user role, IP address;

[0131] Access time: timestamp accurate to milliseconds;

[0132] Access content: the specific type of data requested and its location;

[0133] Access result: success or failure information;

[0134] The log management module also includes a monitoring submodule, which uses machine learning algorithms to analyze the user's historical access data and establish normal access patterns. Each time a user accesses a resource, the monitoring submodule compares the current access with the baseline data in real time. The system triggers an alarm mechanism when the following abnormal behaviors are detected: repeated attempts to access the same resource in a short period of time, access from an unusual geographical location, and access using an unauthorized device;

[0135] Once abnormal behavior is detected, the monitoring submodule will automatically generate alarm information, including the abnormal user, time, behavior description and risk level, and send it to the administrator via email notification. After any abnormal behavior is confirmed, the detailed information will be recorded in the audit log, and the system administrator will regularly review the behavior patterns and alarm records.

[0136] Embodiment 2, the second embodiment of the present invention, is different from the previous embodiment in that:

[0137] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0138] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0139] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0140] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0141] Example 3, reference Figure 2 , as one embodiment of the present invention, provides a method for protecting data security and privacy in a smart conference room, which is characterized by: including collecting audio and video data in a meeting in real time through audio and video sensors and storing them in a data acquisition module;

[0142] The collected data is transmitted to the encryption module and encrypted using the AES algorithm. The encryption keys are also managed and regularly changed to enhance security.

[0143] The encrypted data is securely stored in a distributed cloud storage platform to ensure data security and availability;

[0144] Verify user identity through role-based permission management and record all data access activities in real time for easy auditing and tracking;

[0145] Monitor access activities, automatically detect abnormal behavior and send alerts to administrators, while providing a user-friendly interface for data access and log query.

[0146] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A data security and privacy protection system for a smart conference room, characterized by: Including data acquisition module, data encryption module, data storage module, access control module and log management module; The data acquisition module is used to collect audio and video data during the meeting in real time; The data encryption module is used to encrypt the collected data to ensure data security; The data encryption module includes receiving audio and video data blocks from the data acquisition module, which are denoted as D. The size of each data block is different, specifically D i , i is the data block number; The encryption key management submodule generates a random encryption key, denoted as K, and the random number generator generates a seed S: K=SeeedRandom(S) For each received data block D i , using the improved AES algorithm for encryption, dynamically selecting the number of rounds R, and increasing the number of rounds when the data block size is higher than the threshold: The encryption result is obtained by the following formula: E i =AES(D i ,K,R) Among them, E i To encrypt data, AES represents the AES encryption function, receiving data block D i , the key K and the number of rounds R are input; After encryption, the encrypted data E is processed by a hash function. i Perform integrity check and generate hash value H i : H i =Hash(E i ) The encrypted data E i and hash value H i Send to the data storage module for storage; The data encryption module also includes an encryption key management submodule, which generates random encryption keys and periodically replaces them to prevent key leakage; Set the time interval for periodic key updates, actively trigger the key reset function, and generate a new random key using the same method: K'=SeededRandom(S') Each time a key is changed, the system adds a version number to the new key, denoted as V. The new key is denoted as K'(V+1). The previous key is marked as expired after sufficiently secure data transmission. Versions are managed in the following way: K(V)→K(V-1)(expire) K(V) represents the encryption key of the current version, K(V-1) represents the encryption key of the previous version, and expire indicates that the current version of the key has expired and can no longer be used for encryption or decryption operations. Data encryption can continue after rekeying: E i ’=AES(D i ,K’,R) Among them, E i ' is the encrypted data after reset; The data storage module is used to store the encrypted data securely in the cloud storage platform; The access control module is used to manage user access rights and ensure that only authorized users can access data; The log management module is used to record data access activities for auditing and tracking.

2. The data security and privacy protection system for a smart conference room according to claim 1, characterized in that: The data acquisition module includes: the system receives a startup instruction from the conference management software, the data acquisition module checks the sensor power, connection status and transmission bandwidth of the audio sensor and the video sensor, and when any abnormality or non-compliance with the standard is detected, the system automatically performs adaptive configuration; During the meeting, audio and video sensors start synchronous real-time recording, and the video stream recorded by the video sensor is processed using an adaptive compression algorithm; During the recording process, audio and video data are processed in blocks and transmitted segment by segment through the interface of the encryption module; each time a data block is transmitted, the system will receive a data reception confirmation. If no confirmation signal is received, the system will automatically retry the transmission of the data block; When the meeting ends, the user sends a meeting end command through the meeting control interface, the system stops recording and automatically turns off all sensors, saving the current meeting data status.

3. The data security and privacy protection system for a smart conference room according to claim 2, characterized in that: The data storage module includes, using a distributed cloud storage architecture to continuously store the encrypted data on multiple servers; Before the meeting begins, the storage architecture is selected through the system configuration panel, allowing users to customize storage priorities based on data type and importance. When receiving encrypted audio and video data blocks, identity authentication is performed, and the system dynamically allocates the data blocks to different cloud servers based on the set priority and storage policy. For each encrypted data block, the system further shards it to different storage nodes. The sharding process uses a dynamic sharding algorithm, which allows the shard size to be automatically adjusted during storage, setting small shards for audio blocks and large shards for video blocks. At the same time, each encrypted data piece will be stored in at least three different physical locations. After the data is stored, the system automatically triggers an integrity check by calculating the hash value of each data block and comparing it with the value saved when it was stored. If any inconsistency is found, the system immediately triggers an alarm and starts the data recovery process; After each meeting, the system executes the cleanup strategy to encrypt and delete data blocks that are no longer needed. At the same time, it meets the data retention time strategy and retains data backups for a set time according to compliance requirements.

4. The data security and privacy protection system for a smart conference room according to claim 3, characterized in that: The access control module includes using a role-based access control strategy to grant different access rights according to different user roles, and performing real-time verification each time data is accessed. Only users who pass the authentication can access the corresponding data interface; The roles include administrator, conference participant, and guest. An access permission matrix P is created to define the access relationship between roles and data interfaces: Among them, rows represent roles, columns represent data interfaces, 1 represents permission, and 0 represents no permission; When a user registers or changes roles, the system is responsible for assigning access rights based on the user's identity information and the required role: A mn =J n ·P Among them, A mn Indicates the access rights of user role n to data interface m, J n The identifier of user role n; The system allows dynamic adjustment of user roles based on demand and re-evaluation of access rights. When a user submits an authentication request, the system receives the following verification results based on the enhanced model: Among them, Z represents the verification score, SA l represents the credibility score of the lth verification feature provided by the user, C l represents the weight score of the lth verification feature, δ is the sensitivity parameter, θ is the set threshold of the verification feature, and x is the total number of feature types involved in the verification. When the verification score is greater than or equal to the minimum verification score set by the system, it means that the identity verification is successful; Once authentication is passed, the system will perform access authorization checks based on the access rights matrix and user roles: U=A mn ·J n Here, U represents the user's ultimate access permission to a specific data interface.

5. The data security and privacy protection system for a smart conference room according to claim 4, characterized in that: The log management module includes real-time recording of all data access activities. When a user attempts to access data, the log management module intercepts the access request through the intelligent interface and records the user identity, access timestamp and access target type in the current interface; All access data is recorded in a hierarchical structure and can be accurately traced in subsequent queries through IDs; The log management module also includes a monitoring submodule, which uses machine learning algorithms to analyze the user's historical access data and establish normal access patterns. Each time a user accesses a resource, the monitoring submodule compares the current access with the baseline data in real time. The system triggers an alarm mechanism when the following abnormal behaviors are detected: repeated attempts to access the same resource in a short period of time, access from an unusual geographical location, and access using an unauthorized device; Once abnormal behavior is detected, the monitoring submodule will automatically generate an alert message and send it to the administrator via email notification. After any abnormal behavior is confirmed, the detailed information will be recorded in the audit log, and the system administrator will regularly review the behavior patterns and alert records.

6. A method using the smart conference room data security and privacy protection system according to any one of claims 1 to 5, characterized in that: include The audio and video data in the meeting are collected in real time through audio and video sensors and stored in the data acquisition module; The collected data is transmitted to the encryption module and encrypted using the AES algorithm. The encryption keys are also managed and regularly changed to enhance security. The encrypted data is securely stored in a distributed cloud storage platform to ensure data security and availability; Verify user identity through role-based permission management and record all data access activities in real time for easy auditing and tracking; Monitor access activities, automatically detect abnormal behavior and send alerts to administrators, while providing a user-friendly interface for data access and log query.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images