An engineering supervision file anti-leakage method and system

Abstract

The present application relates to the technical field of data security protection, in particular to a kind of engineering supervision file anti-leakage method and system, comprising: through CP-ABE encryption technology, file is encrypted, and binding access control attribute, according to project progress, dynamically adjust permission and key, ensure the accurate control of file access. Before file transmission, embed invisible watermark, judge target platform, if it is non-controlled platform, then create secure sandbox to decrypt, guarantee transmission security. Meanwhile, record operation log and store in block chain, utilize knowledge graph to detect abnormal behavior, realize file tracing in combination with watermark, enhance audit traceability. When reaching destruction condition, system automatically destroys file and revokes decryption key, eliminate the risk of leakage. The present application effectively prevents file leakage, realizes file security management and access tracking, improves the security of engineering supervision file, access control accuracy and audit traceability.

Description

Technical Field

[0001] This invention relates to the field of data security protection technology, specifically to a method and system for preventing the leakage of engineering supervision documents. Background Technology

[0002] In the field of construction engineering, project supervision documents contain critical information such as design blueprints, construction schedules, quality inspection reports, and change records, which are essential for project quality control, project schedule management, and data security. With the development of information technology, existing supervision documents are gradually being digitized. Although current solutions have improved efficiency, security challenges such as information leakage, lagging access control, cross-platform collaboration risks, and difficulties in audit traceability still exist.

[0003] First, access control lacks dynamic adaptability. The existing static role model is based on fixed rules and cannot adjust access permissions as the project progresses. This means that construction workers may still have access to sensitive documents after completion. At the same time, historical files lack version-level isolation mechanisms, making it difficult to avoid the risk of leaking old drawings.

[0004] Secondly, cross-platform collaboration leads to file loss of control. When engineering files are transmitted on uncontrolled platforms, they often need to be de-encapsulated into plaintext format. Existing structured data protection solutions cannot cover content flow in uncontrolled environments. Files lack dynamic identification and expiration policies, making it difficult to trace the source after leakage. At the same time, there is a lack of real-time detection capabilities for abnormal forwarding and screenshotting, creating blind spots in security protection.

[0005] Finally, these solutions have certain limitations in distributed auditing mechanisms. File operation records are stored separately on independent platforms, lacking a unified standard and real-time synchronization mechanism, making it difficult to accurately identify covert leaks. Furthermore, log storage lacks integrity guarantees; critical records may be tampered with or forged, affecting the tracing and evidence collection of leaks.

[0006] To improve the security, access control accuracy, and audit traceability of engineering supervision documents, a method and system for preventing leakage of engineering supervision documents are proposed. Summary of the Invention

[0007] The purpose of this invention is to provide a method and system for preventing the leakage of engineering supervision documents. It encrypts files using CP-ABE encryption technology and binds access control attributes, dynamically adjusting permissions and keys based on project progress to ensure precise control over file access. An invisible watermark is embedded before file transmission, and the target platform is assessed. If the platform is uncontrolled, a security sandbox is created for decryption, ensuring secure transmission. Simultaneously, operation logs are recorded and stored in a blockchain, utilizing knowledge graphs to detect abnormal behavior. Combined with the watermark, file traceability is achieved, enhancing audit traceability capabilities. When destruction conditions are met, the system automatically destroys the file and revokes the decryption key, eliminating the risk of leakage. This invention effectively prevents file leakage, achieves secure file management and access tracking, and improves the security, access control accuracy, and audit traceability capabilities of engineering supervision documents.

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] A method for preventing the leakage of engineering supervision documents includes:

[0010] Bind attributes to the uploaded project supervision file, generate an encryption key using the CP-ABE algorithm, and encrypt the project supervision file;

[0011] Monitor project progress events and obtain project stage information from the project supervision documents;

[0012] Based on the rule engine, the project stage information is matched, and a permission change policy and a key rotation mechanism are executed; the permission change policy is used to isolate versions and synchronize permissions for the project supervision files; the key rotation mechanism is used to update the key revocation list and generate new keys.

[0013] Listen for file transfer requests, embed an invisible watermark into the project supervision file, and determine whether the target platform is a controlled platform; if the target platform is a controlled platform, transfer the project supervision file according to user permissions; otherwise, create a secure transfer sandbox and decrypt the file within the secure transfer sandbox.

[0014] Record operation logs, and write the operation logs to the blockchain after signing and verifying them; construct a knowledge graph based on the blockchain to detect abnormal access behavior, compare the invisible watermark with the operation logs, and generate a source tracing report;

[0015] When the destruction conditions are met, the file is destroyed, and a request to revoke the decryption key is received.

[0016] Furthermore, the rule engine matches the project stage information based on a preset permission rule library, which includes: stage permission mapping rules for defining file access permissions for different project stages; role permission rules for assigning access permissions based on the identity of project participants; and historical version access rules for restricting access permissions for older versions of the project supervision documents after version changes.

[0017] Furthermore, the permission synchronization includes: broadcasting permission change events to all user terminals through a distributed message push mechanism; online user terminals subscribe to the broadcast permission change events and automatically refresh their local permission cache; offline user terminals lock file access and refresh their local permission cache after reconnecting.

[0018] Furthermore, the embedding process of the invisible watermark includes:

[0019] The engineering supervision document is divided into N data blocks, and a discrete cosine transform is performed on each data block to generate a DCT transform coefficient matrix. The DCT transform coefficient matrix is ​​then partitioned according to a preset frequency threshold to extract low-frequency DCT coefficients and high-frequency DCT coefficients. The low-frequency DCT coefficients represent the global features of the engineering supervision document, and the high-frequency DCT coefficients represent the detailed information of the engineering supervision document.

[0020] Watermark information is embedded in the low-frequency DCT coefficients. This watermark information includes a user ID, a timestamp, and a file hash value, and is represented as follows:

[0021] C′(u,v)=C(u,v)+α×W(u,c);

[0022] Where C'(u,v) is the updated low-frequency DCT coefficient, C(u,v) is the original low-frequency DCT coefficient, W(i,v) is the watermark information, α is the intensity factor, and u and v are the row and column indices of the DCT transform coefficient matrix.

[0023] Perform an inverse DCT transformation on the DCT transform coefficient matrix to obtain the watermarked data block; merge all the data blocks to obtain the updated project supervision document.

[0024] Furthermore, the creation process of the secure transmission sandbox includes:

[0025] Initialize the secure transmission sandbox on the target platform and create a controlled operating space for the engineering supervision documents;

[0026] File decryption is performed within the secure transmission sandbox, and copying, pasting, dragging, printing, and screenshotting operations are blocked through a process-level interception mechanism. Specifically, the secure transmission sandbox on the desktop intercepts global screenshot requests through the operating system hook mechanism, while the secure transmission sandbox in the browser intercepts file access interfaces through WebAssembly technology.

[0027] If the abnormal access behavior is detected, the process of the secure transmission sandbox will be forcibly terminated.

[0028] Furthermore, the abnormal access behavior includes frequent cross-platform access and short-term high-frequency access;

[0029] The method for checking frequent cross-platform access includes: setting a first time window, counting the user's download operations on different target platforms, and if the same user downloads the same project supervision file from more than K target platforms within the first time window, an abnormal warning is triggered.

[0030] The method for checking short-term high-frequency access includes: setting a second time window, calculating the access entropy value of the user's access to the project supervision document, and triggering the abnormal warning if the access entropy value exceeds the set entropy threshold.

[0031] A system for preventing the leakage of engineering supervision documents, comprising:

[0032] The key management module binds attributes to the uploaded project supervision files, generates encryption keys using the CP-ABE algorithm, and encrypts the project supervision files.

[0033] The dynamic permission engine module is used to monitor project progress events and obtain the project stage information of the project supervision file; based on the rule engine, it matches the project stage information and executes the permission change policy and key rotation mechanism; the permission change policy is used to perform version isolation and permission synchronization of the project supervision file; the key rotation mechanism is used to update the key revocation list and generate new keys.

[0034] The secure transmission sandbox module listens for file transmission requests, embeds an invisible watermark into the engineering supervision file, and determines whether the target platform is a controlled platform. If the target platform is a controlled platform, the engineering supervision file is transmitted according to user permissions; otherwise, a secure transmission sandbox is created, and the file is decrypted within the secure transmission sandbox.

[0035] The blockchain audit module records operation logs and writes them to the blockchain after signing and verifying the operation logs; it constructs a knowledge graph based on the blockchain to detect abnormal access behavior, compares the invisible watermark with the operation logs, and generates a traceability report; it executes file destruction when the destruction conditions are met and receives a request to revoke the decryption key.

[0036] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0037] 1. This invention, based on CP-ABE encryption combined with a dynamic key rotation mechanism, ensures that engineering supervision documents can only be accessed by authorized users. When project phases change, old keys are automatically revoked and new keys are generated, preventing the misuse of expired keys. Furthermore, a rule engine and distributed permission synchronization mechanism are employed to automatically push updates after permission adjustments. Online users refresh their permissions instantly, and offline users synchronize their permissions upon reconnection, avoiding unauthorized access due to permission lag. Simultaneously, a version isolation mechanism restricts access permissions to older versions of files, ensuring the security and controllability of engineering documents at different stages and improving the security of engineering supervision documents.

[0038] 2. This invention employs invisible watermarking technology combined with DCT transform to embed user identity, timestamps, and file hash values ​​into the file. Even if the file is leaked, the source of the leak can still be traced through the watermark. Regarding file transmission security, the secure transmission sandbox can create an isolated environment on uncontrolled platforms and intercept high-risk operations, preventing file leakage during transmission. Furthermore, the system supports an automatic file destruction mechanism. When leakage criteria are met, the system automatically executes the destruction operation and submits a decryption key revocation request, improving the security of engineering supervision documents, the accuracy of access control, and audit traceability capabilities.

[0039] 3. This invention combines blockchain technology and knowledge graph analysis to achieve tamper-proof log storage and intelligent anomaly detection. All user operation logs are written to the blockchain after digital signature verification, ensuring data integrity and traceability. By constructing and analyzing the relationships between users, files, devices, and operational behaviors through knowledge graph construction, abnormal behaviors such as frequent cross-platform access and short-term high-frequency downloads can be identified. In addition, the system can compare hidden watermark information with blockchain logs to accurately locate the source of leakage and generate a source tracing report, thereby improving the security of engineering supervision documents, the accuracy of access control, and audit traceability capabilities. Attached Figure Description

[0040] Figure 1 This invention provides a flowchart illustrating a method for preventing the leakage of engineering supervision documents.

[0041] Figure 2 This invention provides a flowchart illustrating the process of a user accessing engineering supervision documents;

[0042] Figure 3 This invention provides a structural schematic diagram of an engineering supervision document leakage prevention system. Detailed Implementation

[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] Please see Figures 1 to 3 This invention provides a method and system for preventing the leakage of engineering supervision documents, the technical solution of which is as follows:

[0045] Example 1:

[0046] While digitizing construction project supervision documents improves collaboration efficiency, it also faces multiple security challenges. Traditional methods rely on static role divisions, which cannot dynamically adjust permissions according to project stages (such as design, construction, and completion). This means that sensitive documents may still be accessible to unauthorized parties after the transition between stages, and the lack of version isolation mechanisms makes it easy for older versions of documents to be leaked through historical archives. In addition, when documents are transmitted across platforms, they need to be decrypted into plaintext. Traditional encryption technologies are insufficient to control the flow of documents through uncontrolled channels, and the lack of dynamic identification and self-destruction strategies makes it difficult to trace leaks. Furthermore, audit logs are scattered across independent systems such as OA and cloud storage, lacking real-time aggregation and anti-tampering capabilities, which means that critical records may be altered.

[0047] To address the aforementioned issues, this embodiment proposes a method for preventing the leakage of engineering supervision documents. Through technologies such as dynamic access control, version isolation, cross-platform secure transmission, and aggregated auditing, it enhances document security, access control accuracy, and audit traceability capabilities. The process is as follows: Figure 1 As shown, it includes:

[0048] Step 1: Bind attributes to the uploaded project supervision file, generate an encryption key using the CP-ABE algorithm, and encrypt the project supervision file.

[0049] Specifically, to implement file encryption and access control, attributes need to be defined for the project supervision files. As shown in Table 1, basic attributes for each file are defined, such as project stage, department, and security level, for file management and encryption policy configuration. At the same time, attributes can also be defined for users, as shown in Table 2, covering roles, departments, and security permission levels. Administrators or file owners set access policies for the files, as shown in Table 3, allowing only users meeting specific attributes to access the corresponding files.

[0050] The system invokes the CP-ABE algorithm to generate an encryption key based on the access policy, encrypting the file and then generating an encrypted file. This algorithm supports complex access policies, ensuring that only qualified users (such as specific roles or departments) can decrypt the file. For example, only design engineers in the design department or high-privilege project managers can access design drawings. This not only achieves efficient access management but also enhances file security and project collaboration flexibility.

[0051] Table 1 File Attribute Table

[0052] File ID file name Project Phase department Security level F001 Design drawings.pdf Design phase Design Department confidential F002 Construction Plan.docx Construction phase Construction Department internal

[0053] Table 2 User Attribute Table

[0054] User ID Role Department Security Permit Level U001 Design Engineer Design Department middle U002 Construction worker Construction Department Low U003 Project Manager Project Management Department high

[0055] Table 3 Access Strategy Table

[0056]

[0057] Step 2: Monitor project progress events and obtain the project stage information from the project supervision documents.

[0058] Project progress events refer to specific events that occur within an engineering project and alter its phase or status. These events encompass the following categories: first, the start and end of a phase, such as "start of the design phase" or "end of the construction phase"; second, the achievement of milestones, such as "topping out of the main structure" or "passing final acceptance"; third, changes in roles, such as "change of project manager" or "adjustment of the design team"; and fourth, changes in the version of engineering supervision documents, such as "construction drawings version V2.0" replacing "construction drawings version V1.0". By monitoring these project progress events, changes in project phases can be detected in real time, ensuring that document management strategies remain synchronized with the actual project progress. Engineering phase information refers to the current project phase (e.g., "design phase" and "construction phase") in which the engineering supervision documents are located.

[0059] The specific operation involves interfacing with project management software (such as Microsoft Project) via an API interface or Webhook mechanism. When a critical event occurs in the project management software, an event notification is sent. Upon receiving the notification, the system extracts information such as the event type, project ID, event occurrence time, and new stage. Subsequently, based on the project ID, it queries the database for files associated with that project and updates the "project stage" attribute of these files. Finally, the file ID and the updated "project stage" information are sent to the rules engine, thereby triggering subsequent permission adjustment policies.

[0060] Step 3: Based on the rule engine, match the project stage information and execute the permission change policy and key rotation mechanism; the permission change policy is used to isolate versions and synchronize permissions of the project supervision files; the key rotation mechanism is used to update the key revocation list (CRL) and generate new keys.

[0061] Furthermore, the rule engine matches the project stage information based on a preset permission rule base, which includes:

[0062] Stage permission mapping rules are used to define file access permissions for different project stages. When the rule engine detects a switch in project stages, it automatically loads the stage permission mapping rules. For example, in the "design stage," the design team has "read and write" permissions for design files, while the construction team has "no permissions." After entering the "construction stage," the permissions for design files will change accordingly: the design team will only have "read-only" permissions, while the construction team will have "read and write" permissions.

[0063] Role-based access rules are used to assign access permissions based on the identity of project participants. The rule engine dynamically generates a permission matrix by combining user identity and role attributes to achieve the principle of least privilege. For example, the "project manager" has "read and write" permissions for all files, while the "construction worker" only has "read and write" permissions for construction-related files and no access to other files.

[0064] Historical version access rules are used to restrict access to older versions of the project supervision documents after version changes. When the rule engine detects a version change in the project supervision documents, it automatically adjusts the access control list of the older version files to achieve version isolation. For example, when a file is updated to version 2, the permissions for version 1 will be set to "read by auditors only".

[0065] Specifically, this embodiment employs the Drools rule engine framework. The rule engine can automatically publish permission change policies based on project stages. Through dual control of stages and roles, it ensures that users can only access files within their scope of responsibility, thereby reducing the risk of internal leaks. Simultaneously, the rule engine supports declarative rule definitions, allowing administrators to flexibly adjust policies according to project needs. For example, to add a "completion stage," simply add the corresponding rule, thereby improving the security of project supervision documents and the accuracy of access control.

[0066] Furthermore, the permission change policy is used to dynamically adjust the access permissions of engineering supervision documents, ensuring that permissions match project progress while achieving version isolation and permission synchronization. Version isolation restricts access to older versions of files, allowing only specific roles to view historical versions. Permission synchronization is used to synchronize permission change events to all user terminals in real time, ensuring that terminal permissions are consistent with the server.

[0067] Furthermore, the permission synchronization includes:

[0068] The permission change event is broadcast to all user terminals through a distributed message push mechanism;

[0069] Online user terminals subscribe to the broadcast permission change event and automatically refresh the local permission cache. Offline user terminals lock file access and refresh the local permission cache after reconnecting.

[0070] Specifically, permission change events are permission change instructions that the rule engine triggers based on project phase information and needs to synchronize with all terminal devices in real time. For example, when the system detects a change in project phase from "design phase" to "construction phase," the rule engine immediately generates a permission change event and broadcasts the change instruction to all registered terminals via the RedisPub / Sub distributed messaging system. This mechanism ensures that after a permission change, online terminal devices can immediately receive the message and automatically refresh their local permission cache. Offline terminal devices, when reconnecting to the server, will actively retrieve the latest permission configuration and synchronize their local cache, thereby achieving consistency of permissions across all devices on the platform. As shown in Table 4, to ensure operational traceability, each permission change and synchronization status will be fully recorded. Log information is stored in a structured format.

[0071] Table 4 Log Information

[0072] User ID U001 File ID F001 operate Permission synchronization time 2024-03-14T10:25:00Z state success Device number Unique Identifier for Terminal Device

[0073] Furthermore, a key rotation mechanism is used to update the CRL and generate new keys, ensuring the security of file encryption. The specific implementation steps are as follows: A new encryption key is generated using the CP-ABE algorithm, ensuring that the key is bound to the access control policy of the current stage. The associated file is re-encrypted using this new key, blocking the old key's access to files in the new stage. The old key is added to the CRL, and the updated CRL is synchronized to all user terminals through a secure channel. This process uses TLS encrypted transmission to prevent the CRL from being tampered with or stolen during distribution. Next, before decrypting a file, the user terminal needs to request the latest CRL from the authentication server for verification. If the key to be used is detected in the CRL, the decryption operation will be rejected and an unauthorized access log will be recorded, ensuring the continued effectiveness of file encryption.

[0074] Step Four: Figure 2 This invention provides a flowchart illustrating the process of a user accessing engineering supervision documents. For example... Figure 2As shown in the upper part, the system listens for file transfer requests, embeds an invisible watermark into the project supervision file, and determines whether the target platform is a controlled platform. If the target platform is a controlled platform, the project supervision file is transferred according to user permissions. Otherwise, a secure transmission sandbox is created, and the file is decrypted within the secure transmission sandbox.

[0075] File transfer requests refer to operations initiated by users or systems to transfer engineering supervision documents from one location to another. The origin and destination of the transfer can be servers, user terminals, or cloud storage platforms. Controlled platforms are high-security environments managed by system administrators or organizations, while uncontrolled platforms are external devices, third-party applications, or public networks where security cannot be guaranteed, such as personal USB drives, social media platforms, or uncertified external servers.

[0076] Furthermore, the embedding process of the invisible watermark includes:

[0077] The engineering supervision document is divided into N data blocks, each of which can be a portion of the document, such as a pixel block in an image or a page region in a document. A Discrete Cosine Transform (DCT) is performed on each data block. The DCT transform decomposes the document content into frequency components, generating a DCT transform coefficient matrix. The values ​​in the coefficient matrix represent the energy distribution at different frequencies, facilitating subsequent watermark embedding.

[0078] The DCT transform coefficient matrix is ​​partitioned according to a preset frequency threshold, and low-frequency DCT coefficients and high-frequency DCT coefficients are extracted.

[0079] The low-frequency DCT coefficients represent the global features of the engineering supervision document (such as overall brightness or color distribution) and are typically located in the upper left corner of the matrix. The high-frequency DCT coefficients represent the detailed information of the engineering supervision document (such as edges or textures) and are typically located in the lower right corner of the matrix.

[0080] Since low-frequency DCT coefficients have little visual impact on files, watermark information is embedded in these low-frequency DCT coefficients. The watermark information includes a user ID, a timestamp, and a file hash value, represented as follows:

[0081] C′(u,v)=C(u,c)+α×W(u,v);

[0082] Where C'(u,v) represents the updated low-frequency DCT coefficients, C(u,v) represents the original low-frequency DCT coefficients, W(u,v) represents the watermark information, α is the intensity factor, and u and v are the row and column indices of the DCT transform coefficient matrix. By adjusting α, a balance can be achieved between concealment (watermark is invisible) and robustness (watermark is extractable). For example, a smaller α results in a more concealed watermark, while a larger α results in a more resistant watermark.

[0083] Perform an inverse DCT transformation on the DCT transform coefficient matrix to convert the frequency domain data back to the spatial domain, obtaining the watermarked data block; merge all the data blocks to obtain the updated engineering supervision document.

[0084] By embedding the watermark in low-frequency areas of the document, it does not affect the document's visual appearance and ensures that the watermark is undetectable to users during normal use, thus guaranteeing the appearance and user experience of the engineering supervision documents. Furthermore, the watermark information is bound to the document, enhancing the anti-counterfeiting and anti-tampering capabilities of the engineering supervision documents, thereby improving their security, access control accuracy, and audit traceability.

[0085] Furthermore, the creation process of the secure transmission sandbox includes:

[0086] The secure transmission sandbox is initialized on the target platform, and a controlled runtime space is created for the project supervision files. The secure transmission sandbox utilizes operating system isolation techniques, such as namespaces on Linux and Job Objects on Windows, to completely isolate it from the main system environment. Furthermore, the controlled runtime space restricts access permissions for the project supervision files, allowing only decryption and viewing within the sandbox, and prohibiting the file content from leaving the sandbox in any form.

[0087] The secure transfer sandbox performs file decryption and prevents file copying, pasting, dragging, printing, and screenshotting operations through a process-level interception mechanism. Specifically, the desktop version of the secure transfer sandbox intercepts global screenshot requests using operating system hook mechanisms (such as SetWindowsHookEx in Windows), preventing users from capturing file content using screenshot tools. The browser version of the secure transfer sandbox intercepts file access interfaces using WebAssembly technology, restricting the scope of file operations. High-risk APIs and screenshot APIs are disabled and replaced with a black screen image to prevent file content from being captured and saved.

[0088] The sandbox is equipped with behavior monitoring to detect user operations in real time. If abnormal access behavior is detected, the process of the secure transmission sandbox will be forcibly terminated.

[0089] Sandboxes allow users to securely view files on uncontrolled platforms without affecting the normal reading experience. By isolating file operations from the main system environment, they ensure that file content is not leaked to uncontrolled platforms, thereby improving the security and accuracy of access control for engineering supervision documents.

[0090] Step 5: Record operation logs, and write the operation logs to the blockchain after signing and verifying them; construct a knowledge graph based on the blockchain to detect abnormal access behavior, compare the invisible watermark with the operation logs, and generate a source tracing report.

[0091] The system meticulously records user actions related to viewing, downloading, and transferring engineering supervision documents, generating operation logs that include user ID, file ID, operation type, timestamp, device information, and platform type. Each log entry is digitally signed using the Ed25519 signature algorithm, and the signature is appended to the log entry to form a complete data packet, ensuring the authenticity and integrity of the documents. The signed logs are then written to a private blockchain based on Hyperledger Fabric via a smart contract. After the smart contract verifies the signature's validity, the logs are stored on the blockchain, ensuring immutability.

[0092] Simultaneously, a knowledge graph is constructed using the Neo4j graph database to parse the operation logs in the blockchain into graph nodes and graph relationships for visual storage. Graph nodes include user ID, file ID, operation type, timestamp, device information, and platform type. Graph relationships represent operation behaviors, such as "user A downloaded file F on platform P".

[0093] Furthermore, the abnormal access behavior includes frequent cross-platform access and short-term high-frequency access;

[0094] The method for checking frequent cross-platform access includes: setting a first time window, counting the user's download operations on different target platforms, and if the same user downloads the same project supervision file from more than K target platforms within the first time window, an abnormal warning is triggered.

[0095] The method for checking short-term high-frequency access includes: setting a second time window, calculating the access entropy value of the user's access to the project supervision document, and triggering the abnormal warning if the access entropy value exceeds the set entropy threshold.

[0096] Abnormal access behavior can also include methods for checking for device / IP changes and abnormal file access.

[0097] The methods for checking access due to device / IP changes include: monitoring the same user accessing the same file by changing devices or IP addresses within a short period of time; if the user's device fingerprint or IP address changes more than M times within the second time window, an abnormal warning will be triggered.

[0098] File access anomaly checks include: monitoring file access permissions; if a user's role does not meet the access rules but still attempts to access a file, an anomaly warning is triggered.

[0099] Specifically, such as Figure 2 The lower half of the diagram shows that an operation log is generated for the access control execution. If the operation type is normal, execution continues; otherwise, an exception warning is triggered. In this embodiment, the Cypher query language is used in Neo4j to detect exceptions. The first time window is set to 1 hour to count the download operations of the same user on different target platforms. If a user downloads the same file from more than 3 platforms (such as OA system, email system, and cloud storage) within 1 hour, an exception warning is triggered. The second time window is set to 10 minutes to calculate the user's access entropy value for the file. If the entropy value exceeds a set threshold (such as 95%), an exception warning is triggered. The entropy value formula is:

[0100] H = -∑ i P i logP i ;

[0101] Where H is the access entropy value, P i Let be the frequency of the i-th operation type (such as viewing and downloading), and log() be the logarithmic function.

[0102] When an abnormal warning is triggered, the hidden watermark in the file is extracted, and the embedded user ID, timestamp, and file hash value are obtained. The user's operation log for the file at that time is queried in the blockchain, and a traceability report is generated, which includes the leaked file, the responsible user, the operation time, and the device information.

[0103] Operation logs are signed with Ed25519 and stored on the blockchain, ensuring their authenticity and tamper-proof capabilities. A knowledge graph presents the relationships between users, files, and platforms; Cypher queries can quickly identify frequent cross-platform access behavior, effectively improving anomaly detection efficiency. Furthermore, comparing the invisible watermark with the blockchain logs accurately pinpoints the source of file leaks, further enhancing the security of engineering supervision documents, the accuracy of access control, and audit traceability capabilities.

[0104] Step 6: Execute file destruction when the destruction conditions are met, and receive a request to revoke the decryption key.

[0105] Specifically, self-destruction conditions are set based on the number of accesses (e.g., a maximum of 3 times) or time (e.g., expires after 24 hours). The user terminal marks the file as "destroyed," deletes a local copy of the file, and ensures that it cannot be accessed again. After the client completes file destruction, it sends a request to the server to revoke the decryption key. The server processes the request, adds the decryption key associated with the file to the CRL, updates and distributes the CRL to all relevant clients, ensuring that the old key cannot decrypt the file.

[0106] This invention first employs the CP-ABE encryption algorithm for fine-grained access control of files, ensuring that only users conforming to the access policy can decrypt files. Combined with a key rotation mechanism, the encryption key is periodically updated and old keys are revoked, eliminating the illegal use of expired keys at the source. Secondly, a rule engine dynamically adjusts file access permissions by matching project stage information in real time. Distributed message push technology enables cross-terminal permission synchronization, and a version isolation strategy automatically restricts access to older versions of files. During file transmission and usage, an invisible watermark technique embeds user identity, timestamps, and file hash values ​​into the file's frequency domain, maintaining an imperceptible appearance while providing a unique identifier for tracing leaks. A secure transmission sandbox uses memory isolation and operation interception to prohibit high-risk behaviors such as screenshots and printing, preventing file content leakage. Furthermore, all user operation logs are digitally signed and written to the blockchain, using smart contracts to ensure data immutability. A knowledge graph is built based on Neo4j to achieve multi-dimensional correlation analysis of operation behaviors, accurately identifying abnormal access patterns. When a file triggers preset destruction conditions, memory erasure and key revocation are automatically performed, eliminating the risk of sensitive information residue. Through the organic synergy of the above technologies, dynamic access control and full-chain traceability of engineering supervision documents are realized, which improves the security, access control accuracy and audit traceability of engineering supervision documents.

[0107] Example 2:

[0108] Construction company A is responsible for multiple infrastructure projects. Because the project supervision documents involve core information such as construction drawings, quality acceptance reports, schedules, and change approval forms, the company uses a digital management platform to store and share these documents. However, as projects progress, file access permissions become difficult to adjust dynamically, the risk of data leakage increases, and document traceability becomes challenging. Traditional static access control methods are no longer sufficient to meet security requirements. To address these issues, company A has introduced a project supervision document leak prevention system, such as... Figure 3 As shown, it includes:

[0109] refer to Figure 3 The key management module binds attributes to the uploaded engineering supervision files, generates encryption keys using the CP-ABE algorithm, and encrypts the engineering supervision files.

[0110] refer to Figure 3 The dynamic permission engine module is used to monitor project progress events and obtain the project stage information of the project supervision file; based on the rule engine, it matches the project stage information and executes the permission change policy and key rotation mechanism; the permission change policy is used to perform version isolation and permission synchronization of the project supervision file; the key rotation mechanism is used to update the key revocation list and generate new keys;

[0111] refer to Figure 3 The secure transmission sandbox module listens for file transmission requests, embeds an invisible watermark into the engineering supervision file, and determines whether the target platform is a controlled platform. If the target platform is a controlled platform, the engineering supervision file is transmitted according to user permissions; otherwise, a secure transmission sandbox is created, and the file is decrypted within the secure transmission sandbox.

[0112] refer to Figure 3 The blockchain audit module records operation logs and writes them to the blockchain after signing and verifying the operation logs; it constructs a knowledge graph based on the blockchain to detect abnormal access behavior, compares the invisible watermark with the operation logs, and generates a traceability report; it executes file destruction when the destruction conditions are met and receives a request to revoke the decryption key.

[0113] Table 5 Log Information

[0114]

[0115] Table 6 Source Tracing Report

[0116]

[0117] For example, if user A (the supervisor) downloads a construction acceptance report in the OA system, the system automatically generates an operation log when user A performs the download operation, as shown in Table 5, which includes user ID, file ID, and operation, thereby assisting in constructing a file access relationship graph.

[0118] If document F001 is leaked, as shown in Table 6, Company A can extract the hidden watermark from the leaked document and compare it with the blockchain log to confirm the source of the leak and generate a traceability report, thereby improving the security, compliance and traceability of the engineering supervision documents.

[0119] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for preventing the leakage of engineering supervision documents, characterized in that, include: Bind attributes to the uploaded project supervision file, generate an encryption key using the CP-ABE algorithm, and encrypt the project supervision file; Monitor project progress events and obtain project stage information from the project supervision documents; Based on the rule engine, the project stage information is matched, and permission change policies and CRL-based dynamic key rotation mechanisms are executed. The permission change policy is used to isolate versions and synchronize permissions for the project supervision documents. The permission synchronization includes: broadcasting permission change events to all user terminals through a distributed message push mechanism; the key rotation mechanism is used to update the key revocation list and generate new keys. Listen for file transfer requests, embed an invisible watermark into the project supervision file, and determine whether the target platform is a controlled platform; if the target platform is a controlled platform, transfer the project supervision file according to user permissions; otherwise, create a secure transfer sandbox and decrypt the file within the secure transfer sandbox. Record operation logs, and write the operation logs to the blockchain after signing and verification; construct a knowledge graph based on the blockchain to detect abnormal access behavior; compare the invisible watermark with the operation logs to generate a source tracing report; When the destruction conditions are met, the file is destroyed, and a request to revoke the decryption key is received.

2. The method for preventing leakage of engineering supervision documents according to claim 1, characterized in that, The rule engine matches the project stage information based on a preset permission rule library. The permission rule library includes: stage permission mapping rules, which define file access permissions for different project stages; role permission rules, which assign access permissions according to the identity of project participants; and historical version access rules, which restrict access permissions for older versions of the project supervision documents after version changes.

3. The method for preventing leakage of engineering supervision documents according to claim 1, characterized in that, Online user terminals subscribe to the broadcast permission change event and automatically refresh the local permission cache. Offline user terminals lock file access and refresh the local permission cache after reconnecting.

4. The method for preventing leakage of engineering supervision documents according to claim 1, characterized in that, The embedding process of the invisible watermark includes: dividing the engineering supervision document into N data blocks, and performing a discrete cosine transform on each data block to generate a DCT transform coefficient matrix; partitioning the DCT transform coefficient matrix according to a preset frequency threshold, and extracting low-frequency DCT coefficients and high-frequency DCT coefficients; wherein, the low-frequency DCT coefficients represent the global features of the engineering supervision document; the high-frequency DCT coefficients represent the detailed information of the engineering supervision document; and embedding watermark information into the low-frequency DCT coefficients, the watermark information including user... The ID, timestamp, and file hash value are represented as: C'(u,v) = C(u,v) + α × W(u,v); where C'(u,v) is the updated low-frequency DCT coefficient, C(u,v) is the original low-frequency DCT coefficient, W(u,v) is the watermark information, α is the intensity factor, and u and v are the row and column indices of the DCT transform coefficient matrix; an inverse DCT transform is performed on the DCT transform coefficient matrix to obtain the watermarked data block; all the data blocks are merged to obtain the updated engineering supervision document.

5. The method for preventing leakage of engineering supervision documents according to claim 1, characterized in that, The creation process of the secure transmission sandbox includes: initializing the secure transmission sandbox on the target platform and creating a controlled operating space for the project supervision file; performing file decryption within the secure transmission sandbox and preventing copying, pasting, dragging, printing, and screenshotting operations of the project supervision file through a process-level interception mechanism; wherein, the secure transmission sandbox on the desktop intercepts global screenshot requests through the operating system hook mechanism, and the secure transmission sandbox in the browser intercepts file access interfaces through WebAssembly technology; if the abnormal access behavior is detected, the process of the secure transmission sandbox is forcibly terminated.

6. The method for preventing leakage of engineering supervision documents according to claim 1, characterized in that, The abnormal access behaviors include frequent cross-platform access and short-term high-frequency access. The method for checking frequent cross-platform access includes: setting a first time window, counting the user's download operations on different target platforms, and if the same user downloads the same project supervision file from more than K target platforms within the first time window, an abnormal warning is triggered. The method for checking short-term high-frequency access includes: setting a second time window, calculating the user's access entropy value for the project supervision file, and if the access entropy value exceeds a set entropy threshold, the abnormal warning is triggered.

7. A system for preventing the leakage of engineering supervision documents, characterized in that, include: The key management module binds attributes to the uploaded project supervision files, generates encryption keys using the CP-ABE algorithm, and encrypts the project supervision files. The dynamic permission engine module is used to listen for project progress events and obtain the project stage information from the project supervision documents. Based on the rule engine, the project stage information is matched, and permission change policies and CRL-based dynamic key rotation mechanisms are executed. The permission change policy is used to isolate versions and synchronize permissions for the project supervision documents; The permission synchronization includes: broadcasting permission change events to all user terminals through a distributed message push mechanism; the key rotation mechanism is used to update the key revocation list and generate new keys. The secure transmission sandbox module listens for file transmission requests, embeds an invisible watermark into the engineering supervision file, and determines whether the target platform is a controlled platform. If the target platform is a controlled platform, the engineering supervision file is transmitted according to user permissions; otherwise, a secure transmission sandbox is created, and the file is decrypted within the secure transmission sandbox. The blockchain audit module records operation logs and writes them to the blockchain after signing and verifying the operation logs; it constructs a knowledge graph based on the blockchain to detect abnormal access behavior, compares the invisible watermark with the operation logs, and generates a source tracing report. When the destruction conditions are met, the file is destroyed, and a request to revoke the decryption key is received.

Images