Tracing-assisted data encryption method

Abstract

The invention relates to the technical field of data encryption, in particular to an auxiliary tracing data encryption method, which comprises the steps of periodically dividing interactive data into a plurality of time periods, configuring a unique time period identifier for each time period, generating an exclusive watermark key in combination with user identity information, extracting keywords, and dividing semantic leaves. Sensitive keywords and non-sensitive keywords in the semantic leaves are divided, interaction data in all time periods are encrypted based on the types of the semantic leaves, and a differential encryption mode is executed on the sensitive keywords and the non-sensitive keywords in any semantic leaf; a time period division and periodic key updating mechanism is adopted, a dynamic evolution security protection system is constructed, even if a key is leaked in a single time period, data security in other time periods cannot be affected, and accurate traceability is provided through a composite watermark identifier fusing user identities, time periods and semantic information. And a leakage source and a time window can be quickly positioned.

Description

Technical Field

[0001] The present invention relates to the technical field of data encryption, and in particular to a data encryption method for auxiliary traceability. Background Art

[0002] Current data encryption technology faces many challenges. Traditional static encryption methods have the problems of high risk of key leakage and lack of time dimension isolation, making it difficult to meet the security needs of modern interactive data. Existing solutions generally lack effective traceability capabilities and are unable to accurately identify the time range and specific content category of the leak after the data is leaked, making it difficult to determine responsibility. At the same time, traditional encryption technology uses a uniform strength of protection for all data and fails to implement differentiated encryption strategies for content with different levels of sensitivity. Although digital watermarking technology is widely used in the field of copyright protection, its static characteristics make it difficult to adapt to dynamic interactive scenarios and lack personalized tagging functions in the user dimension. In addition, existing encryption solutions are often limited to specific platforms and cannot meet the security needs of diverse interactive scenarios such as mobile terminals and web terminals.

[0003] For example, in the prior art, Chinese Patent Publication No.: CN116738472A discloses a task data encryption method, device and equipment for task data interaction. A specific implementation of the method includes: generating a first task data combination method; storing the first combined task data in a first storage space, and storing the original task data used to generate the first combined task data in a second storage space; obtaining a second task data combination method corresponding to the second task data application scenario based on the second task data application scenario corresponding to the task data call instruction; performing task data combination on the first combined task data and the original task data stored in the second storage space to generate second combined task data, and sending the second combined task data to the execution task data application corresponding to the second task data application scenario. This implementation method can further perform encryption design based on the application scenario of the task data to ensure the safe use of the task data when it is decrypted on the application terminal.

[0004] However, the above solution has the following problems:

[0005] The lack of selective analysis and adaptive configuration of data while encrypting it leads to the inability to provide effective data support and auxiliary analysis during theft;

[0006] Using a fixed key or algorithm, once the key is leaked, all historical data may be cracked, lacking security isolation in the time dimension;

[0007] It is difficult to accurately identify the time range and specific content categories of the breach after a data breach. Summary of the Invention

[0008] The purpose of the present invention is to provide a data encryption method for auxiliary traceability to solve at least one of the above-mentioned technical problems in the prior art.

[0009] To this end, the present invention provides a data encryption method for auxiliary traceability, which includes:

[0010] The interactive data is periodically divided into several time periods, and a unique time period identifier is configured for the interactive data in each time period. Based on the user identity information and the time period identifier, a unique watermark key for each user is generated through a hash chain algorithm;

[0011] Extract keywords from interaction data and divide them into sensitive keywords and non-sensitive keywords of various semantic leaves. A single semantic leaf includes several sensitive keywords and several non-sensitive keywords.

[0012] The interaction data within each time period is encrypted based on the semantic leaf type, and the following differentiated encryption methods are performed for sensitive keywords and non-sensitive keywords in any semantic leaf:

[0013] The first encryption algorithm is used for non-sensitive keywords.

[0014] For sensitive keywords, the second encryption algorithm is used for encryption, and the type code of the semantic leaf to which it belongs is generated. The exclusive watermark key and the type code of the semantic leaf are XORed together to generate a composite watermark identifier, which is then embedded in the encrypted ciphertext.

[0015] As a preferred technical solution for the data encryption method for auxiliary traceability, the data encryption method for auxiliary traceability also includes:

[0016] When a data leak occurs, a composite watermark is extracted from the stolen ciphertext. If the extraction fails, the keyword distribution of the stolen data is obtained. If it matches a non-sensitive keyword in any semantic leaf and there are no sensitive keywords, it is determined that data theft targets the corresponding semantic leaf.

[0017] If the extraction is successful, the time period identifier, user identity information, and the corresponding semantic leaf are parsed to generate a traceability evidence chain containing the following content:

[0018] The time period to which the stolen data belongs, the semantic leaf targeted by the theft, and the watermark integrity verification result.

[0019] As a preferred technical solution for the data encryption method of auxiliary traceability, the method of generating each user's exclusive watermark key through a hash chain algorithm based on user identity information and time period identifier includes:

[0020] Generate an initial seed key based on the user name code and registration time;

[0021] The initial seed key is iteratively updated according to the time period identifier.

[0022] As the preferred technical solution for the data encryption method for auxiliary traceability, the first encryption algorithm is the ChaCha20 encryption algorithm, and the second encryption algorithm is the AES-256 encryption algorithm.

[0023] As a preferred technical solution for the data encryption method of auxiliary traceability, the embedding of the composite watermark identifier into the encrypted ciphertext specifically includes: replacing designated bits in the padding field with the composite watermark identifier.

[0024] As a preferred technical solution for the data encryption method of auxiliary traceability, the parsing time period identifier, user identity information and the corresponding semantic leaf specifically include:

[0025] Separate the time period identifier from the composite watermark identifier, map it to the encryption policy change record, and determine the time window of the leaked data;

[0026] Separate the initial seed key from the composite watermark identifier, determine the user name code and registration time, map them to the interactive platform user database, and identify the source user of the leak;

[0027] Count the occurrence frequencies of different semantic leaves and generate the stealer's semantic leaf attention heat map.

[0028] As an optimal technical solution for the data encryption method of auxiliary traceability, the composite watermark identifier is embedded into the transmission protocol packet header for mobile terminal interaction data, and the composite watermark identifier is implicitly written into the cookie or local cache index for web page interaction data.

[0029] As a preferred technical solution for the data encryption method of auxiliary traceability, the type encoding of the semantic leaf is generated by a hash mapping method based on the semantic feature weight.

[0030] As a preferred technical solution for the data encryption method for auxiliary traceability, the screening of sensitive keywords is carried out using context sensitivity analysis based on natural language processing.

[0031] As a preferred technical solution for the data encryption method to assist in traceability, the traceability evidence chain further includes transmission path information of the stolen data, and the transmission path information is extracted through traffic analysis.

[0032] The beneficial effects of the present invention are:

[0033] The dynamic encryption and watermarking technology of the present invention has achieved a breakthrough in data security protection. First, by adopting time period division and periodic key update mechanism, a dynamically evolving security protection system is constructed. Even if the key of a single time period is leaked, it will not affect the data security of other time periods. Secondly, by integrating the composite watermark identification of user identity, time period and semantic information, it provides accurate traceability capabilities, which can quickly locate the source of the leak and the time window. In terms of encryption strategy, differentiated protection is implemented for sensitive keywords and non-sensitive content, which not only ensures security but also optimizes system performance. The intelligent semantic analysis system based on natural language processing can dynamically adjust keyword classification to adapt to the security needs of different fields.

[0034] Furthermore, the cross-platform nature of the present invention enables it to adapt to diverse interactive scenarios such as mobile terminals and web terminals, and to implement a unified security solution through different methods such as protocol header embedding or cookie writing. In terms of judicial evidence, the complete traceability evidence chain generated by the system contains multi-dimensional information, combined with watermark integrity verification, providing a reliable basis for responsibility determination. In terms of anti-attack design, distributed watermark embedding and dynamic key update effectively resist all kinds of cracking attempts. In terms of performance optimization, differentiated encryption strategies and lightweight watermark embedding ensure the system's operating efficiency in high-concurrency scenarios.

[0035] In particular, the present invention reduces the probability of stealing sensitive keywords through differentiated encryption of sensitive keywords and non-sensitive keywords. The differentiated encryption method allows for if non-sensitive keywords are stolen, it can be verified through reverse comparison that the theft is directed at the semantic leaf where the non-sensitive keywords are located, providing effective data support for tracing. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is a flow chart of a data encryption method for assisting traceability in an embodiment of the present invention;

[0037] Figure 2 A flowchart of generating a unique watermark key in an embodiment of the present invention;

[0038] Figure 3 The figure is a flow chart of stolen data analysis in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0040] In the description of the present invention, it should be noted that, unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be understood in a broad sense. For example, they may refer to fixed, detachable, or integral connections; mechanical or electrical connections; direct or indirect connections through an intermediate medium; and internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on the specific circumstances.

[0041] The following describes embodiments of the present invention in detail. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended only to explain the present invention and are not to be construed as limiting the present invention.

[0042] like Figure 1 As shown, the present invention provides a data encryption method for auxiliary traceability, and the data encryption method for auxiliary traceability includes:

[0043] Step S1: The interactive data is periodically divided into several time periods, a unique time period identifier is configured for the interactive data of each time period, and a unique watermark key for each user is generated through a hash chain algorithm based on the user identity information and the time period identifier;

[0044] Step S2: extract keywords from the interaction data and divide them into sensitive keywords and non-sensitive keywords of various semantic leaves. A single semantic leaf includes several sensitive keywords and several non-sensitive keywords.

[0045] Step S3: Encrypt the interaction data in each time period based on the semantic leaf type, and perform the following differentiated encryption method for sensitive keywords and non-sensitive keywords in any semantic leaf:

[0046] The first encryption algorithm is used for non-sensitive keywords.

[0047] Sensitive keywords are encrypted using a second encryption algorithm, which generates a type code for the corresponding semantic leaf. The unique watermark key and the semantic leaf type code are then XORed together to generate a composite watermark identifier, which is then embedded into the encrypted ciphertext. In practice, the first encryption algorithm should be less difficult to crack than the second. In this embodiment, the first encryption algorithm is the ChaCha20 encryption algorithm, and the second encryption algorithm is the AES-256 encryption algorithm.

[0048] Specifically, the data encryption method for auxiliary traceability also includes:

[0049] Step S4: When a data leak occurs, extract the composite watermark from the stolen ciphertext. If the extraction fails, obtain the keyword distribution of the stolen data. If it matches any non-sensitive keyword in any semantic leaf and there are no sensitive keywords, it is determined that data theft targets the corresponding semantic leaf.

[0050] If the extraction is successful, the time period identifier, user identity information, and the corresponding semantic leaf are parsed to generate a traceability evidence chain containing the following content:

[0051] The stolen data's time period, the semantic leaf targeted by the theft, and the watermark integrity check results. In this embodiment, the traceability evidence chain further includes the stolen data's transmission path information, which is extracted through traffic analysis.

[0052] See also Figure 2 As shown, the method of generating a unique watermark key for each user based on the user identity information and the time period identifier through a hash chain algorithm includes:

[0053] Step S11, generating an initial seed key based on the user name code and registration time;

[0054] Step S12: iteratively update the initial seed key according to the time period identifier.

[0055] Specifically, embedding the composite watermark identifier into the encrypted ciphertext includes replacing designated bits in the padding field with the composite watermark identifier. Specifically, this embedding method utilizes a phased key generation mechanism to construct a user-specific watermark key system. In the initial phase, a hash algorithm is used to irreversibly combine the user's name code with a millisecond-accurate registration timestamp to generate a unique initial seed key. This process ensures that each user's key foundation is highly unique. During the key update phase, the initial key is iteratively updated using a hash chain algorithm based on preset time periods (in this embodiment, monthly divisions), using the time period identifier as a dynamic parameter. This chain update mechanism is strictly unidirectional. Even if an attacker obtains the current time period key, they cannot reverse-derive the historical key, thus ensuring comprehensive forward security. At the key application level, a lightweight embedding strategy is used to embed the composite watermark identifier into the encrypted data. During implementation, the padding field structure of the encrypted data is intelligently analyzed to select appropriate bits for watermark replacement. This approach ensures the complete embedding of the watermark information without affecting the main structure and parsing process of the encrypted data. In implementation, the watermark embedding process should use non-destructive writing technology to ensure that the watermark information is completely transparent under normal usage scenarios, and can only be extracted and verified through a dedicated interface when tracing the source and obtaining evidence is required. The entire watermark design fully considers the performance requirements of actual applications. The key generation and embedding processes have been optimized, and the time consumption of a single operation is controlled at the millisecond level, fully meeting the real-time requirements of high-concurrency interactive scenarios. At the same time, sufficient key disaster recovery capabilities should be configured during implementation. When abnormal access is detected, the key rotation mechanism can be quickly triggered to effectively prevent potential security risks. This solution, which deeply combines cryptographic technology with business scenarios, not only ensures data security, but also provides a convenient management and maintenance interface to reduce operation and maintenance costs.

[0056] See also Figure 3 As shown, the parsed time period identifier, user identity information and the corresponding semantic leaf specifically include:

[0057] Step S41, separating the time period identifier from the composite watermark identifier, mapping it to the encryption policy change record, and determining the time window of the leaked data;

[0058] Step S42: Separate the initial seed key from the composite watermark identifier, determine the user name code and registration time, map them to the interactive platform user database, and identify the source user of the leak;

[0059] Step S43 counts the frequency of occurrence of different semantic leaves and generates a heat map of the thief's semantic leaf attention. In the above embodiment, intelligent semantic leaf statistics are designed for behavioral analysis of thieves. Frequency statistics and correlation analysis are performed on various semantic leaves appearing in the leaked data, and the thief's key areas of attention are identified through machine learning algorithms. The analysis results are presented in the form of a visual heat map, which intuitively displays the probability distribution of theft of different semantic leaves, helping the security team quickly grasp the attacker's intention preferences. The entire parsing process adopts a distributed computing architecture, which supports parallel processing of massive leaked data, ensuring that the full analysis is completed in the shortest time.

[0060] Specifically, the composite watermark identifier is embedded into the transmission protocol header for mobile-side interactive data, and the composite watermark identifier is implicitly written into the cookie or local cache index for web-side interactive data. In detail, differentiated watermark embedding strategies are designed based on the characteristics of different terminal platforms to ensure reliable data traceability in various application scenarios. For mobile-side interactive data, a transmission protocol header embedding scheme is adopted, and the specific implementation method is: in the extended header field of the HTTP / HTTPS protocol, the composite watermark identifier is Base64-encoded and written into the X-Watermark custom field, while retaining standard protocol compatibility. This design fully considers the characteristics of the mobile network environment. The watermark information is transmitted with each request / response message, which will not affect the normal communication process and can ensure the transferability at intermediate nodes such as gateways and proxies. A lightweight checksum algorithm is used to protect the watermark identifier to ensure that it is not tampered with during transmission.

[0061] In web application scenarios, an implicit storage embedding strategy is adopted. For short-term interactive data, the composite watermark identifier will be converted into a hash value and written into a specific field of the browser cookie, providing dual protection through the HttpOnly and Secure flags. For data that needs to be persistent, the watermark information is split and stored in multiple locations of the local cache index, and redundant coding technology is used to ensure that the watermark can be fully restored even if some data is lost. This design cleverly utilizes the characteristics of the Web storage mechanism to achieve hidden storage of watermarks without affecting page performance. An automatic synchronization mechanism is also designed to ensure that the watermark identifiers between different devices remain consistent when multiple terminal logins are detected.

[0062] In this embodiment, the screening of sensitive keywords is performed using context-sensitive analysis based on natural language processing. Specifically, using a context-sensitive analysis method based on natural language processing for sensitive keyword screening enables accurate classification through multi-dimensional semantic analysis. First, pre-trained semantic models such as BERT are used to deeply analyze the interactive content. Dependency parsing and named entity recognition techniques are combined to comprehensively capture the contextual characteristics of keywords. A built-in basic sensitive vocabulary database covers professional terms in fields such as finance and healthcare. New sensitive terms are discovered in real time using the TF-IDF algorithm, forming a dynamic expansion mechanism. During the specific analysis, the correlation strength between keywords and the sensitive vocabulary database is comprehensively evaluated, and a sensitivity score is quantitatively determined. Based on the sensitivity score, each piece of interactive data is automatically categorized into the corresponding semantic leaf. (For a single piece of interactive data, which may contain multiple keywords, the semantic leaf corresponding to the keyword with the highest sensitivity score is used as the semantic leaf for that piece of interactive data, and the keyword with the highest sensitivity score is used as the keyword for that piece of interactive data.) By intelligently linking semantic analysis with encryption strategies, refined security management is achieved, ensuring the security strength of highly sensitive content while avoiding over-encryption of low-risk data, effectively balancing security and performance. This technology is particularly suitable for scenarios with strict requirements on data sensitivity, such as financial transactions and medical consultations, and provides an intelligent solution for interactive data protection.

[0063] Specifically, in the above embodiment, first, a dynamically evolving security protection system is constructed by adopting time period division and periodic key update mechanism. Even if the key of a single time period is leaked, it will not affect the data security of other time periods. Secondly, by integrating the composite watermark identification of user identity, time period and semantic information, accurate traceability is provided, which can quickly locate the source of the leak and the time window. In terms of encryption strategy, differentiated protection is implemented for sensitive keywords and non-sensitive content, which not only ensures security but also optimizes performance. Intelligent semantic analysis based on natural language processing can dynamically adjust keyword classification to adapt to the security needs of different fields.

[0064] On the basis of the above effects, the cross-platform feature enables it to adapt to diverse interactive scenarios such as mobile terminals and web terminals, and implement a unified security solution through different methods such as protocol header embedding or cookie writing. In terms of judicial evidence, the generated complete traceability evidence chain contains multi-dimensional information, combined with watermark integrity verification, providing a reliable basis for responsibility determination. In terms of anti-attack design, distributed watermark embedding and dynamic key update effectively resist various cracking attempts. In terms of performance optimization, differentiated encryption strategies and lightweight watermark embedding ensure operational efficiency in high-concurrency scenarios. Furthermore, through the differentiated encryption method of sensitive keywords and non-sensitive keywords, the probability of stealing sensitive keywords is reduced. The differentiated encryption method allows for the theft of non-sensitive keywords. If non-sensitive keywords are stolen, it can be verified through reverse comparison that the theft is targeting the semantic leaf where the non-sensitive keywords are located, providing effective data support for traceability.

[0065] Through technologies such as time dimension encryption, semantic-level watermark embedding, and intelligent keyword classification, a comprehensive, multi-level security protection system has been built, which provides powerful traceability capabilities while ensuring data security. It can be widely used in fields with strict data security requirements such as AI interaction, finance, and medical care, providing a reliable solution for data protection in the digital economy era.

[0066] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions and operations of the devices, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment or part of the code, which contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, as well as the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based device that performs the specified function or operation, or can be implemented using a combination of dedicated hardware and computer instructions.

[0067] Obviously, the above embodiments of the present invention are merely examples for the purpose of clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. A person skilled in the art would be able to make other variations or modifications based on the above description. It is not necessary and impossible to enumerate all embodiments here. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the claims of the present invention.

Claims

1. A data encryption method for auxiliary traceability, characterized in that: include: The interactive data is periodically divided into several time periods, and a unique time period identifier is configured for the interactive data in each time period. Based on the user identity information and the time period identifier, a unique watermark key for each user is generated through a hash chain algorithm; Extract keywords from interaction data and divide them into sensitive keywords and non-sensitive keywords of various semantic leaves. A single semantic leaf includes several sensitive keywords and several non-sensitive keywords. The interaction data within each time period is encrypted based on the semantic leaf type, and the following differentiated encryption methods are performed for sensitive keywords and non-sensitive keywords in any semantic leaf: The first encryption algorithm is used for non-sensitive keywords. For sensitive keywords, the second encryption algorithm is used for encryption, and the type code of the semantic leaf to which it belongs is generated. The exclusive watermark key and the type code of the semantic leaf are XORed together to generate a composite watermark identifier, which is then embedded in the encrypted ciphertext.

2. The data encryption method for auxiliary traceability according to claim 1 is characterized in that: The data encryption method for auxiliary traceability also includes: When a data leak occurs, a composite watermark is extracted from the stolen ciphertext. If the extraction fails, the keyword distribution of the stolen data is obtained. If it matches a non-sensitive keyword in any semantic leaf and there are no sensitive keywords, it is determined that data theft targets the corresponding semantic leaf. If the extraction is successful, the time period identifier, user identity information, and the corresponding semantic leaf are parsed to generate a traceability evidence chain containing the following content: The time period to which the stolen data belongs, the semantic leaf targeted by the theft, and the watermark integrity verification result.

3. The data encryption method for auxiliary traceability according to claim 1, characterized in that: The method of generating a unique watermark key for each user based on the user identity information and the time period identifier by using a hash chain algorithm includes: Generate an initial seed key based on the user name code and registration time; The initial seed key is iteratively updated according to the time period identifier.

4. The data encryption method for auxiliary traceability according to claim 1, characterized in that: The first encryption algorithm is the ChaCha20 encryption algorithm, and the second encryption algorithm is the AES-256 encryption algorithm.

5. The data encryption method for auxiliary traceability according to claim 4 is characterized in that: The embedding of the composite watermark identifier into the encrypted ciphertext specifically includes: replacing designated bits in a padding field with the composite watermark identifier.

6. The data encryption method for auxiliary traceability according to claim 2, characterized in that: The parsed time period identifier, user identity information and the corresponding semantic leaf specifically include: Separate the time period identifier from the composite watermark identifier, map it to the encryption policy change record, and determine the time window of the leaked data; Separate the initial seed key from the composite watermark identifier, determine the user name code and registration time, map them to the interactive platform user database, and identify the source user of the leak; Count the occurrence frequencies of different semantic leaves and generate the stealer's semantic leaf attention heat map.

7. The data encryption method for auxiliary traceability according to claim 1, characterized in that: The composite watermark identifier is embedded into the transmission protocol packet header for the mobile terminal interaction data, and the composite watermark identifier is implicitly written into the cookie or local cache index for the web page interaction data.

8. The data encryption method for auxiliary traceability according to claim 1, characterized in that: The type code of the semantic leaf is generated by a hash mapping method based on the semantic feature weight.

9. The data encryption method for auxiliary traceability according to claim 1, characterized in that: The screening of the sensitive keywords is performed using context sensitivity analysis based on natural language processing.

10. The data encryption method for auxiliary traceability according to claim 2, characterized in that: The traceability evidence chain further includes transmission path information of the stolen data, and the transmission path information is extracted through traffic analysis.

Images