File security access control method and device

Abstract

The invention discloses a file security access control method and device. The method comprises the following steps: acquiring a plurality of user historical access characteristic values; constructing a dynamic weighting function according to the plurality of user historical access characteristic values; determining a user permission according to the dynamic weighting function; encrypting the original file by adopting a hybrid encryption strategy to obtain a ciphertext, an encrypted session key and an integrity check value; if the user permission is readable and writable, the ciphertext, the encrypted session key and the integrity check value are sent to the client, and the client is used for decrypting the ciphertext according to the encrypted session key and the integrity check value to obtain an original file; if the user permission is read-only, after the original file is obtained through decryption processing, multi-layer watermark embedding processing is carried out on the original file, and a watermark embedded file is obtained. According to the invention, file security access control is realized, and system security and user experience are improved. The method can be widely applied to the technical field of file security.

Description

Technical Field

[0001] The present invention relates to the field of file security technology, and in particular to a file security access control method and device. Background Art

[0002] With the development of information technology, data plays an increasingly critical role in the daily operations of businesses, institutions, and individuals. As a crucial carrier of data, files face security challenges. Existing access control models are mostly based on static user permission settings, which struggle to dynamically detect user behavior and environmental changes. When a user's device is attacked by malicious actors or user behavior exhibits anomalies, static user permission settings can result in unauthorized users gaining high-privilege access to files, compromising system security. Alternatively, legitimate users may be unable to access files due to temporary device failures, resulting in a poor user experience.

[0003] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the Invention

[0004] The embodiments of the present invention provide a file security access control method and device, which effectively improve system security and user experience.

[0005] In one aspect, an embodiment of the present invention provides a method for controlling file security access, comprising the following steps:

[0006] Obtain several user historical access feature values;

[0007] Constructing a dynamic weight function based on the plurality of user historical access feature values;

[0008] Determining user permissions based on the dynamic weight function;

[0009] The original file is encrypted using a hybrid encryption strategy to obtain ciphertext, encryption session key and integrity check value;

[0010] If the user permission is read-write, the ciphertext, the encryption session key, and the integrity check value are sent to the client, and the client is configured to decrypt the ciphertext according to the encryption session key and the integrity check value to obtain the original file;

[0011] If the user permission is read-only, the ciphertext, the encrypted session key and the integrity check value are sent to the client, and the client is used to decrypt the ciphertext according to the encrypted session key and the integrity check value to obtain the original file, and perform multi-layer watermark embedding on the original file to obtain a watermark-embedded file.

[0012] In some embodiments, constructing a dynamic weight function based on the plurality of user historical access feature values ​​includes:

[0013] Calculating a characteristic value impact factor based on the plurality of user historical access characteristic values ​​and the user set;

[0014] Calculate the file structure complexity impact factor based on the file structure complexity, the preset file structure complexity maximum value and the file structure complexity impact coefficient;

[0015] Calculate the user equipment hardware aging degree impact factor based on the user equipment hardware aging degree, the preset user equipment hardware aging degree maximum value, and the user equipment hardware aging degree impact coefficient;

[0016] Calculate the impact factor of file semantic complexity;

[0017] The dynamic weight function is constructed according to the feature value influencing factor, the file structure complexity influencing factor, the user device hardware aging degree influencing factor, the file semantic complexity influencing factor, the difference between the current access time and the previous access time and the total number of features.

[0018] In some embodiments, calculating the file semantic complexity impact factor includes:

[0019] The semantic complexity of a document is calculated based on lexical richness, sentence complexity, semantic relationship network complexity, semantic topic diversity, semantic reasoning chain length, and the degree of semantic and contextual dependence;

[0020] The file semantic complexity impact factor is calculated according to the file semantic complexity, a preset file semantic complexity maximum value and a file semantic complexity impact coefficient.

[0021] In some embodiments, determining user rights based on the dynamic weight function includes:

[0022] Calculating a user authority value based on the dynamic weight function and the plurality of user historical access feature values;

[0023] Calculate the biometric stability index based on the number of biometric collections, biometric values, and biometric mean values;

[0024] Calculate the network connection jitter rate based on the number of network connection jitter samples, the network connection jitter value, and the network connection jitter mean;

[0025] The user authority is determined according to the user authority value, the biometric stability index and the network connection jitter rate.

[0026] In some embodiments, determining the user authority based on the user authority value, the biometric stability indicator, and the network connection jitter rate includes:

[0027] If the user authority value, the biometric stability index, and the network connection jitter rate all meet preset requirements, determining that the user authority is readable and writable;

[0028] If one or both of the user authority value, the biometric stability index, and the network connection jitter rate meet preset requirements, determining that the user authority is read-only;

[0029] If the user authority value, the biometric stability index and the network connection jitter rate do not meet the preset requirements, the user authority is determined to be inaccessible.

[0030] In some embodiments, the hybrid encryption strategy is used to encrypt the original file to obtain the ciphertext, the encryption session key, and the integrity check value, including:

[0031] A key pair is generated using an algebraic geometry code cryptosystem, the key pair including a public key and a private key, and the private key is distributed to the user via a secure channel;

[0032] Generate a random initial session key;

[0033] Encrypting the original file using the initial session key according to the interleaved feedback mode to obtain the ciphertext;

[0034] encrypting the initial session key using the public key according to a multivariate public key cryptosystem to obtain the encrypted session key;

[0035] The integrity check value is calculated based on the ciphertext and the encrypted session key using a fractional hash method.

[0036] In some embodiments, decrypting the ciphertext according to the encryption session key and the integrity check value to obtain the original file includes:

[0037] Decrypting the encrypted session key using the private key to obtain the initial session key;

[0038] Calculating a check value to be compared using a fractional hash method based on the ciphertext and the encrypted session key;

[0039] If the check value to be compared is equal to the integrity check value, the ciphertext is decrypted using the initial session key to obtain the original file.

[0040] In some embodiments, performing multi-layer watermark embedding processing on the original file to obtain a watermark-embedded file includes:

[0041] The user identification watermark, access time watermark, file version watermark and biometric feature watermark are embedded into the original file to obtain the watermark embedded file.

[0042] On the other hand, an embodiment of the present invention provides a file security access control device, comprising:

[0043] The first module is used to obtain several user historical access feature values;

[0044] The second module is used to construct a dynamic weight function according to the plurality of user historical access feature values;

[0045] A third module is used to determine user permissions based on the dynamic weight function;

[0046] The fourth module is used to encrypt the original file using a hybrid encryption strategy to obtain a ciphertext, an encryption session key and an integrity check value;

[0047] A fifth module is configured to send the ciphertext, the encryption session key, and the integrity check value to a client if the user permission is read-write, and the client is configured to decrypt the ciphertext according to the encryption session key and the integrity check value to obtain the original file;

[0048] The sixth module is used to send the ciphertext, the encrypted session key and the integrity check value to the client if the user permission is read-only. The client is used to decrypt the ciphertext according to the encrypted session key and the integrity check value to obtain the original file, and perform multi-layer watermark embedding on the original file to obtain a watermark-embedded file.

[0049] In another aspect, an embodiment of the present invention provides a computer device, comprising:

[0050] at least one processor;

[0051] at least one memory for storing at least one program;

[0052] When the at least one program is executed by the at least one processor, the at least one processor implements the method.

[0053] On the other hand, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0054] The beneficial effects of the present invention are as follows:

[0055] The embodiment of the present invention first obtains several user historical access feature values, and then constructs a dynamic weight function based on the several user historical access feature values. According to the dynamic weight function, the user authority is determined, and then a hybrid encryption strategy is used to encrypt the original file to obtain a ciphertext, an encrypted session key and an integrity check value. If the user authority is readable and writable, the ciphertext, the encrypted session key and the integrity check value are sent to the client, so that the client decrypts the ciphertext according to the encrypted session key and the integrity check value to obtain the original file; if the user authority is read-only, after the original file is obtained through decryption, the original file is subjected to multi-layer watermark embedding processing to obtain a watermark-embedded file, so that file security access control can be achieved according to different user authorities, thereby improving system security and user experience.

[0056] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained through the structures particularly pointed out in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0058] Figure 1 This is a flowchart of a file security access control method according to an embodiment of the present invention;

[0059] Figure 2 This is a structural diagram of a file security access control device according to an embodiment of the present invention;

[0060] Figure 3 The figure is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are merely examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.

[0062] It will be understood that the terms "first", "second", etc. used in this application may be used herein to describe various concepts, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0063] The terms "at least one", "plurality", "each", "any", etc. used in this application include "at least one", "two" or more, "plurality" or "each", "any" or "any one", "each" or "any one" as used herein.

[0064] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0065] Before explaining the embodiments of the present application in detail, some of the nouns and terms involved in the embodiments of the present application are first explained. The nouns and terms involved in the embodiments of the present application are subject to the following explanations.

[0066] Public-key cryptography (also known as asymmetric cryptography) is an encryption technology based on mathematical functions. Its core relies on a pair of interrelated keys: a public key and a private key. The public key is used to encrypt data or verify signatures and can be shared publicly. The private key is used to decrypt data or generate signatures and must be kept strictly confidential. The sender encrypts data using the receiver's public key, which can only be decrypted using the receiver's private key. The receiver decrypts the data using their own private key, ensuring that only authorized parties can access the information.

[0067] In related technologies, with the rapid development of information technology, data plays an increasingly critical role in the daily operations of enterprises, institutions and individuals. As an important carrier of data, the security of files faces unprecedented challenges. In the current information environment, file security protection mainly focuses on encryption technology and access control technology. Most existing access control models are based on static user permission settings and lack dynamic perception of user behavior and environmental changes. For example, the role-based access control model simplifies permission management to a certain extent, but once the role is set, the user permission is relatively fixed and cannot be flexibly adjusted according to the user's real-time behavior (such as abnormally frequent access, abnormal access time, etc.) and device status (such as device aging, security vulnerabilities, etc.). When the user's device is attacked maliciously or the user's behavior is abnormal, the static permission setting may cause illegal users to obtain high-authority access to files, or legitimate users may be unable to access files normally due to temporary device failures, reducing the security of the system and user experience.

[0068] In view of this, the embodiment of the present invention first obtains several user historical access feature values, then constructs a dynamic weight function, determines the user authority, and then adopts a hybrid encryption strategy to encrypt the original file to obtain the ciphertext, encryption session key and integrity check value. If the user authority is readable and writable, the ciphertext, encryption session key and integrity check value are sent to the client, so that the client decrypts the ciphertext to obtain the original file; if the user authority is read-only, after the original file is obtained through decryption, the original file is subjected to multi-layer watermark embedding processing to obtain a watermark-embedded file, so that file security access control can be implemented according to different user authorities, thereby improving system security and user experience.

[0069] A file security access control method provided in an embodiment of the present application relates to the field of file security technology. A file security access control method provided in an embodiment of the present application can be applied to a terminal, can also be applied to a server, and can also be software running in a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, and a car terminal, etc., but is not limited to this; the server side can be configured as an independent physical server, or as a server cluster or distributed system composed of multiple physical servers, or as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application that implements a file security access control method, etc., but is not limited to the above forms.

[0070] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments in which tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0071] The following is a detailed explanation of the embodiments of the present application with reference to the accompanying drawings:

[0072] Figure 1 This is an optional flowchart of a file security access control method provided by an embodiment of the present application. Figure 1 The method may include but is not limited to steps S101 to S106.

[0073] Step S101: Obtain several user historical access feature values;

[0074] Step S102: construct a dynamic weight function based on several user historical access feature values;

[0075] Step S103: Determine user authority based on the dynamic weight function;

[0076] Step S104: encrypt the original file using a hybrid encryption strategy to obtain a ciphertext, an encryption session key, and an integrity check value;

[0077] Step S105: If the user permission is read and write, the ciphertext, encryption session key, and integrity check value are sent to the client. The client is used to decrypt the ciphertext based on the encryption session key and integrity check value to obtain the original file.

[0078] Step S106: If the user permission is read-only, the ciphertext, encryption session key and integrity check value are sent to the client. The client is used to decrypt the ciphertext according to the encryption session key and integrity check value to obtain the original file, and perform multi-layer watermark embedding on the original file to obtain a watermark-embedded file.

[0079] Steps S101 to S106 shown in the embodiment of the present application implement file security access control, improving system security and user experience.

[0080] In some embodiments, step S101 can obtain several user historical access feature values ​​from the user's historical access log. Other methods can also be used to obtain several user historical access feature values, without limitation. For example, various user feature information can be collected in an orderly manner, with each user feature corresponding to a user historical access feature value xU,i. User features cover a wide range of areas and can include behavioral features, identity features, and device features. Among behavioral features, a user's historical access frequency, i.e., the number of times a user accesses a file or system resource within a certain period of time, reflects the user's active use of the resource. Access intervals, such as the time difference between two consecutive user accesses, can be used to analyze user usage habits and patterns. Among identity features, user identification, such as user account type (regular user, administrator, etc.), typically corresponds to different permission levels. The department or organization to which the user belongs can be used to restrict cross-departmental resource access in enterprise or institutional environments. Among device features, the type of device used by the user (e.g., PC, mobile device, etc.), may present different security risks and usage requirements. The device's operating system version, as older operating system versions may have security vulnerabilities that affect access security.

[0081] In some embodiments, in step S102, a dynamic weight function is constructed based on a plurality of user historical access feature values, which may include but is not limited to the following steps:

[0082] Calculate the feature value impact factor based on several user historical access feature values ​​and user sets;

[0083] Calculate the file structure complexity impact factor based on the file structure complexity, the preset file structure complexity maximum value and the file structure complexity impact coefficient;

[0084] Calculate the user equipment hardware aging degree impact factor based on the user equipment hardware aging degree, the preset user equipment hardware aging degree maximum value, and the user equipment hardware aging degree impact coefficient;

[0085] Calculate the impact factor of file semantic complexity;

[0086] A dynamic weight function is constructed based on the feature value influencing factor, file structure complexity influencing factor, user device hardware aging influencing factor, file semantic complexity influencing factor, the difference between the current access time and the previous access time, and the total number of features.

[0087] In some embodiments, a characteristic value impact factor may be calculated based on several user historical access characteristic values ​​and a user set, wherein the calculation formula of the characteristic value impact factor is: Where, γ ij (xU,j) is the eigenvalue influencing factor, xU,j is the user's historical access eigenvalue, maxU′ is the maximum value of the j-th eigenvalue of all users in the user set, and U is the user set. It can be understood that j in the user's historical access eigenvalue is used to identify a specific historical access feature dimension (such as access frequency, access duration, etc.). At the same time, the system finds the maximum value of the j-th eigenvalue of all users in the user set U, that is, maxU′∈xU,j. This step is to establish a comparative benchmark to measure the performance level of the current user U relative to other users on this feature dimension. The eigenvalue influencing factor adjusts the weight according to the use of each eigenvalue xU,j. Different user eigenvalues ​​will make γ ij (xU,j) produces different values, which in turn affects the dynamic weight function. For example, if xU,j represents the user's historical access frequency, the higher the access frequency, the more likely γ ij The larger the value of (xU,j), the more influence the user has on the permission evaluation based on this feature. In this way, the system can adjust the weight of the user's specific behavior and attribute characteristics in the permission evaluation accordingly.

[0088] In the calculation process of the eigenvalue influencing factor, when xU,j>0, Calculate the eigenvalue impact factor. This part calculates the relative proportion of the feature value of user U in the user set, reflecting the degree of prominence of the user compared with other users in this feature dimension. This means that the better the user's relative performance in a certain feature ( The larger the value, the greater the eigenvalue influence factor. In subsequent scenarios involving permission evaluation, the influence of this feature on the calculation of user permission values ​​will be stronger. When xU,j≤0,γ ij (xU,j)=1 means that the user has no positive outstanding performance in this feature dimension, and its contribution to the feature value influence factor is the basic value 1, and it participates in the calculation of permission evaluation according to the conventional weight. In addition, the calculated feature value influence factor will participate in the dynamic weight function ω i In the calculation of , it works together with the influencing factors of file structure complexity, user device hardware aging degree, and file semantic complexity to comprehensively determine the weight of each user feature in the user permission evaluation under the current circumstances, thereby affecting the calculation of the user permission value and ultimately determining the user's access rights to resources such as files, thereby achieving refined management of user permissions.

[0089] Then, the file structure complexity impact factor is calculated based on the file structure complexity, the preset maximum file structure complexity value, and the file structure complexity impact coefficient. The calculation formula of the file structure complexity impact factor is: Where, δ i (S file ) is the influencing factor of file structure complexity, S file is the file structure complexity, S max is the maximum value of the preset file structure complexity, φ i is the influence coefficient of file structure complexity. It is understandable that file structure complexity can be measured by indicators such as the number of nested layers of data elements in the file and the number of associated relationships. file The larger the value), δ i (S file ) will change accordingly, thus reflecting the impact of file structure on user authority evaluation in the dynamic weight function. For example, a file with a complex structure may require a user with higher authority to access and process it, so the weight calculation will be adjusted accordingly. In the process of quantifying the complexity of the file structure, it is necessary to first determine the file structure complexity S file This is usually achieved by analyzing the number of nested layers, the number of associations, and the diversity of data types within the file. For example, for an XML file, the more nested layers of tags it has and the more complex the associations between tags, the more complex the file structure complexity S is. file The higher the value of S is, the higher the value of S is. For a database file, the relationship between tables and the nesting of fields will affect S file The value of .

[0090] In the process of calculating the file structure complexity influencing factor, the file structure complexity S is obtained. file Then, combined with the preset maximum file structure complexity S max and the coefficient φ associated with feature i i , calculated according to the calculation formula of the file structure complexity influencing factor. This part calculates the ratio of the current file structure complexity to the set maximum value, reflecting the relative degree of the file structure complexity within the entire possible range. Multiply by φ i Finally, according to different features i and actual needs, adjust the contribution of file structure complexity to the impact factor. For example, if feature i is closely related to the security of file operations, and the current application scenario is more concerned about the security risks caused by the complex file structure, a larger φ can be set. i The value makes the impact factor more obvious when the file structure complexity is high. Finally, add 1 to get the file structure complexity impact factor δ i (Sfile ). This ensures that even if the file structure complexity is 0, the impact factor has a basic value of 1, so that it can stably participate in subsequent calculations. Moreover, the calculated file structure complexity impact factor δ i (S file ) will participate in the dynamic weight function ω i In the calculation of , it works together with other influencing factors (such as the eigenvalue influencing factor, the user device hardware aging factor, the file semantic complexity influencing factor, etc.) to comprehensively determine the weight of each factor in the user permission evaluation, thereby affecting the calculation of the user permission value, and ultimately determining the user's access rights to resources such as files, thereby realizing refined permission management based on the complexity of the file structure.

[0091] Then, based on the user equipment hardware aging degree, the preset maximum user equipment hardware aging degree, and the user equipment hardware aging degree impact coefficient, the user equipment hardware aging degree impact factor is calculated. The calculation formula of the user equipment hardware aging degree impact factor is: Where, ε i (H device ) is the factor affecting the aging degree of user equipment hardware, H device H is the aging degree of the user's equipment hardware. max is the maximum value of the preset user equipment hardware aging degree, θ i is the influence coefficient of the user equipment hardware aging degree. It is understandable that the user equipment hardware aging degree can be quantified based on indicators such as the equipment usage time and the number of hardware failures. The higher the equipment aging degree (H device The larger the value, the more security risks or performance degradation the device may have. i (H device ) will adjust the weight according to this situation and consider the impact of device status on user operation security in the permission evaluation. For example, severely aged devices may limit the user's access rights to certain high-security files. In the process of determining the degree of device aging, it is necessary to determine the degree of aging of the user's device hardware H device This is usually done through a variety of methods to obtain relevant data. For example, based on the length of time the device has been used, the longer it has been used, the higher the degree of aging may be; counting the number of hardware failures, frequent failures indicate that the device is aging and may lead to unstable performance; detecting changes in the performance indicators of hardware components, such as a decrease in hard disk read and write speeds, an increase in memory error rates, etc., and combining this information to quantify the degree of hardware aging of the user's device H. device .

[0092] In the process of calculating the influencing factor of the user equipment hardware aging degree, it is known that the user equipment hardware aging degree H device , preset the maximum value of user equipment hardware aging degree H maxAnd the influence coefficient of user equipment hardware aging degree θ i , calculated according to the calculation formula of the influence factor of the user equipment hardware aging degree. The calculation is the ratio of the current device hardware aging degree to the set maximum value, reflecting the relative situation of the device aging degree within the entire possible range. Multiply by θ i Finally, according to different application scenarios and the degree of attention paid to equipment aging, the effect of the equipment hardware aging degree on the influencing factors is adjusted. i The larger the value, the more obvious the effect of device aging on reducing the impact factor, which means that the negative impact of device aging on user permissions is greater; on the contrary, θ i Small, the impact of equipment aging is relatively weak. Subtract the above product from 1 to get the user equipment hardware aging degree impact factor ε i (H device ). When the device aging degree is 0, the impact factor is 1, indicating that the device is in good condition and has no negative impact on the permission evaluation; as the device aging degree increases, the impact factor gradually decreases, reflecting the restrictive effect of device aging on user permissions. In addition, the calculated user device hardware aging degree impact factor ε i (H device ) will participate in the dynamic weight function ω i In the calculation of . It works together with the eigenvalue influencing factor, file structure complexity influencing factor, file semantic complexity influencing factor, etc. to comprehensively determine the weight of each factor in the user permission evaluation, which in turn affects the calculation of the user permission value and ultimately determines the user's access rights to resources such as files, realizing refined permission management combined with the degree of device hardware aging.

[0093] Finally, the file semantic complexity influencing factor is calculated. In the file semantic complexity analysis, starting from the vocabulary richness, the diversity and uniqueness of the vocabulary in the file are counted; the complexity of the semantic relationship network is deeply studied, and the logical association and mutual influence between semantics are analyzed. This multi-dimensional information collection and analysis provides a rich and accurate data foundation for subsequent permission evaluation. A dynamic weight function is constructed based on the feature value influencing factor, the file structure complexity influencing factor, the user device hardware aging influencing factor, the file semantic complexity influencing factor, the difference between the current access time and the previous access time, and the total number of features. The expression of the dynamic weight function is: Where, ω i is the dynamic weight function value, α i , β i are all constant parameters, Δt is the difference between the current access time and the previous access time, n is the total number of features, γ ij (xU,j) is the eigenvalue influencing factor, δ i (S file) is the file structure complexity influencing factor, ε i (H device ) is the factor affecting the aging degree of user equipment hardware, is the factor affecting the semantic complexity of the file. It is understandable that This part, as time goes by (Δt increases), The value of will gradually decrease (because the exponential part is negative), which means that the longer the time, the weaker the influence of this factor on the dynamic weight function. It reflects a time decay mechanism. For example, the importance of certain user operation characteristics in the current permission evaluation may decrease over time.

[0094] Furthermore, the dynamic weight function combines multiple factors in the form of a numerator and a denominator. The numerator reflects the contribution of the current user's situation under each factor to the weight, and the denominator normalizes all possible situations, so that the weight calculation of each factor is carried out within a unified system. The calculated dynamic weight function value ω i , will be combined with the user characteristic value xU,i, etc. when calculating the user permission value in the subsequent process to jointly determine the user's final permission, thereby achieving refined and dynamic management of user permissions.

[0095] In some embodiments, calculating the file semantic complexity impact factor includes:

[0096] The semantic complexity of a document is calculated based on lexical richness, sentence complexity, semantic relationship network complexity, semantic topic diversity, semantic reasoning chain length, and the degree of semantic and contextual dependence;

[0097] The file semantic complexity impact factor is calculated based on the file semantic complexity, the preset file semantic complexity maximum value and the file semantic complexity impact coefficient.

[0098] In some embodiments, the semantic complexity of a document can be calculated based on the vocabulary richness, sentence complexity, semantic relationship network complexity, semantic topic diversity, semantic reasoning chain length, and semantic and context dependency. The calculation formula for the semantic complexity of a document is: semantic =ρ1·V rich +ρ2·S comp +ρ3·R net +ρ4·T div +ρ5·L inf +ρ6·D ctx , where C semantic For V rich is the vocabulary richness, e comp is the statement complexity, R net is the complexity of the semantic relationship network, T divis the semantic topic diversity, L inf is the length of the semantic reasoning chain, D ctx is the degree of semantic and context dependence, ρ1, ρ2, ρ3, ρ4, ρ5, and ρ6 are all weight factors, which determine the relative importance of each semantic dimension in calculating the semantic complexity of the file.

[0099] It is understandable that the vocabulary richness can be measured by the number of unique words in the statistical document, the proportion of professional terms, and the vocabulary diversity index. rich For example, a scientific document that contains a large number of professional-domain-specific words and a wide variety of vocabulary has a relatively high lexical richness, while a simple everyday text has a low lexical richness. Sentence complexity S can be quantified based on the length of the sentence and the complexity of the grammatical structure. comp For example, the more long sentences contain multi-layer nested clauses and complex grammatical structures, the higher the sentence complexity; on the contrary, texts with simple subject-verb-object structures have lower sentence complexity. The logical association and reference relationship between semantics in the document can be analyzed to obtain the semantic relationship network complexity R net For example, the more complex the mutual references, causal relationships, and hierarchical relationships between concepts in a document, the higher the complexity of the semantic relationship network; for texts with simple and direct semantic relationships, the value of this dimension is low. The diversity of semantic topics involved in a document can be examined to obtain the semantic topic diversity T div If a document covers content from multiple different fields or topics, and the conversion and association between topics are relatively complex, the semantic topic diversity is high; for documents that only revolve around a single topic, this dimension value is low. With the help of technologies such as knowledge graphs, we can analyze the longest reasoning path length formed when the semantic information extracted from the document is reasoned in the knowledge graph, and obtain the semantic reasoning chain length L inf For documents that require deep semantic reasoning and knowledge association, such as the logical argumentation section in academic research papers, the length of the semantic reasoning chain is longer; while for simple declarative texts, the length of the reasoning chain is shorter. The degree of semantic and contextual dependence can be evaluated by analyzing the degree to which the semantics of words or sentences change in different contexts. ctx For example, some words have completely different meanings in different contexts. The more content in a document that is highly context-dependent in semantics, the higher the value of this dimension. Files with relatively independent semantics that do not depend on context have lower values ​​for this dimension.

[0100] Then, the file semantic complexity impact factor is calculated based on the file semantic complexity, the preset file semantic complexity maximum value, and the file semantic complexity impact coefficient. The calculation formula of the file semantic complexity impact factor is: Where, is the file semantic complexity factor, Cmax is the maximum value of the semantic complexity of the preset file, v i is the influence coefficient of document semantic complexity. It is understandable that document semantic complexity can be determined from multiple aspects such as vocabulary richness, sentence complexity, and semantic relationship network complexity. The more complex the document semantics (C semanic The larger the value), The dynamic weight function will change accordingly, reflecting the security requirements of the file semantics and the user's ability to understand and operate the file. For example, a highly professional and semantically complex file may only be accessible and operated by users with the corresponding knowledge and permissions. This access control is achieved through weight adjustment. In the process of quantifying semantic complexity, it is necessary to determine the file semantic complexity C. semantic This requires comprehensive evaluation of multiple factors. From a lexical perspective, we analyze lexical richness, counting the number of unique words and the proportion of professional terms in the document; we study sentence complexity, considering sentence length and the complexity of grammatical structure; and we analyze the complexity of semantic relationship networks, sorting out the logical associations and referential relationships between semantics. Through comprehensive analysis of these aspects, we can quantify the semantic complexity of the document, C. semantic Specific value of .

[0101] In the calculation process of the file semantic complexity influencing factor, it is known that the file semantic complexity C semantic , preset the maximum value of file semantic complexity C max And the file semantic complexity influence coefficient v i Then, the calculation is performed based on the calculation formula of the file semantic complexity impact factor. is the ratio of the current file's semantic complexity to the set maximum value, reflecting the relative degree of the file's semantic complexity in all possible situations. Multiply by v i Finally, according to different application scenarios and the degree of attention to semantic complexity, adjust the effect of file semantic complexity on the impact factor. i If v is larger, the semantic complexity of the file will have a more prominent effect on the impact factor, that is, the file with high semantic complexity will have more strict access restrictions during permission evaluation; i Small, the influence of semantic complexity is relatively weak. Add 1 to get the file semantic complexity impact factor When the file semantic complexity is 0, the impact factor is 1, indicating that the semantics are simple and have no additional impact on the permission evaluation; as the semantic complexity increases, the impact factor increases, reflecting the enhanced restriction on user permissions. Will participate in the dynamic weight function ω i. It works in synergy with the eigenvalue influencing factor, the file structure complexity influencing factor, the user device hardware aging influencing factor, and other factors to comprehensively determine the weight of each factor in the user permission evaluation, thereby affecting the calculation of the user permission value and ultimately determining the user's access rights to resources such as files, achieving refined permission management based on file semantic complexity.

[0102] In some embodiments, in step S103, determining the user authority according to the dynamic weight function may include but is not limited to the following steps:

[0103] Calculate user permission values ​​based on a dynamic weight function and several user historical access feature values;

[0104] Calculate the biometric stability index based on the number of biometric collections, biometric values, and biometric mean values;

[0105] Calculate the network connection jitter rate based on the number of network connection jitter samples, the network connection jitter value, and the network connection jitter mean;

[0106] Determine user permissions based on user permission value, biometric stability index and network connection jitter rate.

[0107] In some embodiments, the user authority value may be calculated based on a dynamic weight function and a number of user historical access feature values, wherein the calculation formula of the user authority value is: Where P(U) is the user permission value, n is the total number of features, ω i This is a dynamic weight function that takes into account multiple factors, including time, user characteristics, file structure complexity, user device hardware aging, and file semantic complexity. It reflects the importance of each user characteristic in the current context. xU,i is the i-th historical access characteristic value for user U. Each characteristic value is multiplied by its corresponding weight and then added together to obtain the user's permission value, which quantifies the user's overall level of permissions in the current system environment. This step is like assigning a score to the user's permissions, and the score reflects the user's current file permissions.

[0108] Then, the biometric stability index is calculated based on the number of biometric collection times, the biometric value, and the biometric mean. The calculation formula of the biometric stability index is: Where B(U) is the biometric stability index, N is the number of biometric collection times, b k is the biometric value collected for the kth time, is the mean of the biometric feature, U′ is an element in the set U, b k U′ is the kth biometric value associated with user U′, b -U′is the mean biometric value of user U′. The biometric stability index is calculated by calculating the difference between each collected biometric value and the mean, comparing it with the maximum difference of other users in the user set, and then averaging it. This index measures the consistency of a user's biometrics across multiple collections. A higher index value indicates a more stable biometric and a higher degree of trustworthiness in the user's identity.

[0109] Then, the network connection jitter rate is calculated based on the number of network connection jitter samples, the network connection jitter value, and the network connection jitter mean. The calculation formula for the network connection jitter rate is: Where J(U) is the network connection jitter rate, M is the number of network connection jitter samples, and j l is the network connection jitter value, The jitter rate is the average value of the network connection jitter. The average of the absolute deviations between each network connection jitter value and the average value is used to calculate the network connection jitter rate. This metric reflects the stability of the network connection. A lower jitter rate indicates a more stable network connection, which is more conducive to secure and stable file access operations. Finally, user permissions are determined based on the user permission value, the biometric stability indicator, and the network connection jitter rate.

[0110] In some embodiments, determining user authority based on the user authority value, the biometric stability indicator, and the network connection jitter rate includes:

[0111] If the user permission value, biometric stability index, and network connection jitter rate all meet the preset requirements, the user permission is determined to be read-write;

[0112] If one or both of the user permission value, biometric stability index, and network connection jitter rate meet preset requirements, the user permission is determined to be read-only;

[0113] If the user permission value, biometric stability index and network connection jitter rate do not meet the preset requirements, the user permission is determined to be inaccessible.

[0114] In some embodiments, the user's biometric stability index (such as the change in the similarity of each feature point match during fingerprint recognition) and the network connection jitter rate (real-time fluctuation of the network signal) and other information can be combined to perform detailed comparative reasoning with a pre-set permission threshold vector. The permission threshold corresponds to the access permission standard for files of different security levels. By comparing and judging whether the user's permission value meets the requirements of the corresponding file security level, the user's specific permissions to the file are determined, whether they have read and write permissions, or only read-only permissions, etc., to achieve accurate judgment and management of user permissions. The user permission value, biometric stability index and network connection jitter rate can be judged separately. If the user permission value, biometric stability index and network connection jitter rate all meet the preset requirements, for example, the user permission value P(U) is greater than or equal to the user permission threshold P(U) ′ , the biometric stability index B(U) is greater than or equal to the biometric stability threshold B min , the network connection jitter rate J(U) is less than or equal to the network connection jitter threshold J max , user U has read and write permissions to the file, and the user permissions are determined to be read-write. If one or both of the user permission value, biometric stability index, and network connection jitter rate meet the preset requirements, user U has read-only permission to the file, and the user permissions are determined to be read-only. If none of the user permission value, biometric stability index, and network connection jitter rate meet the preset requirements, user U has no access to the file, and the user permissions are determined to be inaccessible. Access to the file is prohibited, ensuring file security.

[0115] In some embodiments, in step S104, a hybrid encryption strategy is used to encrypt the original file to obtain a ciphertext, an encrypted session key, and an integrity check value, which may include but is not limited to the following steps:

[0116] The algebraic geometry code cryptography system is used to generate a key pair, which includes a public key and a private key. The private key is distributed to the user through a secure channel.

[0117] Generate a random initial session key;

[0118] According to the interleaved feedback mode, the original file is encrypted using the initial session key to obtain the ciphertext;

[0119] According to the multivariate public key cryptosystem, the initial session key is encrypted using the public key to obtain the encrypted session key;

[0120] The integrity check value is calculated using the fractional hash method based on the ciphertext and the encrypted session key.

[0121] In some embodiments, a novel algebraic geometry code cryptosystem can be used to generate a key pair, consisting of a public key and a private key. The private key can be distributed to users via a secure channel. It is understood that the unique mathematical properties of a specific genus algebraic curve are used to generate a pair of interrelated keys: one for encryption (public key) and one for decryption (private key). This key pair acts like a "key mold" for file encryption, laying the foundation for security for subsequent encryption operations. A random initial session key is then generated. This session key acts like a temporary "encryption lock," its randomness ensuring the uniqueness and security of each encryption. The initial session key is then used to encrypt the original file using an interleaved feedback scheme to produce ciphertext. For example, the interleaved feedback mode (CFB) of the Advanced Encryption Standard (AES) can be used to encrypt the original file. By feeding the results of the previous encryption block back into the current encryption process, encryption security and data confidentiality are further enhanced. Converting the original file to ciphertext provides preliminary encryption protection for the file content, like giving the file an invisible "encryption shield."

[0122] Because the session key is a critical intermediate link in file encryption and decryption, leaking the session key can potentially compromise the ciphertext. To further ensure the security of the session key, a multivariate public key cryptosystem can be used to encrypt the initial session key using the public key to obtain the encrypted session key. For example, the initial session key can be concatenated with a random padding string to increase its complexity and confidentiality. This random padding string is then encrypted using a multivariate public key cryptosystem to obtain the encrypted session key. Multivariate public key cryptosystems are based on hyperelliptic curve multivariate equations. Through complex nonlinear operations between multiple variables, the encrypted session key becomes extremely difficult to decrypt. Finally, an integrity check value is calculated based on the ciphertext and the encrypted session key using a fractal hashing method. For example, a fractal hashing method can be used to partition the ciphertext and the encrypted session key according to fractal rules and generate a unique integrity check value. This integrity check value acts as a "digital fingerprint" of the file's encryption status, used to verify whether the file has been tampered with during storage and transmission. Furthermore, ciphertext, encrypted session keys, and integrity check values ​​can be stored or transmitted together. This layer-by-layer encryption and strict verification ensures high file security throughout the entire transfer process.

[0123] In some embodiments, in step S105, decrypting the ciphertext according to the encryption session key and the integrity check value to obtain the original file may include but is not limited to the following steps:

[0124] Decrypt the encrypted session key using the private key to obtain the initial session key;

[0125] According to the ciphertext and the encrypted session key, the check value to be compared is calculated using the fractional hash method;

[0126] If the check value to be compared is equal to the integrity check value, the ciphertext is decrypted using the initial session key to obtain the original file.

[0127] In some embodiments, when a user requests file access, the access control matrix can first be used to verify user permissions. The access control matrix acts like a permissions "database," recording each user's access rights to different file resources. If the user's permissions are verified, the system obtains the encrypted session key, integrity check value, and ciphertext. The encrypted session key is then decrypted using the private key to obtain the initial session key. For example, the encrypted session key can be decrypted using the user's multivariate private key, which corresponds to the multivariate public key used for encryption. A specific mathematical inverse operation is performed to extract the initial session key. This step is like unlocking the encrypted session key with the correct "key," preparing the way for subsequent file decryption. A fractal hashing algorithm is then used to calculate a check value to be compared based on the ciphertext and the encrypted session key. If the check value to be compared and the integrity check value are equal, the ciphertext is decrypted using the initial session key to obtain the original file. For example, a fractal hashing algorithm can be performed on the encrypted ciphertext and the encrypted session key to generate the check value to be compared. The fractal hashing algorithm then performs a further calculation on the ciphertext according to fractal rules to obtain the check value to be compared. This recalculated checksum is then precisely compared with the pre-stored integrity checksum, much like comparing two "digital fingerprints" for consistency. If they match, the file has not been tampered with during storage or transmission. The ciphertext can then be decrypted using the initial session key, and the inverse of the AES algorithm is used to restore the ciphertext to its original form for user access.

[0128] In some embodiments, in step S106, performing multi-layer watermark embedding processing on the original file to obtain a watermark embedded file may include but is not limited to the following steps:

[0129] The user identification watermark, access time watermark, file version watermark and biometric watermark are embedded into the original file to obtain a watermark-embedded file.

[0130] In some embodiments, when the user permission is read-only, the system can perform multi-layer watermark embedding processing after decrypting the original file. The user identification watermark, access time watermark, file version watermark and biometric watermark can be embedded into the original file to obtain a watermark-embedded file. It is understandable that embedding the user identification watermark into the file in a secret and imperceptible way will not have any impact on the normal use and content display of the file, but the user identification information can be accurately extracted when it is necessary to trace it back, and the access time watermark can be accurately recorded in the file with the high security and accuracy of quantum key distribution. Quantum key distribution uses the characteristics of quantum states to transmit keys, ensuring the security and accuracy of watermark embedding, just like giving the access time of the file an unalterable "timestamp". The unique properties of fractal geometry enable watermarks to be evenly and stably distributed in the file, clearly identifying the file version information and preventing the file version from being confused or tampered with.

[0131] In some embodiments, this embodiment comprehensively considers factors such as file structure complexity, user device aging, and file semantic complexity to generate a dynamic weighting function to calculate user permissions. This combines multi-dimensional information such as biometric stability indicators and network connection jitter rates to determine access rights, enabling refined assessment and management of user permissions. This allows for more precise matching of user access relationships with file resources, effectively preventing unauthorized access, and improving system security and rational resource management.

[0132] The beneficial effects of implementing the embodiments of the present invention include: the embodiments of the present invention first obtain several user historical access feature values, then construct a dynamic weight function based on the several user historical access feature values, determine the user authority based on the dynamic weight function, and then use a hybrid encryption strategy to encrypt the original file to obtain the ciphertext, encryption session key and integrity check value. If the user authority is readable and writable, the ciphertext, encryption session key and integrity check value are sent to the client, so that the client decrypts the ciphertext according to the encryption session key and integrity check value to obtain the original file; if the user authority is read-only, after the original file is obtained through decryption, the original file is subjected to multi-layer watermark embedding processing to obtain a watermark-embedded file, thereby enabling file security access control to be implemented according to different user authorities, thereby improving system security and user experience.

[0133] like Figure 2 As shown, an embodiment of the present invention further provides a file security access control device, comprising:

[0134] The first module 801 is used to obtain several user historical access feature values;

[0135] The second module 802 is used to construct a dynamic weight function based on a number of user historical access feature values;

[0136] The third module 803 is used to determine user permissions based on the dynamic weight function;

[0137] The fourth module 804 is configured to encrypt the original file using a hybrid encryption strategy to obtain a ciphertext, an encryption session key, and an integrity check value;

[0138] The fifth module 805 is configured to send the ciphertext, the encryption session key, and the integrity check value to the client if the user has read and write permissions. The client is configured to decrypt the ciphertext based on the encryption session key and the integrity check value to obtain the original file.

[0139] The sixth module 806 is used to send the ciphertext, encryption session key and integrity check value to the client if the user permission is read-only. The client is used to decrypt the ciphertext according to the encryption session key and integrity check value to obtain the original file, and perform multi-layer watermark embedding on the original file to obtain a watermark-embedded file.

[0140] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0141] like Figure 3 As shown, an embodiment of the present invention further provides a computer device, including:

[0142] at least one processor 901;

[0143] At least one memory 902, configured to store at least one program;

[0144] When at least one program is executed by at least one processor, the at least one processor implements Figure 1 The method shown.

[0145] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0146] The embodiment of the present invention further provides a computer-readable storage medium, which stores a computer program, which is executed by a processor to implement Figure 1 The method shown.

[0147] The contents of the above method embodiments are all applicable to the present storage medium embodiment. The functions specifically implemented by the present storage medium embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0148] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A file security access control method, characterized in that: The following steps are involved: Obtain several user historical access feature values; Constructing a dynamic weight function based on the plurality of user historical access feature values; Determining user permissions based on the dynamic weight function; The original file is encrypted using a hybrid encryption strategy to obtain ciphertext, encryption session key and integrity check value; If the user permission is read-write, the ciphertext, the encryption session key, and the integrity check value are sent to the client, and the client is configured to decrypt the ciphertext according to the encryption session key and the integrity check value to obtain the original file; If the user permission is read-only, the ciphertext, the encrypted session key and the integrity check value are sent to the client, and the client is used to decrypt the ciphertext according to the encrypted session key and the integrity check value to obtain the original file, and perform multi-layer watermark embedding on the original file to obtain a watermark-embedded file.

2. The method according to claim 1, characterized in that The step of constructing a dynamic weight function based on the plurality of user historical access feature values ​​includes: Calculating a characteristic value impact factor based on the plurality of user historical access characteristic values ​​and the user set; Calculate the file structure complexity impact factor based on the file structure complexity, the preset file structure complexity maximum value and the file structure complexity impact coefficient; Calculate the user equipment hardware aging degree impact factor based on the user equipment hardware aging degree, the preset user equipment hardware aging degree maximum value, and the user equipment hardware aging degree impact coefficient; Calculate the impact factor of file semantic complexity; The dynamic weight function is constructed according to the feature value influencing factor, the file structure complexity influencing factor, the user device hardware aging degree influencing factor, the file semantic complexity influencing factor, the difference between the current access time and the previous access time and the total number of features.

3. The method according to claim 2, characterized in that The calculation of the file semantic complexity impact factor includes: The semantic complexity of a document is calculated based on lexical richness, sentence complexity, semantic relationship network complexity, semantic topic diversity, semantic reasoning chain length, and the degree of semantic and contextual dependence; The file semantic complexity impact factor is calculated according to the file semantic complexity, a preset file semantic complexity maximum value and a file semantic complexity impact coefficient.

4. The method according to claim 1, wherein Determining user rights according to the dynamic weight function includes: Calculating a user authority value based on the dynamic weight function and the plurality of user historical access feature values; Calculate the biometric stability index based on the number of biometric collections, biometric values, and biometric mean values; Calculate the network connection jitter rate based on the number of network connection jitter samples, the network connection jitter value, and the network connection jitter mean; The user authority is determined according to the user authority value, the biometric stability index and the network connection jitter rate.

5. The method according to claim 4, characterized in that The determining the user authority according to the user authority value, the biometric stability index, and the network connection jitter rate includes: If the user authority value, the biometric stability index, and the network connection jitter rate all meet preset requirements, determining that the user authority is readable and writable; If one or both of the user authority value, the biometric stability index, and the network connection jitter rate meet preset requirements, determining that the user authority is read-only; If the user authority value, the biometric stability index and the network connection jitter rate do not meet the preset requirements, the user authority is determined to be inaccessible.

6. The method according to claim 1, characterized in that The hybrid encryption strategy is used to encrypt the original file to obtain the ciphertext, encryption session key and integrity check value, including: A key pair is generated using an algebraic geometry code cryptosystem, the key pair including a public key and a private key, and the private key is distributed to the user via a secure channel; Generate a random initial session key; Encrypting the original file using the initial session key according to the interleaved feedback mode to obtain the ciphertext; encrypting the initial session key using the public key according to a multivariate public key cryptosystem to obtain the encrypted session key; The integrity check value is calculated based on the ciphertext and the encrypted session key using a fractional hash method.

7. The method according to claim 6, characterized in that The decrypting the ciphertext according to the encryption session key and the integrity check value to obtain the original file includes: Decrypting the encrypted session key using the private key to obtain the initial session key; Calculating a check value to be compared using a fractional hash method based on the ciphertext and the encrypted session key; If the check value to be compared is equal to the integrity check value, the ciphertext is decrypted using the initial session key to obtain the original file.

8. The method according to claim 1, characterized in that The performing multi-layer watermark embedding processing on the original file to obtain a watermark embedded file includes: The user identification watermark, access time watermark, file version watermark and biometric feature watermark are embedded into the original file to obtain the watermark embedded file.

9. A file security access control device, characterized in that: include: The first module is used to obtain several user historical access feature values; The second module is used to construct a dynamic weight function according to the plurality of user historical access feature values; A third module is used to determine user permissions based on the dynamic weight function; The fourth module is used to encrypt the original file using a hybrid encryption strategy to obtain a ciphertext, an encryption session key and an integrity check value; A fifth module is configured to send the ciphertext, the encryption session key, and the integrity check value to a client if the user permission is read-write, and the client is configured to decrypt the ciphertext according to the encryption session key and the integrity check value to obtain the original file; The sixth module is used to send the ciphertext, the encrypted session key and the integrity check value to the client if the user permission is read-only. The client is used to decrypt the ciphertext according to the encrypted session key and the integrity check value to obtain the original file, and perform multi-layer watermark embedding on the original file to obtain a watermark-embedded file.

10. A computer device, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 8.

Images