Data security storage method and system of an electronic photo frame

Abstract

The application relates to the technical field of electronic photo frames, and discloses a data security storage method and system of an electronic photo frame. The method comprises the following steps: obtaining metadata information and a preliminary attribute data set of an original image file; performing feature extraction and partition judgment according to the preliminary attribute data set to obtain a sensitive category identifier; when the sensitive category identifier is a sensitive partition, performing segmentation to obtain a data block unit; encrypting the data block unit, adding an embedding preparation mark, and obtaining an encrypted data block unit; obtaining an embedding target, and corresponding the encrypted data block unit to the embedding target one by one to obtain an embedding carrier file; adjusting a file directory structure according to the embedding carrier file, generating a file directory after directory level randomization, and storing the embedding carrier file to the file directory. The method can realize dynamic dispersion and embedding of high-sensitive photo data blocks into a common file structure, and ensures the integrity and untraceability of the embedding process.

Description

Technical Field

[0001] This invention relates to the field of electronic photo frame technology, and in particular to a method and system for secure data storage in electronic photo frames. Background Technology

[0002] Currently, digital photo frames are an important tool for recording and displaying photos in family and personal life. Their data security storage is receiving increasing attention. With the growing demand for privacy protection, ensuring that photo data is not illegally obtained or misused during storage and display has become an important issue in the field of digital storage.

[0003] Current technologies typically encrypt the photo file itself, neglecting the protection of metadata. While existing technologies are relatively mature in encrypting photo file content, metadata processing is often limited to simple stripping. Attackers can still infer a user's lifestyle from incompletely cleaned metadata (such as latitude and longitude, and shooting time), leading to privacy breaches. Furthermore, existing classification and storage systems often operate independently, lacking dynamic hiding and disguise mechanisms for sensitive data.

[0004] Existing technologies suffer from insufficient metadata protection and a lack of dynamic hiding and disguise mechanisms for sensitive data. Summary of the Invention

[0005] This invention provides a data security storage method and system for electronic photo frames, which embeds encrypted data blocks into ordinary image files, thereby achieving effective hiding and tracking protection of sensitive images.

[0006] In a first aspect, to solve the above-mentioned technical problems, the present invention provides a method for secure data storage in an electronic photo frame, comprising:

[0007] The metadata information of the original image file is obtained, and the metadata information is decomposed into a structure using a parsing module to obtain a preliminary attribute dataset.

[0008] Based on the preliminary attribute dataset, features are extracted for shooting time and location information, and a pre-established classification model is used to determine the partitions and obtain sensitive category identifiers.

[0009] When the sensitive category is identified as a sensitive partition, the hiding module is triggered to assign a high priority weight value to the original image file and perform segmentation to obtain data block units;

[0010] The data block unit is encrypted using a lightweight encryption algorithm, and an embedding preparation marker is added to obtain the encrypted data block unit;

[0011] Non-sensitive image files are obtained from a preset image carrier library as embedding targets. The encrypted data block units are mapped one by one to the embedding targets using mapping technology to obtain the embedding carrier file.

[0012] Based on the embedded carrier file, the file directory structure is adjusted, the adjusted storage path is hashed and renamed, a file directory with randomized directory hierarchy is generated, and the embedded carrier file is stored in the file directory with randomized directory hierarchy.

[0013] Preferably, based on the preliminary attribute dataset, feature extraction is performed on the shooting time and location information, and a pre-established classification model is used for partitioning and judgment to obtain sensitive category identifiers, including:

[0014] Based on the preliminary attribute dataset, a pre-built random forest model is used for classification analysis to extract detailed information from images that meet the sensitive category features, and a second verification is performed to obtain the results after the second verification.

[0015] Based on the results of the secondary verification, the category label information of the image is obtained, and a sensitive category identifier is generated.

[0016] Preferably, when the sensitive category is identified as a sensitive partition, the hiding module is triggered to assign a high-priority weight value to the original image file and perform segmentation to obtain data block units, including:

[0017] When a sensitive category is identified as a sensitive partition, the hiding module is activated to perform a priority marking operation on the original image file to obtain an image file with a high priority weight value.

[0018] Based on the image file with the high priority weight value, extract its original data content, and divide the original data content according to the decomposition rules to obtain data block units.

[0019] Preferably, the data block unit is encrypted using a lightweight encryption algorithm, and an embedding preparation marker is added to obtain the encrypted data block unit, including:

[0020] The data block unit is encrypted block by block using the AES lightweight encryption algorithm to generate a preliminary encrypted data block unit;

[0021] A unique location identifier is created for the initial encrypted data block unit using a location index generator, and an embedding preparation tag mapping table is obtained.

[0022] The data integrity verification module performs hash calculation on the embedded preparation tag mapping table to generate a verification code.

[0023] Once the verification code passes, the initial encrypted data block unit is bound to the corresponding embedding preparation tag to obtain the encrypted data block unit.

[0024] Preferably, the step of obtaining non-sensitive image files from a preset image carrier library as embedding targets, and using mapping technology to map each encrypted data block unit to the embedding target to obtain the embedding carrier file includes:

[0025] Obtain non-sensitive image files from a pre-defined image carrier library and identify them as initial embedding targets;

[0026] Based on the image characteristics of the initial embedding target, a region segmentation method is used to identify non-critical regions in the image, and the lowest pixel bit of the non-critical regions is selected to obtain the embedding target.

[0027] Based on the encrypted data block unit, it is split into smaller data block units, and a mapping technique is used to map each of the smaller data block units to the embedding target to obtain the embedding carrier file.

[0028] Preferably, based on the embedded carrier file, the file directory structure is adjusted, the adjusted storage path is hashed and renamed to generate a file directory with randomized directory hierarchy, and the embedded carrier file is stored in the file directory with randomized directory hierarchy, including:

[0029] The initial file directory of the embedded carrier is scanned to obtain the storage paths and hierarchical relationships of all files, and the mapping data of the original directory structure is obtained.

[0030] Based on the mapping data of the original directory structure, a random path generation algorithm is used to reorganize the directory hierarchy to obtain the adjusted path distribution;

[0031] Based on the adjusted path distribution, each storage path is encrypted using hash renaming technology to obtain the encrypted path name;

[0032] Based on the encrypted path name, a new directory hierarchy is constructed, forming a randomized file storage structure, and a file directory with a randomized directory hierarchy is generated.

[0033] The embedded carrier file is stored in a directory with randomized directory hierarchy.

[0034] Preferably, after generating the file directory with randomized directory hierarchy, the method further includes:

[0035] Based on the file directory after the directory hierarchy is randomized, the location information of the encrypted data block unit is obtained. The location information of the encrypted data block unit is compared with the path verification mechanism to determine whether it conforms to the preset distribution rules, and the embedding location compliance judgment result is obtained.

[0036] If the embedding location compliance judgment result does not meet the preset distribution rules, then non-sensitive image files are retrieved from the preset image carrier library again, and the embedding operation of the encrypted data block unit and the path naming encryption process are repeated until the preset distribution rules are met.

[0037] When the embedded location compliance judgment result is determined to meet the preset distribution rules, the location information passes the path verification mechanism.

[0038] Preferably, after storing the embedded carrier file in a directory with randomized directory hierarchy, the method further includes:

[0039] Based on the randomized file directory of the directory hierarchy, a processing log is generated and written to a preset database. Access restrictions are used to set permissions for the obfuscated paths to achieve privacy protection.

[0040] Secondly, the present invention provides a data security storage system for an electronic photo frame, comprising:

[0041] The data acquisition module is used to acquire metadata information from the original image files. The parsing module performs structured decomposition on the metadata information to obtain a preliminary attribute dataset.

[0042] The sensitive identification module is used to extract features based on the shooting time and location information according to the preliminary attribute dataset, and to perform partition judgment using a pre-established classification model to obtain sensitive category identifiers;

[0043] The segmentation module is used to trigger the hiding module to assign a high priority weight value to the original image file and segment it to obtain data block units when the sensitive category is identified as a sensitive partition.

[0044] The binding module is used to encrypt the data block unit using a lightweight encryption algorithm, add an embedding preparation marker, and obtain the encrypted data block unit.

[0045] The data embedding module is used to obtain non-sensitive image files from a preset image carrier library as embedding targets, and to use mapping technology to map the encrypted data block units one by one to the embedding targets to obtain the embedding carrier file;

[0046] The data storage module is used to adjust the file directory structure according to the embedded carrier file, perform hash renaming on the adjusted storage path, generate a file directory with randomized directory hierarchy, and store the embedded carrier file in the file directory with randomized directory hierarchy.

[0047] As an optional implementation, in a second aspect of the present invention, the binding module specifically includes:

[0048] An embedding preparation unit is used to create a unique location identifier for the initial encrypted data block unit through a location index generator, and obtain an embedding preparation mark mapping table.

[0049] The verification unit is used to perform hash calculation on the embedded preparation tag mapping table using the data integrity verification module to generate a verification code.

[0050] The binding unit is used to bind the initial encrypted data block unit with the corresponding embedding preparation mark when the verification code passes, so as to obtain the encrypted data block unit.

[0051] Thirdly, the present invention also provides a terminal, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the data security storage method for the electronic photo frame described in any one of the above.

[0052] Fourthly, the present invention also provides a computer-readable storage medium comprising a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the data security storage method for the electronic photo frame described in any one of the above.

[0053] Compared with the prior art, the present invention has the following beneficial effects:

[0054] This invention provides a secure data storage method for electronic photo frames, comprising: acquiring metadata information of the original image file; performing structured decomposition of the metadata information using a parsing module to obtain a preliminary attribute dataset; extracting features based on the shooting time and location information using the preliminary attribute dataset; performing partitioning judgment using a pre-established classification model to obtain sensitive category identifiers; when the sensitive category identifier is a sensitive partition, triggering a hiding module to assign a high priority weight value to the original image file and segmenting it to obtain data block units; encrypting the data block units using a lightweight encryption algorithm and adding an embedding preparation marker to obtain encrypted data block units; acquiring non-sensitive image files from a preset image carrier library as embedding targets; using mapping technology to map the encrypted data block units one by one to the embedding targets to obtain an embedding carrier file; adjusting the file directory structure according to the embedding carrier file; hashing and renaming the adjusted storage path to generate a file directory with randomized directory hierarchy; and storing the embedding carrier file in the file directory with randomized directory hierarchy.

[0055] This invention divides sensitive image files into multiple data blocks, encrypts them, and then embeds the encrypted data blocks into ordinary image files, thereby achieving effective hiding and tracking protection of sensitive images. Attached Figure Description

[0056] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 This is a flowchart illustrating a data security storage method for an electronic photo frame disclosed in an embodiment of the present invention;

[0058] Figure 2 This is a schematic diagram of the structure of a data security storage system for an electronic photo frame disclosed in an embodiment of the present invention;

[0059] Figure 3 This is a schematic diagram of the binding module of a data security storage system for an electronic photo frame disclosed in an embodiment of the invention;

[0060] Figure 4 This is a schematic diagram of the structure of a data security storage terminal for an electronic photo frame disclosed in an embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of a computer storage medium disclosed in an embodiment of the present invention. Detailed Implementation

[0061] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0062] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or end that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or ends.

[0063] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0064] Example 1

[0065] Please see Figure 1 , Figure 1 This is a flowchart illustrating a data security storage method for an electronic photo frame disclosed in an embodiment of the present invention. Figure 1 As shown, the data security storage method for this electronic photo frame may include the following operations:

[0066] S11: Obtain the metadata information of the original image file, and use the parsing module to perform structured decomposition of the metadata information to obtain a preliminary attribute dataset.

[0067] In step S11, the image file reading interface scans the photo files in the storage device to obtain the complete path and basic file information of each file. Based on the file format type, if the file format is JPEG or TIFF, the EXIF ​​data extraction tool is called to read the metadata information. The metadata parsing module is used to identify fields in the extracted EXIF ​​information to obtain a preliminary attribute dataset including the shooting timestamp, GPS coordinates, device model, and camera parameters.

[0068] In practice, the system first calls the operating system's underlying API functions through the file input / output interface to open the target JPEG image file in binary read mode. It then processes 4096-byte data blocks at a time using a buffer block reading mechanism, locating the EXIF ​​data segment at the beginning of the file during this process. Subsequently, the parsing module uses a byte order detection algorithm to determine whether the data storage format is big-endian or little-endian by reading the first two bytes (0x4D4D or 0x4949). It then extracts the GPS coordinate information, converting the latitude and longitude in degrees, minutes, and seconds format to decimal format (e.g., 39°54′26.657″N to 39.907404°, 116°23′37.808″E to 116.393835°). Simultaneously, it uses an ISO8601 standard format recognition algorithm to convert the shooting time in the format "2023:10:15 14:32:18" to Unix format. With timestamp 1697356338, a preliminary attribute dataset containing shooting timestamp, GPS coordinates, device model, and camera parameters was finally obtained.

[0069] S12, Based on the preliminary attribute dataset, feature extraction is performed on the shooting time and location information, and a pre-established classification model is used to perform partitioning judgment to obtain sensitive category identifiers.

[0070] In step S12, the shooting time and location features are extracted from the preliminary attribute dataset to construct an initial feature set, resulting in pre-processed feature data. Based on the pre-processed feature data, a pre-built random forest model is used to classify and analyze the features, selecting images that meet the sensitive category features. Then, detailed information is extracted from the images and combined with location features for secondary verification. Based on the results, category labels and sensitive category identifiers are generated to determine the sensitive region to which the image belongs.

[0071] In an optional embodiment, based on the preliminary attribute dataset, features are extracted for shooting time and location information, and a pre-established classification model is used for partitioning to obtain sensitive category identifiers, including:

[0072] Based on the preliminary attribute dataset, a pre-built random forest model is used for classification analysis to extract detailed information from images that meet the sensitive category features, and a second verification is performed to obtain the results after the second verification.

[0073] Based on the results of the secondary verification, the category label information of the image is obtained, and a sensitive category identifier is generated.

[0074] First, for feature extraction of shooting time and location information, based on the preliminary attribute dataset obtained in step S11, time and location features are extracted to construct an initial feature set. This feature set is then input into a pre-trained random forest model. The model learns the correlation between "time-location" and sensitive areas in historical data (e.g., children's areas are mostly around schools, and sensitive areas are mostly specific scenic spots), performs classification analysis on the original image, and outputs the probability that the original image belongs to "children-related" or "sensitive area".

[0075] For images that the model determines meet the characteristics of sensitive categories (such as those with a probability exceeding a threshold), further detailed information is extracted. For example, the image content is combined to identify whether there are children or whether it contains landmark buildings of the scenic area. The image is then combined with its location characteristics (such as whether the GPS coordinates fall within the known child protection area or sensitive tourist area database) for secondary verification to eliminate model misjudgments (such as images that are only geographically close but actually unrelated).

[0076] After the secondary verification is passed, clear category labels (such as "children's area" and "sensitive tourist area") are generated based on the results, and corresponding sensitivity category labels (such as "children sensitive" and "tourism sensitive") are generated accordingly.

[0077] S13, when the sensitive category is identified as a sensitive partition, the hiding module is triggered to assign a high priority weight value to the original image file and perform segmentation to obtain data block units.

[0078] After detecting sensitive category identifiers in the original image file, if it is a sensitive partition, the subsequent processing flow is triggered. The hiding module is activated to perform a priority marking operation on the original image file, assigning a high priority weight value. Then, the original data of the high-priority image is extracted, and its data integrity is judged. If the data integrity meets the preset threshold, the original data content is segmented according to the decomposition rules to generate multiple data block units.

[0079] In an optional embodiment, if the sensitive category is identified as a sensitive partition, the hiding module is triggered to assign a high-priority weight value to the original image file and perform segmentation to obtain data block units, including:

[0080] When a sensitive category is identified as a sensitive partition, the hiding module is activated to perform a priority marking operation on the original image file to obtain an image file with a high priority weight value.

[0081] Based on the image file with the high priority weight value, extract its original data content, and divide the original data content according to the decomposition rules to obtain data block units.

[0082] When the original image file is identified as belonging to a sensitive category (such as "children-sensitive" or "travel-sensitive"), the system automatically activates the hidden module. This module assigns a high-priority weight value (e.g., 9.5, significantly higher than the weight of 5.0 or less for ordinary files) to the image file by calling a preset priority marking function, and writes this weight into the file's metadata. This operation ensures that the image is prioritized in subsequent processing flows (such as data extraction and storage), avoiding delays in processing sensitive content.

[0083] The system extracts the complete original data content of the image (e.g., 2.5MB of JPEG image binary data) and verifies the data integrity using a hash algorithm (e.g., MD5) to ensure that the data is not corrupted or tampered with. After successful verification, the original data is divided into multiple independent data block units (e.g., 10 units, named Block_001 to Block_010) according to preset decomposition rules (e.g., each 256KB unit). Each unit is appended with a unique identifier to record the order and association relationship.

[0084] It should be noted that hash algorithms (such as MD5) are cryptographic hash functions that convert input data of arbitrary length into a fixed-length output. In data processing, they are mainly used for verifying data integrity and preventing tampering. In this application, the input is the original data content of the image file to be processed, and the output is a 32-bit hexadecimal hash value. By comparing this hash value with the "original hash value" of the image file pre-stored in the system (e.g., generated and recorded when the file is created), if they match, the data is considered complete (not tampered with or corrupted); if they do not match, it indicates that the data is missing or has been tampered with, requiring a retransmission or error reporting process.

[0085] S14, the data block unit is encrypted using a lightweight encryption algorithm, and an embedding preparation mark is added to obtain the encrypted data block unit.

[0086] The data block units are encrypted block by block using the AES lightweight encryption algorithm to obtain preliminary encrypted data blocks. A unique location identifier is created for each block using a location index generator, recording its coordinate information within the original data structure to form an embedding preparation tag mapping table. A hash calculation is performed on this mapping table to generate a checksum. After successful verification, the preliminary encrypted data block is bound to the corresponding embedding preparation tag, ultimately obtaining the encrypted data block unit.

[0087] In an optional embodiment, the data block unit is encrypted using a lightweight encryption algorithm, and an embedding preparation marker is added to obtain the encrypted data block unit, including:

[0088] The data block unit is encrypted block by block using the AES lightweight encryption algorithm to generate a preliminary encrypted data block unit;

[0089] A unique location identifier is created for the initial encrypted data block unit using a location index generator, and an embedding preparation tag mapping table is obtained.

[0090] The data integrity verification module performs hash calculation on the embedded preparation tag mapping table to generate a verification code.

[0091] Once the verification code passes, the initial encrypted data block unit is bound to the corresponding embedding preparation tag to obtain the encrypted data block unit.

[0092] For the data block units obtained in step S13, block-by-block encryption is performed using the AES lightweight encryption algorithm (such as AES-128). During the encryption process, the original byte stream of each data block is encrypted using a preset key and initialization vector (IV) as parameters to generate preliminary encrypted data block units.

[0093] It should be noted that the block-by-block encryption process of AES lightweight encryption algorithms (such as AES-128, AES-192, etc.) is based on the characteristics of its block cipher, dividing a continuous data stream into fixed-length blocks (usually 128 bits, or 16 bytes), and encrypting each block independently or according to association rules. In this application, the input is the data block unit to be encrypted, the key, and the initialization vector (IV, only used in block cipher mode). The data block unit to be encrypted is XORed byte-by-byte with the previous encrypted ciphertext block (or the initialization vector, for the first plaintext block) to obtain a mixed data block. After multiple rounds of operations such as byte substitution, row shifting, column mixing, and round key addition (e.g., 10 rounds for a 128-bit key), the output is a preliminary encrypted data block unit with the same length as the data block unit.

[0094] The location index generator assigns a unique location identifier to each initially encrypted data block unit. Specifically, it embeds the original location number (e.g., 1 to 8) of each data block in 4-byte binary form into the data block header to record its original location relationship. Subsequently, the system organizes the correspondence between the location identifiers and the initially encrypted data block units into a structured embedding preparation tag mapping table.

[0095] The data integrity verification module performs a hash calculation (such as using the SHA-256 algorithm) on the embedded preparation tag mapping table to generate a fixed-length checksum. This checksum is used to verify whether the mapping table has been tampered with during transmission or storage. By comparing the currently calculated checksum with a preset baseline value, if they match, the mapping table is considered complete and valid; if they do not match, an anomaly is identified, and the mapping table needs to be regenerated.

[0096] It's important to note that hash calculation (such as SHA-256) is a one-way, irreversible process that converts binary data of arbitrary length into a fixed-length output (256 bits / 32 bytes). In this application, the input is binary data embedded in the mapping table to be marked. The mapping table data is preprocessed (padded to a multiple of 512 bits and appended with the original data length information). The processed data is then divided into blocks and subjected to 64 rounds of iterative calculations (including message expansion, constant addition, shifting, and logical operations), ultimately generating a fixed 256-bit (32-byte) hash value as a checksum. This checksum is stored in conjunction with the mapping table. During subsequent verification, the SHA-256 hash value of the current mapping table needs to be recalculated and compared with the stored checksum. If they match, it proves that the mapping table has not been tampered with and the original position association of the data block units is complete and valid. If they do not match, it indicates that the mapping table is abnormal, requiring data verification or a regeneration process to be triggered.

[0097] Once the verification code is verified, the system binds the initial encrypted data block unit to its corresponding embedding preparation mark (i.e., location identifier and mapping relationship information) to form an encrypted data block unit containing ciphertext data, location identifier, and integrity information.

[0098] S15, obtain non-sensitive image files from a preset image carrier library as embedding targets, and use mapping technology to map the encrypted data block units one by one to the embedding targets to obtain the embedding carrier file.

[0099] In step S15, non-sensitive image files are obtained from a preset image carrier library as embedding targets. An automated script can be used to filter files that meet the non-sensitive criteria in the preset image database, and an image metadata analysis algorithm (such as EXIF ​​data extraction) is used to confirm that the images have no privacy tags. Encrypted data is obtained and split into multiple data block units. A mapping technique is used to map each data block unit to a specific location in the embedding target, resulting in the embedding carrier file.

[0100] In an optional embodiment, the step of obtaining non-sensitive image files from a preset image carrier library as embedding targets, and using mapping technology to map each encrypted data block unit to the embedding target to obtain an embedding carrier file includes:

[0101] Obtain non-sensitive image files from a pre-defined image carrier library and identify them as initial embedding targets;

[0102] Based on the image characteristics of the initial embedding target, a region segmentation method is used to identify non-critical regions in the image, and the lowest pixel bit of the non-critical regions is selected to obtain the embedding target.

[0103] Based on the encrypted data block unit, it is split into smaller data block units, and a mapping technique is used to map each of the smaller data block units to the embedding target to obtain the embedding carrier file.

[0104] At least one image file meeting the non-sensitive criteria is selected from a pre-defined image library as the initial embedding target. An automated script can filter eligible files from the pre-defined image database, and image metadata analysis algorithms (such as EXIF ​​data extraction) can be used to confirm that the image has no privacy tags.

[0105] Next, the image is region-divided using frequency domain analysis based on DCT (Discrete Cosine Transform) to divide it into critical regions (such as the main landscape, accounting for approximately 40%) and non-critical regions (such as the edge sky, accounting for approximately 60%). Non-critical regions are selected as embedding targets. Assuming the encrypted data block is 128KB, it is divided into 1024 small units, each unit being 128 bytes. A hash mapping algorithm (such as MD5) is used to generate corresponding embedding position indices, ensuring uniform distribution. LSB (Least Significant Bit) steganography is used to embed the data units one by one into the least significant bit of the pixels in the non-critical regions. For example, 1 bit of data can be embedded into the least significant bit of each pixel's RGB channel, with an embedding density of 0.5 bits / pixel. The embedding process ensures that the image PSNR value remains above 40dB, verifying that there is no significant degradation in image quality, and generating the embedding carrier file.

[0106] S16, according to the embedded carrier file, adjust the file directory structure, perform hash renaming on the adjusted storage path, generate a file directory with randomized directory hierarchy, and store the embedded carrier file in the file directory with randomized directory hierarchy.

[0107] In step S16, the storage paths and hierarchical relationships of all files are obtained by scanning the initial file directory of the embedded carrier, and the mapping data of the original directory structure is determined. Based on the mapping data, the directory hierarchy is reorganized using a random path generation algorithm to generate a new randomized structure and obtain the adjusted path distribution.

[0108] For the adjusted path distribution, each storage path is encrypted using hash renaming technology. If encrypted path names conflict, fine-tuning is performed to ensure uniqueness. The fine-tuned path names are obtained, a new directory hierarchy is constructed to form a randomized storage structure, and the final hidden layout is determined.

[0109] The original files are moved to a new path and renamed, while an encrypted index mapping table is created to record the corresponding relationships. Finally, the migrated path is verified to ensure it conforms to the preset randomization structure, thus completing the file association hiding process.

[0110] In an optional embodiment, based on the embedded carrier file, the file directory structure is adjusted, the adjusted storage path is hash-renamed to generate a file directory with randomized directory hierarchy, and the embedded carrier file is stored in the file directory with randomized directory hierarchy, including:

[0111] The initial file directory of the embedded carrier is scanned to obtain the storage paths and hierarchical relationships of all files, and the mapping data of the original directory structure is obtained.

[0112] Based on the mapping data of the original directory structure, a random path generation algorithm is used to reorganize the directory hierarchy to obtain the adjusted path distribution;

[0113] Based on the adjusted path distribution, each storage path is encrypted using hash renaming technology to obtain the encrypted path name;

[0114] Based on the encrypted path name, a new directory hierarchy is constructed, forming a randomized file storage structure, and a file directory with a randomized directory hierarchy is generated.

[0115] The embedded carrier file is stored in a directory with randomized directory hierarchy.

[0116] The system first scans the initial file directory of the embedded carrier, traversing all files and subdirectories, recording information such as the absolute storage path of each file, the hierarchical relationship between parent and subdirectories, filename, and file attributes, forming structured raw directory mapping data (which can be viewed as a tree-like data structure, clearly presenting the directory hierarchy and file location). For example, scanning document.pdf will record its path, the hierarchy of its directory "docs", and its positional association with other files.

[0117] Based on the original directory mapping data, the system invokes a random path generation algorithm to reorganize the directory structure. The algorithm initializes a pseudo-random number generator with a preset random seed (such as the first 8 bits of a file's hash value, ensuring controllable randomness in each generation), and then generates a random sequence using a linear congruential generator (LGG). This sequence determines the new directory depth (e.g., 4 levels), the number of branches per level, and other parameters. For example, the random sequence generated for document.pdf might map to a "4-level directory" structure, breaking the hierarchical logic of the original directory and forming a path layout completely different from the original distribution (i.e., the adjusted path distribution).

[0118] It should be noted that the Linear Congruent Generator (LCG) is an algorithm for generating pseudo-random numbers, and its mathematical formula is:

[0119]

[0120] In this formula, a is the multiplier, c is the increment, m is the modulus, and X(0) is the initial value or seed.

[0121] In this application, a preset random seed (such as the first 8 bits of a file hash value) is used as X(0), and other parameters are set to a=1664525, c=1013904223, m= ,

[0122] The first random number X(1) is generated using LCG and mapped to a preset directory depth range (e.g., minimum 2 levels, maximum 5 levels). The specific mapping method is as follows:

[0123]

[0124] in, Indicates the maximum depth. This indicates the minimum depth.

[0125] For a given directory depth (e.g., 4 levels), generate subsequent random numbers X(2), X(3), X(4)..., which are then mapped to the range of branch counts for each level (e.g., minimum 1 branch, maximum 3 branches). The mapping method is as follows:

[0126]

[0127] in, Indicates the first Number of branches in a layer This indicates the preset maximum number of branches. This indicates the preset minimum number of branches.

[0128] To address the adjusted path distribution, the system employs hash renaming technology to encrypt directory and file names at each level. Directory names can be combined with file hash fragments (e.g., the 9th-16th bits of the hash value), timestamps, random numbers, etc., and then encoded using MD5, Base64, or XOR operations to generate meaningless strings (e.g., 7f8e9d0a“ZG9jdW1lbnQ”), thus hiding the semantic information of the original directory. File names can be generated using hashing or encryption algorithms (e.g., AES-128 encryption followed by SHA-1 hashing) to generate random names (e.g., 9h8i7j6k.tmp), replacing the original filename (e.g., document.pdf). If path name conflicts occur after encryption (e.g., two directories generate the same name), fine-tuning is performed using preset rules (e.g., adding random numbers, adjusting hash fragments) to ensure that all path names are unique.

[0129] The encrypted path names are combined according to the reorganized hierarchical relationship to construct a completely new directory tree. For example, the new directory structure of document.pdf might be / 7f8e9d0a / ZG9jdW1lbnQ / 23a4b5c6 / d7e8f9g0 / , where each level of directory name is an encrypted string, and the level depth and structure are completely randomized, forming a randomized storage structure from which the original association cannot be inferred.

[0130] The system migrates the original embedded carrier file (e.g., document.pdf) to a newly generated randomized directory and stores it with an encrypted filename (e.g., 9h8i7j6k.tmp). Simultaneously, an encrypted index mapping table is generated to record the correspondence between the original file and the new path (for later retrieval), ultimately completing the hiding of file storage associations.

[0131] In an optional embodiment, after generating the file directory with randomized directory hierarchy, the method further includes:

[0132] Based on the file directory after the directory hierarchy is randomized, the location information of the encrypted data block unit is obtained. The location information of the encrypted data block unit is compared with the path verification mechanism to determine whether it conforms to the preset distribution rules, and the embedding location compliance judgment result is obtained.

[0133] If the embedding location compliance judgment result does not meet the preset distribution rules, then non-sensitive image files are retrieved from the preset image carrier library again, and the embedding operation of the encrypted data block unit and the path naming encryption process are repeated until the preset distribution rules are met.

[0134] When the embedded location compliance judgment result is determined to meet the preset distribution rules, the location information passes the path verification mechanism.

[0135] Based on the randomized directory hierarchy, the location information of the encrypted data block units is first obtained. The absolute position coordinates of each data unit in the carrier file are extracted through the file system traversal algorithm. An encrypted block distribution mapping table is constructed, and the directory hierarchy depth and relative offset of each data unit are recorded to form a complete distribution location index.

[0136] A path verification mechanism is used to verify the distribution location index. If the distance between data units is less than a preset threshold, it is marked as a dense distribution; if the distance is greater than the preset threshold, it is marked as a sparse distribution. A clustering algorithm is used to analyze the data unit sets of the dense and sparse distributions, calculating the clustering coefficient and dispersion coefficient of each set to obtain the distribution pattern feature vector. The distribution pattern feature vector is then matched against a preset rule template. If the similarity between the feature vector and the rule template exceeds a preset similarity threshold, it is determined to be a compliant distribution.

[0137] When the embedding location compliance judgment result does not meet the preset distribution rules, non-sensitive image files are retrieved from the ordinary image carrier library again, and the embedding operation of the encrypted data block unit and the path naming encryption process are repeated until the location information passes the path verification mechanism.

[0138] When the embedded location compliance judgment result is determined to meet the preset distribution rules, the location information passes the path verification mechanism.

[0139] In an optional embodiment, after storing the embedded carrier file in a directory with randomized directory hierarchy, the method further includes:

[0140] Based on the randomized file directory of the directory hierarchy, a processing log is generated and written to a preset database. Access restrictions are used to set permissions for the obfuscated paths to achieve privacy protection.

[0141] Based on the file directory after directory hierarchy randomization, the system integrates three types of core information sensitive category identifiers, embedded location records, and directory hierarchy randomization information to generate processing logs. The content of the processing logs is then structured and organized to ensure the integrity and consistency of the logs.

[0142] If the integrity of the processing log meets the preset threshold, the processing log is written to the preset database through the storage module, and the status feedback during the writing process is obtained to determine whether the writing is successful.

[0143] If the write operation is successful, permission control rules for obfuscated paths are set for the path access records in the preset database. A hierarchical access strategy is used to restrict path access. Through the RBAC model, only the "Admin" role is allowed to access the obfuscated path " / data / rand7x9 / info3k". The file permissions are set to "700" through system calls, and access attempt logs are recorded. Analysis shows that the proportion of unauthorized access is less than 0.01%, effectively protecting privacy.

[0144] It's important to note that the RBAC (Role-Based Access Control) model divides system users into different roles (such as Admin, User, Guest, etc.). In this application, only the "Admin" role is granted access permissions (including read, write, and execute); other roles have no permissions by default. At the operating system level, system calls (such as the Linux chmod command) are used to set the file permissions of the obfuscated path to "700". This permission means that the path owner (usually the system administrator account) has read (r), write (w), and execute (x) permissions; users in the same group and other users have no permissions.

[0145] Finally, the data tracking and privacy protection trigger module scans the database every hour via a scheduled task to detect abnormal access frequency. If it exceeds the threshold of 5 times / minute, an alarm is triggered, the API interface is automatically called to notify the security team, and a tracking report is generated, which includes access IP distribution and time series analysis.

[0146] It is evident that implementation Figure 1 The described method for secure data storage of electronic photo frames implements metadata protection, generates processing logs, and sets access control, thereby achieving effective hiding and tracking protection of sensitive images.

[0147] Example 2

[0148] Please see Figure 2 , Figure 2 This is a schematic diagram of a data security storage system for an electronic photo frame disclosed in an embodiment of the present invention. Figure 2 As shown, the data security storage system of this electronic photo frame may include the following modules:

[0149] The data acquisition module 201 is used to acquire metadata information of the original image file, and the parsing module performs structured decomposition of the metadata information to obtain a preliminary attribute dataset;

[0150] Sensitive identification module 202 is used to extract features based on the shooting time and location information according to the preliminary attribute dataset, and to perform partition judgment using a pre-established classification model to obtain sensitive category identifiers;

[0151] The segmentation module 203 is used to trigger the hiding module to assign a high priority weight value to the original image file and segment it to obtain data block units when the sensitive category is identified as a sensitive partition.

[0152] Binding module 204 is used to encrypt the data block unit using a lightweight encryption algorithm, add an embedding preparation mark, and obtain the encrypted data block unit;

[0153] The data embedding module 205 is used to obtain non-sensitive image files from a preset image carrier library as embedding targets, and to use mapping technology to map the encrypted data block units one by one to the embedding targets to obtain the embedding carrier file;

[0154] The data storage module 206 is used to adjust the file directory structure according to the embedded carrier file, perform hash renaming on the adjusted storage path, generate a file directory with randomized directory hierarchy, and store the embedded carrier file in the file directory with randomized directory hierarchy.

[0155] The data acquisition module 201 can use an embedded chip (such as Allwinner V3s) equipped with an ARM Cortex-A7 processor to read raw image files (such as JPEG format family photos) from the SD card via the USB interface, call the EXIF ​​parsing library (such as libexif) to extract metadata, parse out information such as shooting time and GPS coordinates, and decompose it into a preliminary attribute dataset, which is then stored in the on-chip Flash (such as 16MB SPI Flash).

[0156] The sensitive identification module 202 can be implemented using an FPGA (such as Xilinx Artix-7). It extracts the shooting time (decomposed into dimensions such as year / month / day) and GPS coordinates (converted to GeoHash encoding) from the preliminary attribute dataset, inputs them into a classification model trained based on the SVM algorithm (model parameters are stored in DDR3 memory), performs image partitioning and judgment. If a photo was taken in the center of a children's activity area (latitude and longitude corresponding area encoding match), a "child sensitive" label is generated and transmitted to the subsequent modules via the SPI bus.

[0157] The segmentation module 203 uses an STM32F407 microcontroller. After receiving the sensitive category identifier, it triggers the hiding module, assigns a high priority weight value of 9.5 to the image file (writes file metadata), and segments the original data in 256KB / blocks through the DMA controller (e.g., a 2.5MB file is segmented into 10 blocks). The data blocks are temporarily stored in SRAM (e.g., IS62WV51216).

[0158] The binding module 204 selects an encryption chip (such as AT88SC0204C) to encrypt the data blocks in SRAM using the AES-128 algorithm. At the same time, the microcontroller generates an embedding preparation mark (4-byte header + 8-bit checksum) containing the original location, binds the encrypted data block with the mark to form an encrypted data block unit, and stores it in NAND Flash (such as K9F1G08).

[0159] The data embedding module 205 uses a video processing chip (such as ADV7511) to retrieve non-sensitive landscape images from a preset image carrier library (stored on a 256GB SSD), embeds encrypted data block units into the least significant bit of the image pixels using the LSB algorithm, generates an embedding carrier file, and temporarily stores it on the SD card.

[0160] The data storage module 206 controls the SD card through the SDIO interface, calls the microprocessor's random number generator to reorganize the directory hierarchy (e.g., generate " / x3f7 / 8d2e / "), renames the path using the SHA-256 algorithm, and stores the embedded carrier file therein. The modules work together through interfaces such as GPIO and SPI to form a complete link from data acquisition to secure storage.

[0161] Please see Figure 3 , Figure 3 This is a schematic diagram of a data security storage system for an electronic photo frame disclosed in an embodiment of the present invention. Figure 3 As shown, the binding module in the data security storage system of this electronic photo frame may include the following units:

[0162] The embedding preparation unit 2041 mainly works with the help of the position index generator. After receiving the preliminary encrypted data block unit from the encryption module, it creates a unique position identifier for each data block based on its specific position in the original data stream (such as offset, sequence number, etc.). Subsequently, the unit constructs an embedding preparation mark mapping table based on the association between these position identifiers and the first encrypted data block unit, recording the correspondence between the encrypted data blocks and the original positions, and providing basic data for subsequent verification and binding.

[0163] Verification unit 2042 is used to ensure the integrity of the embedding preparation mark mapping table. It calls the data integrity verification module to perform hash calculations on the mapping table generated by embedding preparation unit 2041, such as using the SHA-256 algorithm to process the mapping table content and generate a corresponding checksum. By comparing the checksum, it can be determined whether the mapping table has been tampered with during transmission or processing, ensuring its accuracy and validity.

[0164] Binding unit 2043 starts working after verification by verification unit 2042 (i.e., checksum matching and mapping table integrity). It binds the initial encrypted data block unit with the corresponding embedding preparation tag generated by embedding preparation unit 2041. Specifically, it integrates the tag information containing the location identifier (such as embedding it in the data block header in 4-byte binary form and appending an 8-bit checksum to the tail) with the encrypted data block to form an encrypted data block unit that contains both encrypted data and original location information. This allows each encrypted data block to be traced back to its position in the original data, providing a basis for subsequent data embedding and recovery. These three units work together sequentially to complete the entire process from location identifier generation and integrity verification to data and tag binding, which is the key link in realizing the function of the binding module.

[0165] Example 3

[0166] Please see Figure 4 , Figure 4 This is a schematic diagram of the structure of a data security storage terminal for an electronic photo frame disclosed in an embodiment of the present invention. Figure 4 As shown, the data security storage method terminal for the electronic photo frame may include:

[0167] Memory 401 storing executable program code;

[0168] Processor 402 coupled to the memory;

[0169] The processor calls the executable program code stored in the memory to execute some or all of the steps in the data security storage method for electronic photo frames disclosed in Embodiment 1 of the present invention.

[0170] This invention discloses a computer storage medium storing computer instructions. When these computer instructions are invoked, they are used to execute the steps of the data security storage system method for electronic photo frames disclosed in Embodiment 1 of this invention.

[0171] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0172] Through the detailed description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, including read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-Erasable Programmable Read-Only Memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0173] Finally, it should be noted that the data security storage system method and system for electronic photo frames disclosed in the embodiments of the present invention are merely preferred embodiments of the present invention, and are only used to illustrate the technical solutions of the present invention, not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for securely storing data in an electronic photo frame, characterized in that, Executed by a computer, including: The metadata information of the original image file is obtained, and the metadata information is decomposed into a structure using a parsing module to obtain a preliminary attribute dataset. Based on the preliminary attribute dataset, features are extracted for shooting time and location information, and a pre-established classification model is used to determine the partitions and obtain sensitive category identifiers. When the sensitive category is identified as a sensitive partition, the hiding module is triggered to assign a high priority weight value to the original image file and perform segmentation to obtain data block units; The data block unit is encrypted using a lightweight encryption algorithm, and an embedding preparation marker is added to obtain the encrypted data block unit; Non-sensitive image files are obtained from a preset image carrier library as embedding targets. The encrypted data block units are mapped one by one to the embedding targets using mapping technology to obtain the embedding carrier file. Based on the embedded carrier file, the file directory structure is adjusted, the adjusted storage path is hashed and renamed, a file directory with randomized directory hierarchy is generated, and the embedded carrier file is stored in the file directory with randomized directory hierarchy.

2. The data security storage method for an electronic photo frame according to claim 1, characterized in that, Based on the preliminary attribute dataset, features are extracted based on the shooting time and location information. A pre-established classification model is used for partitioning and judgment to obtain sensitive category identifiers, including: Based on the preliminary attribute dataset, a pre-built random forest model is used for classification analysis to extract detailed information from images that meet the sensitive category features, and a second verification is performed to obtain the results after the second verification. Based on the results of the secondary verification, the category label information of the image is obtained, and a sensitive category identifier is generated.

3. The data security storage method for an electronic photo frame according to claim 1, characterized in that, When the sensitive category is identified as a sensitive partition, the hiding module is triggered to assign a high-priority weight value to the original image file and perform segmentation to obtain data block units, including: When a sensitive category is identified as a sensitive partition, the hiding module is activated to perform a priority marking operation on the original image file to obtain an image file with a high priority weight value. Based on the image file with the high priority weight value, extract its original data content, and divide the original data content according to the decomposition rules to obtain data block units.

4. The data security storage method for an electronic photo frame according to claim 1, characterized in that, The data block unit is encrypted using a lightweight encryption algorithm, and an embedding preparation marker is added to obtain the encrypted data block unit, including: The data block unit is encrypted block by block using the AES lightweight encryption algorithm to generate a preliminary encrypted data block unit; A unique location identifier is created for the initial encrypted data block unit using a location index generator, and an embedding preparation tag mapping table is obtained. The data integrity verification module performs hash calculation on the embedded preparation tag mapping table to generate a verification code. Once the verification code passes, the initial encrypted data block unit is bound to the corresponding embedding preparation tag to obtain the encrypted data block unit.

5. The data security storage method for an electronic photo frame according to claim 1, characterized in that, The process of obtaining non-sensitive image files from a preset image carrier library as embedding targets, and using mapping technology to map each encrypted data block unit to the embedding target to obtain the embedding carrier file includes: Obtain non-sensitive image files from a pre-defined image carrier library and identify them as initial embedding targets; Based on the image characteristics of the initial embedding target, a region segmentation method is used to identify non-critical regions in the image, and the lowest pixel bit of the non-critical regions is selected to obtain the embedding target. Based on the encrypted data block unit, it is split into smaller data block units, and a mapping technique is used to map each of the smaller data block units to the embedding target to obtain the embedding carrier file.

6. The data security storage method for an electronic photo frame according to claim 1, characterized in that, Based on the embedded carrier file, the file directory structure is adjusted, the adjusted storage path is hashed and renamed to generate a file directory with randomized directory hierarchy, and the embedded carrier file is stored in the file directory with randomized directory hierarchy, including: The initial file directory of the embedded carrier is scanned to obtain the storage paths and hierarchical relationships of all files, and the mapping data of the original directory structure is obtained. Based on the mapping data of the original directory structure, a random path generation algorithm is used to reorganize the directory hierarchy to obtain the adjusted path distribution; Based on the adjusted path distribution, each storage path is encrypted using hash renaming technology to obtain the encrypted path name; Based on the encrypted path name, a new directory hierarchy is constructed, forming a randomized file storage structure, and a file directory with a randomized directory hierarchy is generated. The embedded carrier file is stored in a directory with randomized directory hierarchy.

7. The data security storage method for an electronic photo frame according to claim 6, characterized in that, After generating the file directory with randomized directory hierarchy, the method further includes: Based on the file directory after the directory hierarchy is randomized, the location information of the encrypted data block unit is obtained. The location information of the encrypted data block unit is compared with the path verification mechanism to determine whether it conforms to the preset distribution rules, and the embedding location compliance judgment result is obtained. If the embedding location compliance judgment result does not meet the preset distribution rules, then non-sensitive image files are retrieved from the preset image carrier library again, and the embedding operation of the encrypted data block unit and the path naming encryption process are repeated until the preset distribution rules are met. When the embedded location compliance judgment result is determined to meet the preset distribution rules, the location information passes the path verification mechanism.

8. The data security storage method for an electronic photo frame according to any one of claims 1-7, characterized in that, After storing the embedded carrier file in a directory with randomized directory hierarchy, the method further includes: Based on the randomized file directory of the directory hierarchy, a processing log is generated and written to a preset database. Access restrictions are used to set permissions for the obfuscated paths to achieve privacy protection.

9. A data security storage system for an electronic photo frame, characterized in that, include: The data acquisition module is used to acquire metadata information from the original image files. The parsing module performs structured decomposition on the metadata information to obtain a preliminary attribute dataset. The sensitive identification module is used to extract features based on the shooting time and location information according to the preliminary attribute dataset, and to perform partition judgment using a pre-established classification model to obtain sensitive category identifiers; The segmentation module is used to trigger the hiding module to assign a high priority weight value to the original image file and segment it to obtain data block units when the sensitive category is identified as a sensitive partition. The binding module is used to encrypt the data block unit using a lightweight encryption algorithm, add an embedding preparation marker, and obtain the encrypted data block unit. The data embedding module is used to obtain non-sensitive image files from a preset image carrier library as embedding targets, and to use mapping technology to map the encrypted data block units one by one to the embedding targets to obtain the embedding carrier file; The data storage module is used to adjust the file directory structure according to the embedded carrier file, perform hash renaming on the adjusted storage path, generate a file directory with randomized directory hierarchy, and store the embedded carrier file in the file directory with randomized directory hierarchy.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform the data security storage method for an electronic photo frame as described in any one of claims 1 to 8.

Images