Privacy protection system based on multimedia short message

Abstract

The application relates to the technical field of multimedia short messages and discloses a privacy protection system based on multimedia short messages, which comprises a preprocessing module, a secure transmission module and a secure storage module.The preprocessing module receives original multimedia short message content, encrypts the original multimedia short message content to generate encrypted content, and generates verification metadata uniquely associated with the encrypted content.The secure transmission module encapsulates the encrypted content into a transmission data packet, establishes an encrypted channel by using a dynamic key negotiation mechanism in the transmission process, and performs bidirectional verification on the identity of a receiver through the verification metadata.The secure storage module performs permission verification on the encrypted content that has passed the identity verification before decryption at a receiving end, and stores the encrypted content in a device isolated storage area after the permission verification; the device isolated storage area realizes access control through a hardware-level encryption engine.The application can prevent network attacks and interception in the transmission process, avoid privacy leakage when a device is lost or cracked, guarantee the privacy and security of multimedia short messages of users, and meet the requirements of people for privacy and security.

Description

Technical Field

[0001] This invention relates to the field of multimedia messaging technology, and in particular to a privacy protection system based on multimedia messaging. Background Technology

[0002] With the widespread application of multimedia messaging technology, privacy protection issues have become increasingly prominent. In existing technologies, on the one hand, the transmission process of multimedia messages is vulnerable to network attacks and interception, potentially leading to the unauthorized acquisition of users' private information such as pictures and videos, posing potential security risks. On the other hand, the storage and management of SMS messages lack effective privacy protection measures. Once a device is lost or maliciously hacked, the multimedia message content stored on the device may be easily accessed by others, failing to fully protect users' privacy rights and failing to meet the high demands for privacy and security that people currently have.

[0003] Therefore, there is an urgent need to provide a technical solution to address the above problems. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a privacy protection system based on multimedia SMS.

[0005] In a first aspect, the present invention provides a privacy protection system based on multimedia SMS, the technical solution of which is as follows: The preprocessing module is used to receive the original multimedia SMS content, encrypt the original multimedia SMS content to generate encrypted content, and generate verification metadata uniquely associated with the encrypted content. The secure transmission module is used to encapsulate the encrypted content into a transmission data packet, establish an encrypted channel using a dynamic key negotiation mechanism during transmission, and perform two-way verification of the recipient's identity through the verification metadata. The secure storage module is used to perform permission verification on the encrypted content that has passed authentication at the receiving end before decryption. After successful verification, the encrypted content is stored in the device isolation storage area, which implements access control through a hardware-level encryption engine.

[0006] The beneficial effects of the privacy protection system based on multimedia SMS of the present invention are as follows: The system of this invention can effectively prevent network attacks and interception during transmission, avoid privacy leaks when devices are lost or hacked, fully protect the privacy and security of users' multimedia text messages, and meet people's high requirements for privacy and security.

[0007] Based on the above solution, the privacy protection system based on multimedia SMS of the present invention can be further improved as follows.

[0008] In one alternative approach, the preprocessing module is specifically used for: Receive the original multimedia message content, and separate the media data and descriptive metadata from the original multimedia message content; Identify the target media type of the media data, and determine the target encryption algorithm corresponding to the target media type based on the preset mapping relationship between media type and encryption strategy; The media data is encrypted using the target encryption algorithm to generate encrypted media data, and the encrypted media data is combined with the unencrypted description metadata to generate the encrypted content.

[0009] In one alternative approach, the preprocessing module is specifically used for: Extract the content feature value of the encrypted content as the basic verification factor, and combine the current user identity identifier with the target recipient identity identifier to generate an identity verification factor; The basic verification factor and the authentication factor are input into a preset cryptographic binding function to generate a binding hash value, and the verification metadata carrying an access control tag is generated based on the binding hash value.

[0010] In one alternative approach, the cryptographic binding function includes: a dynamic nonlinear fusion function and a one-way hash function; the preprocessing module is specifically used for: The basic verification factor and the identity verification factor are input into the dynamic nonlinear fusion function to generate the fusion verification factor; The fusion verification factor and dynamic timestamp are input into the one-way hash function to generate the binding hash value; the binding hash value is associated with the access control tag to generate the verification metadata.

[0011] In one alternative approach, the expression for the dynamic nonlinear fusion function is: ;in, This represents the fusion verification factor. This represents the basic verification factor. This refers to the authentication factor. and The weight coefficients are dynamically generated and satisfy... , and It is a nonlinear transformation exponent and , , This indicates a bitwise XOR operation.

[0012] In one alternative approach, the secure transmission module is specifically used for: The encrypted content and the verification metadata are separately encapsulated into a transmission data packet; When the transmission is initiated, a key negotiation request carrying the access control tag is sent to the target receiver, triggering the receiver to perform whitelist verification based on the access control tag. When the whitelist verification is successful, a temporary public key is exchanged with the receiver and a session key is generated. An encrypted channel is established using the session key to transmit the data packet. After transmission is completed, the identity of the recipient is verified bidirectionally using the authentication factor in the verification metadata.

[0013] In one alternative approach, the secure transmission module is specifically used for: The access control tag is parsed to extract the target device type requirements and verification level identifier, and the dynamic timestamp in the key negotiation request is obtained and its timeliness is verified. Based on the target device type requirement, query the device type feature library stored locally on the receiving end to determine whether the current device type meets the target device type requirement; When the current device type meets the requirements of the target device type, a whitelist verification strategy corresponding to the security level is selected based on the verification level identifier; Multi-factor authentication is performed based on the whitelist verification strategy, and the whitelist verification is deemed successful when the multi-factor authentication is successful and the dynamic timestamp verification is valid.

[0014] In one alternative approach, the secure storage module is specifically used for: Extract the storage security level identifier from the access control tag associated with the encrypted content; Based on the storage security level identifier, a preset storage policy matching rule is queried to determine the corresponding target storage area security level and target access control policy; Verify whether the current user's operation permissions conform to the minimum permission set in the target access control policy; When the permission verification is successful, the hardware-level encryption engine is activated, and the encrypted content is written to a physical isolation partition in the isolated storage area of ​​the device that matches the security level of the target storage area. The hardware-level encryption engine then loads the partition-specific key to implement access control.

[0015] In one alternative approach, the secure storage module is specifically used for: The storage security level identifier is input into a preset storage policy mapping database to match the basic storage area security level and the initial access control policy. Based on the real-time acquired environmental security parameters, a dynamic adjustment coefficient for the storage policy is calculated. Based on the dynamic adjustment coefficient, the security level of the basic storage area is enhanced to generate the security level of the target storage area. At the same time, dynamic constraints are added to the initial access control policy to generate the target access control policy.

[0016] Secondly, the present invention provides a privacy protection method based on multimedia SMS, the technical solution of which is as follows: Receive the original multimedia SMS content, encrypt the original multimedia SMS content to generate encrypted content, and generate verification metadata uniquely associated with the encrypted content; The encrypted content is encapsulated into a transmission data packet. During transmission, a dynamic key negotiation mechanism is used to establish an encrypted channel, and the identity of the recipient is verified bidirectionally through the verification metadata. At the receiving end, the encrypted content that has passed authentication is subjected to permission verification before decryption. After successful verification, it is stored in the device isolation storage area, which implements access control through a hardware-level encryption engine.

[0017] The beneficial effects of the privacy protection method based on multimedia SMS of the present invention are as follows: The method of this invention can effectively prevent network attacks and interception during transmission, avoid privacy leaks when devices are lost or hacked, fully protect the privacy and security of users' multimedia text messages, and meet people's high requirements for privacy and security.

[0018] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0020] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This is a schematic diagram of an embodiment of a privacy protection system based on multimedia SMS according to the present invention; Figure 2This is a flowchart illustrating an embodiment of a privacy protection method based on multimedia SMS according to the present invention. Detailed Implementation

[0021] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0022] Figure 1 A schematic diagram of an embodiment of a privacy protection system based on multimedia messaging provided by the present invention is shown. Figure 1 As shown, the system includes: The preprocessing module 110 is used to receive the original multimedia SMS content, encrypt the original multimedia SMS content to generate encrypted content, and generate verification metadata uniquely associated with the encrypted content.

[0023] The original multimedia message content refers to the raw data of the SMS message to be sent by the user, containing at least one media type: images, videos, and audio. For example, a video taken by the user and its accompanying text description. Encrypted content refers to the data set of the original multimedia message content after encryption, such as a data packet combining encrypted video data with an unencrypted text description. Verification metadata refers to additional data uniquely bound to the encrypted content and used for authentication and access control, such as a binary identifier block containing hash values ​​and permission tags.

[0024] The secure transmission module 120 is used to encapsulate the encrypted content into a transmission data packet, establish an encrypted channel using a dynamic key negotiation mechanism during transmission, and perform two-way verification of the recipient's identity through the verification metadata.

[0025] In this context, a data packet refers to a standardized communication unit that encapsulates encrypted content and verification metadata, such as an encrypted data packet conforming to the IP protocol. A dynamic key negotiation mechanism refers to the protocol interaction process that generates session keys in real time during transmission, such as negotiating keys between the sender and receiver using the ECDH key exchange protocol. An encrypted channel refers to a data transmission link encrypted with session keys, such as an end-to-end encrypted communication channel established based on the TLS protocol. Recipient identity refers to the unique identification information of the receiving user, such as a mobile phone number or the public key fingerprint in a digital certificate.

[0026] The secure storage module 130 is used to perform permission verification on the encrypted content that has passed authentication at the receiving end before decryption. After the verification is successful, the encrypted content is stored in the device isolation storage area, which implements access control through a hardware-level encryption engine.

[0027] In this context, the receiving end refers to the target device receiving multimedia text messages, such as a smartphone or tablet with this system installed. Permission verification refers to the process of verifying user permissions before data decryption, such as checking if the user has permission to "read" the text message. Device-isolated storage refers to a protected storage area partitioned using hardware isolation technology, such as an encrypted storage partition within a mobile device security chip (eSE). Hardware-level encryption engine refers to a cryptographic processing unit integrated into the device hardware, such as a secure execution environment (TEE) under the ARM TrustZone architecture.

[0028] The technical solution of this embodiment can effectively prevent network attacks and interception during transmission, avoid privacy leaks when devices are lost or hacked, fully protect the privacy and security of users' multimedia text messages, and meet people's high requirements for privacy and security.

[0029] In an alternative embodiment, the preprocessing module 110 is specifically used for: Receive the original multimedia message content and separate the media data and description metadata from the original multimedia message content.

[0030] Media data refers to the non-text content of multimedia messages, such as pixel data of images or frame data streams of videos. Descriptive metadata refers to auxiliary information describing the attributes of the media data, such as text tags for image resolution, video duration, and file format.

[0031] Identify the target media type of the media data, and determine the target encryption algorithm corresponding to the target media type based on a preset mapping relationship between media types and encryption strategies.

[0032] Here, "target media type" refers to the specific category to which the media data belongs, such as MP4 format in video or JPEG format in image. The media type-encryption strategy mapping relationship refers to the predefined matching rules between media types and encryption algorithms, such as the mapping table "Video → AES-GCM algorithm, Image → ChaCha20 algorithm". The target encryption algorithm refers to the encryption method selected based on the target media type, such as assigning the AES-256 encryption algorithm to MP4 video data.

[0033] The media data is encrypted using the target encryption algorithm to generate encrypted media data, and the encrypted media data is combined with the unencrypted description metadata to generate the encrypted content.

[0034] Encrypted media data refers to the ciphertext generated after media data has been processed by the target encryption algorithm, such as the binary ciphertext block generated by encrypting a JPEG image.

[0035] Among the above optional methods, the preprocessing module further clarifies that it separates media data and description metadata, selects encryption algorithms based on media type for encryption, and can implement precise encryption strategies for different types of media data to improve encryption efficiency and security, while retaining unencrypted description metadata for easy subsequent processing and identification.

[0036] In an alternative embodiment, the preprocessing module 110 is specifically used for: Extract the content feature value of the encrypted content as the basic verification factor, and combine the current user identity identifier with the target recipient identity identifier to generate an authentication factor.

[0037] Here, the content feature value refers to the unique identifier of the encrypted content generated through a feature extraction algorithm, such as calculating the SHA3-256 hash value of encrypted media data. The basic verification factor refers to the verification element generated based on the content feature value, such as truncating the first 128 bits of the content feature value as a factor. The current user identity identifier refers to the authentication identifier of the sender user, such as the combined hash value of the sender's mobile phone IMEI number and SIM card ID. The target receiver identity identifier refers to the authentication identifier of the receiver user, such as the receiver's digital certificate public key digest. The authentication factor refers to the verification element generated by combining the identity identifiers of both the sender and receiver, such as the HMAC value calculated by concatenating the sender's and receiver's identifiers.

[0038] The basic verification factor and the authentication factor are input into a preset cryptographic binding function to generate a binding hash value, and the verification metadata carrying an access control tag is generated based on the binding hash value.

[0039] In this context, a cryptographic binding function refers to an encryption function that combines multiple factors to generate an irreversible result. A binding hash value is the output of the cryptographic binding function, such as a 64-byte SHA-512 hash value. An access control label is a metadata identifier that defines data operation permissions, such as a binary label that says "Only allow the receiving device to decrypt once."

[0040] Among the above-mentioned optional methods, it is further clarified that the preprocessing module uses content feature values ​​and user identity identifiers to generate verification metadata, providing a strong correlation verification basis for multimedia SMS content and user identity, enhancing the accuracy and reliability of verification, and effectively preventing identity forgery and information tampering.

[0041] In one alternative approach, the cryptographic binding function includes: a dynamic nonlinear fusion function and a one-way hash function; the preprocessing module 110 is specifically used for: The basic verification factor and the identity verification factor are input into the dynamic nonlinear fusion function to generate the fusion verification factor.

[0042] The fusion verification factor and dynamic timestamp are input into the one-way hash function to generate the binding hash value; the binding hash value is associated with the access control tag to generate the verification metadata.

[0043] One-way hash functions are cryptographic functions that generate irreversible hash values, such as SHA-3 or BLAKE2 algorithms. Fusion verification factors are intermediate results resulting from the fusion of basic verification factors and authentication factors, such as a 256-bit binary vector. Dynamic timestamps are real-time generated time-sensitive identifiers, such as UTC time encoding accurate to milliseconds.

[0044] Among the above optional methods, a cryptographic binding function combining a dynamic nonlinear fusion function and a one-way hash function is further adopted. This function, along with a basic verification factor, an authentication factor, and a dynamic timestamp, generates verification metadata. This gives the verification metadata a high degree of randomness and unpredictability, thereby further improving verification security and resisting various attacks.

[0045] In one alternative approach, the expression for the dynamic nonlinear fusion function is: ;in, This represents the fusion verification factor. This represents the basic verification factor. This refers to the authentication factor. and The weight coefficients are dynamically generated and satisfy... , and It is a nonlinear transformation exponent and , , This indicates a bitwise XOR operation.

[0046] It should be noted that the construction principle of the dynamic nonlinear fusion function is based on the provable security theory of cryptography, and achieves irreversible factor fusion through nonlinear exponential transformation and dynamic weight allocation. It is a dimensionless binary sequence, with a value range of 1. ; A dimensionless fixed-length string, with a value range of 1. ; and It is a dimensionless scalar, and its range of values ​​is 1. And satisfy ; and Dimensionless Strengthen content factors, Weaken identity factors; It is a dimensionless binary stream with its length aligned to the input factor.

[0047] Among the above-mentioned optional methods, it is further clarified that the dynamic nonlinear fusion function fuses factors through dynamically generated weight coefficients and nonlinear transformation exponents, which enhances the dynamism and complexity of the verification process, making it difficult for attackers to crack the verification logic and effectively ensuring the reliability of multimedia SMS transmission and storage.

[0048] In one alternative embodiment, the secure transmission module 120 is specifically used for: The encrypted content and the verification metadata are separately encapsulated into a transmission data packet.

[0049] When the transmission is initiated, a key negotiation request carrying the access control tag is sent to the target receiver, triggering the receiver to perform whitelist verification based on the access control tag. When the whitelist verification is successful, a temporary public key is exchanged with the receiver and a session key is generated.

[0050] An encrypted channel is established using the session key to transmit the data packet. After transmission is completed, the identity of the recipient is verified bidirectionally using the authentication factor in the verification metadata.

[0051] Here, whitelist verification refers to the identity verification process based on a pre-authorized list, such as checking whether the receiving device is in the sender's preset list of trusted devices. A temporary public key is a short-term valid public key generated during key negotiation, such as a public key temporarily generated on the secp256k1 elliptic curve. A session key is a dynamically negotiated symmetric encryption key, such as a 256-bit AES key derived through the ECDH protocol.

[0052] Among the above-mentioned optional methods, it is further clarified that the secure transmission module independently encapsulates encrypted content and verification metadata, uses session keys to encrypt transmission, and performs two-way authentication to ensure the confidentiality and integrity of information and the credibility of the recipient's identity during transmission, prevent information leakage and tampering, and protect privacy and security.

[0053] In one alternative embodiment, the secure transmission module 120 is specifically used for: The access control tag is parsed to extract the target device type requirements and verification level identifier, and the dynamic timestamp in the key negotiation request is obtained and its timeliness is verified.

[0054] The target device type requirement refers to the device hardware standard specified in the access control label, such as "devices that only support TEE security chips". The verification level identifier refers to the security verification strength level defined in the access control label, such as the numerical label "1=low security, 2=high security".

[0055] Based on the target device type requirements, the receiver queries the device type feature database stored locally to determine whether the current device type meets the target device type requirements.

[0056] Among them, the device type feature library refers to a local database that stores the hardware features of devices, such as a mapping table between mobile phone models and security chip models.

[0057] When the current device type meets the requirements of the target device type, a whitelist verification strategy corresponding to the security level is selected based on the verification level identifier.

[0058] Security level refers to the strength grading of the whitelist verification strategy. For example, level 3 requires simultaneous verification of device certificate and fingerprint. Whitelist verification strategy refers to the set of authentication rules selected based on the verification level identifier. For example, the strategy "high security level = device certificate + facial recognition" is used.

[0059] Multi-factor authentication is performed based on the whitelist verification strategy, and the whitelist verification is deemed successful when the multi-factor authentication is successful and the dynamic timestamp verification is valid.

[0060] Multi-factor authentication refers to a verification method that combines multiple credentials, such as simultaneously verifying a device's digital certificate and the user's iris features.

[0061] Among the above optional methods, the secure transmission module further clarifies that it parses the access control tags, performs whitelist verification and multi-factor authentication based on device type requirements and verification level identifiers, and finely controls transmission permissions to ensure that only qualified devices and users who have passed strict authentication can receive SMS messages, thereby enhancing access control capabilities during the transmission process.

[0062] In one alternative embodiment, the secure storage module 130 is specifically used for: Extract the storage security level identifier from the access control tag associated with the encrypted content.

[0063] Among them, the storage security level identifier refers to the storage protection level defined in the access control label, such as the label value "0x01=normal level, 0x02=confidential level".

[0064] Based on the storage security level identifier, the preset storage policy matching rules are queried to determine the corresponding target storage area security level and target access control policy.

[0065] Among them, the storage policy matching rule refers to the matching logic between the storage security level identifier and the storage policy, such as the rule "Confidential level → Physically isolated partition + dedicated key". The target storage area security level refers to the final determined protection level of the storage area, such as the dynamically adjusted "Enhanced L3 security level". The target access control policy refers to the final effective data access control rule, such as the policy "Only allow users with biometric authentication to read".

[0066] Verify whether the current user's operation permissions conform to the minimum permission set in the target access control policy.

[0067] The current user's operation permissions refer to the operation permissions requested by the user, such as "read," "forward," or "delete" operation requests. The minimum permission set refers to the minimum set of operation permissions allowed by the access control policy, such as the set {"read"} (forwarding and screenshotting are prohibited).

[0068] When the permission verification is successful, the hardware-level encryption engine is activated, and the encrypted content is written to a physical isolation partition in the isolated storage area of ​​the device that matches the security level of the target storage area. The hardware-level encryption engine then loads the partition-specific key to implement access control.

[0069] In this context, a physical isolation partition refers to an independent storage unit partitioned by hardware within the device's isolated storage area, such as sector number #5 assigned inside a security chip. A partition-specific key is the encryption key bound to the physical isolation partition, such as an AES-256 key bound via a chip fuse.

[0070] Among the above optional methods, it is further clarified that the secure storage module determines the security level and access control policy of the storage area based on the storage security level identifier in the access control label, strictly verifies the user's operation permissions, and writes the encrypted content to the physical isolation partition after activating the hardware-level encryption engine, thereby achieving hardware-level security protection for storage and effectively preventing information leakage when the storage device is lost or maliciously cracked.

[0071] In one alternative embodiment, the secure storage module 130 is specifically used for: The storage security level identifier is input into a preset storage policy mapping database to match the basic storage area security level and the initial access control policy.

[0072] The preset storage policy mapping database refers to a predefined mapping database between storage security level identifiers and basic policies, such as the database table {"0x01":"Basic L1 Level"}. The basic storage area security level refers to the initial protection level matched according to the storage policy mapping database, such as level "L2: Software Encrypted Storage". The initial access control policy refers to the basic access rules matched according to the storage policy mapping database, such as the policy "Allow owner to read".

[0073] Based on the real-time acquired environmental security parameters, a dynamic adjustment coefficient for the storage policy is calculated. Based on the dynamic adjustment coefficient, the security level of the basic storage area is enhanced to generate the security level of the target storage area. At the same time, dynamic constraints are added to the initial access control policy to generate the target access control policy.

[0074] Among them, environmental safety parameters refer to real-time collected equipment environmental risk indicators, such as network connection type, GPS positioning reliability, and ambient light sensor data. The storage policy dynamic adjustment coefficient refers to the policy enhancement coefficient calculated based on the environmental safety parameters; for example, a risk score of 0.8 corresponds to a coefficient of 1.5. Dynamic constraints refer to access restriction clauses added based on the storage policy dynamic adjustment coefficient, such as "network transmission is prohibited in high-risk environments."

[0075] Among the above-mentioned optional methods, it is further clarified that the security storage module dynamically adjusts the storage strategy according to the environmental security parameters, enhances the security level of the storage area, and adds dynamic constraints to the access control strategy, making the storage security strategy more adaptable and flexible, and able to respond to security threats in different environments in a timely manner, thereby improving the security and reliability of the storage process.

[0076] Figure 2 This diagram illustrates a flowchart of an embodiment of a privacy protection method based on multimedia SMS provided by the present invention. Figure 2 As shown, it includes the following steps: S1. Receive the original multimedia SMS content, encrypt the original multimedia SMS content to generate encrypted content, and generate verification metadata uniquely associated with the encrypted content. S2. The encrypted content is encapsulated into a transmission data packet. During transmission, a dynamic key negotiation mechanism is used to establish an encrypted channel, and the identity of the recipient is verified bidirectionally through the verification metadata. S3. At the receiving end, the encrypted content that has passed authentication is subjected to permission verification before decryption. After the verification is successful, it is stored in the device isolation storage area. The device isolation storage area implements access control through a hardware-level encryption engine.

[0077] The technical solution of this embodiment can effectively prevent network attacks and interception during transmission, avoid privacy leaks when devices are lost or hacked, fully protect the privacy and security of users' multimedia text messages, and meet people's high requirements for privacy and security.

[0078] Furthermore, the system provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the system can be divided into different functional modules according to the actual situation to complete all or part of the functions described above. In addition, the system and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0079] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

[0080] It should be noted that the terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and represent a limitation on a specific order or sequence. Where appropriate, the order of use for similar objects can be interchanged so that the embodiments of this application described herein can be implemented in an order other than that shown or described.

[0081] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A privacy protection system based on multimedia SMS, characterized in that, The system includes: The preprocessing module is used to receive the original multimedia SMS content, encrypt the original multimedia SMS content to generate encrypted content, and generate verification metadata uniquely associated with the encrypted content. The secure transmission module is used to encapsulate the encrypted content into a transmission data packet, establish an encrypted channel using a dynamic key negotiation mechanism during transmission, and perform two-way verification of the recipient's identity through the verification metadata. The secure storage module is used to perform permission verification on the encrypted content that has been authenticated at the receiving end before decryption. After the verification is successful, the content is stored in the device isolation storage area, which implements access control through a hardware-level encryption engine. The preprocessing module is specifically used to: extract the content feature value of the encrypted content as a basic verification factor, and combine the current user identity identifier with the target recipient identity identifier to generate an authentication factor; input the basic verification factor and the authentication factor into a preset cryptographic binding function to generate a binding hash value, and generate the verification metadata carrying an access control tag based on the binding hash value; The cryptographic binding function includes a dynamic nonlinear fusion function and a one-way hash function; the preprocessing module is specifically used to: input the basic verification factor and the authentication factor into the dynamic nonlinear fusion function to generate a fusion verification factor; input the fusion verification factor and the dynamic timestamp into the one-way hash function to generate the binding hash value; associate the binding hash value with the access control tag to generate the verification metadata; The expression for the dynamic nonlinear fusion function is: ;in, This represents the fusion verification factor. This represents the basic verification factor. This refers to the authentication factor. and The weight coefficients are dynamically generated and satisfy... , and It is a nonlinear transformation exponent and , , This indicates a bitwise XOR operation; It is a dimensionless binary sequence, with a value range of 1. ; A dimensionless fixed-length string, with a value range of 1. ; and It is a dimensionless scalar, and its range of values ​​is 1. And satisfy ; and Dimensionless Strengthen content factors, Weaken identity factors; It is a dimensionless binary stream with its length aligned to the input factor.

2. The privacy protection system based on multimedia SMS as described in claim 1, characterized in that, The preprocessing module is specifically used for: Receive the original multimedia message content, and separate the media data and descriptive metadata from the original multimedia message content; Identify the target media type of the media data, and determine the target encryption algorithm corresponding to the target media type based on the preset mapping relationship between media type and encryption strategy; The media data is encrypted using the target encryption algorithm to generate encrypted media data, and the encrypted media data is combined with the unencrypted description metadata to generate the encrypted content.

3. The privacy protection system based on multimedia SMS as described in claim 1, characterized in that, The secure transmission module is specifically used for: The encrypted content and the verification metadata are separately encapsulated into a transmission data packet; When the transmission is initiated, a key negotiation request carrying the access control tag is sent to the target receiver, triggering the receiver to perform whitelist verification based on the access control tag. When the whitelist verification is successful, a temporary public key is exchanged with the receiver and a session key is generated. An encrypted channel is established using the session key to transmit the data packet. After transmission is completed, the identity of the recipient is verified bidirectionally using the authentication factor in the verification metadata.

4. The privacy protection system based on multimedia SMS as described in claim 3, characterized in that, The secure transmission module is specifically used for: The access control tag is parsed to extract the target device type requirements and verification level identifier, and the dynamic timestamp in the key negotiation request is obtained and its timeliness is verified. Based on the target device type requirement, query the device type feature library stored locally on the receiving end to determine whether the current device type meets the target device type requirement; When the current device type meets the requirements of the target device type, a whitelist verification strategy corresponding to the security level is selected based on the verification level identifier; Multi-factor authentication is performed based on the whitelist verification strategy, and the whitelist verification is deemed successful when the multi-factor authentication is successful and the dynamic timestamp verification is valid.

5. The privacy protection system based on multimedia SMS according to claim 4, characterized in that, The secure storage module is specifically used for: Extract the storage security level identifier from the access control tag associated with the encrypted content; Based on the storage security level identifier, a preset storage policy matching rule is queried to determine the corresponding target storage area security level and target access control policy; Verify whether the current user's operation permissions conform to the minimum permission set in the target access control policy; When the permission verification is successful, the hardware-level encryption engine is activated, and the encrypted content is written to a physical isolation partition in the isolated storage area of ​​the device that matches the security level of the target storage area. The hardware-level encryption engine then loads the partition-specific key to implement access control.

6. The privacy protection system based on multimedia SMS as described in claim 5, characterized in that, The secure storage module is specifically used for: The storage security level identifier is input into a preset storage policy mapping database to match the basic storage area security level and the initial access control policy. Based on the real-time acquired environmental security parameters, a dynamic adjustment coefficient for the storage policy is calculated. Based on the dynamic adjustment coefficient, the security level of the basic storage area is enhanced to generate the security level of the target storage area. At the same time, dynamic constraints are added to the initial access control policy to generate the target access control policy.

7. A privacy protection method based on multimedia SMS, characterized in that, The privacy protection system based on multimedia SMS as described in any one of claims 1 to 6, wherein the method comprises: Receive the original multimedia SMS content, encrypt the original multimedia SMS content to generate encrypted content, and generate verification metadata uniquely associated with the encrypted content; The encrypted content is encapsulated into a transmission data packet. During transmission, a dynamic key negotiation mechanism is used to establish an encrypted channel, and the identity of the recipient is verified bidirectionally through the verification metadata. At the receiving end, the encrypted content that has passed authentication is subjected to permission verification before decryption. After successful verification, it is stored in the device isolation storage area, which implements access control through a hardware-level encryption engine.

Images