Multi-dimensional dynamic encryption and tracing method and system for collaborative document

Abstract

The invention belongs to the technical field of information security, and particularly discloses a multi-dimensional dynamic encryption and tracing method and system for a collaborative document, and the method comprises the steps: dividing the document into content units, generating a main encryption key and a unit key, and constructing a key tree; generating an authorization voucher in response to the authorization request, and performing cryptographic conversion on a unit key to obtain a re-encrypted authorization voucher; after the verification of the server, decrypting the complete view of the assembled document and embedding the watermark embedded with the encrypted information; when a leaked copy is found, watermark decryption identity and context information are extracted, and a leaked collaborator and an access session are traced; through organic combination of technical links such as multi-dimensional encryption, proxy re-encryption authorization, dynamic watermark rendering by a client, leakage traceability and the like, full-life-cycle closed-loop management from encrypted storage, permission distribution, safe use to leakage responsibility investigation of collaborative documents is realized, and the problem of a security window of permission change delay in a traditional key management scheme is solved.

Description

Technical Field

[0001] This invention belongs to the field of information security technology and relates to a method and system for multi-dimensional dynamic encryption and tracking of collaborative documents. Background Technology

[0002] With the rapid development of information technology and network communication, cloud-based collaborative document platforms have become widely used tools for modern enterprise office work and team collaboration. Users can create, edit, and share documents in real time in the cloud, greatly improving work efficiency. However, the high degree of document sharing and ease of circulation also brings serious information security challenges. How to effectively prevent sensitive document content from being accessed, misused, or maliciously leaked during collaboration is an important issue that urgently needs to be addressed in the field of information security.

[0003] Currently, for the security protection of collaborative documents, existing technologies typically employ several independent technical means: at the access control level, role-based access control models or access control lists are commonly used to determine user access permissions on the server side; at the content protection level, documents stored on the server are usually encrypted as a whole, and then decrypted when users download them; at the leakage tracing level, some solutions embed static visible or invisible watermarks containing user information into the file before it is generated or distributed, so that accountability can be traced after a leakage is discovered.

[0004] However, the above-mentioned existing technical means have obvious technical defects in practical applications: (1) the permission management is not flexible enough and there is a delay. Once the user downloads the document to the local machine, the access control on the server side will be declared invalid, and the revocation of permissions often cannot take effect in real time.

[0005] (2) Encrypting and sharing documents as a whole cannot meet the refined business needs of sharing only a part of the content, and increases the risk of unnecessary exposure of sensitive information.

[0006] (3) Pre-embedded static watermarks are easily tampered with or even completely removed by malicious users with certain technical capabilities through format conversion, content editing or special tools, resulting in the loss of traceability information and making it impossible to effectively pursue responsibility for leakage. Summary of the Invention

[0007] In view of this, in order to solve the problems mentioned in the background technology above, a multi-dimensional dynamic encryption and tracking method and system for collaborative documents is proposed.

[0008] The objective of this invention can be achieved through the following technical solution: The first aspect of this invention provides a multi-dimensional dynamic encryption and tracking method for collaborative documents, comprising: dividing the target collaborative document into several content units based on the logical structure of the acquired target collaborative document.

[0009] A master encryption key is generated for the target collaborative document, and a unit key is derived for each content unit to construct a key tree containing the master encryption key and the unit keys.

[0010] In response to the authorization request from the target collaborator, authorization credentials are generated according to the preset authorization policy and the key tree.

[0011] The authorization credential is cryptographically converted using the document owner's private key and the cloud server's public key to generate a re-encrypted authorization credential.

[0012] The re-encrypted authorization credential is submitted to the client cloud server for verification. After successful verification, the ciphertext of the authorized content unit is obtained, and the unit key recovered from the authorization credential is used to decrypt and assemble the complete view of the target collaborative document in memory.

[0013] When a leaked copy of a target collaborative document is discovered, the watermark of the embedded encrypted information in the complete view is extracted. The identity and context information obtained from the decryption are used to trace back to the collaborator who caused the leak and their access session.

[0014] A second aspect of the present invention provides a multi-dimensional dynamic encryption and traceability system for collaborative documents, comprising: a document processing module, a key management module, an authorization management module, a re-encryption module, a dynamic rendering module, and a traceability module.

[0015] The document processing module is connected to the key management module, the key management module is connected to the authorization management module, the authorization management module is connected to the re-encryption module, the re-encryption module is connected to the dynamic rendering module, and the dynamic rendering module is connected to the tracing and source tracking module.

[0016] The document processing module divides the target collaborative document into several content units based on the logical structure of the acquired document.

[0017] The key management module generates a master encryption key for the target collaborative document and derives a unit key for each content unit, constructing a key tree containing the master encryption key and the unit keys.

[0018] The authorization management module responds to the authorization request from the target collaborator and generates authorization credentials based on the preset authorization policy and the key tree.

[0019] The re-encryption module uses the document owner's private key and the cloud server's public key to perform cryptographic transformation on the authorization credential, generating a re-encrypted authorization credential.

[0020] The dynamic rendering module submits the re-encrypted authorization certificate to the client cloud server for verification. After successful verification, it obtains the ciphertext of the authorized content unit and uses the unit key recovered from the authorization certificate to decrypt and assemble a complete view of the target collaborative document in memory.

[0021] The tracing module, when it discovers a leaked copy of a target collaborative document, extracts the watermark of the embedded encrypted information in the complete view, and traces back to the collaborator who caused the leak and their access session through the decrypted identity and context information.

[0022] Compared with existing technologies, the beneficial effects of the present invention are as follows: 1. The present invention organically combines multi-dimensional encryption, proxy re-encryption authorization, client dynamic rendering watermarking and leakage tracing technologies to achieve closed-loop management of the entire lifecycle of collaborative documents from encrypted storage, permission distribution, secure use to leakage accountability.

[0023] 2. By introducing a proxy re-encryption mechanism, the cloud server can execute permission granting and revocation commands instantly without the document owner's online participation or re-encryption of the document. Combined with real-time permission verification before each client access, permission changes take effect immediately, eliminating the security window problem caused by permission change delays and optimizing the real-time response capability and permission configuration flexibility of access control.

[0024] 3. This invention integrates a watermark strongly bound to the current visitor's identity and session information into the document view in real time during dynamic rendering in the client's memory. This ensures that any leaked document copy inherently carries an undeniable digital identity imprint, making the traceability information difficult to tamper with or strip away. This guarantees the accuracy of leak tracing and the validity of evidence, and enhances the credibility of the tracing mechanism.

[0025] 4. This invention reduces interference with normal reading for compliant users by adaptively adjusting the watermark strength according to the sensitivity level of collaborative documents. Under the premise of ensuring a high level of security, it achieves a balance between user operation smoothness and system operating efficiency, optimizes resource allocation, and improves the overall usability of the system. Attached Figure Description

[0026] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is a schematic diagram illustrating the implementation steps of the method of the present invention.

[0028] Figure 2 This is a schematic diagram of the system module connections of the present invention. Detailed Implementation

[0029] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] Example 1: Please refer to Figure 1 As shown, the present invention provides a multi-dimensional dynamic encryption and tracking method for collaborative documents. The specific steps are as follows: Based on the logical structure of the acquired target collaborative document, the target collaborative document is divided into several content units.

[0031] In one feasible embodiment of the present invention, the specific process of dividing the plurality of content units includes: parsing the inherent format of the target collaborative document to identify the preset structured elements therein.

[0032] Specifically, the logical boundaries of the target collaborative document are identified based on its inherent format, and the content of the target collaborative document is traversed to locate and extract the preset structured elements.

[0033] It should be noted that the intrinsic format includes, but is not limited to, XML document format, rich text format, etc.

[0034] The structured elements include, but are not limited to, chapter titles, paragraph separators, and table tags.

[0035] The target collaborative document is divided into content units based on the structured elements.

[0036] Specifically, based on the identified logical boundaries, the original continuous stream of target collaborative documents is divided into a series of discrete and independent blocks, which constitute content units.

[0037] After the content units are divided, a unique identifier is assigned to each content unit to form a set of content units with unique identifiers.

[0038] It should be noted that the unique identifier can be a globally unique ID to ensure that the reference to each content unit is clear and unambiguous.

[0039] Furthermore, the unique identifier for each content unit can be constructed as a structured string containing the document ID, chapter number, and paragraph number.

[0040] This invention organically combines multi-dimensional encryption, proxy re-encryption authorization, client-side dynamic rendering watermarking, and leakage tracing technologies to achieve closed-loop management of collaborative documents throughout their entire lifecycle, from encrypted storage, permission distribution, secure use to leakage accountability.

[0041] A master encryption key is generated for the target collaborative document, and a unit key is derived for each content unit to construct a key tree containing the master encryption key and the unit keys.

[0042] In one feasible embodiment of the present invention, the specific construction process of the key tree includes: A1, Master encryption key generation: obtaining a random source and using a cryptographically secure random number generator to generate a key of a specific length for the target collaborative document.

[0043] It should be noted that the specific method for obtaining the random source can be: combining the unique identifier of the target collaborative document and the owner's master password, i.e., deriving through a key derivation function or a hardware random number generator to increase randomness.

[0044] In one specific example, the key can be determined based on a chosen symmetric encryption algorithm. For instance, if AES-256 encryption is used, a 256-bit random key is generated as the master encryption key.

[0045] A2. Key Derivation: Define the tree structure of the key tree and use the key derivation function to derive the child node keys from the parent node keys, that is, derive the unit key for each content unit.

[0046] In a specific example, the defined tree structure can be as follows: (1) Root node: representing the entire target collaborative document. (2) First-level child nodes: representing the main chapters or parts of the target collaborative document. (3) Second-level child nodes: representing paragraphs or subheadings within a chapter. (4) Leaf nodes: representing the final indivisible content unit, such as a paragraph, an image, or a table.

[0047] It should be noted that the process of deriving the unit key follows the hierarchical structure shown in the tree structure, deriving step by step from the root to the leaves.

[0048] For example, the key derivation function can be a KDF, including an HMAC-based KDF or an HKDF, which is designed so that even if the parent key and some derived child keys are known, it is impossible to deduce other child keys or the parent key.

[0049] The derivation formula for the derived unit key is as follows: Child node key = KDF(parent node key, derived salt value), where the derived salt value ensures that different child keys can be derived from the same parent key. It typically includes: fixed label: indicating the level or type; unique identifier: the unique path or ID of the node in the tree; document ID: to prevent key trees of different documents from colliding.

[0050] A3. Content Unit Ciphertext Generation: From the constructed key tree, find the leaf node key corresponding to the content unit, and use the leaf node key, i.e. the unit key, to encrypt the content unit using a symmetric encryption algorithm such as AES-GCM to generate the content unit ciphertext.

[0051] It should be noted that the specific operations for key tree storage and management include the following: (1) Master encryption key: must be strictly protected, usually encrypted using the asymmetric public key of the target collaborative document owner, and then stored in the cloud or locally. (2) Key tree itself: does not need to be stored in its entirety. Since all subkeys can be re-derived from the master key as needed, it is only necessary to securely store the master encryption key and the salt parameter used during derivation, i.e., the target collaborative document structure and identifier.

[0052] It should be further noted that the present invention uses the BBS98 bidirectional proxy re-encryption scheme as an example. The BBS98 bidirectional proxy re-encryption scheme is based on an extension of the RSA cryptosystem. Its core feature is that the proxy, i.e., the cloud server, can convert the authorization certificate encrypted by the document owner, i.e. the entrusting party, into a form that the target collaborator, i.e. the entrusted party, can decrypt without obtaining the plaintext and the original key. It also supports flexible granting and revocation of permissions.

[0053] The detailed implementation process of the BBS98 bidirectional proxy re-encryption scheme includes: (1) Key generation stage: The document owner, i.e. the entrusting party, denoted as Alice, generates an asymmetric key pair: private key SK_A and public key PK_A, with the public key in the form of (n_A, e_A) and the private key in the form of (n_A, d_A), satisfying e_A×d_A≡1 mod φ(n_A), where φ is the Euler totient function; The cloud server, i.e. the proxy party, denoted as Proxy, generates a proxy re-encryption key RK, which is generated by Alice's private key SK_A and the cloud server's own public key PK_Proxy through a key derivation function: RK=KDF(SK_A||PK_Proxy), which is only used for re-encryption conversion and cannot decrypt any original data; The target collaborator, i.e. the entrusted party, denoted as Bob, generates its own asymmetric key pair: private key SK_B and public key PK_B, which is used to finally decrypt the re-encryption authorization certificate.

[0054] (2) Original encryption stage: After Alice extracts the unit key according to the preset authorization policy, she uses her own public key PK_A to encrypt the unit key and generate the encrypted unit key CT_A=E(PK_A, unit key); she combines CT_A with the collaborator's identity information and access context information, and encrypts it with the intermediate key to generate the authorization certificate.

[0055] (3) Re-encryption stage: After receiving the authorization certificate, the cloud server extracts CT_A from it, calls the BBS98 re-encryption algorithm, and uses the proxy re-encryption key RK to convert CT_A: First, it parses the ciphertext structure of CT_A and extracts the RSA encryption factor; it performs a modulo operation on the encryption factor through RK to generate a new ciphertext CT_B=ReEnc(RK,CT_A,PK_B) adapted to Bob's public key PK_B; it reassembles CT_B with other non-sensitive information in the authorization certificate to generate a re-encrypted authorization certificate, ensuring that only Bob can decrypt it through his private key SK_B.

[0056] (4) In the final decryption stage, after Bob obtains the re-encryption authorization certificate on the client, he uses his own private key SK_B to decrypt CT_B and recover the unit key: unit key = D(SK_B,CT_B), which is then used to decrypt the ciphertext of the content unit.

[0057] It should also be noted that when Bob's access permissions need to be revoked, the cloud server directly marks the corresponding re-encryption authorization credential as invalid, without the need to re-encrypt the document or update the key tree; at the same time, by updating the proxy re-encryption key RK, the old re-encryption authorization credential generated by the proxy can be rendered unable to pass verification, ensuring that the permission revocation takes effect immediately.

[0058] In response to the authorization request from the target collaborator, authorization credentials are generated according to the preset authorization policy and the key tree.

[0059] In one feasible embodiment of the present invention, the specific process of generating the authorization certificate includes: filtering out a list of content units that the target collaborator is authorized to access from the content unit set according to a preset authorization strategy.

[0060] It should be noted that when the document owner, i.e. the target collaborator, initiates an authorization operation, the authorization module first obtains and parses the preset authorization policy, and the authorization policy defines the range of content units that the target collaborator is allowed to access, such as specifying which chapters or paragraphs of the document they can access.

[0061] Based on the unique identifier in the content unit list, the corresponding unit key is extracted from the key tree.

[0062] The extracted unit key is combined with the identity information and access context information of the target collaborator, and encrypted using an intermediate key to generate a structured data packet, which is the authorization credential.

[0063] The identity information includes, but is not limited to, user ID and digital certificate; the access context information includes, but is not limited to, timestamp of the request being initiated, device fingerprint, and geolocation data.

[0064] It should be noted that combining the extracted unit key with the target collaborator's identity information and access context information is intended to strongly bind permissions, identity, and context.

[0065] The authorization credentials ensure that the unit key can only be effectively used if both the identity and context match.

[0066] It should be noted that the intermediate key is a temporary, session-specific encryption key used to protect sensitive unit keys and user information during the generation of authorization credentials.

[0067] It should be noted that the main functions of the intermediate key include providing an additional layer of security to prevent authorization credentials from being directly cracked; enabling key separation, with different intermediate keys used for different sessions; and supporting fine-grained access control, allowing each authorization credential to be invalidated independently.

[0068] The authorization credential is cryptographically converted using the document owner's private key and the cloud server's public key to generate a re-encrypted authorization credential.

[0069] In one feasible embodiment of the present invention, the specific process of generating the re-encrypted authorization certificate includes: obtaining the authorization certificate.

[0070] The application proxy re-encryption function performs a cryptographic transformation on the unit key in the authorization credential using the private key of the document owner and the public key of the cloud server, and combines the transformed unit key with the identity information and access context information of the authorization credential to generate a re-encrypted authorization credential.

[0071] It should be noted that the aforementioned proxy re-encryption is a special public-key cryptosystem that allows a proxy, i.e., a cloud server, to convert ciphertext encrypted with the principal's public key into ciphertext encrypted with the delegate's public key without obtaining the plaintext information.

[0072] The re-encrypted authorization credential has a key cryptographic property: the cloud server can verify or further process it using its own private key, but cannot reverse-engineer the original authorization credential content or the unit key contained therein through any computation.

[0073] It should also be noted that the re-encrypted authorization credential is securely sent to the cloud server and stored in association with the corresponding collaborator identity.

[0074] This invention introduces a proxy re-encryption mechanism, enabling the granting and revocation of permissions to be executed instantly by the cloud server without the document owner's online involvement or document re-encryption. Combined with real-time permission verification before each client access, permission changes take effect immediately, eliminating the security window problem caused by permission change delays and optimizing the real-time response capability and permission configuration flexibility of access control. The re-encrypted authorization credential is submitted to the client cloud server for verification. Upon successful verification, the ciphertext of the authorized content unit is obtained, and using the unit key recovered from the authorization credential, it is decrypted in memory and assembled to obtain a complete view of the target collaborative document.

[0075] In one feasible embodiment of the present invention, the specific process of submitting the re-encrypted authorization credential to the client cloud server for verification includes: the client sending an authorization verification request containing the identifier of the re-encrypted authorization credential to the cloud server.

[0076] The cloud server checks the validity status of the re-encryption authorization credential corresponding to the identifier.

[0077] If the validity status is valid, the cloud server returns an access-allowed response to the client and transmits the encrypted content unit; otherwise, it returns an access-denied response.

[0078] Specifically, when a collaborator initiates a request to access a target collaborative document on the client side, the client first sends an authorization verification request to the cloud server. This request contains a token that uniquely identifies the current session and an identifier for the associated re-encrypted authorization credential. Upon receiving this request, the cloud server queries its internal authorization status management database to find the record corresponding to the re-encrypted authorization credential.

[0079] The server checks the validity of the record. When the owner of the target collaborative document issues a permission revocation command, the cloud server immediately updates this flag to invalid. If the server finds the credential to be invalid, it will return an access denied response to the client. Upon receiving this response, the client will terminate all subsequent operations and display a permission denied message to the user. Conversely, if the credential is valid, the server verifies the legitimacy of the access request and continues with the subsequent process: retrieving the encrypted content units authorized by the credential from its storage system and securely transmitting them to the client.

[0080] It should be noted that the validity status is a dynamic flag.

[0081] In one feasible embodiment of the present invention, the specific process of obtaining a complete view of the target collaborative document includes: obtaining a document sensitivity level that characterizes the importance of the target collaborative document from the authorization credentials.

[0082] Based on the document's sensitivity level, a security policy mapping table is queried, which defines the correspondence between different levels and watermark strength parameters.

[0083] Based on the retrieved watermark strength parameters, the density and transparency of the visible watermark and the embedding rate of the invisible digital fingerprint are adaptively adjusted.

[0084] Specifically, before the client executes the watermark fusion operation, the document sensitivity level is first parsed from the authorization credentials of the current access session. After obtaining the document sensitivity level, a built-in or server-issued security policy mapping table is queried. For example, for documents marked as confidential, the security policy mapping table specifies a higher density (more frequent appearances of the visible watermark on the page) and a lower transparency to make the watermark more conspicuous; simultaneously, the security policy mapping table also specifies a higher rate of embedding the invisible digital fingerprint, modifying more micro-features within the document content. Conversely, for levels marked as internally public, a lower density and higher transparency are used. Based on the queried strength parameters, the rendering algorithm is adjusted in real time, and finally, watermarks conforming to the strength parameters are fused into the generated complete view.

[0085] It should be noted that the document sensitivity level is a metadata tag pre-set by the document owner or automation policy when the document is created or authorized.

[0086] The security policy mapping table defines the correspondence between different document sensitivity levels and watermark strength parameters. These watermark strength parameters primarily include the density and transparency of the visible watermark and the embedding rate of the invisible digital fingerprint.

[0087] In one feasible embodiment of the present invention, the specific process of obtaining a complete view of the target collaborative document further includes: generating a visual watermark and a non-visual digital fingerprint in real time based on the identity information and the access context information.

[0088] It should be noted that the visual watermark is generated as follows: the rendering engine overlays information such as the username or session timestamp onto the full view as a semi-transparent layer.

[0089] The specific method for generating the invisible digital fingerprint is as follows: the rendering engine uses a pseudo-random algorithm determined by identity information and context information to fine-tune the underlying layout attributes of the rendered content. For example, it may slightly increase or decrease the spacing between specific characters or slightly adjust the line spacing of the text. The changes are difficult to detect visually, but can be detected and restored through a specific algorithm.

[0090] When rendering the full view, the visual watermark is overlaid on the full view as a layer.

[0091] Simultaneously, the layout attributes of the content in the complete view are adjusted according to the invisible digital fingerprint to embed the invisible digital fingerprint.

[0092] Specifically, after successfully retrieving the encrypted content units within the authorized scope from the cloud server, they are not directly decrypted and saved as local files. Instead, a real-time processing flow is initiated within the client's protected memory space. First, using the unit key decrypted from the authorization credentials, the received encrypted content units are decrypted one by one, generating temporary plaintext content units. Then, based on the unique identifiers and document structure information of these content units, these discrete plaintext content units are dynamically reassembled in memory to construct a complete view readable by the user.

[0093] It should be further added that the memory refers to a physically isolated and logically encrypted memory area built in the client device, used to store the decrypted plaintext content unit, unit key and dynamically rendered document view, to prevent memory dump, debugging tool theft or malicious process access.

[0094] The specific technical implementation of the memory space includes any one or any combination of the following schemes: (1) Operating system-level secure memory mechanism: Based on Windows system: When calling the VirtualAlloc function to allocate memory, specify PAGE_READWRITE|PAGE_GUARD permissions, set memory protection pages, and prevent illegal writing; at the same time, use the CryptProtectMemory function to encrypt sensitive data in memory such as unit keys and plaintext content, decrypt them only temporarily when the CPU is executing, and clear them immediately after execution; Based on Linux system: Map the memory region through the mmap function, set PROT_READ|PROT_WRITE permissions and bind the MAP_PRIVATE flag to ensure that the memory region is only visible to the current process; combine the mprotect function to dynamically adjust permissions, and set the memory permission to PROT_NONE after rendering to prevent subsequent access.

[0095] (2) Logical isolation and protection at the application level: Construct an independent encrypted memory pool: Divide a dedicated memory area in the application process, use the AES-128 algorithm to encrypt the memory pool as a whole, and complete the reading and writing of all sensitive data through a custom encryption interface to avoid direct operation of the original memory; Anti-memory dump protection: By detecting the process debugging status, such as calling the Check Remote Debugger Present function in Windows, if debugging behavior is found, the memory pool is immediately released and the process is terminated; At the same time, disable the core memory dump function. In Linux, this is achieved by prctl(PR_SET_DUMPABLE,0) to prevent memory data from being written to the disk.

[0096] (3) Hardware-assisted secure memory support If the client device supports a hardware security module (HSM) or a trusted execution environment (TEE), such as Intel SGX or ARM Trust Zone, the protected memory space will be deployed in the TEE: all decryption and rendering operations are performed inside the TEE, and sensitive data is not leaked to the ordinary memory space; by utilizing the hardware isolation characteristics of the TEE, it can resist kernel-level attacks and malware theft, and further improve security.

[0097] It should also be noted that when the document view is closed or the client exits, a dual mechanism of overwrite and release is used through a custom memory cleanup function: first, all sensitive data in the protected memory space is overwritten with random data, and then the system function is called to release the memory to ensure that no data remains.

[0098] This invention integrates a watermark strongly bound to the current visitor's identity and session information into the document view in real time during dynamic rendering in the client's memory. This ensures that any leaked document copy inherently carries an undeniable digital identity imprint, making the traceability information difficult to tamper with or strip away. This guarantees the accuracy and validity of the evidence in tracing leaks and enhances the credibility of the tracing mechanism.

[0099] When a leaked copy of a target collaborative document is discovered, the watermark of the embedded encrypted information in the complete view is extracted. The identity and context information obtained from the decryption are used to trace back to the collaborator who caused the leak and their access session.

[0100] It needs to be further explained that the specific implementation process of the watermark embedded in the complete view includes the following: (1) Pre-adaptation mechanism for watermark generation: First, extract the document sensitivity level such as confidential, internal public, etc. from the authorization certificate, query the security policy mapping table, and determine the watermark strength parameter; based on the identity information and access context information of the target collaborator, generate a unique corresponding visual watermark text such as user ID + timestamp and invisible digital fingerprint sequence through a pseudo-random algorithm, so as to ensure that the watermark of each access session is unique and traceable.

[0101] (2) Dual-track embedding method: For visual watermark embedding: When rendering the complete view of the document in the client's memory, the generated visual watermark is superimposed on the view as a semi-transparent layer. The layer position and density are adaptively adjusted according to the sensitivity level. For example, the confidential watermark has a high density and low transparency, while the internal public watermark has a low density and high transparency. It does not affect normal reading but clearly identifies the access subject. For invisible digital fingerprint embedding: The fingerprint sequence is embedded by finely adjusting the underlying layout attributes of the document content, such as character spacing, text line spacing, and slight deviations in font outline. The modification range is controlled within the range that is imperceptible to the human eye, but it can be detected and restored by a special algorithm to form an unalterable invisible traceability mark.

[0102] It should also be noted that the watermark embedding is performed dynamically only in the client's memory. After the document is decrypted, it is not stored on the hard drive. The watermark is integrated with the complete view in real time and presented only to the user; no separate watermark file is generated. Furthermore, the embedding process is completed synchronously with the document view assembly, requiring no additional waiting time, balancing security and operational smoothness. The watermark is also strongly bound to the access session; subsequent accesses after permission revocation will generate a new watermark, ensuring accurate traceability.

[0103] In one feasible embodiment of the present invention, the specific process of tracing back to the collaborator who caused the leak and their access session includes: digitizing the leaked target collaborative document copy to generate a digital copy.

[0104] The digital copy is analyzed, and by comparing it with a reference template and applying optical character recognition technology, the identity information and access context information encoded in the watermark of the embedded encrypted information in the complete view are restored.

[0105] The restored identity information and access context information are matched with the identity information database of access session records stored in the database to determine the source of the leak.

[0106] Specifically, upon discovering or receiving a leaked document copy, the leaked target collaborative document copy is first preprocessed; if the copy is a physical printout, it is digitized using a high-precision scanner.

[0107] For parsing the invisible digital fingerprint, a dedicated analysis algorithm is invoked. This algorithm reveals the subtle typographical features of the document copy, such as character spacing, line spacing, and minute variations in font outlines, and compares them with a baseline template. By calculating the difference sequence between the two and applying the decoding logic reversed from that used during embedding, the encoded digital information is reconstructed. This digital information serves as a unique identifier containing collaborator identity information and access context information.

[0108] It should be noted that the baseline template represents the original rendering state without watermark embedding.

[0109] For the recognition of visual watermarks, optical character recognition technology is used directly to read the text content in the watermark layer, such as username or session timestamp.

[0110] It's worth noting that whether analyzing invisible digital fingerprints or recognizing visible watermarks, the ultimate result is a source identifier containing crucial identity information. This source identifier is then used as a query index to match a pre-defined identity information database. This database stores complete records of every authorization and access session, including collaborator identity, session ID, access time, and device information. Matching the records allows for precise identification of the source of this leak.

[0111] This invention adaptively adjusts the watermark strength based on the sensitivity level of collaborative documents, reducing interference with the normal reading of compliant users. While ensuring a high level of security, it achieves a balance between user operation fluency and system operating efficiency, optimizes resource allocation, and improves the overall usability of the system.

[0112] Example 2: Please refer to Figure 2 As shown, the present invention provides a multi-dimensional dynamic encryption and traceability system for collaborative documents, with the following specific module distribution: document processing module, key management module, authorization management module, re-encryption module, dynamic rendering module, and traceability module.

[0113] The document processing module is connected to the key management module, the key management module is connected to the authorization management module, the authorization management module is connected to the re-encryption module, the re-encryption module is connected to the dynamic rendering module, and the dynamic rendering module is connected to the tracing and source tracking module.

[0114] The document processing module divides the target collaborative document into several content units based on the logical structure of the acquired document.

[0115] The key management module generates a master encryption key for the target collaborative document and derives a unit key for each content unit, constructing a key tree containing the master encryption key and the unit keys.

[0116] The authorization management module responds to the authorization request from the target collaborator and generates authorization credentials based on the preset authorization policy and the key tree.

[0117] The re-encryption module uses the document owner's private key and the cloud server's public key to perform cryptographic transformation on the authorization credential, generating a re-encrypted authorization credential.

[0118] The dynamic rendering module submits the re-encrypted authorization certificate to the client cloud server for verification. After successful verification, it obtains the ciphertext of the authorized content unit and uses the unit key recovered from the authorization certificate to decrypt and assemble a complete view of the target collaborative document in memory.

[0119] The tracing module, when it discovers a leaked copy of a target collaborative document, extracts the watermark of the embedded encrypted information in the complete view, and traces back to the collaborator who caused the leak and their access session through the decrypted identity and context information.

[0120] The above content is merely an example and illustration of the concept of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described, or use similar methods to replace them, as long as they do not deviate from the concept of the invention or exceed the scope defined by the present invention, and all such modifications and additions should fall within the protection scope of the present invention.

Claims

1. A method for multi-dimension dynamic encryption and tracking of a collaborative document, the method comprising: The application comprises the following steps: ​ dividing the target collaborative document into several content units based on the logical structure of the target collaborative document obtained; generating a master encryption key for the target collaborative document and deriving a unit key for each of the content units, and constructing a key tree containing the master encryption key and the unit keys; generating an authorization credential in response to an authorization request of a target collaborator and according to a preset authorization policy and the key tree; performing cryptographic conversion on the unit key contained in the authorization credential by using the private key of the document owner and the public key of the cloud server to generate a re-encrypted authorization credential; submitting the re-encrypted authorization credential to the client cloud server for verification, and obtaining the ciphertext of the authorized content unit after verification, and decrypting and assembling the target collaborative document in the memory to obtain a complete view of the target collaborative document by using the unit key recovered from the authorization credential; when a leaked copy of the target collaborative document is found, extracting the watermark of the embedded encryption information in the complete view, and tracing back to the collaborator causing the leakage and the access session thereof through the decrypted identity information and context information.

2. The method of claim 1, wherein: The specific division process of the several content units comprises the following steps: analyzing the internal format of the target collaborative document to identify the preset structured elements therein; segmenting the target collaborative document into the content units according to the structured elements; after completing the division of the content units, assigning a unique identifier to each of the content units to form a content unit set with unique identifiers.

3. The method of claim 2, wherein: The specific construction process of the key tree comprises the following steps: A1, master encryption key generation: obtaining a random source, and generating a key of a specific length for the target collaborative document by using a cryptographically secure random number generator; A2, key derivation: defining the tree structure of the key tree, and deriving the child node keys from the parent node keys by using a key derivation function, i.e., deriving a unit key for each of the content units; A3, content unit ciphertext generation: finding the leaf node key corresponding to the content unit from the constructed key tree, and encrypting the content unit by using the leaf node key, i.e., the unit key, to generate content unit ciphertext.

4. The method of claim 3, wherein: The specific process of generating the authorization credential comprises the following steps: screening a content unit list that the target collaborator has the right to access from the content unit set according to a preset authorization policy; extracting the unit key corresponding to the unique identifier in the content unit list from the key tree; combining the extracted unit key, the identity information of the target collaborator and the access context information together, and encrypting them by using an intermediate key to finally generate a structured data packet, which is the authorization credential; wherein the identity information includes but is not limited to user ID and digital certificate; and the access context information includes but is not limited to timestamp, device fingerprint and geographic location data when the request is initiated.

5. The method of claim 1, wherein: The specific generation process of the re-encrypted authorization credential comprises the following steps: obtaining the authorization credential; The proxy re-encryption function is applied to cryptographically transform the unit key in the authorization credential with the private key of the document owner and the public key of the cloud server, and the transformed unit key is combined with the identity information and access context information of the authorization credential to generate a re-encrypted authorization credential.

6. The method of claim 5, wherein: The specific process of submitting the re-encrypted authorization credential to the client cloud server for verification includes: The client sends a permission verification request containing the re-encrypted authorization credential identifier to the cloud server; The cloud server checks the validity status of the re-encrypted authorization credential corresponding to the identifier; If the validity status is valid, the cloud server returns a response allowing access to the client and transmits the content unit ciphertext, otherwise returns a response denying access.

7. The method of claim 1, wherein: The specific process of obtaining the complete view of the target collaborative document includes: Obtain a document sensitivity level representing the importance of the target collaborative document from the authorization credential; Query a security policy mapping table defining the correspondence between different levels and watermark intensity parameters according to the document sensitivity level; Adaptively adjust the density and transparency of the visible watermark and the embedding rate of the invisible digital fingerprint according to the queried watermark intensity parameter.

8. The method of claim 7, wherein: The specific process of obtaining the complete view of the target collaborative document also includes: Generate visible watermarks and invisible digital fingerprints in real time according to the identity information and access context information; When rendering the complete view, superimpose the visible watermarks on the complete view in the form of a layer; At the same time, adjust the typesetting properties of the content in the complete view according to the invisible digital fingerprint to embed the invisible digital fingerprint.

9. The method of claim 8, wherein: The specific process of tracing to the collaborator and access session causing the leak includes: Digitize the leaked target collaborative document copy to generate a digital copy; Analyze the digital copy to restore the identity information and access context information encoded in the watermark of the embedded encrypted information in the complete view by comparing with the reference template and applying optical character recognition technology; Match the restored identity information and access context information with the identity information database of the access session record stored in the database to determine the source of the leak.

10. A system for implementing the method of multi-dimensional dynamic encryption and tracking of a collaborative document as claimed in claims 1-9, characterized in that: It includes: A document processing module divides the target collaborative document into several content units based on the logical structure of the target collaborative document obtained; A key management module generates a master encryption key for the target collaborative document and derives a unit key for each content unit, and constructs a key tree containing the master encryption key and the unit keys; An authorization management module responds to the authorization request of the target collaborator and generates an authorization credential according to the preset authorization policy and the key tree; A re-encryption module uses the private key of the document owner and the public key of the cloud server to cryptographically transform the unit key contained in the authorization credential to generate a re-encrypted authorization credential; A dynamic rendering module submits the re-encrypted authorization credential to a client cloud server for verification, and upon verification, obtains the encrypted content units authorized, and decrypts and assembles the complete view of the target collaborative document in memory using the unit keys recovered from the authorization credential; A tracking module extracts the watermark of the embedded encrypted information in the complete view from the leaked copy of the target collaborative document, and traces back to the collaborator and their access session that caused the leak through the decrypted identity and context information.

Images