Sensitive picture adaptive shielding and authorization restoration method and device based on national secret algorithm, equipment and storage medium

Abstract

This application discloses a method, apparatus, device, and storage medium for adaptive masking and authorization restoration of sensitive images based on Chinese national cryptographic algorithms. The method includes: acquiring and identifying sensitive regions in the original video stream; dynamically and adaptively masking the sensitive regions to obtain a teaching video stream, while retaining the original video stream; encrypting the original video stream using a combination of multi-key encryption and block encryption based on Chinese national cryptographic algorithms to obtain an encrypted original video stream and an encryption key, and storing the encrypted original video stream and encryption key together; when a user requests to view the original video stream, generating a temporary token using the user's private key, the approver's private key, and biometric identification; and decrypting the encrypted original video stream based on the temporary token. By using Chinese national cryptographic algorithms throughout the entire chain—from masking sensitive regions of the original video, user access, permission granting and approval, to the encryption process of the encrypted video—the security of data in sensitive regions is guaranteed.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a method, apparatus, device, and storage medium for adaptive masking and authorized restoration of sensitive images based on Chinese cryptographic algorithms. Background Technology

[0002] With the deep integration of information technology in fields such as healthcare and education, recording and broadcasting systems have become core tools for surgical demonstrations, academic seminars, and remote training. However, the video content generated in these scenarios often contains sensitive information, such as:

[0003] 1. Medical scenario: The patient's wound site, private parts, and personal identification information during the surgical process.

[0004] 2. Education and research scenarios: involving demonstrations of unpublished research results, confidential experimental processes, etc.

[0005] Direct dissemination of this sensitive content would pose serious risks, including breaches of patient privacy, leakage of research data, and ethical concerns. Therefore, strict security controls are essential to ensure the data's value.

[0006] The existing technology has the following main defects and shortcomings:

[0007] (1) “One-size-fits-all” global masking: Existing solutions often use blurring or masking to process the entire picture or video segment. Although this method protects privacy, it destroys the integrity and usability of the original data, making it impossible for authorized users with learning or research needs (such as visiting doctors or research collaborators) to observe key details, which greatly reduces the teaching and research value of the recorded materials.

[0008] (2) Static and coarse-grained access control: A common method is to use a simple username / password to control access to video files. Once the password is leaked or authorization is granted, the user can access the entire original video indiscriminately. This method cannot achieve fine-grained management based on specific content segments or specific time ranges, and permissions cannot be revoked, access behavior is untraceable, and there is a huge risk of unauthorized access and data leakage.

[0009] (3) Disconnect between security and business operations: General encryption schemes can only guarantee the confidentiality of video files during storage and transmission, but cannot link decryption permissions to specific business approval processes. For example, if a doctor needs to view the original surgical footage, current technology cannot force him to obtain online approval from the surgeon and make that approval a prerequisite for decryption, resulting in management systems failing to be effectively implemented through technical means. Summary of the Invention

[0010] The purpose of this application is to provide a method, device, equipment, and storage medium for adaptive masking and authorized restoration of sensitive images based on national cryptographic algorithms. It has the advantages of maintaining the integrity of the original video and its usability for teaching and research while ensuring the security of sensitive information, and realizing dynamic access control and approval association through encryption and token mechanisms.

[0011] This application provides a method for adaptive masking and license restoration of sensitive images based on Chinese cryptographic algorithms, which includes at least the following steps:

[0012] Acquire the raw video stream and identify sensitive areas within it;

[0013] The sensitive areas are dynamically and adaptively masked to obtain the teaching video stream, while the original video stream is preserved.

[0014] Based on the national cryptographic algorithm, the original video stream is encrypted using a combination of multi-key encryption and block encryption to obtain the encrypted original video stream and the encryption key, and the encrypted original video stream and the encryption key are stored together.

[0015] When a user requests to watch the original video stream, a temporary token is generated using the user's private key, the approver's private key, and biometric identification.

[0016] Decrypt the encrypted original video stream based on a temporary token.

[0017] Furthermore, the original video stream is acquired, and sensitive regions within the original video stream are identified, specifically:

[0018] Based on a pre-trained deep learning model, sensitive regions in the original video stream are identified and segmented in real time through image recognition, semantic analysis, and behavior analysis. Among them, image recognition is used to identify static sensitive patterns and text, semantic analysis is used to parse sensitive words in video audio, and behavior analysis is used to determine the sensitive behaviors corresponding to people's actions and postures.

[0019] It also outputs a binary mask image representing the location of the sensitive region.

[0020] Furthermore, the sensitive areas are dynamically and adaptively masked to obtain the teaching video stream, while retaining the original video stream, specifically as follows:

[0021] Based on the binarized mask image, the motion trajectory and size change of the sensitive area in the video are tracked, and the position and size of the masked area are adjusted in real time.

[0022] The masking style is automatically matched according to the video scene and sensitivity. The masking style includes blurring and color overlay. Slightly sensitive areas are blurred, while highly sensitive areas are overlaid with color.

[0023] Add appropriate shielding prompts around the shielded area to complete the sensitization process and obtain the teaching video stream, while retaining the original video stream.

[0024] Furthermore, based on the national cryptographic algorithm, a combination of multi-key encryption and block encryption is used to encrypt the original video stream, resulting in an encrypted original video stream and an encryption key. The encrypted original video stream and the encryption key are then stored together, specifically as follows:

[0025] The original video stream is divided into multiple independent data blocks. An SM4 session key is pre-generated using the national cryptographic algorithm. A different subkey is assigned to each data block. The subkeys are used to encrypt the corresponding data blocks in real time to obtain the encrypted original video stream.

[0026] The SM4 session key and its subkeys are encrypted using the preset SM2 public key to obtain the encryption key. The SM4 session key is stored as the master key in the secure hardware encryption chip.

[0027] The encryption key is associated with and stored in relation to the encrypted original video stream.

[0028] Furthermore, when a user requests to watch the original video stream, a temporary token is generated using the user's private key, the approver's private key, and biometric identification. Specifically:

[0029] When a user requests to watch the original video stream, a data request form is generated, which includes user information, resource ID, request time, and reason for access.

[0030] The first data request form is obtained by signing the data request form using the user's private key;

[0031] When the approver receives the first data application form, he / she verifies the signature in the first data application form, and after the verification is passed, approves the first data application form and signs the approval result with the approver's private key;

[0032] When the approval is granted, the encryption key is decrypted using the approver's private key to obtain the SM4 session key and each subkey;

[0033] The system obtains the user's biometric features for identification, including at least one of fingerprints and facial features. After successful verification, the SM4 session key and each subkey are re-encrypted using the user's SM2 public key, and a temporary token is generated.

[0034] Furthermore, the encrypted original video stream is decrypted based on a temporary token, specifically as follows:

[0035] When the user's player receives the temporary token, it decrypts the temporary token using the user's private key to obtain the re-encrypted SM4 session key and each subkey;

[0036] The encrypted original video stream received from the server is decrypted using the subkey corresponding to the re-encrypted SM4 session key, and then spliced ​​together to obtain the complete original video stream.

[0037] Furthermore, the method for adaptive masking and authorization restoration of sensitive images based on national cryptographic algorithms also includes:

[0038] When a user's permission level is lower than the preset level, the user's access to the original video stream is denied, and a teaching video stream is displayed to the user.

[0039] This application also proposes a sensitive image adaptive blocking and authorization restoration device based on national cryptographic algorithms, including:

[0040] The acquisition module is used to acquire the raw video stream and identify sensitive areas in the raw video stream;

[0041] The shielding module is used to dynamically and adaptively shield sensitive areas to obtain a teaching video stream while preserving the original video stream.

[0042] The encryption module is used to encrypt the original video stream using a combination of multi-key encryption and block encryption based on the national cryptographic algorithm, to obtain the encrypted original video stream and the encryption key, and to store the encrypted original video stream and the encryption key together.

[0043] The request module is used to generate a temporary token by combining the user's private key, the approver's private key, and biometric identification when a user requests to watch the original video stream.

[0044] The decryption module is used to decrypt the encrypted original video stream based on a temporary token.

[0045] This application also proposes a sensitive image adaptive blocking and license restoration device based on national cryptographic algorithms, including:

[0046] One or more processors;

[0047] The memory stores one or more programs, which, when executed by one or more processors, enable the processors to implement the aforementioned method for adaptive masking and authorization restoration of sensitive images based on national cryptographic algorithms.

[0048] This application also proposes a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform the aforementioned sensitive image adaptive masking and authorization restoration method based on national cryptographic algorithms.

[0049] Compared with the prior art, this application has the following beneficial effects:

[0050] By shielding sensitive areas, the original video is transformed into instructional video and encrypted original video. The instructional video meets general needs and protects privacy, while the original video is restored through a secure path to meet in-depth needs, maximizing the value of the recorded data. Furthermore, online real-time approval of user access to encrypted video is achieved through national cryptographic algorithms and digital signatures, and the permission to watch the original video is dynamically assigned, enabling fine-grained control of permissions. Moreover, because sensitive areas of the original video are shielded, the entire chain of user access, permission assignment and approval, and the final encryption process of the encrypted video uses national cryptographic algorithms to ensure the security of data in sensitive areas. Attached Figure Description

[0051] Figure 1 This is a flowchart of a sensitive image adaptive blocking and authorization restoration method based on national cryptographic algorithms provided in an embodiment of this application;

[0052] Figure 2 This is a structural block diagram of a sensitive image adaptive shielding and authorization restoration device based on national cryptographic algorithms provided in an embodiment of this application;

[0053] Figure 3 This is a schematic diagram of a sensitive image adaptive shielding and authorization restoration device based on national cryptographic algorithms provided in an embodiment of this application. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, specific embodiments of this application will be described in further detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are merely for explaining this application and not for limiting it. It should also be noted that, for ease of description, only the parts relevant to this application are shown in the drawings, not all of them. Before discussing exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe operations (or steps) as being processed sequentially, many of these operations can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the operations can be rearranged. A process can be terminated when its operation is completed, but it may also have additional steps not included in the drawings. A process can correspond to a method, function, procedure, subroutine, subroutine, etc.

[0055] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0056] As described in the background technology, the existing technology lacks a solution that can intelligently identify sensitive content, achieve hierarchical display, and deeply bind national cryptographic security capabilities with business processes, thereby achieving secure, controllable, and refined authorization restoration.

[0057] Existing recording systems commonly suffer from a "one-size-fits-all" approach to blocking video content containing sensitive information. This not only undermines the integrity and usability of the original data but also significantly reduces its value for teaching and research. Furthermore, static and coarse-grained access control mechanisms fail to provide fine-grained management of specific content segments or time ranges, leading to risks of unauthorized access and data leakage. General encryption schemes also fail to tightly link decryption permissions to specific business approval processes, making it difficult to effectively implement management systems through technical means.

[0058] In this regard, such as Figure 1 As shown, this embodiment proposes a method for adaptive masking and authorization restoration of sensitive images based on national cryptographic algorithms. The method includes:

[0059] S100. Acquire the raw video stream and identify sensitive areas in the raw video stream;

[0060] S200. Perform dynamic adaptive masking on the sensitive area to obtain the teaching video stream, and retain the original video stream;

[0061] S300. Based on the national cryptographic algorithm, the original video stream is encrypted using a combination of multi-key encryption and block encryption to obtain the encrypted original video stream and the encryption key, and the encrypted original video stream and the encryption key are associated and stored.

[0062] S400: When a user requests to watch the original video stream, a temporary token is generated using the user's private key, the approver's private key, and biometric identification.

[0063] S500: Decrypt the encrypted original video stream based on the temporary token.

[0064] One possible approach is manual review, where operators view the video content frame by frame and manually mark sensitive information such as faces, identification numbers, or specific scenes. Another possible approach is to pre-set a series of keywords or image templates and use a simple pattern matching algorithm to scan the video stream to identify sensitive content matching the pre-set patterns.

[0065] Once sensitive areas are identified, a fixed masking method can be used, such as overlaying a solid-color rectangle on the sensitive area or applying a uniform mosaic effect. The position and size of this masked area can be fixed based on the initial identification results and should not be adjusted as the video content changes. The processed video stream is used as a teaching video stream for viewing in unauthorized scenarios, while the original video stream is saved intact.

[0066] The raw video stream can be divided into several fixed-size data blocks, and a unique encryption key is generated for each data block. These keys can be derived from a master key using a simple hash function. Subsequently, these unique keys are used to encrypt their respective data blocks, forming an encrypted raw video stream. Simultaneously, these encryption keys are packaged together to form an encryption key, which is then stored and associated with the corresponding encrypted raw video stream.

[0067] When a user initiates a viewing request, the system can require the user to provide their private key for authentication, and simultaneously require a pre-defined approver to authorize the viewing using their private key. After successful private key verification by both parties, the system will prompt the user to perform biometric verification, such as fingerprint scanning or facial recognition, to further confirm the user's identity. Once all verification steps are successful, the system will generate a temporary token containing decryption permissions.

[0068] Once a user obtains a temporary token, it is sent to the video playback client or decryption service module. The client or module parses the temporary token, extracts the information needed for decryption, and uses this information to decrypt the encrypted original video stream obtained from the server. After decryption, the user can watch the complete original video stream.

[0069] This embodiment generates a teaching video stream by adaptively masking sensitive areas in the original video stream, effectively balancing privacy protection and data availability, and avoiding the damage to teaching and research value caused by traditional "one-size-fits-all" masking. Simultaneously, by combining multi-key block encryption using national cryptographic algorithms with a temporary token authorization mechanism based on user private keys, approver private keys, and biometric recognition, it achieves refined and dynamic access control of the original video stream, ensuring the secure and compliant use of sensitive data in scenarios such as medical surgery and educational research. Furthermore, it closely links decryption permissions with business approval processes, improving the efficiency of management system implementation.

[0070] In practical applications, sensitive content in video streams may take many forms, such as still images, sensitive words in text and audio, and sensitive behaviors of people. Simply identifying sensitive areas may not be enough to fully and accurately capture all potential sensitive information, thus affecting the effectiveness of subsequent blocking processes.

[0071] Based on this, the process of identifying sensitive regions in the original video stream in this embodiment is based on a pre-trained deep learning model. A pre-trained deep learning model refers to a neural network model that has been trained on a large-scale dataset and learned rich feature representation capabilities. These models typically have powerful feature extraction and pattern recognition capabilities, and can effectively handle complex visual and auditory information. In this embodiment, the model undergoes further fine-tuning or specialized training to accurately identify various types of sensitive content in the video stream. Its role is to provide an efficient, accurate, and intelligent recognition framework to cope with the diversity and complexity of video content.

[0072] To comprehensively identify sensitive areas, this embodiment integrates image recognition, semantic analysis, and behavioral analysis technologies to identify and segment sensitive areas in the original video stream in real time. Image recognition focuses on visual information in video frames, detecting static or dynamic sensitive patterns, signs, text, and other visual elements. Semantic analysis focuses on the audio portion of the video, recognizing and converting speech to text to analyze whether sensitive words or inappropriate language exist in the text content. Behavioral analysis focuses on the actions, postures, and interactions of people in the video to determine whether inappropriate behavior exists. These three analysis methods complement each other, jointly constructing a multimodal sensitive content identification system to ensure comprehensiveness and accuracy. Real-time performance means that the system can process at near-video playback speed, ensuring that sensitive content is detected before it is viewed. Segmentation refers to accurately separating the identified sensitive content from the video frames, determining its specific location and boundaries within the frame. This is typically achieved through pixel-level classification or object detection techniques, so that subsequent masking processing can precisely target sensitive areas rather than the entire frame, thereby preserving the integrity of non-sensitive content to the greatest extent possible.

[0073] In this embodiment, image recognition technology is specifically used to identify static sensitive patterns and text in video footage. By learning and matching image features through a deep learning model, the system can automatically detect these visually sensitive elements. For example, the model can be trained to recognize specific sensitive symbols or text styles, or to determine the presence of inappropriate scenes through scene classification. Semantic analysis technology focuses on the audio portion of the video, with its core function being the parsing of sensitive words in the video's audio. This typically involves Automatic Speech Recognition (ASR) technology, converting the audio content in the video into text, and then using Natural Language Processing (NLP) technology to perform sensitive word filtering, sentiment analysis, or topic identification on the text. By constructing a sensitive word database and semantic rules, the system can accurately capture inappropriate words or phrases appearing in the audio. In this embodiment, behavioral analysis technology is used to determine sensitive behaviors corresponding to human actions and postures. By analyzing the skeleton, key points, and movement trajectories of people in the video, combined with a pre-set behavioral pattern database, the deep learning model can identify human behaviors with sensitive characteristics. For example, the model can be trained to recognize fighting, sexually suggestive actions, etc., thereby achieving the detection of dynamic sensitive behaviors.

[0074] After identifying and segmenting sensitive regions, the system outputs a binary mask representing the location of these regions. A binary mask is image data where each pixel has only two possible values, typically 0 or 1. In the sensitive region mask, a pixel with a value of 1 indicates that the location belongs to a sensitive region, while a pixel with a value of 0 indicates a non-sensitive region. This mask precisely defines the shape and location of the sensitive regions, providing accurate input for subsequent dynamic adaptive masking processing and ensuring the accuracy and effectiveness of the masking.

[0075] In some implementations, the step of dynamically adaptively masking the sensitive area to obtain a teaching video stream and retaining the original video stream includes: tracking the motion trajectory and size changes of the sensitive area in the video based on the binarized mask image, and adjusting the position and size of the masked area in real time; automatically matching a masking style according to the video scene and sensitivity level, wherein the masking style includes blurring and color overlay, wherein slightly sensitive areas are blurred and highly sensitive areas are color overlayed; adding corresponding masking prompt information around the masked area to complete the sensitization processing to obtain the teaching video stream, and retaining the original video stream.

[0076] Specifically, based on the binarized mask image, the system tracks the motion trajectory and size changes of sensitive regions in the video, adjusting the position and size of the masked region in real time to ensure that the masked region accurately follows the dynamic changes of sensitive content in the video. After obtaining the binarized mask image representing the position of the sensitive region, the system uses video processing techniques, such as target tracking algorithms (e.g., Kalman filtering, optical flow, deep learning target tracking models), to continuously analyze the sensitive region indicated by the mask image. By analyzing pixel changes, feature point matching, or region deformation between consecutive frames, the system can accurately predict and detect the position and size of the sensitive region in subsequent frames. Based on this tracking result, the coordinates and size of the masked region are updated in real time to ensure that it always remains consistent with the sensitive region, thereby achieving a dynamic and accurate masking effect.

[0077] The system automatically matches a masking style based on the video scene and its sensitivity level. These masking styles include blurring and color overlay, with slightly sensitive areas using blurring and highly sensitive areas using color overlay. This technology provides diverse and intelligent masking strategies. After identifying sensitive areas, the system further evaluates the video scene in which the area is located (e.g., background complexity, lighting conditions, etc.) and its sensitivity level (e.g., risk rating of sensitive content using a deep learning model). Based on these evaluation results, the system automatically selects the most suitable style from a pre-set masking style library. Masking styles may include, but are not limited to: blurring, which reduces detail clarity by smoothing pixels; mosaic processing, which blocks pixels to achieve a blurring effect; and color overlay, which completely obscures sensitive areas with solid color blocks. Specifically, for areas with low sensitivity, blurring can be used to preserve the overall continuity of the video while protecting privacy; while for areas with high sensitivity, more thorough masking methods such as color overlay are used to ensure that sensitive information is not leaked.

[0078] Adding appropriate sensitization information around the sensitized area completes the sensitization process, resulting in the teaching video stream, while preserving the original video stream. This technical feature aims to improve user experience and information transparency. After sensitizing the sensitive area, the system overlays a layer of visual sensitization information at or near the edge of the sensitized area. This sensitization information can be text (such as "Sensitive content has been sensitized"), icons (such as warning symbols), or semi-transparent borders, clearly informing viewers that the area has been processed. Adding sensitization information not only prevents viewers from misunderstanding the video content but also enhances the professionalism and standardization of the teaching video stream. After completing the above processing, a teaching video stream for users to view is generated. Simultaneously, the original video stream is completely preserved for subsequent restoration under authorized conditions.

[0079] In some implementations, a combination of multi-key encryption and block encryption based on national cryptographic algorithms is used to encrypt the original video stream, resulting in an encrypted original video stream and an encryption key. This encrypted original video stream and the encryption key are then stored together. Specifically, the original video stream is divided into multiple independent data blocks. Since the original video stream is typically a continuous data stream, directly encrypting it as a whole may lead to inefficiency and difficulty in achieving fine-grained security control. By dividing the video stream into multiple independent data blocks, such as according to video frames, keyframe intervals, fixed time lengths (e.g., several seconds), or fixed data sizes (e.g., megabyte levels), a foundation can be laid for subsequent parallel processing and independent encryption, thereby improving encryption efficiency and supporting more flexible key management.

[0080] SM4 session keys are pre-generated using Chinese national cryptographic algorithms. As a symmetric encryption algorithm key, the pre-generation of the SM4 session key ensures the randomness and security of the encryption process and serves as the master key in the entire encryption system, used to derive or manage subsequent subkeys. Pre-generating SM4 session keys helps reduce the computational resource requirements during real-time encryption of video streams.

[0081] Building upon this, a different subkey is assigned to each data block. Encrypting each individual data block with a different subkey significantly improves encryption security. Even if an attacker successfully cracks a subkey, they can only decrypt the corresponding data block and cannot affect the security of the entire video stream. These subkeys can be generated from the SM4 session key using a key derivation function (KDF) combined with the unique identifier or index of the data block, thereby achieving effective key management and distribution.

[0082] The corresponding data blocks are encrypted in real time using the subkeys to obtain the encrypted original video stream. Real-time encryption means that as soon as a data block is formed during the generation or transmission of the original video stream, its corresponding subkey is used for encryption processing. This block-based real-time encryption method, combined with different subkeys, allows the encryption process to be executed in parallel, thereby effectively improving the encryption processing efficiency of the video stream and further enhancing data security.

[0083] To ensure the security of key transmission and storage, the SM4 session key and all subkeys are encrypted using a preset SM2 public key to obtain the encryption key. SM2 is an asymmetric cryptographic algorithm whose public-key encryption feature securely protects symmetric keys. Encrypting the SM4 session key and all subkeys using the preset SM2 public key ensures the confidentiality of these critical keys during transmission and storage. Only authorized entities possessing the corresponding SM2 private key can decrypt and obtain these symmetric keys, thus solving the security issues of key distribution and storage.

[0084] The SM4 session key is stored as the master key in a secure hardware encryption chip. Storing the SM4 session key, which serves as the master key, in a secure hardware encryption chip, such as a Hardware Security Module (HSM) or Trusted Platform Module (TPM), provides the highest level of physical and logical security protection. Secure hardware encryption chips typically possess features such as tamper-proof, theft-proof, and non-exportable keys, effectively preventing unauthorized access or copying of the key and greatly enhancing the security of the entire encryption system.

[0085] The encryption key is associated with and stored in relation to the encrypted original video stream. This association can take the form of an index in metadata, a database record, or file header information, ensuring a clear correspondence between the encrypted video stream data and the encryption key used to decrypt it. This allows for convenient and accurate retrieval of the corresponding encryption key when decryption is needed, guaranteeing a smooth decryption process.

[0086] In some implementations, when a user requests to watch the original video stream, a temporary token is generated using the user's private key, the approver's private key, and biometric identification. Specifically, when a user requests to watch the original video stream, the system first generates a data request form. This data request form records detailed user information, resource ID, request time, and reason for access, providing the necessary information basis for subsequent approval processes. The data request form is then digitally signed using the user's private key to generate a first data request form. This step aims to ensure the authenticity and non-repudiation of the request, proving that the request was indeed initiated by the user.

[0087] Once the approver receives the first data request form, the system verifies the user signature on the form to confirm its legitimacy. After successful signature verification, the approver approves the first data request form and signs the approval result using their private key. This step introduces a multi-party authorization mechanism to ensure that access to sensitive video streams requires strict review and approval, enhancing the authority and traceability of the decision.

[0088] S440. Upon approval, the system will decrypt the previously encrypted encryption key using the approver's private key, thereby obtaining the SM4 session key and its subkeys. This means that the critical key used to decrypt the video stream will only be released after authorization. To further enhance security, the system will obtain the user's biometric identification, which includes at least one of fingerprints and facial features. S450. After successful biometric identification verification, the system will re-encrypt the SM4 session key and its subkeys using the user's SM2 public key and generate the temporary token.

[0089] In some implementations, the method for decrypting the encrypted original video stream based on the temporary token specifically includes: when the user's player receives the temporary token, decrypting the re-encrypted SM4 session key and each sub-key from the temporary token using the user's private key; decrypting the encrypted original video stream received from the server using the sub-keys corresponding to the re-encrypted SM4 session key, and splicing them together to obtain the complete original video stream.

[0090] In this context, the user's player refers to the application or software module running on the user's terminal device, whose main function is to receive, process, and play video streams. When the player receives a temporary token, it means that the user has passed a series of security checks, including authentication, permission approval, and biometric recognition, and has been authorized to access the encrypted original video stream. This temporary token is typically sent from the server to the user's player via a secure communication channel, serving as a credential for subsequent decryption. The user's private key is the private portion of the asymmetric encryption key pair paired with the user's SM2 public key, and is securely held only by the user. According to the above implementation, the temporary token contains the SM4 session key and its subkeys, re-encrypted using the user's SM2 public key. Therefore, after receiving the temporary token, the user's player needs to use the user's locally stored or securely obtained private key to decrypt the encryption key information contained in the temporary token. This decryption process uses the SM2 algorithm to restore the re-encrypted SM4 session key and its subkeys to the original SM4 session key and its subkeys, which are necessary for subsequent decryption of the encrypted original video stream. This mechanism ensures that only legitimate users with the corresponding private key can obtain the actual decryption key, thereby guaranteeing the confidentiality and security of the key. After obtaining the SM4 session key and its subkeys, the user's player gains the ability to decrypt the encrypted original video stream. The encrypted original video stream is obtained by dividing the original video stream into multiple independent data blocks, and encrypting each data block in real time using different subkeys generated from the SM4 session key, according to the implementation method described above. Therefore, when the player receives these encrypted video data blocks from the server, it decrypts the corresponding encrypted data block using the SM4 decryption algorithm based on the subkey corresponding to each data block (e.g., by matching the data block's index or metadata). The SM4 algorithm is a Chinese national standard symmetric encryption algorithm capable of efficiently encrypting and decrypting data. After each encrypted video data block is successfully decrypted, these decrypted data blocks need to be reassembled in their original order. The user's player is responsible for sequentially splicing these independent decrypted data blocks to reconstruct a complete and continuous original video stream. This splicing process is a crucial step in ensuring the integrity of the video content and smooth playback, allowing the user to watch the unblocked original video content.

[0091] In some implementations, when the user's permission level is lower than a preset level, the user's access to the original video stream is denied, and the teaching video stream is displayed to the user.

[0092] Specifically, a user's permission level is an identifier assigned by the system to each user or user group, recognizing their scope of operations and access levels within the system. This permission level can be implemented by associating a permission value (e.g., a number, string, or role identifier) ​​with each user account in the user management system, or managed through a role-based access control (RBAC) model. A preset permission level is a baseline permission level pre-set by the system administrator or policy maker based on factors such as business needs and data sensitivity. For example, only users with a permission level higher than "ordinary user" are allowed to access the raw video stream. When a user requests to watch the raw video stream, the system queries the user's permission level and compares it with the preset level.

[0093] When the system determines that a user's permission level is below a preset level, it will deny the user access to the original video stream. This means the system will interrupt the subsequent decryption and transmission of the original video stream. This denial operation can be performed early in the request processing flow, such as setting a permission checkpoint before generating a temporary token or before decrypting the encrypted original video stream. Once the permission check fails, the system will immediately return an access denied response, thereby avoiding unnecessary decryption or data transmission operations and effectively saving system resources.

[0094] Meanwhile, to provide a user-friendly experience and meet users' basic needs for understanding the content, the system will display the instructional video stream to the user. This instructional video stream is a dynamically adaptively masked version and does not contain sensitive information, therefore it can be safely displayed to all users. In the logic of denying access to the original video stream, the system can redirect requests from the player or client to the address of the instructional video stream, or directly send the instructional video stream's data stream to the client, ensuring that users can still obtain processed alternative content when they cannot access the original content.

[0095] With the deep integration of information technology into fields such as healthcare and education, video content generated by recording and broadcasting systems often contains sensitive information. Existing technologies mainly suffer from the problem of "one-size-fits-all" global blocking, which significantly reduces the integrity and availability of the original data; static and coarse-grained access control mechanisms cannot achieve fine-grained management based on specific content segments or time ranges; and security is disconnected from business operations, failing to link decryption permissions with specific business approval processes, thus leading to privacy leaks, data breaches, and ethical risks.

[0096] This embodiment combines dynamic adaptive shielding with multi-key encryption and block encryption based on national cryptographic algorithms, and introduces a temporary token authorization process based on user private key, approver private key and biometric recognition. This achieves precise shielding of sensitive areas and fine-grained access control of the original video stream, maximizing data availability while ensuring privacy and security, and strictly binding decryption permissions to the business approval process.

[0097] It should be noted that the method of this disclosure embodiment can be executed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method of this disclosure embodiment, and the multiple devices will interact with each other to complete the method described.

[0098] It should be noted that the above description describes some embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0099] like Figure 2 As shown, based on the same inventive concept and corresponding to any of the above embodiments, this embodiment also proposes a sensitive image adaptive shielding and authorization restoration device based on the national cryptographic algorithm. The device includes an acquisition module 10 for acquiring the original video stream and identifying sensitive areas in the original video stream; a shielding module 20 for dynamically and adaptively shielding the sensitive areas to obtain a teaching video stream and retaining the original video stream; an encryption module 30 for encrypting the original video stream using a combination of multi-key encryption and block encryption based on the national cryptographic algorithm to obtain an encrypted original video stream and an encryption key, and storing the encrypted original video stream and the encryption key together; a request module 40 for generating a temporary token using the user's private key, the approver's private key, and biometric identification when a user requests to view the original video stream; and a decryption module 50 for decrypting the encrypted original video stream based on the temporary token.

[0100] For ease of description, the above system is described by dividing it into various modules based on their functions. Of course, in implementing this disclosure, the functions of each module can be implemented in one or more software and / or hardware.

[0101] The system described in the above embodiments is used to implement the corresponding sensitive image adaptive blocking and authorization restoration method based on the national cryptographic algorithm in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0102] Based on the same inventive concept, corresponding to any of the above embodiments, such as Figure 3 As shown, this embodiment also discloses a sensitive image adaptive shielding and authorization restoration device based on national cryptographic algorithms, including: a processor 31, a memory 32, a communication device 33, an input device 34, and an output device 35. The number of processors 31 and the number of memories 32 in this wind turbine gearbox temperature visualization device can be one or more. The processor 31, memory 32, communication device 33, input device 34, and output device 35 of this sensitive image adaptive shielding and authorization restoration device based on national cryptographic algorithms can be connected via a bus or other means.

[0103] The memory 32, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as the program instructions / modules corresponding to the sensitive image adaptive masking and authorization restoration method based on national cryptographic algorithms in any of the above embodiments. The memory 32 may mainly include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a function; the data storage area may store data created based on the use of the device, etc. Furthermore, the memory 32 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the device via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0104] The communication device 33 is used for data transmission.

[0105] The processor 31 executes various functional applications and data processing of the device by running software programs, instructions and modules stored in the memory 32, thereby realizing the above-mentioned sensitive screen adaptive shielding and authorization restoration method based on national cryptographic algorithms.

[0106] Input device 34 can be used to receive input digital or character information, and to generate key signal inputs related to user settings and function control of the device. Output device 35 may include display devices such as a display screen.

[0107] The aforementioned sensitive image adaptive masking and authorization restoration device based on national cryptographic algorithms can be used to execute the sensitive image adaptive masking and authorization restoration method based on national cryptographic algorithms provided in the above embodiments, and has corresponding functions and beneficial effects.

[0108] Based on the same inventive concept, corresponding to any of the above embodiments, this embodiment also provides a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to execute a sensitive image adaptive masking and authorization restoration method based on national cryptographic algorithms.

[0109] Storage medium – any type of memory device or storage apparatus. The term “storage medium” is intended to include: mounting media, such as CD-ROMs, floppy disks, or magnetic tape devices; computer system memory or random access memory, such as DRAM, DDRRAM, SRAM, EDORAM, Rambus RAM, etc.; non-volatile memory, such as flash memory, magnetic media (e.g., hard disks or optical storage); registers or other similar types of memory elements, etc. Storage medium may also include other types of memory or combinations thereof. Furthermore, storage medium may reside in a first computer system in which a program is executed, or it may reside in a different second computer system connected to the first computer system via a network (such as the Internet). The second computer system can provide program instructions to the first computer for execution. The term “storage medium” can include two or more storage media residing in different locations (e.g., in different computer systems connected via a network). Storage medium may store program instructions (e.g., specifically implemented as a computer program) executable by one or more processors.

[0110] Of course, the computer-executable instructions provided in the embodiments of this application are not limited to the above-mentioned method for adaptive masking and authorization restoration of sensitive images based on national cryptographic algorithms, but can also perform related operations in the method for adaptive masking and authorization restoration of sensitive images based on national cryptographic algorithms provided in any embodiment of this application.

[0111] The sensitive image adaptive shielding and authorization restoration device, storage medium, and sensitive image adaptive shielding and authorization restoration equipment based on national cryptographic algorithms provided in the above embodiments can execute the sensitive image adaptive shielding and authorization restoration method based on national cryptographic algorithms provided in any embodiment of this application. For technical details not described in detail in the above embodiments, please refer to the sensitive image adaptive shielding and authorization restoration method based on national cryptographic algorithms provided in any embodiment of this application.

[0112] The above description is merely a preferred embodiment and the technical principles employed in this application. This application is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions that can be made by those skilled in the art will not depart from the scope of protection of this application. Therefore, although this application has been described in detail through the above embodiments, this application is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of this application. The scope of this application is determined by the scope of the claims.

Claims

1. A method for adaptive masking and authorization restoration of sensitive images based on national cryptographic algorithms, characterized in that, It should include at least the following steps: The system acquires the original video stream and, based on a pre-trained deep learning model, identifies and segments sensitive regions in the original video stream in real time through image recognition, semantic analysis, and behavior analysis, outputting a binary mask image representing the location of the sensitive region. Among these, image recognition is used to identify static sensitive patterns and text, semantic analysis is used to parse sensitive words in the video audio, and behavior analysis is used to determine the sensitive behaviors corresponding to human actions and postures. Based on the binarized mask image, the motion trajectory and size change of the sensitive region in the video are tracked and dynamic adaptive masking is performed to obtain the teaching video stream, while the original video stream is preserved. The original video stream is encrypted using a combination of multi-key encryption and block encryption based on the national cryptographic algorithm, resulting in an encrypted original video stream and an encryption key. The encrypted original video stream and the encryption key are then stored together. When a user requests to watch the original video stream, a temporary token is generated using the user's private key, the approver's private key, and biometric identification. The encrypted original video stream is decrypted based on the temporary token; Specifically, based on the binarized mask image, the motion trajectory and size changes of the sensitive region in the video are tracked and dynamically adaptively masked to obtain a teaching video stream, while retaining the original video stream, including: The position and size of the shielding area are adjusted in real time based on the movement trajectory and size changes of the sensitive area in the video. The masking style is automatically matched according to the video scene and sensitivity. The masking style includes blurring and color overlay, wherein slightly sensitive areas are blurred and highly sensitive areas are overlaid with color. Add appropriate shielding prompts around the shielded area to complete the sensitization process and obtain the teaching video stream, while retaining the original video stream; When a user requests to watch the original video stream, a temporary token is generated using the user's private key, the approver's private key, and biometric identification, including: When a user requests to watch the original video stream, a data request form is generated, which includes user information, resource ID, request time, and reason for access. The data request form is signed using the user's private key to obtain a first data request form; When the approver receives the first data application form, he / she verifies the signature in the first data application form, and after the verification is passed, approves the first data application form and signs the approval result with the approver's private key; When the approval is granted, the encryption key is decrypted using the approver's private key to obtain the SM4 session key and each subkey; The system acquires the user's biometric features for identification, including at least one of fingerprints and facial features. After successful verification, the SM4 session key and each subkey are re-encrypted using the user's SM2 public key, and a temporary token is generated.

2. The method for adaptive masking and authorization restoration of sensitive images based on national cryptographic algorithms as described in claim 1, characterized in that, The original video stream is encrypted using a combination of multi-key encryption and block encryption based on the national cryptographic algorithm, resulting in an encrypted original video stream and an encryption key. The encrypted original video stream and the encryption key are then associated and stored, including: The original video stream is divided into multiple independent data blocks. An SM4 session key is pre-generated using the national cryptographic algorithm. A different subkey is assigned to each data block. The corresponding data blocks are encrypted in real time using the subkeys to obtain the encrypted original video stream. The SM4 session key and each subkey are encrypted using the preset SM2 public key to obtain the encryption key, wherein the SM4 session key is stored as the master key in the security hardware encryption chip; The encryption key is associated with and stored in relation to the encrypted original video stream.

3. The method for adaptive masking and authorization restoration of sensitive images based on national cryptographic algorithms as described in claim 1, characterized in that, Decrypting the encrypted original video stream based on the temporary token includes: When the user's player receives the temporary token, it decrypts the temporary token using the user's private key to obtain the re-encrypted SM4 session key and each subkey; The encrypted original video stream received from the server is decrypted using the subkey corresponding to the re-encrypted SM4 session key, and then spliced ​​together to obtain the complete original video stream.

4. The method for adaptive masking and authorization restoration of sensitive images based on national cryptographic algorithms as described in claim 1, characterized in that, Also includes: When the user's permission level is lower than the preset level, the user's access to the original video stream is denied, and the teaching video stream is displayed to the user.

5. A sensitive image adaptive blocking and authorization restoration device based on national cryptographic algorithms, characterized in that, include: The acquisition module is used to acquire the original video stream and, based on a pre-trained deep learning model, to identify and segment sensitive regions in the original video stream in real time through image recognition, semantic analysis, and behavior analysis, and output a binary mask image representing the location of the sensitive region; wherein, image recognition is used to identify static sensitive patterns and text, semantic analysis is used to parse sensitive words in video and audio, and behavior analysis is used to determine the sensitive behaviors corresponding to human actions and postures. The masking module is used to track the motion trajectory and size change of the sensitive region in the video based on the binarized mask image and perform dynamic adaptive masking processing to obtain the teaching video stream while retaining the original video stream; The encryption module is used to encrypt the original video stream based on the national cryptographic algorithm using a combination of multi-key encryption and block encryption, to obtain the encrypted original video stream and the encryption key, and to store the encrypted original video stream and the encryption key together. The request module is used to generate a temporary token by combining the user's private key, the approver's private key, and biometric identification when the user requests to watch the original video stream. A decryption module is used to decrypt the encrypted original video stream based on the temporary token; Specifically, the shielding module is used for: The position and size of the shielding area are adjusted in real time based on the movement trajectory and size changes of the sensitive area in the video. The masking style is automatically matched according to the video scene and sensitivity. The masking style includes blurring and color overlay, wherein slightly sensitive areas are blurred and highly sensitive areas are overlaid with color. Add appropriate shielding prompts around the shielded area to complete the sensitization process and obtain the teaching video stream, while retaining the original video stream; Specifically, the request module is used for: When a user requests to watch the original video stream, a data request form is generated, which includes user information, resource ID, request time, and reason for access. The data request form is signed using the user's private key to obtain a first data request form; When the approver receives the first data application form, he / she verifies the signature in the first data application form, and after the verification is passed, approves the first data application form and signs the approval result with the approver's private key; When the approval is granted, the encryption key is decrypted using the approver's private key to obtain the SM4 session key and each subkey; The system acquires the user's biometric features for identification, including at least one of fingerprints and facial features. After successful verification, the SM4 session key and each subkey are re-encrypted using the user's SM2 public key, and a temporary token is generated.

6. A device for adaptive masking and authorization restoration of sensitive images based on national cryptographic algorithms, characterized in that, include: One or more processors; The memory stores one or more programs, which, when executed by the one or more processors, enable the one or more processors to implement the sensitive image adaptive masking and authorization restoration method based on the national cryptographic algorithm as described in any one of claims 1 to 4.

7. A storage medium containing computer-executable instructions, characterized in that, When executed by a computer processor, the computer-executable instructions are used to perform the sensitive image adaptive blocking and authorization restoration method based on the national cryptographic algorithm as described in any one of claims 1 to 4.

Images