Image data processing method, cloud server and terminal client
By configuring an independent permission chain for each sensitive region in an image, and combining deep learning and dynamic factors, the problems of coarse permission control and weak anti-attack capabilities in existing technologies are solved. This enables fine-grained access control and dynamic permission management of image data, enhancing system security and compliance.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-12
- Publication Date
- 2026-04-10
AI Technical Summary
Existing image privacy protection technologies have coarse access control, lack granular differentiation, have weak anti-attack capabilities, cannot determine access permissions based on dynamic context information, and are difficult to adapt to the complex needs of multi-user/multi-terminal/multi-organizational environments.
It employs an encryption mechanism with an independent permission chain for each sensitive area, combined with dynamic factors and threshold strategies. It identifies sensitive areas through deep learning, generates permission chain metadata and digitally signs it, supports multi-factor decryption control, and records decryption behavior.
It achieves fine-grained access control for image data, enhances the system's resistance to attacks, supports dynamic permission updates, meets compliance requirements, and has cross-system adaptability.
Smart Images
Figure CN121842331A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of image data processing technology, specifically to an image data processing method, a cloud server, and a terminal client. Background Technology
[0002] Existing image privacy protection technologies commonly employ unified keys or single access control mechanisms to manage the encryption and decryption of sensitive areas in images (such as faces, ID cards, license plates, etc.). The main methods include:
[0003] (1) Use symmetric or asymmetric encryption algorithms to encrypt the entire image or an image region containing sensitive content;
[0004] (2) Set up a basic decryption permission control mechanism, such as account login, user role verification or simple access permission flags;
[0005] (3) Use irreversible data desensitization methods (such as masking, blurring, and mosaic processing) to process sensitive areas, fundamentally blocking the need for decryption.
[0006] However, the existing solutions described above have the following key drawbacks:
[0007] (1) Coarse access control and lack of granular differentiation: Most solutions only support image-level or account-level access control and cannot configure differentiated permission policies according to the sensitivity level or application scenario of different areas in the image.
[0008] (2) Weak resistance to attacks and risk of single point of failure: Once the unified key or account information of the encrypted image is leaked, attackers can directly access all sensitive content, making it impossible to achieve the principle of least privilege.
[0009] (3) Lack of contextual judgment ability: Existing systems generally cannot determine whether to grant decryption permission based on dynamic contextual information at the time of access (such as visitor identity, role, terminal device, access time or geographical location);
[0010] (4) Lack of scalability to adapt to multi-user / multi-terminal / multi-organizational environments: Traditional methods are difficult to cope with the complex needs of multi-role collaboration, permission layering and compliance auditing in scenarios such as medical care, government affairs and finance. Summary of the Invention
[0011] The purpose of this disclosure is to overcome the shortcomings of the prior art and provide an image data processing method, a cloud server, and a terminal client. In this image data processing method, each sensitive area has an independent permission chain that does not interfere with each other, thereby improving the security of image data access.
[0012] According to a first aspect of the present disclosure, an image data processing method is provided, comprising a cloud server, and the method includes the following steps:
[0013] Identify several sensitive regions in the target image and configure a permission chain for each of the sensitive regions;
[0014] Symmetric encryption is performed on each of the aforementioned sensitive areas, and the key for each of the aforementioned sensitive areas is encrypted according to the permission chain configured for each of the aforementioned sensitive areas;
[0015] Generate permission chain metadata and digitally sign it, then encapsulate the digitally signed permission chain metadata into encrypted image data and send it to the terminal client.
[0016] In one embodiment, configuring a permission chain for each of the sensitive areas includes:
[0017] A permission chain is configured for each of the aforementioned sensitive areas based on user identity information, usage scenario, time window, location information, dynamic factors, and preset configuration strategies.
[0018] In one embodiment, before performing symmetric encryption on each of the sensitive regions, the method further includes:
[0019] Use a secure random number generator to generate a partition key for each of the sensitive areas;
[0020] Each of the sensitive areas is symmetrically encrypted using the partition key.
[0021] In one embodiment, the generation of permission chain metadata includes:
[0022] The encryption factors for each of the aforementioned sensitive areas are collected. These encryption factors include user identity information, access information, and dynamic verification codes. The access information includes access time, access location, and access device.
[0023] Set threshold values and attribute expressions for the permission chains of each of the aforementioned sensitive regions;
[0024] Each sensitive region, its encryption factor, and the permission chain configured for each sensitive region are packaged together to generate a permission chain data packet, and the validity period and version information are set for the permission chain data packet.
[0025] In one embodiment, before performing symmetric encryption on each of the sensitive regions, the method further includes:
[0026] Set a label for each of the aforementioned sensitive areas;
[0027] A partition index table is generated based on each of the sensitive regions and the corresponding tags.
[0028] According to a second aspect of the present disclosure, an image data processing method is provided, applied to a terminal client, the method comprising:
[0029] Obtain the decryption request initiated by the user for the target sensitive area;
[0030] Collect effective decryption factors from users targeting the aforementioned sensitive areas;
[0031] The user's valid decryption factor for the target sensitive area is compared with the encryption factor in the corresponding area's permission chain metadata to determine whether the user meets the permission chain requirements for the corresponding area.
[0032] If the user meets the permission chain requirements for the corresponding region, the decryption path of the target sensitive region is obtained, and the target sensitive region is decrypted after recovering the key according to the decryption path.
[0033] In one embodiment, the method further includes:
[0034] The user's decryption behavior in the target sensitive area is recorded in the audit log, and the decryption result is returned to the user.
[0035] In one embodiment, the collection of effective decryption factors for the target sensitive area by the user includes:
[0036] Obtain user identity credentials, device fingerprint, geolocation, time window, and dynamic factors;
[0037] The user's identity credentials, device fingerprint, geographical location, time window, and dynamic factors are used as effective decryption factors for the user to access the target sensitive area.
[0038] According to a third aspect of the present disclosure, a cloud server is provided, the cloud server comprising: an identification module, an encryption module, and a generation module; wherein...
[0039] The recognition module is used to identify several sensitive regions in the target image and configure a permission chain for each of the sensitive regions;
[0040] The encryption module performs symmetric encryption on each of the sensitive areas and encrypts the key of each sensitive area according to the permission chain configured for each sensitive area;
[0041] The generation module generates permission chain metadata and performs digital signature, then encapsulates the digitally signed permission chain metadata into encrypted image data and sends it to the terminal client.
[0042] According to a fourth aspect of the present disclosure, a terminal client is provided, the terminal client comprising: an acquisition module, a collection module, a comparison module, and a decryption module; wherein...
[0043] The acquisition module is used to acquire the decryption request initiated by the user for the target sensitive area;
[0044] The collection module is used to collect effective decryption factors for the target sensitive area by the user;
[0045] The comparison module compares the user's valid decryption factor for the target sensitive area with the encryption factor in the corresponding area's permission chain metadata to determine whether the user meets the permission chain requirements for the corresponding area.
[0046] The decryption module is used to obtain the decryption path of the target sensitive area when the user meets the permission chain of the corresponding area, and decrypt the target sensitive area after recovering the key according to the decryption path.
[0047] The image data processing method according to the embodiments of this disclosure can achieve the following effects:
[0048] (1) Implement fine-grained access control for sensitive image areas: Split image data into multiple privacy partitions (such as faces, ID numbers, addresses, etc.) and bind an independent permission chain to each privacy partition. This permission chain can be configured with multiple dimensions such as visitor identity, role, access time, geographical location, and terminal fingerprint, supporting differentiated authorization and the principle of least privilege access, thereby improving compliance and security.
[0049] (2) Enhance the overall anti-attack capability and key security of the system: The system adopts a combination of "k / n threshold mechanism" and attribute encryption to ensure that only access requests that meet the combination conditions can be successfully decrypted, preventing risks such as single-factor cracking, role abuse or key leakage.
[0050] (3) Supports dynamic updates and remote revocation of the permission chain: The permission chain exists as structured metadata and image data decoupled. It supports updating access factors and changing the chain structure as needed. It supports version control and signature verification. Permission adjustments do not require re-encrypting the original image data and have good permission response capabilities.
[0051] (4) Construct an auditable and traceable access behavior chain: The system automatically records the complete factor combination, time, geographical location, decryption area number, device fingerprint and other information for each decryption behavior, which meets the "traceable" access compliance requirements of the Personal Information Protection Law and the Data Security Law.
[0052] (5) It has good versatility and cross-system adaptability: This mechanism is not only applicable to image data privacy protection, but also applicable to multiple data forms such as video frames, structured data fields, and document paragraphs. It can be integrated into existing identity management platforms, encrypted storage systems or zero-trust access control platforms, and has broad adaptability and promotion prospects. Attached Figure Description
[0053] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.
[0054] Figure 1 This is an architecture diagram of an image data processing system provided in an embodiment of the present disclosure.
[0055] Figure 2 This is a flowchart of an image data processing method provided in an embodiment of the present disclosure.
[0056] Figure 3 This is a flowchart of an image data processing method provided in an embodiment of the present disclosure.
[0057] Figure 4 This is a schematic diagram of the encryption process in an image data processing method provided in an embodiment of this disclosure.
[0058] Figure 5 This is a flowchart illustrating an image data processing method provided in an embodiment of the present disclosure.
[0059] Figure 6 This is a schematic diagram of the decryption process in an image data processing method provided in an embodiment of this disclosure.
[0060] Figure 7 This is a structural diagram of a cloud server provided in an embodiment of the present disclosure.
[0061] Figure 8 This is a structural diagram of a terminal client provided in an embodiment of the present disclosure. Detailed Implementation
[0062] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.
[0063] To address the following key technical issues in existing image privacy protection technologies:
[0064] 1. The decryption permission control is coarse-grained, making it difficult to set personalized access policies for different areas of the image;
[0065] 2. Lack of access judgment based on dynamic context conditions (such as identity, time and space, terminal environment);
[0066] 3. Centralized key management presents a single point of failure and security risks.
[0067] 4. The access control policy is static, difficult to update, and lacks auditing and tracing capabilities;
[0068] This invention proposes a structured image sensitive area decryption permission chain mechanism. This mechanism constructs an image encryption and decryption model of "partition access + permission chain control" by chaining multiple independent security control factors (such as user identity, role permissions, access spatiotemporal environment, terminal, dynamic authentication token, etc.) with each sensitive area in the image. This mechanism integrates threshold policies, attribute-based encryption (ABE), multi-factor joint authentication and other technical means to support flexible, fine-grained, secure and auditable access control.
[0069] Figure 1 This is an architecture diagram of an image data processing system provided in an embodiment of this disclosure. Figure 1 As shown, the system comprises: a client and a cloud server working together; the cloud server includes the following key modules: privacy identification module, permission chain generation module, regional encryption module, and metadata encapsulation and signing module; the client includes: decryption control module and auditing and logging module; wherein,
[0070] The privacy recognition module is used to identify sensitive regions in images using deep learning models (such as CNN and Transformer), marking regions including faces, documents, license plates, etc., and generating a "partition index table".
[0071] The permission chain generation module is used to organize user identity, role, usage scenario, time window, location restrictions, dynamic factors, etc. into a permission chain structure according to the configuration policy. Each permission chain supports threshold combination policies (such as 3 / 5) and can be combined with attribute-based encryption (ABE) policy expressions.
[0072] The regional encryption module is used to perform symmetric encryption (such as AES-256) on each sensitive area separately, and to encrypt each encryption key using the threshold scheme and ABE strategy defined by the permission chain.
[0073] Specifically, each privacy partition uses a different symmetric encryption key.
[0074] The symmetric encryption key is generated in the following ways: In the regional encryption module, a secure random number generator (CSPRNG) is called for each partition to directly generate a key; alternatively, the key can be derived through KDF using "master key + partition ID", but the key for each partition will be different.
[0075] The management method for symmetric encryption keys is as follows: the generated partition key is then encrypted according to the permission chain (threshold policy + ABE attribute policy) of the partition, and encapsulated together with the permission chain metadata into JSON, which is then stored and transmitted along with the ciphertext.
[0076] Decryption timing: The corresponding symmetric key will be decrypted only when the request satisfies the multi-factor access chain conditions of the partition, and then used to decrypt the data in that area. This ensures that the key of each partition is both independent and subject to strict multi-factor access control.
[0077] The metadata encapsulation and signing module generates structured permission chain metadata (JSON) for each image file, including decryption factor combinations, threshold requirements, policy version, validity period, and signature. The entire metadata is digitally signed to prevent tampering.
[0078] Specifically, the permission chain metadata is automatically generated by the server in the permission chain generation module. The main process is as follows:
[0079] Collection factors: user identity, role + access time / location / device + dynamic verification code, etc.;
[0080] Configure the strategy: set the threshold value (e.g., 3 / 5) and the attribute expression (ABE multi-attribute combination);
[0081] Assemble metadata: Package information such as partition ID, threshold, attribute list, validity period, and version;
[0082] Digital signature: The server signs the metadata with its private key to ensure tamper-proof protection. Policy updates only require replacing the metadata and re-signing it.
[0083] The decryption control module is used to collect relevant decryption factors (such as user authentication, device fingerprint, OTP, etc.) from the local machine or server when a user requests decryption, and to verify whether the permission chain of the corresponding sensitive area is satisfied.
[0084] The auditing and logging module records complete information for each decryption attempt, including the requester's identity, the factor used, the metadata version, the decryption area, the geographical location and time, and the result, and saves it in an immutable manner.
[0085] Figure 2 This is a schematic flowchart illustrating an image data processing method provided in an embodiment of this disclosure. Figure 2As shown, this method is applied to a cloud server and includes:
[0086] Step 201: Identify several sensitive regions in the target image and configure a permission chain for each of the sensitive regions;
[0087] In this step, deep learning models (such as CNN and Transformer) are used to identify sensitive regions of the image.
[0088] In one embodiment, configuring a permission chain for each of the sensitive areas includes:
[0089] A permission chain is configured for each of the aforementioned sensitive areas based on user identity information, usage scenario, time window, location information, dynamic factors, and preset configuration strategies.
[0090] In this embodiment, according to the configuration strategy, user identity, role, usage scenario, time window, location restriction, dynamic factors, etc. are organized into a permission chain structure, and each permission chain supports threshold combination strategy (such as 3 / 5) and can be combined with attribute base encryption (ABE) strategy expression.
[0091] Step 202: Perform symmetric encryption on each of the sensitive areas, and encrypt the key of each sensitive area according to the permission chain configured for each sensitive area;
[0092] In this step, each sensitive area is individually encrypted using symmetric encryption (such as AES-256), and each encryption key is encrypted using the threshold scheme defined by the permission chain and the ABE policy. It should be noted that each privacy partition uses a different symmetric encryption key.
[0093] In one embodiment, before performing symmetric encryption on each of the sensitive regions, the method further includes:
[0094] Use a secure random number generator to generate a partition key for each of the sensitive areas;
[0095] Each of the sensitive areas is symmetrically encrypted using the partition key.
[0096] In this embodiment, the symmetric encryption key is generated as follows: in the regional encryption module, a secure random number generator (CSPRNG) is called to directly generate a key for each partition; alternatively, the key can be derived through KDF using "master key + partition ID", but ultimately the key for each partition will be different.
[0097] The management method for symmetric encryption keys is as follows: the generated partition key is then encrypted according to the permission chain (threshold policy + ABE attribute policy) of the partition, and encapsulated together with the permission chain metadata into JSON, which is then stored and transmitted along with the ciphertext.
[0098] Decryption timing: The corresponding symmetric key will be decrypted only when the request satisfies the multi-factor access chain conditions of the partition, and then used to decrypt the data in that area. This ensures that the key of each partition is both independent and subject to strict multi-factor access control.
[0099] Step 203: Generate permission chain metadata and digitally sign it, then encapsulate the digitally signed permission chain metadata into encrypted image data and send it to the terminal client.
[0100] In this step, each image file is accompanied by structured permission chain metadata (JSON), which includes decryption factor combinations, threshold requirements, policy version, validity period, and signature. The entire metadata is digitally signed to prevent tampering.
[0101] In one embodiment, as shown in / 3, the generation of permission chain metadata includes:
[0102] Step 301: Collect encryption factors for each of the sensitive areas. The encryption factors include user identity information, access information, and dynamic verification codes. The access information includes access time, access location, and access device.
[0103] Step 302: Set threshold values and attribute expressions for the permission chain of each sensitive area;
[0104] Step 303: Package each of the sensitive areas, the encryption factor of each of the sensitive areas, and the permission chain configured for each of the sensitive areas to generate a permission chain data package, and set the validity period and version information for the permission chain data package.
[0105] In this embodiment, the permission chain metadata is automatically generated by the server in the "Permission Chain Generation Module". The main process is as follows:
[0106] Collection factors: user identity, role + access time / location / device + dynamic verification code, etc.;
[0107] Configure the strategy: set the threshold value (e.g., 3 / 5) and the attribute expression (ABE multi-attribute combination);
[0108] Assemble metadata: Package information such as partition ID, threshold, attribute list, validity period and version;
[0109] Digital signature: The server signs the metadata with its private key to ensure tamper-proof protection. Policy updates only require replacing the metadata and re-signing it.
[0110] Optionally, before performing symmetric encryption on each of the sensitive regions, the method further includes:
[0111] Set a label for each of the aforementioned sensitive areas;
[0112] A partition index table is generated based on each of the sensitive regions and the corresponding tags.
[0113] Figure 4 This is a schematic diagram of the encryption process in an image data processing method provided in an embodiment of this disclosure. Figure 4 As shown, the encryption process includes:
[0114] Step 1: The user uploads an image, and the system calls the privacy recognition module to automatically identify all sensitive areas;
[0115] Step 2: Treat each area as an independent "privacy partition", and configure a permission chain for each partition;
[0116] Step 3: Perform symmetric encryption (AES) on the partitioned data, and encrypt the encryption key using the permission chain scheme;
[0117] Step 4: All permission chain information is encapsulated in a JSON structure along with encrypted image data, and then signed to generate a complete ciphertext image.
[0118] Figure 5 This is a schematic flowchart illustrating an image data processing method provided in an embodiment of this disclosure. Figure 5 As shown, this method is applied to a terminal client and includes:
[0119] Step 501: Obtain the decryption request initiated by the user for the target sensitive area;
[0120] Step 502: Collect the effective decryption factors for the target sensitive area from the user;
[0121] In this step, when the terminal client receives a decryption request from the user for the target sensitive area, it collects the relevant decryption factors (such as user authentication, device fingerprint, OTP, etc.) from the local machine or the server.
[0122] In one embodiment, the collection of effective decryption factors for the target sensitive area by the user includes:
[0123] Obtain user identity credentials, device fingerprint, geolocation, time window, and dynamic factors;
[0124] The user's identity credentials, device fingerprint, geographical location, time window, and dynamic factors are used as effective decryption factors for the user to access the target sensitive area.
[0125] In this embodiment, the decryption control module automatically collects the user's currently available factor credentials in the following manner:
[0126] Identity credentials: Obtain user ID and role information from login status or Token service;
[0127] Device fingerprint: Read client environment parameters (such as browser fingerprint, operating system version, CPU information, MAC address hash, etc.) to generate a unique device identifier;
[0128] Location: Obtain current latitude and longitude or city information through client location permissions (GPS, IP address);
[0129] Time window: Automatically determines whether the time is within the valid time period configured by the policy based on the server time;
[0130] Dynamic factors: Push one-time verification codes (OTPs) to users or trigger third-party authentication (such as SMS / email / App push notifications) and verify their validity.
[0131] These factors are aggregated locally or on an authorized server and then compared with the metadata of the permission chain to determine whether the decryption conditions are met.
[0132] Step 503: Compare the user's valid decryption factor for the target sensitive area with the encryption factor in the corresponding area's permission chain metadata to determine whether the user meets the permission chain requirements for the corresponding area.
[0133] In this step, the user's valid decryption factor for the target sensitive area is compared with the encryption factor in the corresponding area's permission chain metadata to verify whether the user meets the permission chain requirements for the corresponding area.
[0134] Step 504: If the user meets the permission chain of the corresponding area, obtain the decryption path of the target sensitive area, and decrypt the target sensitive area after recovering the key according to the decryption path.
[0135] In this step, "corresponding decryption path" refers to dynamically determining the decryption process and required credential combination based on the threshold policy and attribute-based encryption (ABE) policy defined in the permission chain metadata, obtaining specific decryption conditions and steps from the permission chain metadata, verifying whether the factors provided by the user meet these conditions, and then recovering the encryption key of the corresponding partition.
[0136] Additionally, if the judgment result is not met, meaning the user's current factor credentials do not meet the threshold or attribute requirements specified in the permission chain, the system will perform the following actions:
[0137] The decryption request was rejected, and no decryption key or sensitive data was returned.
[0138] Return a clear "insufficient permissions" or "authentication failed" error message to the user or caller;
[0139] Record the decryption attempt log for this failed attempt, including request time, user identity, missing or unmet factors, for subsequent auditing and security analysis;
[0140] Depending on the system policy, security alerts may be triggered or the number of subsequent attempts may be limited to prevent brute-force attacks or malicious access.
[0141] In this embodiment, the above operations ensure that only requests that meet strict permission conditions can be successfully decrypted, thereby guaranteeing data security and compliance.
[0142] Optionally, the method further includes:
[0143] The user's decryption behavior in the target sensitive area is recorded in the audit log, and the decryption result is returned to the user.
[0144] In this embodiment, each decryption attempt records complete information, including the requester's identity, the factor used, the metadata version, the decryption area, the geographical location and time, the result, etc., and is saved in an immutable manner.
[0145] Figure 6 This is a schematic diagram of the decryption process in an image data processing method provided in an embodiment of this disclosure. Figure 6 As shown, the decryption process includes:
[0146] Step 1: The user initiates a decryption request for a certain image region through the front end or decryption terminal;
[0147] Step 2: The system collects its currently available factor credentials (such as role certificates, device signatures, OTPs);
[0148] Specifically, in the "Decryption Control Module," the system automatically collects the user's currently available factor credentials in the following ways:
[0149] Identity credentials: Obtain user ID and role information from login status or Token service;
[0150] Device fingerprint: Read client environment parameters (such as browser fingerprint, operating system version, CPU information, MAC address hash, etc.) to generate a unique device identifier;
[0151] Location: Obtain current latitude and longitude or city information through client location permissions (GPS, IP address);
[0152] Time window: The system automatically determines whether the time is within the valid time period configured by the policy based on the server time;
[0153] Dynamic factors: Push one-time verification codes (OTPs) to users or trigger third-party authentication (such as SMS / email / App push notifications) and verify their validity.
[0154] These factors are aggregated locally or on an authorized server and then compared with the metadata of the permission chain to determine whether the decryption conditions are met.
[0155] Step 3: Determine whether the threshold and policy are met based on the metadata of the permission chain for the corresponding region;
[0156] Step 4: If satisfied, the system uses the corresponding decryption path to recover the key and completes the decryption of that area.
[0157] In this step, "corresponding decryption path" refers to dynamically determining the decryption process and required credential combination based on the threshold policy and attribute-based encryption (ABE) policy defined in the permission chain metadata. The system retrieves the specific decryption conditions and steps from the permission chain metadata, verifies whether the factors provided by the user meet these conditions, and then recovers the encryption key for the corresponding partition.
[0158] Step 5: The decryption action is recorded in an immutable audit log.
[0159] The image data processing method according to the embodiments of this disclosure can achieve the following effects:
[0160] (1) Implement fine-grained access control for sensitive image areas: Split image data into multiple privacy partitions (such as faces, ID numbers, addresses, etc.) and bind an independent permission chain to each privacy partition. This permission chain can be configured with multiple dimensions such as visitor identity, role, access time, geographical location, and terminal fingerprint, supporting differentiated authorization and the principle of least privilege access, thereby improving compliance and security.
[0161] (2) Enhance the overall anti-attack capability and key security of the system: The system adopts a combination of "k / n threshold mechanism" and attribute encryption to ensure that only access requests that meet the combination conditions can be successfully decrypted, preventing risks such as single-factor cracking, role abuse or key leakage.
[0162] (3) Supports dynamic updates and remote revocation of the permission chain: The permission chain exists as structured metadata and image data decoupled. It supports updating access factors and changing the chain structure as needed. It supports version control and signature verification. Permission adjustments do not require re-encrypting the original image data and have good permission response capabilities.
[0163] (4) Construct an auditable and traceable access behavior chain: The system automatically records the complete factor combination, time, geographical location, decryption area number, device fingerprint and other information for each decryption behavior, which meets the "traceable" access compliance requirements of the Personal Information Protection Law and the Data Security Law.
[0164] (5) It has good versatility and cross-system adaptability: This mechanism is not only applicable to image data privacy protection, but also applicable to multiple data forms such as video frames, structured data fields, and document paragraphs. It can be integrated into existing identity management platforms, encrypted storage systems or zero-trust access control platforms, and has broad adaptability and promotion prospects.
[0165] The image data processing method disclosed herein is highly feasible, as evidenced by the following aspects:
[0166] (1) Clear technological dependence and mature software and hardware conditions: The image recognition model (such as CNN, Transformer), encryption algorithm (AES-256, ABE), and identity authentication mechanism (OTP, device fingerprint, etc.) on which this solution depends are all currently mainstream and available technologies, with readily available open source toolkits or commercial service support, and low implementation cost;
[0167] (2) Module decoupling and flexible deployment: The system architecture supports front-end and back-end separation and modular deployment. The permission chain and image encryption data are completely decoupled, making it suitable for SaaS cloud platforms, local area network private deployments or embedded edge device scenarios.
[0168] (3) It can be compatible with and integrated with existing security infrastructure, such as enterprise identity access management (IAM), PKI public key system, zero trust architecture, security gateway, etc., which can be directly reused and are easy to connect;
[0169] (4) Supported by industrial application needs: This solution can be widely used in high-confidential scenarios such as medical image privacy protection, law enforcement image hierarchical management, financial contract / certificate privacy isolation, and enterprise image asset authorization management, and has clear application scenarios and promotion paths.
[0170] Figure 7 This is a structural diagram of a cloud server provided in an embodiment of this disclosure. Figure 7 As shown, the cloud server 70 includes: an identification module 701, an encryption module 702, and a generation module 703; wherein, the identification module 701 is used to identify several sensitive regions in the target image and configure a permission chain for each sensitive region; the encryption module 702 performs symmetric encryption on each sensitive region and encrypts the key of each sensitive region according to the permission chain configured for each sensitive region; the generation module 703 generates permission chain metadata and performs digital signature, and encapsulates the digitally signed permission chain metadata into encrypted image data and sends it to the terminal client.
[0171] Figure 8 This is a structural diagram of a terminal client provided in an embodiment of this disclosure. Figure 8As shown, the terminal client 80 includes: an acquisition module 801, a collection module 802, a comparison module 803, and a decryption module 804; wherein, the acquisition module 801 is used to acquire the decryption request initiated by the user for the target sensitive area; the collection module 802 is used to collect the valid decryption factors of the user for the target sensitive area; the comparison module 803 is used to compare the valid decryption factors of the user for the target sensitive area with the encryption factors in the permission chain metadata of the corresponding area to determine whether the user meets the permission chain of the corresponding area; the decryption module 804 is used to acquire the decryption path of the target sensitive area when the user meets the permission chain of the corresponding area, and decrypt the target sensitive area after recovering the key according to the decryption path.
[0172] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0173] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0174] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0175] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0176] Although preferred embodiments of this disclosure have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this disclosure.
[0177] Obviously, those skilled in the art can make various modifications and variations to this disclosure without departing from its spirit and scope. Therefore, if such modifications and variations fall within the scope of the claims of this disclosure and their equivalents, this disclosure is also intended to include such modifications and variations.
Claims
1. An image data processing method, characterized in that, Applied to a cloud server, the method includes: Identify several sensitive regions in the target image and configure a permission chain for each of the sensitive regions; Symmetric encryption is performed on each of the aforementioned sensitive areas, and the key for each of the aforementioned sensitive areas is encrypted according to the permission chain configured for each of the aforementioned sensitive areas; Generate permission chain metadata and digitally sign it, then encapsulate the digitally signed permission chain metadata into encrypted image data and send it to the terminal client.
2. The method according to claim 1, characterized in that, The configuration of permission chains for each of the sensitive areas includes: A permission chain is configured for each of the aforementioned sensitive areas based on user identity information, usage scenario, time window, location information, dynamic factors, and preset configuration strategies.
3. The method according to claim 1, characterized in that, Before performing symmetric encryption on each of the sensitive regions, the method further includes: Use a secure random number generator to generate a partition key for each of the sensitive areas; Each of the sensitive areas is symmetrically encrypted using the partition key.
4. The method according to claim 1, characterized in that, The generated permission chain metadata includes: The encryption factors for each of the aforementioned sensitive areas are collected. These encryption factors include user identity information, access information, and dynamic verification codes. The access information includes access time, access location, and access device. Set threshold values and attribute expressions for the permission chains of each of the aforementioned sensitive regions; Each sensitive region, its encryption factor, and the permission chain configured for each sensitive region are packaged together to generate a permission chain data packet, and the validity period and version information are set for the permission chain data packet.
5. The method according to claim 1, characterized in that, Before performing symmetric encryption on each of the sensitive regions, the method further includes: Set a label for each of the aforementioned sensitive areas; A partition index table is generated based on each of the sensitive regions and the corresponding tags.
6. An image data processing method, characterized in that, Applied to a terminal client, the method includes: Obtain the decryption request initiated by the user for the target sensitive area; Collect effective decryption factors from users targeting the aforementioned sensitive areas; The user's valid decryption factor for the target sensitive area is compared with the encryption factor in the corresponding area's permission chain metadata to determine whether the user meets the permission chain requirements for the corresponding area. If the user meets the permission chain requirements for the corresponding region, the decryption path of the target sensitive region is obtained, and the target sensitive region is decrypted after recovering the key according to the decryption path.
7. The method according to claim 6, characterized in that, The method further includes: The user's decryption behavior in the target sensitive area is recorded in the audit log, and the decryption result is returned to the user.
8. The method according to claim 6, characterized in that, The effective decryption factors collected from users for the target sensitive area include: Obtain user identity credentials, device fingerprint, geolocation, time window, and dynamic factors; The user's identity credentials, device fingerprint, geographical location, time window, and dynamic factors are used as effective decryption factors for the user to access the target sensitive area.
9. A cloud server, characterized in that, The cloud server includes: an identification module, an encryption module, and a generation module; wherein, The recognition module is used to identify several sensitive regions in the target image and configure a permission chain for each of the sensitive regions; The encryption module performs symmetric encryption on each of the sensitive areas and encrypts the key of each sensitive area according to the permission chain configured for each sensitive area; The generation module generates permission chain metadata and performs digital signature, then encapsulates the digitally signed permission chain metadata into encrypted image data and sends it to the terminal client.
10. A terminal client, characterized in that, The terminal client includes: an acquisition module, a collection module, a comparison module, and a decryption module; wherein, The acquisition module is used to acquire the decryption request initiated by the user for the target sensitive area; The collection module is used to collect effective decryption factors for the target sensitive area by the user; The comparison module is used to compare the user's valid decryption factor for the target sensitive area with the encryption factor in the corresponding area's permission chain metadata to determine whether the user meets the permission chain requirements for the corresponding area. The decryption module is used to obtain the decryption path of the target sensitive area when the user meets the permission chain of the corresponding area, and decrypt the target sensitive area after recovering the key according to the decryption path.