Intelligent image encryption and access control method and system for large-scale data

Abstract

The invention discloses an intelligent image encryption and access control method and system for large-scale data. The system comprises an intelligent analysis module, a secret key generation module, an encryption storage module, a secret key packaging and mapping module, an access control and credential module, a revocation updating and auditing module and the like. According to the core technical scheme, the method comprises the following steps: constructing a versioned hierarchical key packaging tree, and introducing two complementary version numbers, namely an object version number ObjVer and a policy entry version number PolicyVer; wherein the ObjVer is solidified along with the ciphertext object and is not modified due to permission revocation or strategy change; and the PolicyVer only acts on the secret key packaging packet / packaging mapping and unpackaging voucher verification, and when the secret key packaging packet / packaging mapping and the unpackaging voucher verification are revoked or changed, the PolicyVer is upgraded through the minimum update set and a new packaging mapping is generated. Meanwhile, legal access triggering type repackaging write-back is adopted, updating pressure is converged to a secret key packet side, a ciphertext object is kept unchanged, and an auditable closed loop is formed.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and more specifically, to a method for intelligent image encryption and access control of large-scale data. Background Technology

[0002] In large-scale data scenarios such as medical imaging cloud platforms and urban security image platforms, massive amounts of images typically need to be stored and shared long-term in the cloud or distributed environment, facing high-frequency permission change requirements such as multi-entity collaboration, cross-departmental authorization, and revocation of temporary authorizations. Existing solutions mostly focus on improving image encryption strength or achieving fine-grained access control, but there are still significant engineering bottlenecks in "large-scale key updates triggered by permission revocation or change," making it difficult to balance communication volume, latency, and the thoroughness of revocation, thus failing to fully guarantee cloud security.

[0003] Existing publication 1 (Research on Cloud-based Secure Image Retrieval Methods Supporting Fine-grained Access Control, 2024) proposes a scheme for secure cloud-based image retrieval, pointing out that many schemes use AES and other encryption methods to encrypt images, and further introduce attribute-based encryption to achieve fine-grained access control to protect data confidentiality. However, it also points out that such schemes face problems such as key management difficulties and key leakage, and some attribute-based encryption-based access control schemes have high computational overhead; in large-scale, multi-user scenarios with frequent changes in permissions, it is easy to cause pressure on key updates and distribution, and it is difficult to avoid the increase in system latency and overhead caused by permission changes.

[0004] Existing publication 2 (Research on Image Encryption Technology Based on Hyperchaotic Systems and Intelligent Optimization Algorithms, 2025) proposes an image encryption scheme based on hyperchaotic systems and intelligent optimization algorithms. It emphasizes improving encryption security through algorithm design and points out that high computational complexity leads to long encryption and decryption times, making it difficult to meet the needs of applications such as real-time transmission. However, this type of research focuses on optimizing the encryption algorithm itself and does not address the closed-loop mechanism for permission revocation and key distribution updates under multi-subject access control. When permission changes trigger key updates, it can easily further increase system latency and distribution burden on top of the existing computational time.

[0005] Therefore, there is an urgent need in this field for a key distribution method and system that can still achieve low communication volume, low latency, thorough revocation and auditability when permissions are revoked or changed. Summary of the Invention

[0006] To overcome the aforementioned deficiencies in existing technologies, this invention provides an intelligent image encryption and access control method for large-scale data. This method constructs a versioned hierarchical key encapsulation tree and introduces dual version numbers, ObjVer and PolicyVer. Revocation or modification only upgrades PolicyVer and updates the KeyPackage mapping. Legitimate access triggers re-encapsulation and write-back, while the ciphertext object remains unchanged. This achieves low communication volume, low latency, thorough revocation, and an auditable closed loop, effectively improving the cloud security level of large-scale data and solving the problems mentioned in the background technology.

[0007] To achieve the above objectives, the present invention provides the following technical solution: A method for intelligent image encryption and access control of large-scale data includes the following steps: Step 1: Obtain image data and object identification codes, and generate a sensitivity mapping that includes a set of sensitive region coordinates and sensitivity levels; Step 2: Determine the key granularity based on the sensitivity level and generate the full map data key and the sensitive area data key; Step 3: Perform authenticated symmetric encryption on the image data based on the data key, generate a ciphertext object, and store it; Step 4: Construct a versioned hierarchical key encapsulation tree, generate domain encapsulation keys and policy group encapsulation keys grouped by policy tag codes; introduce object version numbers and policy entry version numbers, encapsulate the data keys into key encapsulation packages bound to policy tag codes and policy entry version numbers, and establish encapsulation mappings.

[0008] Step 5: Authenticate the access request and match it with the policy, and issue a version unblocking certificate containing the policy tag code, policy entry version number and time expiration control fields.

[0009] Step 6: When permission revocation or change is detected, execute the sensitivity versioning minimum update key allocation algorithm: determine the set of affected key encapsulation packets by the encapsulation mapping, establish the policy group entry coverage relationship and calculate the entry update weight, and select the minimum update set Umin; upgrade the policy entry version number of the policy tag code corresponding to Umin and generate a new encapsulation mapping, so that the version unsealing certificate of the old policy entry version number becomes invalid; when a legitimate access is triggered, re-encapsulate the data key and only update the key encapsulation packet and encapsulation mapping, while the ciphertext object remains unchanged.

[0010] Step 7: Generate and save the corresponding audit summary.

[0011] As a further aspect of the present invention, the coordinates of the sensitive area are represented by a rectangular box quadruple, which includes the upper left corner horizontal coordinate, the upper left corner vertical coordinate, the width, and the height, and the sensitivity level is a discrete level from 1 to 5.

[0012] As a further embodiment of the present invention, the sensitivity mapping generation parameters in step one satisfy the following: the candidate region confidence threshold is 0.60, the minimum area of ​​the connected component is 4096 pixels, the overlap region intersection-union ratio threshold is 0.50, and overlapping regions exceeding the intersection-union ratio threshold are merged into bounding rectangles.

[0013] As a further embodiment of the present invention, the key granularity rules in step two include: generating a full-map data key K-map; generating sensitive area data keys K-region,i for sensitive areas with a sensitivity level of not less than 4; and the data key length is 256 bits.

[0014] As a further aspect of the present invention, in step three, the output data random number and data authentication tag with authentication are provided. The data random number has a length of 96 bits, and the data authentication tag has a length of 128 bits. At least two of the following are used as additional authentication data for authentication: object identifier code, policy tag code, object version number ObjVer, and region number. The policy entry version number PolicyVer is not used as the additional authentication data to ensure that the PolicyVer upgrade triggered by permission revocation or change will not cause the ciphertext object to be rewritten.

[0015] As a further embodiment of the present invention, the key encapsulation package in step four includes an object identifier code, a region number, a policy tag code, an object version number ObjVer, a policy entry version number PolicyVer, an encapsulation key ciphertext WrapKey, an encapsulation random number, and an encapsulation authentication tag; the object identifier code is 128 bits, the region number is a 32-bit integer, the policy tag code is a 64-bit encoding, ObjVer is a 32-bit integer that remains unchanged after creation, PolicyVer is a 32-bit integer that monotonically increases with permission revocation or policy change, the encapsulation random number is 96 bits long, and the encapsulation authentication tag is 128 bits long; when the data key length is 256 bits, the WrapKey length is preferably 256 bits, corresponding to the ciphertext portion obtained by performing symmetric encapsulation with authentication on the data key.

[0016] As a further embodiment of the present invention, the update weight in step six is ​​generated by the maximum sensitivity level of the associated objects of the strategy group node and the number of high-sensitivity objects. The number of high-sensitivity objects is defined as the number of objects with a sensitivity level of not less than 4. The weight coefficients a and b for the medical imaging scene are 10 and 1 respectively. The update weight is obtained by multiplying the maximum sensitivity level by a and the number of high-sensitivity objects by b.

[0017] As a further aspect of the present invention, after the version upgrade is completed in step six, the server sets the unblocking certificate status to invalid for versions with the same policy tag code and a policy entry version number (PolicyVer) that is less than the currently valid PolicyVer, and uses the consistency of the policy tag code and the consistency of PolicyVer as the unblocking condition.

[0018] A large-scale intelligent image encryption and access control system includes an intelligent analysis module, a key generation module, an encryption storage module, a key encapsulation and mapping module, an access control and credential module, a revocation and update module, and an audit module. The encryption storage module generates and stores ciphertext objects containing the object version number ObjVer, and the ciphertext objects remain unchanged. The key encapsulation and mapping module maintains a versioned hierarchical key encapsulation tree, key encapsulation packages, and encapsulation mappings with policy tag codes and policy entry version numbers PolicyVer as entry points. The revocation and update module calculates the minimum update set based on coverage relationships and update weights when permissions are revoked or policies are changed, upgrades PolicyVer, generates new encapsulation mappings, invalidates old PolicyVer credentials, and re-encapsulates the data key and writes it back to the key package side when legitimate access is triggered. The audit module stores audit digests.

[0019] As a further aspect of the present invention, the system also includes a ciphertext object storage area and a key package storage area. The ciphertext object storage area stores ciphertext objects, and the key package storage area stores key encapsulation packages and encapsulation mappings. When permissions are revoked or changed, the write updates are concentrated in the key package storage area.

[0020] The technical effects and advantages of the intelligent image encryption and access control method for large-scale data of the present invention are as follows: When permissions are revoked or changed, the present invention quickly locates the set of affected key encapsulation packets based on encapsulation mapping, obtains the minimum update set through coverage relationship and sensitivity level weight, upgrades only a small number of policy group encapsulation keys and invalidates old credentials, avoids the surge in communication volume and latency jitter caused by object-level batch updates, and achieves controllable and thorough revocation.

[0021] This invention updates the version entry and encapsulation mapping applied to the key packet side, preventing batch rewriting or re-encryption in the ciphertext object storage area; the write pressure for reversing changes is reduced from massive object operations to a small number of entry upgrade operations, significantly reducing peak load and storage write amplification risk, and enabling real-time access response to be maintained even in large-scale long-term storage scenarios.

[0022] This invention binds migration write-back to subsequent legitimate access-triggered repackaging write-back, distributes updates according to access frequency and maintains version consistency verification throughout the process, which reduces the pressure of immediate distribution and avoids residual keys from continuing to decrypt old data; at the same time, it records the audit summary of version upgrade, certificate issuance and repackaging write-back, forming a traceable closed loop to meet compliance audit requirements; and at the same time, it can effectively improve the cloud security level of large-scale data. Attached Figure Description

[0023] Figure 1 This is a diagram showing the overall system structure of the present invention; Figure 2This is a schematic diagram of the data key encapsulation and KeyPackage structure of the present invention; Figure 3 This is a flowchart of the minimum update and access-triggered repackaging process for revoking changes in this invention. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] Example 1

[0026] This embodiment is deployed on a medical imaging cloud platform, which provides unified services for multi-departmental shared image reading, cross-hospital consultations, quality control sampling, and compliance audits. The platform receives millions of image objects daily, with a typical resolution of 2048×2048 pixels per object and a storage period of several years. Access is provided by radiologists, clinical physicians, consulting experts, quality control personnel, and auditors. Authorization policies frequently change with the start and end of consultation tasks, patient referrals, cross-departmental collaborations, and quality control sampling. Common events include automatic revocation of temporary authorizations upon expiration, manual immediate revocation, policy changes due to role adjustments, and convergence of access scope due to task archiving. The engineering bottleneck lies in the key updates triggered by revocation or changes: if repackaging or even reencrypting in batches at the object level, the communication and writing volume for key distribution increases sharply during peak periods, causing latency jitter; if revocation is delayed to reduce latency, there is a risk that residual credentials continue to unseal old data keys, resulting in insufficient revocation thoroughness; without a complete chain of evidence connecting "credential issuance—version upgrade—repackaging and writing back," auditing cannot be closed-loop.

[0027] To simultaneously meet the requirements of low communication volume, low latency, thorough revocation, and auditability under the aforementioned real-world conditions, this embodiment employs the closed-loop link of the system of this invention. The encrypted object and key control material are stored separately. The core update for revocation or modification is converged from a full operation at the object level to a minimum update set at the policy group level. Furthermore, the migration write-back is bound to subsequent legitimate access-triggered write-backs, ensuring that the encrypted object remains unchanged.

[0028] like Figure 1 As shown, the system of the present invention includes at least an intelligent analysis module, a key generation module, an encrypted storage module, a key encapsulation and mapping module, an access control and credential module, a revocation and update module, and an audit module, and is equipped with a ciphertext object storage area and a key packet storage area. Figure 1The system exhibits two main paths: the first is the object storage path, where after an image object is accessed, the encryption storage module generates a ciphertext object and writes it into the ciphertext object storage area. Subsequent revocation or modification does not trigger a batch rewrite of this storage area. The second is the key control path, where the intelligent analysis module outputs a sensitivity mapping for the key generation module to determine the key granularity. The data key is processed by the key encapsulation and mapping module to generate a key encapsulation package and encapsulation mapping, which is then written into the key package storage area. The access control and credential module issues version unsealing credentials. The revocation and update module calculates the minimum update set and completes version upgrade and encapsulation mapping update under revocation or modification events. The audit module generates an audit digest by writing back the credential issuance, version upgrade, and recapsulation.

[0029] The platform assigns an object identifier code (ImgID) of 128 bits to each image object. This embodiment uses fixed-length field concatenation encoding (e.g., a combination of institution identifier, inspection number, and timestamp) to support cross-institutional sharing and deduplication indexing. Simultaneously, a region ID (regionid, 32-bit integer) is assigned to each object to distinguish between business and storage domains, and a policy tag (policytag, 64-bit encoding) is associated with each object to represent access policy groups. This invention uses two version numbers: the object version number (ObjVer, 32-bit integer) is written and fixed when the object is first encrypted to generate a ciphertext object; the policy entry version number (PolicyVer, 32-bit integer) only applies to the key encapsulation packet and encapsulation mapping entry, initially set to 1, and monotonically increments when a permission revocation or policy change event occurs. Table 1 shows the engineering parameter configuration for this embodiment.

[0030] Table 1 Engineering Parameter Configuration

[0031] When an image object is accessed by the platform, the intelligent analysis module receives the image data and ImgID, performs sensitive element detection on the image, and outputs a sensitivity map. The sensitivity map includes a set of sensitive region coordinates and a sensitivity level. Sensitive region coordinates are represented by a rectangular quadruple (x, y, w, h), where x is the top-left horizontal coordinate, y is the top-left vertical coordinate, w is the width, and h is the height, all being pixel-level integers. The sensitivity level L is a discrete level from 1 to 5. In this embodiment, the patient identification barcode area and name number range are defined as level 5, the lesion area as level 4, the general tissue area as level 2, and the background area as level 1. This allows the sensitivity level to drive both the key granularity and the revocation / update weight.

[0032] To stabilize the sensitive region set and reduce noise fragmentation, this embodiment adopts the following reproducible rules: the candidate region confidence threshold is set to 0.60, and candidate regions below the threshold are not included in the sensitive region set; the minimum area of ​​connected components is set to 4096 pixels, and connected components smaller than this area are considered noise and are removed; when there is overlap between candidate regions, their intersection-over-union ratio (IoU) is calculated, and overlapping regions with an IoU exceeding 0.50 are merged into bounding rectangles, thereby converging the multi-frame results of the same sensitive entity into a single-frame boundary. The final output sensitivity mapping is written into the object metadata in the form of <regionid=i, (xᵢ,yᵢ,wᵢ,hᵢ),Lᵢ>, where regionid is a 32-bit integer and Lᵢ ranges from 1 to 5. regionid=0 is reserved for the background block of the entire image, and its sensitivity level is fixed at 1, which is used to unify the reading interface for subsequent key granularity and weight calculation. To facilitate subsequent statistics and auditing, this embodiment also stores three derived fields for each object: "region count Nreg, highest level Lmax, and region quantity vector Cnt[1..5]". Nreg is the number of sensitive regions; Lmax is the maximum value of all region levels for this object; and Cnt[k] is the number of regions at level k. These derived fields are directly calculated from the sensitivity mapping and are used to accelerate the weight statistics and audit summary generation in the revocation update algorithm.

[0033] After the sensitivity mapping is generated, the key generation module determines the key granularity and generates data keys based on the sensitivity level. This embodiment generates a full-map data key K-map and generates sensitive region data keys K-region,i for sensitive regions with a sensitivity level of not less than 4. Both the K-map and K-region,i are 256 bits long. The K-map corresponds to regionid=0 and is used for the background block; K-region,i corresponds to regionid=i and is used for the i-th high-sensitivity region block. To ensure traceability and security, this embodiment establishes an index tuple <ImgID,regionid> for each data key within the key management security domain and records the generation timestamp and key usage tag. During the initial encapsulation, the policy tag and ver are bound to the encapsulation result of the key, instead of directly writing the policy tag and ver into the data key generation record, thus avoiding unnecessary coupling caused by "policy changes leading to changes in the data key itself." Key materials are transmitted between modules using controlled handles; plaintext is not entered into the business log, not written to the database in plaintext form, and not returned to the access subject, thereby reducing the key leakage surface.

[0034] After the data key is generated, the encrypted storage module performs authenticated symmetric encryption on the image data based on the data key, forming a ciphertext object and writing it to the ciphertext object storage area. The ciphertext object contains at least ImgID, regionid, policytag, object version number ObjVer, data random number, data authentication tag, and ciphertext payload (corresponding to ciphertext segments for the entire image and sensitive areas). ObjVer is determined during object creation and remains fixed with the ciphertext object; therefore, even if permissions are revoked or policies change subsequently, there is no need to batch rewrite the ciphertext object, thus avoiding object storage write amplification.

[0035] After the encrypted object is stably stored, the key encapsulation and mapping module establishes a versioned hierarchical key encapsulation tree to switch the update unit for revocation or modification from the object level to the policy group level entry point. The policy group entry point is determined by (policytag, PolicyVer): PolicyVer is the version number of the currently valid policy entry point. Revocation or modification can have a uniform impact on a large number of objects by upgrading PolicyVer. Since PolicyVer only exists on the key package side (KeyPackage and encapsulation mapping) and in the credential verification process, and is not written to and bound to the authentication data of the encrypted object, it can simultaneously satisfy the engineering constraints of "revocation takes effect immediately" and "encrypted object remains unchanged".

[0036] Based on this encapsulation tree, this embodiment encapsulates the data key into a KeyPackage bound to the policytag and policyVer, and records the index relationship between (ImgID, regionid) and the entry point (policytag, policyVer) and KeyPackage records in the encapsulation mapping. When revocation or change occurs, the affected KeyPackage set can be directly located through the entry point index without traversing the ciphertext object storage area. To ensure consistency, this embodiment explicitly defines the type and length of the KeyPackage fields according to Table 2, and serializes and saves them in the key packet storage area according to the field order.

[0037] Table 2 KeyPackage Field Definitions

[0038] WrapKey is the ciphertext result after encapsulating the data key. For example... Figure 2As shown, this embodiment uses symmetric encapsulation with authentication to encapsulate the data key: the input is the plaintext data key (preferably 256 bits), and the output consists of WrapKey (a ciphertext portion of the same length as the plaintext), an encapsulated random number (96 bits), and an encapsulated authentication tag (128 bits). Therefore, when using a fixed-length data key, the WrapKey length is the same as the data key length (e.g., 32 bytes), while the authentication tag length is determined by the selected authentication encapsulation algorithm (e.g., 16 bytes). The encapsulation mapping simultaneously records the entry point (policytag, PolicyVer), the key packet record location, and necessary verification information for unsealing consistency verification and audit review; this structure allows the affected KeyPackage set to be directly determined through an index when a revocation or change event occurs, avoiding traversing massive amounts of ciphertext objects.

[0039] When a user initiates a request to access images or for consultation, the access control and credential module performs identity verification and policy matching on the request. Identity verification outputs a SubjectID and a set of attributes, while policy matching outputs a policytag. Based on this, the platform issues a version unblocking credential token. The token must contain at least the SubjectID, policytag, and policy entry version number. Ver The expiration time (texp) and the maximum number of attempts (cntmax) are specified, and these fields are encapsulated with authentication or signed. The additional authentication data always includes the Subject field. ID ,policytag,Policy Ver , texp, cnt max This ensures that the credentials cannot be tampered with and can be identified as invalid by the server.

[0040] Credential verification requires consistency between the policytag and PolicyVer: the server reads the current valid entry point PolicyVercur(policytag) corresponding to the policytag. If the PolicyVer in the token is not equal to PolicyVercur, it is directly rejected; otherwise, texp and cntmax are verified and the number of concurrent attempts is deducted for concurrency safety. This determination transforms revocation from a procedural constraint into an executable conditional verification, providing a definite landing point for revocation to take effect after subsequent version upgrades.

[0041] When the platform detects a permission revocation or change event, the revocation update module executes the sensitivity versioned minimum update key allocation algorithm, which includes a closed-loop process of constructing the affected set, establishing coverage relationships, calculating weights, selecting the minimum update set, upgrading the version, controlling the expiration of old credentials, writing back the access-triggered re-encapsulation, and generating audit digests. In this embodiment, all inputs, calculations, and outputs of the algorithm are defined as computable quantities that can be directly obtained from the system data structure, avoiding unreproducible "pure descriptions".

[0042] like Figure 3 As shown, a revocation or modification event is first parsed into a set P of affected policy tag codes, and the event type (revocation / modification), scope (subject / department / task), trigger timestamp, and operation subject identifier are recorded. The platform then constructs a set A of affected KeyPackages based on encapsulation mapping: for each policytag ∈ P, its current valid policy entry version number PolicyVercur(policytag) is read, the entry is located using the first-level index (policytag, PolicyVercur(policytag)), and the corresponding KeyPackage entry is obtained by expanding the second-level index (ImgID, regionid) and summarizing and deduplicating. Elements of set A are represented by a quadruple e: e = (ImgID, regionid, policytag, PolicyVercur), where PolicyVercur is the entry version number of the entry. This construction process only accesses the key packet storage area and index structure, without scanning the ciphertext object storage area; therefore, the location latency is controllable even with millions of objects.

[0043] After obtaining set A, the platform establishes policy group node coverage relationships. For any policy group node G (uniquely identified by a policy tag), the coverage set C(G) is defined as the set of KeyPackage entries that can be located through secondary indexes under the current valid entry of that node. The constraint for coverage to hold is expressed using the following expression: ;

[0044] Where U is the set of candidate nodes, and U is selected by extracting the deduplicated policytag set from A and mapping it to the corresponding policy group node set. The symbols have the following meanings: A is the set of affected KeyPackage entries; C(G) is the set of entries that node G can locate under its current valid entry point; U is the set of candidate nodes; G∈U indicates that node G is selected from the candidate node set U. The above coverage constraint is used to ensure that the selected node set completely covers A, avoiding the reversal vulnerability where "some affected entries are not covered by the version upgrade".

[0045] After the coverage relationship is established, the platform generates update weights for candidate nodes to ensure that the selection of the minimum update set simultaneously reflects both sensitive risk and high-sensitivity scale. This embodiment defines a sensitivity level reading function L(ImgID, regionid): when regionid=0, the sensitivity level L0 of the entire map is taken; when regionid=i (>0), the sensitivity level Li of that region in the sensitivity map is taken. The maximum sensitivity level MaxLevel(G) is defined as the maximum value of the sensitivity level corresponding to the coverage entry. MaxLevel(G)=max{L(ImgID,regionid)|(ImgID,regionid)∈C(G)} The value ranges from 1 to 5. The High Sensitivity Quantity (HighCnt(G)) is defined as the number of covered entries with a sensitivity level of 4 or higher. ;

[0046] The result is a non-negative integer that can be directly counted. The update weight W(G) is defined as: ;

[0047] Where a and b are configuration coefficients, and in this embodiment, a=10 and b=1; W(G) is the update weight cost of node G; a is used to amplify the sensitivity level items, giving priority to higher levels; b is used to characterize the scale of high sensitivity, giving priority to entry points with more high-sensitivity objects. To reduce the statistical overhead when revocation is triggered, the platform can incrementally update the MaxLevel and HighCnt statistics of the old and new entry points when the access-triggered re-encapsulation write-back and the entry is migrated to the new entry point, so that the weight statistics can be obtained at the entry layer in near real-time when revocation or change is triggered.

[0048] The selection of the minimum update set follows a two-level objective: prioritizing the minimization of the number of update nodes, and minimizing the weight cost under the constraint of minimizing the number of nodes. This embodiment employs deterministic online selection and pruning: first, nodes are selected from largest to smallest based on their coverage contribution to satisfy the coverage constraint as quickly as possible; once the coverage is satisfied, redundant nodes are pruned from the candidate set to reduce the number of nodes; when the number of nodes is the same, the set with the smaller weight cost is selected as the minimum update set Umin. In this embodiment, the coverage contribution is defined as the "number of coverable entries". ;

[0049] Coverage(G) can be obtained by index expansion counting, or it can be approximated by the number of entries maintained at the entry point and precisely verified during the pruning stage, in order to achieve a balance between response latency and accuracy.

[0050] Once Umin is determined, the platform only performs version upgrades and generates new encapsulation mappings for policy group entry points within Umin. For each policytag ∈ Umin, it reads its current valid policy entry version number PolicyVercur and generates a new version number PolicyVernew: ;

[0051] A new version policy group encapsulation key is generated; the old entry point (policytag, PolicyVercur) is set to retired, and the new entry point (policytag, PolicyVernew) is set to active and written into the encapsulation mapping. Meanwhile, [1, PolicyVernew-1] is considered the invalid version range; during credential verification, if the credential PolicyVer falls into the invalid version range, it is directly rejected, thus avoiding the communication pressure caused by reclaiming credentials one by one.

[0052] After the version upgrade is completed, the platform will not immediately repackage and write back all objects in set A in batches to avoid write spikes on the key package side at the time of revocation. In this embodiment, the migration write-back is bound to subsequent legitimate access triggers: when an object is legitimately accessed and needs to be unsealed, the platform repackages its data key with the current entry point (policytag, PolicyVercur) and writes it back to KeyPackage. Before writing back, it checks whether the (ImgID, regionid) record already exists under the new entry point and whether the authentication tag verification is passed; if it exists, it is directly reused and no longer written repeatedly to avoid concurrent write amplification.

[0053] After the data key is repackaged and written back, the accessing subject obtains the data key and performs decryption and authentication verification on the ciphertext object. During decryption, the random number s and authentication tag s stored in the ciphertext object are used, along with additional authentication data consistent with the encryption. K-graph decryption is used for the entire background block, and K-region,i decryption is used for highly sensitive areas. When the accessing subject's permissions only cover the background policy and not the highly sensitive policy, the server only decrypts the background-related data key, leaving the sensitive area ciphertext in an undecryptable state, thus achieving consistent control over key granularity and sensitivity level.

[0054] When voucher issuance, version upgrades, or re-encapsulation write-back occur, the audit module generates and saves an audit summary. The audit summary includes at least the event type, policy tag, old PolicyVersion, new PolicyVersion, trigger timestamp, operating entity, number of affected entry points, Umin size, and write-back object count, and is protected against repudiation. This links the revocation effective point, entry point upgrade scope, old voucher invalidation scope, and migration write-back progress into a chain of evidence, enabling the platform to provide traceable compliance audit evidence.

[0055] This embodiment provides a set of reproducible evaluation criteria examples and gives the computable source for each quantity: the number of affected objects, Naff, is obtained by deduplicating and counting (ImgID, regionid) in set A; under the object-level immediate update criterion, at the revocation time, r key units of each affected object need to be repackaged and written back; under the criterion of this embodiment, at the revocation time, only the entry version number PolicyVer corresponding to the minimum update set Umin is upgraded and a new encapsulation mapping is generated. The KeyPackage length Lpkg can be obtained by summing the field lengths in Table 2. In this embodiment, when ImgID is 16 bytes, regionid is 4 bytes, policytag is 8 bytes, ObjVer is 4 bytes, PolicyVer is 4 bytes, WrapKey is 32 bytes, encapsulated random number is 12 bytes, and encapsulated authentication tag is 16 bytes, Lpkg = 96 bytes. Let Naff = 1,000,000, r = 2, Hhit = 20,000, |Umin| = 50, and the comparison criteria are shown in Table 3.

[0056]

[0057] As shown in Table 3, the key update at the time of revocation or modification converges from a full operation at the object level to a minimum update set upgrade at the policy group level, and the migration write-back is distributed to subsequent legitimate access trigger times, while the ciphertext object remains unchanged. This effect is achieved by encapsulation mapping index positioning, minimum update set selection under the constraint of coverage relationship, sensitivity level-driven weight measurement, determination of the execution point for versioned entry upgrade and old credential expiration, access-triggered re-encapsulation write-back, and closed-loop coupling of the audit evidence chain.

[0058] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0059] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for intelligent image encryption and access control of large-scale data, characterized in that, Includes the following steps: Step 1: Obtain image data and object identification codes, and generate a sensitivity mapping that includes a set of sensitive region coordinates and sensitivity levels; Step 2: Determine the key granularity based on the sensitivity level and generate the full map data key and the sensitive area data key; Step 3: Perform authenticated symmetric encryption on the image data based on the data key, generate a ciphertext object, and store it; Step 4: Construct a versioned hierarchical key encapsulation tree, generate domain encapsulation keys and policy group encapsulation keys grouped by policy tag codes; introduce object version numbers and policy entry version numbers, encapsulate the data keys into key encapsulation packages bound to policy tag codes and policy entry version numbers, and establish encapsulation mappings. Step 5: Authenticate the access request and match it with the policy, and issue a version unblocking certificate containing the policy tag code, policy entry version number and time expiration control fields. Step 6: When permission revocation or change is detected, execute the sensitivity versioned minimum update key allocation algorithm: determine the set of affected key encapsulation packets by the encapsulation mapping, establish the policy group entry coverage relationship and calculate the entry update weight, and select the minimum update set Umin; Upgrade the policy entry version number corresponding to the policy tag code of Umin and generate a new encapsulation mapping, so that the version of the old policy entry version number becomes invalid for the uncapsulation certificate; when a legitimate access is triggered, re-encapsulate the data key and only update the key encapsulation package and encapsulation mapping, while the ciphertext object remains unchanged; Step 7: Generate and save the corresponding audit summary.

2. The intelligent image encryption and access control method for large-scale data according to claim 1, characterized in that... The coordinates of the sensitive area are represented by a rectangular quadruple, which includes the upper left corner x-coordinate, the upper left corner y-coordinate, the width, and the height. The sensitivity level is a discrete level from 1 to 5.

3. The intelligent image encryption and access control method for large-scale data according to claim 1, characterized in that... The sensitivity mapping generation parameters in step one satisfy the following: the candidate region confidence threshold is 0.60, the minimum area of ​​the connected component is 4096 pixels, the cross-union ratio threshold of the overlapping region is 0.50, and the overlapping regions exceeding the cross-union ratio threshold are merged into bounding rectangles.

4. The intelligent image encryption and access control method for large-scale data according to claim 1, characterized in that, The key granularity rules in step two include: generating a full-map data key K-map; generating sensitive area data keys K-region,i for sensitive areas with a sensitivity level of not less than 4; and the data key length is 256 bits.

5. The intelligent image encryption and access control method for large-scale data according to claim 1, characterized in that, The third step involves outputting a symmetric encrypted data random number and a data authentication tag. The random number is 96 bits long, and the data authentication tag is 128 bits long. At least two of the following are included as additional authentication data: object identifier code, policy tag code, object version number ObjVer, and region number. The PolicyVer entry version number is not included in the additional authentication data to ensure that PolicyVer upgrades triggered by permission revocation or change do not lead to the rewriting of the ciphertext object.

6. The intelligent image encryption and access control method for large-scale data according to claim 1, characterized in that, The key encapsulation package in step four includes an object identifier, a region number, a policy tag, an object version number (ObjVer), a policy entry version number (PolicyVer), a ciphertext encapsulation key (WrapKey), an encapsulated random number, and an encapsulated authentication tag. The object identifier is 128 bits, the region number is a 32-bit integer, the policy tag is a 64-bit encoding, ObjVer is a 32-bit integer that remains unchanged after creation, PolicyVer is a 32-bit integer that monotonically increases with permission revocation or policy change, the encapsulated random number is 96 bits long, and the encapsulated authentication tag is 128 bits long. When the data key length is 256 bits, the WrapKey length is preferably 256 bits, corresponding to the ciphertext portion obtained by performing symmetric encapsulation with authentication on the data key.

7. The intelligent image encryption and access control method for large-scale data according to claim 1, characterized in that, The update weight in step six is ​​generated by the maximum sensitivity level of the objects associated with the strategy group node and the number of high-sensitivity objects. The number of high-sensitivity objects is defined as the number of objects with a sensitivity level of not less than 4. The weight coefficients a and b for the medical imaging scene are 10 and 1 respectively. The update weight is obtained by multiplying the maximum sensitivity level by a and the number of high-sensitivity objects by b.

8. The intelligent image encryption and access control method for large-scale data according to claim 1, characterized in that, After the version upgrade is completed in step six, the server will set the unblocking certificate status to invalid for versions with the same policy tag code and a policy entry version number (PolicyVer) that is less than the current valid PolicyVer, and use the consistency of the policy tag code and the consistency of PolicyVer as the unblocking condition.

9. A large-scale intelligent image encryption and access control system, characterized in that, It includes an intelligent analysis module, a key generation module, an encrypted storage module, a key encapsulation and mapping module, an access control and credential module, a revocation and update module, and an audit module; among which the encrypted storage module generates and stores a ciphertext object containing the object version number ObjVer and the ciphertext object remains unchanged; The key encapsulation and mapping module maintains a versioned hierarchical key encapsulation tree, key encapsulation package, and encapsulation mapping with the policy tag code and policy entry version number PolicyVer as the entry point. When permissions are revoked or policies are changed, the revocation update module calculates the minimum update set based on the coverage relationship and update weight, upgrades the PolicyVer, generates a new encapsulation mapping, invalidates the old PolicyVer credentials, and re-encapsulates the data key and writes it back to the key packet side when a legitimate access is triggered; the audit module saves the audit summary.

10. A large-scale data intelligent image encryption and access control system according to claim 9, characterized in that, The system also includes a ciphertext object storage area and a key package storage area. The ciphertext object storage area stores ciphertext objects, while the key package storage area stores key packages and package mappings. When permissions are revoked or changed, write updates are concentrated in the key package storage area.

Images