Cross-terminal collaborative paperless conference office document real-time synchronization system

Abstract

The invention is suitable for the technical field of data synchronization, and provides a cross-terminal collaborative paperless conference office document real-time synchronization system, which comprises a host end, conference participating ends and an authority management end, the host end comprises a key dynamic generation module, a document segmentation encryption module and a data packet distribution module; the conference participating end comprises a permission dynamic generation module and a document decryption and reading module; and the authority management end is used for monitoring the authority level change event of the conference participating end in real time, and updating the dynamic session key packet and the authority token in real time according to the authority level change event of the conference participating end. According to the invention, through a dual encryption binding mechanism and content fragmentation encryption transmission, the transmission and storage security of document synchronization is obviously improved; according to the method, the authority token is generated in combination with the identity information of the current participating end user, dynamic binding of the user identity and document access is achieved, and unauthorized access behaviors such as equipment borrowing, account sharing or login state hijacking of the participating end can be effectively prevented.

Description

Technical Field

[0001] This invention belongs to the field of data synchronization technology, and in particular relates to a real-time synchronization system for paperless meeting and office documents for cross-terminal collaboration. Background Technology

[0002] With the popularization of mobile and green office concepts, collaborative office systems based on paperless meetings have become the mainstream choice for modern enterprises. In a typical meeting scenario, the host needs to synchronize meeting documents in real time to the mobile terminals (such as tablets, laptops, and mobile phones) of multiple participants, supporting simultaneous viewing or annotation by multiple people. Existing document synchronization technologies mostly adopt a centralized server relay and terminal download model, that is, the host uploads the document to the cloud server, and the participants pull the document copy from the server. However, this model has inherent defects when dealing with meeting scenarios with high real-time requirements: document transmission depends on server bandwidth, which can easily cause synchronization delays; there is a risk of data leakage while the document is stored or cached on the server; and once the document is downloaded to the participant's local device, the host loses control over the document flow, making security difficult to guarantee.

[0003] To address the aforementioned issues, some improvements in existing technologies have introduced peer-to-peer transmission and encryption mechanisms. For example, documents can be distributed directly through P2P channels, reducing server intermediaries; or AES encryption can be applied to documents to ensure confidentiality during transmission.

[0004] However, these solutions remain at the transport layer security level, their core assumption being that security is guaranteed as long as the document is transmitted encrypted and permissions are verified once upon user login. But in real-world meeting scenarios, participant permissions change dynamically (e.g., new participants joining mid-meeting, or demoted observers), and the authenticity of participant identities cannot be consistently guaranteed through a single login verification. Existing technologies cannot achieve real-time binding of document content to the dynamic identities of participants, meaning that documents synchronized locally can still be unauthorized accessed after permission changes, posing a serious security risk. Summary of the Invention

[0005] The purpose of this invention is to provide a real-time synchronization system for paperless meeting and office documents across terminals, in order to solve the aforementioned technical problems.

[0006] This invention is implemented as follows: a cross-terminal collaborative paperless meeting and office document real-time synchronization system, including a host terminal, participant terminals, and an access control terminal, wherein the host terminal includes: The key dynamic generation module is used to extract the document feature value of the document to be synchronized and generate a dynamic session key package based on the document feature value; the dynamic session key package includes the document master key and the participant key factor used to encrypt the document master key; The document segmentation and encryption module is used to segment the document to be synchronized into several content fragments, and to encrypt each content fragment using the dynamic session key packet to generate an encrypted fragment data packet. The data packet distribution module is used to distribute the encrypted fragmented data packets to the participating terminals; The participating terminal is used to receive and cache the encrypted fragmented data packets, specifically including: The dynamic permission generation module is used to generate permission tokens in real time based on the identity information of the current participating user. The document decryption and reading module is used to decrypt and reassemble the encrypted fragmented data packets based on the permission token; The permission management terminal is used to monitor permission level change events of participating terminals in real time, and update the dynamic session key package and permission token in real time according to the permission level change events of participating terminals.

[0007] Furthermore, the key dynamic generation module specifically includes: The feature value generation unit is used to respond to the document synchronization command, obtain the document identifier of the document to be synchronized, the current meeting ID, and the host device fingerprint, and generate the document feature value through a hash algorithm; A master key generation unit is used to generate a document master key bound to the document to be synchronized based on the document feature value; The key factor generation unit is used to obtain the identification information of all participants and generate a unique key factor for each participant based on the identification information. The document master key encryption unit is used to encrypt the document master key using the participant key factor of each participant to generate a dynamic session key packet for the corresponding participant.

[0008] Furthermore, the identification information includes the fingerprint of the participating device, the user information of the participant, and their corresponding permission level; the participating key factor is calculated based on the fingerprint of the participating device, the user information of the participant, and their corresponding permission level.

[0009] Furthermore, the document segmentation and encryption module specifically includes: The content segmentation generation unit is used to divide the document to be synchronized into several content segments based on a preset segment size, and assign a unique sequence number to each content segment. The encrypted fragment generation unit is used to perform symmetric encryption on each content fragment using the document master key to obtain several encrypted fragments; The dynamic hash chain generation unit is used to determine the dynamic hash value of each encrypted segment based on the hash function, and form a dynamic hash chain. The fragment encapsulation unit is used to encapsulate each encrypted fragment and its corresponding sequence number and dynamic hash value into an encrypted fragment data packet.

[0010] Furthermore, the method for determining the dynamic hash value is as follows: for each encrypted segment, based on the current timestamp and the hash value of the previous encrypted segment, a hash function is used to generate the dynamic hash value of the current encrypted segment, forming a dynamic hash chain; wherein, the dynamic hash value of the first encrypted segment is generated based on an initial random vector.

[0011] Furthermore, the dynamic permission generation module specifically includes: The identity information collection unit is used to collect the identity information of the current participant in real time after receiving the encrypted fragmented data packet; The identity matching unit is used to match the identity information collected in real time with the identity templates in the preset dynamic authorization identity database, determine the current permission level of the participating user, and generate a corresponding permission token; the permission token includes the current permission level and a decryption key factor corresponding to the participating user's key factor.

[0012] Furthermore, the identity information includes at least one of facial images, voiceprint features, fingerprint features, and account information.

[0013] Furthermore, the identity template includes at least one of the following: a face template, a voiceprint template, a fingerprint template, and an account information template, all of which have read / write or read-only permissions; if the identity information does not match any of the identity templates in the dynamic authorized identity database, then the current permission level of the participating user is determined to be prohibited access.

[0014] Furthermore, the method for decryption and reconstructing the read is as follows: extract the current permission level and decryption key factor from the currently valid permission token; If the current permission level is read-only or read-write, the encrypted fragment data packets stored locally are decrypted using the decryption key factor to obtain the document master key. Then, the encrypted fragments in each encrypted fragment data packet are decrypted sequentially using the document master key. For each content fragment decrypted, its integrity is verified based on the dynamic hash value of the encrypted fragment. If the verification fails, the host is requested to retransmit. All decrypted and verified content fragments are reassembled according to their sequence numbers to restore the original document. If the current access level is denied, the decryption process will be stopped and the received encrypted fragmented data packets will be cleared.

[0015] Another objective of this invention is to provide a method for real-time synchronization of paperless meeting and office documents across terminals, based on the aforementioned real-time synchronization system for paperless meeting and office documents across terminals, which includes the following steps: The host extracts the document feature value of the document to be synchronized and generates a dynamic session key package based on the document feature value; the dynamic session key package includes the document master key and the participant key factor used to encrypt the document master key; The host divides the document to be synchronized into several content fragments and uses the dynamic session key packet to encrypt each content fragment, generating an encrypted fragment data packet; The host distributes the encrypted fragmented data packets to the participants; The participating terminal generates an access token in real time based on the identity information of the current participating user; The participating terminal decrypts and reassembles the encrypted fragmented data packets based on the permission token; The permission management terminal monitors permission level change events of participating terminals in real time and updates the dynamic session key package and permission token in real time according to the permission level change events of participating terminals.

[0016] This invention provides a cross-terminal collaborative paperless meeting document real-time synchronization system. Through a dual encryption binding mechanism and content fragmentation encryption transmission, it significantly improves the security of document synchronization transmission and storage. This invention generates permission tokens based on the identity information of the current participating users, achieving dynamic binding between user identity and document access. This effectively prevents unauthorized access behaviors such as device sharing, account sharing, or login hijacking. Furthermore, by setting up a permission management terminal, this invention can monitor permission level change events of participating terminals in real time, ensuring that permission changes take effect immediately and eliminating the risk of information leakage due to residual data on the participating terminals after permission adjustments. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the structure of a cross-terminal collaborative paperless meeting and office document real-time synchronization system provided in an embodiment of the present invention.

[0018] Figure 2 This is a schematic diagram of the host terminal provided in an embodiment of the present invention.

[0019] Figure 3 This is a schematic diagram of the structure of the participant terminal provided in an embodiment of the present invention.

[0020] Figure 4 This is a schematic diagram of the key dynamic generation module provided in an embodiment of the present invention.

[0021] Figure 5 This is a schematic diagram of the document segmentation and encryption module provided in an embodiment of the present invention.

[0022] Figure 6 This is a schematic diagram of the structure of the permission dynamic generation module provided in an embodiment of the present invention.

[0023] Figure 7 This is a flowchart illustrating the method for real-time synchronization of paperless meeting and office documents across terminals, as provided in an embodiment of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0025] like Figures 1-3 As shown, in one embodiment of the present invention, a cross-terminal collaborative paperless meeting document real-time synchronization system is provided, including a host terminal, participant terminals, and an access control terminal, wherein the host terminal includes: The key dynamic generation module 110 is used to extract the document feature value of the document to be synchronized and generate a dynamic session key package based on the document feature value; the dynamic session key package includes the document master key and the participant key factor used to encrypt the document master key; The document segmentation and encryption module 120 is used to segment the document to be synchronized into several content segments, and to encrypt each content segment using the dynamic session key packet to generate an encrypted segment data packet. The data packet distribution module 130 is used to distribute the encrypted fragmented data packets to the participating terminals; The participating terminals include: The permission dynamic generation module 210 is used to generate permission tokens in real time based on the identity information of the current participating user. The document decryption and reading module 220 is used to decrypt and reassemble the encrypted fragmented data packet based on the permission token; The permission management terminal is used to monitor permission level change events of participating terminals in real time, and update the dynamic session key package and permission token in real time according to the permission level change events of participating terminals.

[0026] like Figure 4 As shown, in a preferred embodiment of the present invention, the key dynamic generation module 110 specifically includes: The feature value generation unit 111 is used to respond to the document synchronization command, obtain the document identifier, the current meeting ID and the host device fingerprint of the document to be synchronized, and generate the document feature value through a hash algorithm; The master key generation unit 112 is used to generate a document master key bound to the document to be synchronized based on the document feature value; The key factor generation unit 113 is used to obtain the identification information of all participating terminals and generate a unique participating terminal key factor for each participating terminal based on the identification information. The document master key encryption unit 114 is used to encrypt the document master key using the participant key factor of each participant to generate a dynamic session key package for the corresponding participant; at the same time, the dynamic session key package is associated with the identifier of the participant and stored or distributed.

[0027] In a preferred embodiment of the present invention, the identification information includes the fingerprint of the participating device, the user information of the participant and its corresponding permission level; the participating key factor is calculated based on the fingerprint of the participating device, the user information of the participant and its corresponding permission level; the permission level includes read-write permission, read-only permission and prohibited access permission, etc.

[0028] In practical applications, as an example, a company holds a board meeting. The host uses the conference screen (i.e., the host's device) to open a document titled "Annual Financial Budget Draft.pdf". The host's system responds to the document synchronization command by first extracting the document's MD5 hash value, the current meeting ID (e.g., Board-2026-02-25), and the host's device's MAC address, and then generating a unique document feature value using the SHA-256 algorithm. Based on the document's feature values, a document master key, Key_Master_001d, is generated. Subsequently, the system obtains the identification information of each participant: for example, the CEO's tablet (ID: Pad_CEO, permission level: read / write), the CFO's laptop (ID: Laptop_CFO, permission level: read / write), and the external consultant's mobile phone (ID: Phone_Advisor, permission: read-only). The system generates a unique participant key factor for each of these three participants: for example, for the CEO's tablet, the participant key factor Factor_CEO is calculated based on its device fingerprint (MAC address), login account (e.g., ceo@company.com), and read / write permission level. This participant key factor is then used to encrypt the document master key, Key_Master_001d, generating a CEO-specific dynamic session key package, KeyPack_CEO. The same process applies to other participants, ensuring that each participant can only decrypt its own dynamic session key package in its own way (e.g., the dynamic session key package corresponding to the external consultant's mobile phone is KeyPack_Phone), and that the dynamic session key package of one participant cannot be decrypted by another participant.

[0029] In this embodiment of the invention, document feature values ​​are generated by extracting multiple features such as document identifier, meeting ID, and host device fingerprint, and a document master key uniquely bound to the document is created based on these features, thus achieving a "one document, one key" root security foundation. Furthermore, a unique participant key factor is generated for each participant based on the participant device fingerprint, participant user information, and permission level, and this participant key factor is used to encrypt the document master key, forming a "one participant, one key" key distribution mechanism. This dual encryption binding mechanism ensures that even if the communication link is eavesdropped, attackers cannot obtain complete key information; simultaneously, different participants cannot decrypt each other's dynamic session key packets, fundamentally eliminating unauthorized access caused by key sharing.

[0030] like Figure 5 As shown, in a preferred embodiment of the present invention, the document segmentation and encryption module 120 specifically includes: The content fragment generation unit 121 is used to divide the document to be synchronized into several content fragments based on a preset fragment size, and assign a unique sequence number to each content fragment. The preset fragment size can be dynamically adjusted according to the actual network conditions, document size or system configuration. For example, in a good network environment, the fragment size can be set to 1MB; in a poor network environment, the fragment size can be set to 256KB.

[0031] The encrypted fragment generation unit 122 is used to perform symmetric encryption on each content fragment using the document master key to obtain several encrypted fragments; The dynamic hash chain generation unit 123 is used to determine the dynamic hash value of each encrypted segment based on the hash function, and form a dynamic hash chain. The fragment encapsulation unit 124 is used to encapsulate each encrypted fragment and its corresponding sequence number and dynamic hash value into an encrypted fragment data packet.

[0032] In a preferred embodiment of the present invention, the method for determining the dynamic hash value is as follows: for each encrypted segment, based on the current timestamp and the hash value of the previous encrypted segment, a hash function is used to generate the dynamic hash value of the current encrypted segment, forming a dynamic hash chain; wherein, the dynamic hash value of the first encrypted segment is generated based on an initial random vector.

[0033] In practical application, as an example, the system divides the 20MB document "Annual Financial Budget Draft.pdf" into 256KB segments, resulting in 80 content segments with sequence numbers 001-080. Next, each content segment is encrypted using the generated document master key Key_Master_001, resulting in 80 encrypted segments. For the first encrypted segment, a hash value H001 is generated based on the current timestamp (e.g., 14:30:05.123) and an initial random vector; for the second encrypted segment, a hash value H002 is generated based on the timestamp (e.g., 14:30:05.124) and H001, and so on, forming a complete dynamic hash chain. Finally, each encrypted segment, along with its sequence number and dynamic hash value, is encapsulated into an independent encrypted segment data packet, such as Packet_001 (encrypted segment content + sequence number 001 + H001).

[0034] In this embodiment of the invention, by dividing the document into fine-grained content fragments and encrypting each fragment independently using the document's master key, even if a single fragment is cracked, the complete document cannot be recovered, significantly increasing the difficulty of brute-force attacks. More importantly, a dynamic hash chain based on timestamps and the hash values ​​of preceding encrypted fragments is generated for each encrypted fragment, tightly linking the fragments to form an immutable integrity verification chain. Any tampering, replacement, or rearrangement of the transmitted encrypted fragments will disrupt the continuity of the hash chain, thus being immediately detected by the receiving end. This achieves proactive anti-tampering protection during data transmission, ensuring the integrity and authenticity of the document content.

[0035] In a preferred embodiment of the present invention, the data packet distribution module 130 pushes the encrypted fragmented data packet and the corresponding dynamic hash chain to each participating end in parallel through a P2P transmission channel or a server relay channel according to the identifier of the participating end; for each participating end, the data packet distribution module 130 also sends the dynamic session key packet corresponding to the participating end along with the first encrypted fragmented data packet; each time a participating end receives an encrypted fragmented data packet, it returns a fragmented reception confirmation signal containing the fragmented sequence number of the received content to the data packet distribution module 130 of the host end; the data packet distribution module 130 counts the encrypted fragmented data packet reception progress of each participating end according to the received confirmation signal, and retransmits if no confirmation is received within the time limit.

[0036] In practical application, as an example, the host pushes 80 encrypted fragmented data packets in parallel to participating devices such as the CEO tablet, CFO laptop, and external consultant's mobile phone via a P2P transmission channel. Simultaneously, a dynamic session key encryption packet corresponding to each participating device is sent along with the first encrypted fragmented data packet (e.g., KeyPack_CEO is included in the data packet sent to the CEO tablet). Furthermore, upon receiving Packet_001, the external consultant's mobile phone immediately returns an acknowledgment signal ACK_001 to the host. The host tracks the reception progress of each participating device in real time.

[0037] In this embodiment of the invention, the parallel push of encrypted fragmented data packets via a P2P channel effectively reduces dependence on the central server, avoids bandwidth bottlenecks, and significantly improves synchronization efficiency in large-scale conference scenarios. Simultaneously, sending the dynamic session key packet along with the first encrypted fragment ensures that participants can begin authorization verification as early as possible, shortening the initial waiting time for document opening. Furthermore, the introduction of fragmented reception confirmation and timeout retransmission mechanisms ensures transmission reliability in unreliable network environments, preventing document corruption or opening failures due to packet loss, and providing underlying communication guarantees for a smooth collaborative conference experience.

[0038] like Figure 6 As shown, in a preferred embodiment of the present invention, the permission dynamic generation module 210 specifically includes: The identity information collection unit 211 is used to collect the identity information of the current participant user in real time after receiving the encrypted fragmented data packet; The identity matching unit 212 is used to match the identity information collected in real time with the identity templates in the preset dynamic authorization identity library to determine the current permission level of the participating user and generate a corresponding permission token. The permission token includes the current permission level (such as read-write or read-only) and a decryption key factor corresponding to the participating key factor (used to decrypt and obtain the document master key). The generated permission token can be temporarily stored in the secure storage area of ​​the participating end and the validity period of the permission token can be set.

[0039] In a preferred embodiment of the present invention, the identity information of the participant (participant) includes at least one of facial image, voiceprint feature, fingerprint feature, and account information (account ID and password information for logging into the participant). The dynamic authorization identity database contains multiple dynamically updated identity templates. The host can change the permission level of the participant by changing the identity template in the dynamic authorization identity database. It should be noted that the identity template includes at least one of facial template, voiceprint template, fingerprint template, and account information template with read / write or read-only permissions. Multiple identity templates can be set for collaborative matching. If the identity information does not match any of the identity templates in the dynamic authorization identity database, the current permission level of the participant is determined to be prohibited access.

[0040] In practical applications, as an example, after receiving encrypted fragmented data packets, the external consultant's mobile phone, due to the high security level of the meeting, requires facial recognition verification. The system will then request the activation of the phone's front-facing camera to capture the current user's real-time facial image. The captured facial image is compared with the external consultant's facial template pre-stored in the dynamic authorization identity database. If a match is found, the user is confirmed as legitimate. Combined with the external consultant's role in the meeting (external consultant, default read-only permission), an access token containing read-only permission level and decryption key factor is generated and stored in the phone's secure storage area, valid for 5 minutes. If other participating devices, such as a CEO tablet, are used, the system may simultaneously verify the account information and facial image successfully logged in on the participating device, generating an access token containing read / write permission level and decryption key factor.

[0041] In this embodiment of the invention, by collecting the identity information of the current participant in real time before document decryption and comparing it with a preset dynamic authorization identity database, it is ensured that the operator of the current participant is indeed an authorized legitimate user, thereby effectively preventing unauthorized access behaviors such as borrowing of participant devices, account sharing, or login state hijacking.

[0042] In a preferred embodiment of the present invention, the decryption and reconstructed reading method is as follows: the document decryption and reading module 220 obtains the currently valid permission token from the secure storage area and extracts the current permission level and decryption key factor therein; If the current permission level is read-only or read-write, the encrypted fragment data packets stored locally are decrypted using the decryption key factor to obtain the document master key. Then, the encrypted fragments in each encrypted fragment data packet are decrypted sequentially using the document master key. For each content fragment decrypted, its integrity is verified based on the dynamic hash value of the encrypted fragment. If the verification fails, the host is requested to retransmit. All decrypted and verified content fragments are reassembled according to their sequence numbers to restore the original document. If the current access level is denied, the decryption process will be stopped and the received encrypted fragmented data packets will be cleared.

[0043] In practical application, as an example, the external consultant's mobile phone retrieves the permission token from the secure storage area, identifying the permission level as read-only. Using the decryption key factor within the permission token, it successfully decrypts the locally stored dynamic session key packet KeyPack_Phone, obtaining the document master key Key_Master_001. This master key is then used to decrypt encrypted fragments Packet_001 to Packet_080 sequentially. Specifically, when decrypting encrypted fragment Packet_002, its dynamic hash value H002 is compared with the result recalculated based on the hash value H001 of encrypted fragment Packet_001. If they match, the integrity verification passes. After all 80 encrypted fragments have been decrypted and verified, they are reassembled according to their serial numbers 001-080 to restore the complete "Annual Financial Budget Draft.pdf" document. This document is then opened in the phone's secure sandbox application, allowing the external consultant to view it but not edit it.

[0044] In this embodiment of the invention, by extracting the decryption key factor from the authorization token, the participating end can decrypt the exclusive dynamic session key package to obtain the document master key, and then decrypt each encrypted fragment. During this process, a dynamic hash chain is used for real-time integrity verification to ensure that the restored document is completely consistent with the original document on the host end and has not been maliciously tampered with.

[0045] In a preferred embodiment of the present invention, when the permission management terminal detects that the permission level of a participant has been downgraded or revoked, it immediately generates a new document master key and regenerates the corresponding dynamic session key package and permission token based on the new permission levels of all currently valid participants. Then, it sends a key invalidation instruction to the participant whose permission level has been changed, and simultaneously distributes the new dynamic session key package to other participants whose permission levels have not been changed. After receiving the key invalidation instruction, the participant whose permission level has been changed immediately clears all locally cached encrypted fragment data packets, dynamic session key packages, and restored documents, and disconnects the display view associated with the document.

[0046] In practical application, as an example, during a meeting, the host discovers that an external advisor is not a board member and decides to downgrade their access level from read-only to restricted access. The access management system monitors this permission change event and immediately generates a new document master key, Key_Master_002. Based on the new (unchanged) permissions of all currently active participants (CEO and CFO), it regenerates the corresponding dynamic session key packages, NewKeyPack_CEO and NewKeyPack_CFO. Simultaneously, a key expiration command is sent to the external advisor's mobile phone. Upon receiving the command, the advisor's phone immediately clears all locally cached encrypted fragment data packets, the dynamic session key package KeyPack_Phone, and the restored document. The document viewing interface automatically closes with a message (e.g., "You no longer have permission to view this document"). Meanwhile, the CEO and CFO participants receive the new dynamic session key package and can continue to view and edit the document.

[0047] like Figure 7 As shown, in another embodiment of the present invention, a method for real-time synchronization of paperless meeting documents across terminals is also provided, based on the above system, and specifically includes the following steps: S100. The host extracts the document feature value of the document to be synchronized and generates a dynamic session key package based on the document feature value; the dynamic session key package includes the document master key and the participant key factor used to encrypt the document master key. S200: The host terminal divides the document to be synchronized into several content fragments, and uses the dynamic session key packet to encrypt each content fragment to generate an encrypted fragment data packet; S300: The host terminal distributes the encrypted fragmented data packets to the participating terminals; S400: The participating terminal generates an access token in real time based on the identity information of the current participating terminal user. S500: The participating terminal decrypts and reassembles the encrypted fragmented data packet based on the permission token; The S600 and permission management terminal monitor the permission level change events of the participating terminals in real time, and update the dynamic session key package and permission token in real time according to the permission level change events of the participating terminals.

[0048] It should be noted that the above modules and units can be implemented as a computer program, which can run on a computer device. The computer device's memory can store the computer program that makes up the modules or units, enabling the processor to execute the various steps of the above method.

[0049] It should be understood that although the steps in the flowcharts of the embodiments of the present invention are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in each embodiment may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0050] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods.

[0051] The above embodiments merely illustrate several implementation methods of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of this patent should be determined by the appended claims.

Claims

1. A cross-terminal collaborative paperless meeting document real-time synchronization system, comprising a host terminal, participant terminals, and an access control terminal, characterized in that, The hosting terminal includes: The key dynamic generation module is used to extract the document feature value of the document to be synchronized and generate a dynamic session key package based on the document feature value; the dynamic session key package includes the document master key and the participant key factor used to encrypt the document master key; The document segmentation and encryption module is used to segment the document to be synchronized into several content fragments, and to encrypt each content fragment using the dynamic session key packet to generate an encrypted fragment data packet. The data packet distribution module is used to distribute the encrypted fragmented data packets to the participating terminals; The participating terminals include: The dynamic permission generation module is used to generate permission tokens in real time based on the identity information of the current participating user. The document decryption and reading module is used to decrypt and reassemble the encrypted fragmented data packets based on the permission token; The permission management terminal is used to monitor permission level change events of participating terminals in real time, and update the dynamic session key package and permission token in real time according to the permission level change events of participating terminals.

2. The cross-terminal collaborative paperless meeting and office document real-time synchronization system according to claim 1, characterized in that, The key dynamic generation module specifically includes: The feature value generation unit is used to respond to the document synchronization command, obtain the document identifier of the document to be synchronized, the current meeting ID, and the host device fingerprint, and generate the document feature value through a hash algorithm; A master key generation unit is used to generate a document master key bound to the document to be synchronized based on the document feature value; The key factor generation unit is used to obtain the identification information of all participants and generate a unique key factor for each participant based on the identification information. The document master key encryption unit is used to encrypt the document master key using the participant key factor of each participant to generate a dynamic session key packet for the corresponding participant.

3. The cross-terminal collaborative paperless meeting and office document real-time synchronization system according to claim 2, characterized in that, The identification information includes the fingerprint of the participating device, the user information of the participant and its corresponding permission level; the participating key factor is calculated based on the fingerprint of the participating device, the user information of the participant and its corresponding permission level.

4. The cross-terminal collaborative paperless meeting and office document real-time synchronization system according to claim 1, characterized in that, The document segmentation and encryption module specifically includes: The content segmentation generation unit is used to divide the document to be synchronized into several content segments based on a preset segment size, and assign a unique sequence number to each content segment. The encrypted fragment generation unit is used to perform symmetric encryption on each content fragment using the document master key to obtain several encrypted fragments; The dynamic hash chain generation unit is used to determine the dynamic hash value of each encrypted segment based on the hash function, and form a dynamic hash chain. The fragment encapsulation unit is used to encapsulate each encrypted fragment and its corresponding sequence number and dynamic hash value into an encrypted fragment data packet.

5. The cross-terminal collaborative paperless meeting and office document real-time synchronization system according to claim 4, characterized in that, The method for determining the dynamic hash value is as follows: for each encrypted segment, based on the current timestamp and the hash value of the previous encrypted segment, a hash function is used to generate the dynamic hash value of the current encrypted segment, forming a dynamic hash chain; wherein, the dynamic hash value of the first encrypted segment is generated based on the initial random vector.

6. The cross-terminal collaborative paperless meeting and office document real-time synchronization system according to claim 4, characterized in that, The dynamic permission generation module specifically includes: The identity information collection unit is used to collect the identity information of the current participant in real time after receiving the encrypted fragmented data packet; The identity matching unit is used to match the identity information collected in real time with the identity templates in the preset dynamic authorization identity database, determine the current permission level of the participating user, and generate a corresponding permission token; the permission token includes the current permission level and a decryption key factor corresponding to the participating user's key factor.

7. The cross-terminal collaborative paperless meeting and office document real-time synchronization system according to claim 6, characterized in that, The identity information includes at least one of facial images, voiceprint features, fingerprint features, and account information.

8. The cross-terminal collaborative paperless meeting and office document real-time synchronization system according to claim 7, characterized in that, The identity template includes at least one of the following: a face template, a voiceprint template, a fingerprint template, and an account information template, all of which have read / write or read-only permissions. If the identity information does not match any of the identity templates in the dynamic authorization identity database, then the current permission level of the participating user is determined to be prohibited from accessing the platform.

9. The cross-terminal collaborative paperless meeting and office document real-time synchronization system according to claim 8, characterized in that, The method for decryption and reconstructing the read is as follows: extract the current permission level and decryption key factor from the currently valid permission token; If the current permission level is read-only or read-write, the encrypted fragment data packets stored locally are decrypted using the decryption key factor to obtain the document master key. Then, the encrypted fragments in each encrypted fragment data packet are decrypted sequentially using the document master key. For each content fragment decrypted, its integrity is verified based on the dynamic hash value of the encrypted fragment. If the verification fails, the host is requested to retransmit. All decrypted and verified content fragments are reassembled according to their sequence numbers to restore the original document. If the current access level is denied, the decryption process will be stopped and the received encrypted fragmented data packets will be cleared.

10. A method for real-time synchronization of paperless meeting documents across terminals, implemented based on the real-time synchronization system for paperless meeting documents across terminals as described in any one of claims 1-9, characterized in that, Includes the following steps: The host extracts the document feature value of the document to be synchronized and generates a dynamic session key package based on the document feature value; the dynamic session key package includes the document master key and the participant key factor used to encrypt the document master key; The host divides the document to be synchronized into several content fragments and uses the dynamic session key packet to encrypt each content fragment, generating an encrypted fragment data packet; The host distributes the encrypted fragmented data packets to the participants; The participating terminal generates an access token in real time based on the identity information of the current participating user; The participating terminal decrypts and reassembles the encrypted fragmented data packets based on the permission token; The permission management terminal monitors permission level change events of participating terminals in real time and updates the dynamic session key package and permission token in real time according to the permission level change events of participating terminals.

Images