A visual system data protection method based on intranet penetration

Abstract

The application provides a visual system data protection method based on intranet penetration, which comprises the following steps: deploying an intermediate proxy service on a public network proxy server and configuring a port mapping rule; an intranet penetration client deployed in an intranet initiatively initiates a connection to the public network proxy server, establishes a persistent encrypted connection, and multiplexes multiple virtual sub-connections on the persistent encrypted connection; the intermediate proxy service authenticates an external network request initiated by an external access device, and a visual data protection module deployed on a server side in the intranet sequentially executes data grading, sensitive content identification and desensitization, digital watermark embedding, differential encryption and fragmentation confusion processing on visual response data in a specific time sequence, so as to construct a complete protection link from an application semantic layer to a transmission confusion layer; and the sensitive content identification and desensitization are completed on the intranet side, so that the sensitive original data cannot leave the intranet in a non-desensitized form.

Description

Technical Field

[0001] This invention relates to the field of network communication, and in particular to a data protection method for a visualization system based on intranet penetration. Background Technology

[0002] With the rapid evolution of cloud computing, IoT and AI technologies, visualization systems have been widely used in scenarios such as video surveillance, industrial configuration, energy management and judicial evidence display. There is also a need to present visualized data deployed on the intranet to external network users. However, the financial, government, judicial and medical fields generally adopt a multi-layered protection system that combines physical isolation and logical isolation, forming a strict internal and external network isolation architecture, which makes it difficult to securely provide services to external users with visualized data deployed on the intranet.

[0003] To enable cross-network access to visualized data, existing solutions involve assigning public IP addresses to internal network devices and deploying firewalls. However, this exposes the internal network directly to public network attack surfaces and is constrained by IPv4 address depletion and dynamic IP drift issues. VPN dedicated tunnels can be built, but the cost of equipment procurement and maintenance increases exponentially with multi-point access and it is difficult to meet low latency requirements. Traditional intranet penetration technology is used, where internal network clients actively initiate connections to a relay server to establish an encrypted channel.

[0004] The aforementioned traditional intranet penetration solutions only encrypt data at the transmission channel level, lacking protection for the application layer visualization data itself. Once the transmission channel is breached or the relay server is compromised, attackers can obtain the complete application layer plaintext data. Sensitive information such as faces, license plates, and ID numbers contained in the original visualization response data needs to be transmitted via public network links, posing a risk of leakage. Sequential transmission through a single channel is vulnerable to side-channel attacks. The relay server itself may become a point of attack. Furthermore, once data leakage occurs, there is a lack of means to trace and locate the source of the leak. Summary of the Invention

[0005] The technical problem to be solved by this invention is to overcome the defects of the existing technology. This invention proposes a data protection method for a visualization system based on intranet penetration.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a data protection method for a visualization system based on intranet penetration, comprising: S1. Deploy the intermediate proxy service on the public network proxy server and configure port mapping rules; S2. Deploy an intranet penetration client on the intranet server. The intranet penetration client actively initiates a connection to the public proxy server to establish a persistent encrypted connection, and reuses multiple virtual sub-connections on the persistent encrypted connection. S3. Receive external network requests initiated by external access devices based on the intermediate proxy service and perform multi-level authentication. S4. If the external network request passes authentication, the external network request is mapped to the corresponding service port on the internal network server using the port mapping rule. S5. The internal network server responds to the external network request and generates corresponding visual response data; S6. The visualized response data is processed sequentially by the visualized data protection module, including data classification, sensitive content identification and desensitization, digital watermark embedding, dynamic key negotiation, multi-layer hybrid encryption, and fragment obfuscation, to obtain multiple encrypted fragments. The sensitive content identification and desensitization are completed on the intranet server side. The fragment obfuscation is to divide the obtained encrypted payload into K fragment bodies and add fragment headers, where K is an integer greater than or equal to 2. S7. The K fragments are sent out of order to the public network proxy server via the multiple virtual sub-connections. The public network proxy server forwards the K fragments to the external access device based only on the fragment header without decrypting the fragments. The external access device reassembles and decrypts the fragments based on the fragment header to obtain the de-identified visual response data for visualization.

[0007] Preferably, in step S6, the data classification includes assigning classification labels to the visualized response data according to preset rules. The classification labels include public level L0, internal level L1, and confidential level L2. The public level L0 corresponds to data that can be disclosed to any external visitor; the internal level L1 corresponds to data that is only disclosed to authenticated users; and the confidential level L2 corresponds to data that is only disclosed to authorized users. The sensitive content identification and desensitization are performed on the visualized response data whose classification label is internal level L1 or confidential level L2. The sensitive content includes faces, license plates, personnel identification documents, and sensitive fields consisting of at least one of ID card numbers, mobile phone numbers, bank card numbers, and addresses.

[0008] Preferably, in step S6, the multi-layer hybrid encryption includes differential encryption of the watermarked data based on the hierarchical labels: Data with the classification label set to public level L0 will only be protected for integrity. The data with the hierarchical label of the internal level L1 is encrypted using a symmetric encryption algorithm; For data with the classification label of confidentiality level L2, further attribute-based encryption or identity-based encryption is applied on top of the encryption using the symmetric encryption algorithm.

[0009] Preferably, in step S6, the dynamic key negotiation includes: A key exchange handshake is performed once when each of the aforementioned virtual sub-connections is established, and a session master key is generated; Multiple sets of utility keys are derived from the session master key based on the key derivation function. The utility keys include data encryption keys, message authentication keys, and watermark keys. When the session duration exceeds a preset time threshold or the amount of data transmitted exceeds a preset traffic threshold, key rollover is triggered at time t. r Calculate using the following formula: Among them, t r t0 is the key rollover trigger time; t0 is the start time of this session; T max V is the preset time threshold; max The preset flow threshold; R avg This represents the real-time average transmission rate for this session; min is the minimum value operator.

[0010] Preferably, in step S6, the digital watermark embedding includes embedding a digital watermark into keyframes or charts in the desensitized visual response data; wherein the watermark content of the digital watermark includes a hash value of at least one of session ID, user ID, device fingerprint, and timestamp; the digital watermark embedding is implemented using at least one or more of the following techniques in combination: frequency domain watermarking based on discrete wavelet transform; frequency domain watermarking based on discrete cosine transform; robust watermarking based on quantization index modulation; and invisible markings for vector graphics.

[0011] Preferably, in step S6, the fragment header includes at least one field selected from session ID, stream ID, fragment sequence number, total number of fragments, random offset, and CRC checksum; the K is calculated based on the length N of the encrypted payload and the hierarchical tag using the following formula: Where K is the number of fragments of the encrypted payload; N is the length of the encrypted payload in bytes; B0 is the basic fragment unit length in bytes; γ(L) is the hierarchical adjustment factor, which increases as the hierarchical label level L increases; `+` is the floor function; `max` is the maximum value operator.

[0012] Preferably, in step S2, establishing a persistent encrypted connection includes: The intranet penetration client collects the host's hardware fingerprint upon first startup. The hardware fingerprint includes at least one of the following: CPU serial number, motherboard UUID, network card MAC address, and storage medium serial number. The hardware fingerprint is hashed to form a device fingerprint identifier. The device fingerprint identifier is bound together with a pre-set device private key and stored in the trusted execution environment provided by the operating system or the sealed storage area of ​​the hardware security module. During two-way authentication between the intranet penetration client and the public network proxy server, the public network proxy server first verifies whether the client certificate submitted by the intranet penetration client is in the trusted certificate list, and then verifies whether the device fingerprint submitted by the intranet penetration client matches the trusted device list; if both the client certificate verification and the device fingerprint verification pass, the persistent encrypted connection is established. Preferably, after the persistent encrypted connection is established, the method further includes: The intranet penetration client and the public network proxy server periodically send encrypted heartbeat packets at a preset frequency; wherein, the payload of the encrypted heartbeat packet includes identification information, timestamp and connection status verification information, and the connection status verification information includes at least one of the number of currently established virtual sub-connections, the byte count of the most recent successful transmission and reception, and the key fingerprint of the most recent key roll. If the number of consecutive lost encrypted heartbeat packets exceeds a preset loss threshold, the persistent encrypted connection is determined to be unstable, triggering a connection reconstruction process that includes closing the current connection, re-initializing encryption parameters, and re-establishing the connection. After the connection is re-established, the intranet penetration client compares the connection status verification information with the public network proxy server. For the data stream that was being transmitted when the connection was lost, the transmission is automatically resumed based on the most recent successfully sent and received byte count in the connection status verification information, thus achieving breakpoint resume transmission.

[0013] In a second aspect, the present invention provides an electronic device, characterized in that the electronic device comprises: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the data protection method for the visualization system based on intranet penetration.

[0014] Thirdly, the present invention provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores computer instructions, which are used to cause a processor to execute the aforementioned data protection method for a visualization system based on intranet penetration.

[0015] Compared with existing technologies, the beneficial effects of this invention include: a visualization data protection module deployed on an intranet server sequentially performs data classification, sensitive content identification and desensitization, digital watermark embedding, differentiated encryption, and fragmentation obfuscation on the visualization response data according to a specific time sequence, constructing a complete protection link from the application semantic layer to the transmission obfuscation layer; and sensitive content identification and desensitization are completed on the intranet side, ensuring that sensitive original data does not leave the intranet in an un-desensitized form; based on the classification label, watermarked data is encrypted with different strength encryption algorithms for differentiated encryption, and confidential data is further protected by attribute-based or identity-based encryption on the basis of symmetric encryption, forming a double protection, so that even if the transmission layer key is leaked, the attacker still needs to use the encryption algorithm to protect the confidential data. The application layer ciphertext can only be decrypted with the corresponding key; the encrypted payload is fragmented and then mapped out of order in multiple virtual sub-connections before being sent, so that no single traffic can be used to reconstruct the complete application layer plaintext, significantly improving its resistance to side-channel eavesdropping attacks such as deep packet inspection and traffic profiling analysis; the public network proxy server only forwards the fragment body based on the fragment header without decryption, and does not come into contact with the application layer plaintext itself, so even if it is compromised, it cannot obtain the application layer plaintext data; and by embedding digital watermarks carrying session ID, user ID, device fingerprint and timestamp hash value into the desensitized visual response data, the session, user, device and time corresponding to the leakage event can be accurately located through watermark extraction and decoding when a suspected data leakage occurs. Attached Figure Description

[0016] The disclosure of this invention is illustrated with reference to the accompanying drawings. It should be understood that the drawings are for illustrative purposes only and are not intended to limit the scope of protection of this invention. In the drawings, the same reference numerals are used to refer to the same parts. Wherein: Figure 1 A flowchart illustrating a visualization system data protection method based on intranet penetration, provided as an embodiment of the present invention; Figure 2 This is a schematic diagram of the overall system architecture corresponding to the visualization system data protection method based on intranet penetration provided in the embodiments of the present invention; Figure 3 This is a schematic diagram of the internal structure of the visual data protection module provided in an embodiment of the present invention; Figure 4 A flowchart illustrating another data protection method for a visualization system based on intranet penetration, provided as an embodiment of the present invention; Figure 5This is a schematic diagram of the structure of an electronic device for implementing a visualization system data protection method based on intranet penetration, as provided in an embodiment of the present invention. Detailed Implementation

[0017] It is readily understood that, based on the technical solution of this invention, those skilled in the art can propose various interchangeable structural methods and implementations without altering the essential spirit of the invention. Therefore, the following detailed embodiments and accompanying drawings are merely illustrative examples of the technical solution of this invention and should not be considered as the entirety of the invention or as limitations or restrictions on the technical solution of this invention.

[0018] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0019] Figure 1 The flowchart illustrates a data protection method for a visualization system based on intranet penetration, as provided in this embodiment of the invention. This embodiment is applicable to scenarios where the visualization system securely exposes visualization data deployed on the intranet to external access devices in network environments without a public IP address or with only a dynamic public IP address.

[0020] S1. Deploy an intermediate proxy service on the public network proxy server and configure port mapping rules.

[0021] Among them, first see Figure 2 , Figure 2This is a schematic diagram of the overall architecture of the visualization system data protection method based on intranet penetration provided in this embodiment of the invention. Reference numerals 10, 20, 30, 40, and 50 represent external access devices, public network proxy servers, intranet penetration clients, visualization business servers, and visualization data protection modules, respectively. The public network proxy server 20 refers to a cloud server or independent physical server with a public IP address. The intermediate proxy service can be implemented using a reverse proxy engine. The fields of the port mapping rules include at least one of the following: external port, protocol type, target service identifier, target intranet service address, maximum concurrency, traffic rate limiting parameters, data classification requirements, and access control policy references. The protocol types include, but are not limited to, HTTP, HTTPS, WebSocket, RTMP, RTSP, MQTT, and custom TCP. n port mapping rules can carry visualization data streams of various protocol types, where n is an integer greater than or equal to 1.

[0022] Specifically, an intranet penetration server is configured on the public proxy server 20 with a public IP address to deploy an intermediate proxy service on the public proxy server 20 and configure port mapping rules; furthermore, a data transmission channel based on an encryption protocol is constructed, and the received external network requests are encrypted through the data transmission channel.

[0023] For example, the encryption protocol uses a transport layer security protocol, including but not limited to the TLS protocol or the national cryptographic SM2, SM3, and SM4 suites, on the outer layer, and further superimposes application layer encryption, including but not limited to the Noise protocol framework, on the inner layer to form a double-layer encryption channel. The double-layer encryption channel is used to resist man-in-the-middle attacks and session hijacking.

[0024] Optionally, an access control policy module, a traffic monitoring module, and an audit log storage module are also deployed on the public network proxy server 20. The access control policy module is configured with at least three layers of identity verification based on a zero-trust security architecture: the first layer is whitelist and blacklist verification based on IP address or network segment; the second layer is device identity verification based on X.509 certificate or national cryptographic SM2 certificate; and the third layer is user identity verification based on token, including but not limited to OAuth token, OIDC token, or custom token.

[0025] S2. Deploy an intranet penetration client on the intranet server and establish a persistent encrypted connection between the intranet penetration client and the public proxy server.

[0026] Among them, the intranet penetration client 30 can be deployed on the same device as the visualization business server 40, or it can be deployed as an independent edge proxy device at the exit of the intranet segment or in the DMZ area; the persistent encrypted connection refers to an encrypted communication connection initiated by the intranet side to the public network side that can penetrate the intranet firewall and NAT device and be maintained for a long time.

[0027] Specifically, deploy an intranet penetration client 30 on the intranet server and configure the intranet penetration client 30 with configuration parameters corresponding to those of the public network proxy server 20.

[0028] For example, the intranet penetration client 30 performs the following steps upon first startup: collecting the hardware fingerprint of the host, which includes at least one of the CPU serial number, motherboard UUID, network card MAC address and storage medium serial number; hashing the hardware fingerprint using SM3 or SHA-256 to form a device fingerprint identifier; binding the device fingerprint identifier together with a pre-set device private key and storing it in the sealed storage area of ​​the Trusted Execution Environment (TEE) provided by the operating system or the hardware security module.

[0029] Furthermore, a persistent encrypted connection is established between the intranet penetration client 30 and the public network proxy server 20, including: the intranet penetration client 30 actively initiates a TCP connection from the intranet to the designated listening port of the public network proxy server 20; after the connection is established, both parties complete a TLS handshake or a national cryptographic handshake at the transport layer; after the handshake is completed, further bidirectional authentication and session key negotiation are performed at the application layer; after successful negotiation, both parties reuse multiple virtual sub-connections on the TCP connection, and each virtual sub-connection corresponds to one or a type of visual business data stream.

[0030] Optionally, a service port whitelist can be set in the intranet penetration client 30 according to the principle of least privilege, and external network requests in the service port whitelist can be mapped to the corresponding service port of the intranet server.

[0031] S3. Receive external network requests initiated by external access devices based on the intermediate proxy service, and perform multi-level authentication on the external network requests.

[0032] Specifically, external network requests are processed sequentially through first authentication, second authentication, third authentication, and fourth authentication. First authentication verifies whether the source IP is on the whitelist; second authentication verifies the validity of the TLS client certificate; third authentication verifies the validity and expiration of the access token, as well as the match between the declared permission scope and the permission scope required by the target service identifier; and fourth authentication uses a behavior profiling engine to perform anomaly scoring based on the request frequency, time period, content fingerprint, and source geographical location of the current request.

[0033] For example, if the abnormal score obtained from the fourth authentication reaches a preset abnormal score threshold, a second authentication process is triggered, and subsequent steps are executed after the second authentication process is passed.

[0034] S4. If an external network request passes authentication, the external network request is mapped to the corresponding service port on the internal network server using port mapping rules.

[0035] Specifically, based on port mapping rules and the target service identifier, the service port of the internal network server corresponding to the external network request is determined, so as to map the external network request to the corresponding service port of the internal network server based on the intermediate proxy service.

[0036] S5: The internal network server responds to external network requests and generates corresponding visual response data.

[0037] The visual response data includes at least one of the following: video stream, chart data, map tiles, real-time push data frames, and configuration interface rendering results.

[0038] Specifically, the intranet penetration client 30 receives external network requests and forwards them to the visualization business server 40; the visualization business server 40 calls the corresponding business module according to the request type of the external network request, and aggregates the output of all corresponding business modules to the entry point of the visualization data protection module 50.

[0039] S6. Through the visual data protection module, data classification, sensitive content identification and desensitization, digital watermark embedding, dynamic key negotiation, multi-layer hybrid encryption and fragment obfuscation are performed on the visual response data in sequence to obtain multiple encrypted fragments.

[0040] Among them, see Figure 3 , Figure 3 This is a schematic diagram of the internal structure of the visual data protection module 50 provided in an embodiment of the present invention. The visual data protection module 50 includes a data classification unit 51, a sensitive content identification and desensitization unit 52, a dynamic key negotiation unit 53, a multi-layer hybrid encryption unit 54, a fragmentation obfuscation unit 55, a digital watermark embedding unit 56, and a watermark tracing unit 57.

[0041] Specifically, step S6 includes sub-steps S61 to S66: S61. The data classification unit 51 assigns classification labels to the visualized response data according to preset rules. The classification labels include public level L0, internal level L1 and confidential level L2. Among them, L0 is data that can be disclosed to any external visitor, L1 is data that can only be disclosed to certified users, and L2 is data that can only be disclosed to authorized users.

[0042] S62. The sensitive content identification and desensitization unit 52 performs sensitive content identification and desensitization processing on the visual response data with hierarchical labels L1 or L2 to obtain the desensitized visual response data.

[0043] Specifically, sensitive content recognition is achieved based on at least one or more of the following technologies in combination: face, license plate or personnel identification detection based on a lightweight object detection model; text recognition and regular expression matching based on OCR; chart annotation and desensitization based on rules and dictionaries; and video clip filtering based on keyframe extraction and scene recognition.

[0044] For example, the desensitization process includes at least one of mosaic, pixelation, Gaussian blur, key region cropping, character replacement, numerical perturbation, and bucketing aggregation.

[0045] Optionally, sensitive content identification and de-identification can be performed on the intranet penetration client 30 side or on the visualization business server 40 side, so that the original data does not leave the intranet in an un-de-identified form.

[0046] S63. The digital watermark embedding unit 56 embeds digital watermarks into keyframes or charts in the desensitized visual response data to obtain watermarked data.

[0047] The watermark content of the digital watermark includes the hash value of at least one of session ID, user ID, device fingerprint and timestamp; the digital watermark is embedded using at least one or more of the following techniques: frequency domain watermarking based on discrete wavelet transform (DWT); frequency domain watermarking based on discrete cosine transform (DCT); robust watermarking based on quantization index modulation (QIM); and invisible markings for vector maps.

[0048] Furthermore, regarding the embedding method of frequency domain watermarking based on Discrete Wavelet Transform (DWT), the low-frequency sub-band is obtained by performing J-level discrete wavelet decomposition on the desensitized visual response data frame. The watermark carrying capacity C of the low-frequency sub-band is... w Calculate using the following formula: (1) Among them, C w λ represents the number of watermark bits that the low-frequency subband can carry; H represents the height of the desensitized visual response data frame in pixels; W represents the width of the desensitized visual response data frame in pixels; J represents the level of the discrete wavelet decomposition; and λ represents the number of low-frequency coefficients occupied by each watermark bit. As a floor operator, the initial values ​​of J and λ can be preset based on empirical values.

[0049] S64. The dynamic key negotiation unit 53 generates the current data encryption key based on the key status of this session.

[0050] Specifically, dynamic key negotiation is implemented based on ECDH or the national cryptographic SM2 key exchange algorithm; a key exchange handshake is performed once when each virtual sub-connection is established to generate a session master key; and data encryption key, message authentication key and watermark key are derived from the session master key based on HKDF or SM3-KDF.

[0051] Furthermore, when the session duration exceeds a preset time threshold or the transmitted data volume exceeds a preset traffic threshold, key rolling is triggered, a new session master key is generated, and a smooth switch is achieved; the key rolling trigger time is t. r Calculate using the following formula: (2) Among them, t r t0 is the key rollover trigger time; t0 is the start time of this session; T max V is a preset time threshold; max Preset traffic threshold; R avg This represents the real-time average transmission rate for this session; min is the minimum value operator.

[0052] S65. The multi-layer hybrid encryption unit 54 performs differentiated encryption on the watermarked data according to the hierarchical label to obtain the encrypted payload.

[0053] Specifically, data with the L0 tier only undergoes integrity protection, which is implemented using HMAC-SHA256 or SM3-HMAC. Data with the L1 tier is encrypted using symmetric encryption algorithms, including but not limited to AES-GCM or SM4-GCM. Data with the L2 tier is further encrypted using attribute-based encryption (ABE) or identity-based encryption (IBE) on top of the symmetric encryption algorithm, to achieve dual protection of transmission encryption and access encryption.

[0054] For example, for data with an L2 hierarchical label, even if an external access device decrypts the transport layer ciphertext, it still needs to possess the corresponding attribute key or identity key to decrypt the application layer ciphertext of the encrypted payload.

[0055] S66. The fragmentation and obfuscation unit 55 performs fragmentation and obfuscation processing on the encrypted payload to obtain multiple encrypted fragments.

[0056] Specifically, an encrypted payload of length N bytes is divided into K fragments according to a preset fragmentation strategy, and a fragment header is attached to each fragment. The fragment header includes at least one field among session ID, stream ID, fragment sequence number, total number of fragments, random offset, and CRC checksum. The K fragments are sent out of order through multiple pre-established virtual sub-connections, where K is an integer greater than or equal to 2 and N is an integer greater than or equal to 1.

[0057] Furthermore, the number of fragments K is calculated based on the length N of the encrypted payload and the hierarchical tag using the following formula: (3) Where K is the number of fragments of the encrypted payload; N is the length of the encrypted payload in bytes; B0 is the basic fragment unit length in bytes; γ(L) is the hierarchical adjustment factor, which increases with the hierarchical label level L, so that the higher the hierarchical label level, the finer the fragmentation granularity of the encrypted payload. `+` is the floor function; `max` is the maximum value operator. The initial values ​​of B0 and γ(L) can be preset based on empirical values.

[0058] Furthermore, the byte length L of a single fragment body f Calculate using the following formula: (4) Where L_f is the byte length of a single fragment; K is the number of fragments determined by Formula 3; and N is the length of the encrypted payload. The byte length of the first K-1 fragments is all L. f In this case, the actual byte length of the Kth fragment is N-(K-1)×L f .

[0059] Optionally, the K fragments are mapped out of order in multiple virtual sub-connections. Physically, the same TCP connection can be reused or multiple TCP connections can be used. The traffic on any single virtual sub-connection cannot be used to reconstruct the complete encrypted payload. All K fragments must be reassembled at the receiving end according to the fragment header before decryption can be performed.

[0060] S7. Multiple encrypted fragments are sent back to the external access device via a persistent encrypted connection through an intermediate proxy service. The external access device then completes the fragment reassembly, decryption, and visualization.

[0061] Specifically, the intranet penetration client 30 sends multiple encrypted fragments to the public network proxy server 20 through a persistent encrypted connection; the intermediate proxy service of the public network proxy server 20 only forwards the multiple encrypted fragments to the external access device 10 based on the fragment header, without decrypting the fragment body of the encrypted fragments; after receiving the multiple encrypted fragments, the external access device 10 reassembles the multiple encrypted fragments according to the session ID and stream ID in the fragment header, and decrypts them using the session key negotiated by the local end to obtain the encrypted payload; for data with the L2 hierarchical label, it further uses the decryption key based on attributes or identity to perform secondary decryption; finally, the de-identified visual response data is obtained and rendered, played, or interactively displayed.

[0062] The technical solution provided by this invention, through hierarchical protection and fragmented obfuscation, analyzes the security risks of visualized data from the application semantic level. By performing hierarchical, desensitized, dynamic key encryption, multi-layer hybrid encryption, fragmented obfuscation, and watermark embedding on the visualized response data, even if the persistent encrypted connection is compromised or the public network proxy server is compromised, attackers will find it difficult to recover valid visualized business information or sensitive personal information from the intercepted data. Furthermore, sensitive original data is strictly retained on the internal network, eliminating the risk of privacy leakage caused by the original sensitive data flowing through the public network link, thus effectively improving the overall security of the visualized system data.

[0063] Figure 4 This is a flowchart illustrating another data protection method for a visualization system based on intranet penetration, provided by an embodiment of the present invention. This embodiment further defines the aforementioned embodiments based on the present invention. See also... Figure 4 The method includes: S10. Deploy the intermediate proxy service on the public network proxy server and configure port mapping rules.

[0064] S20. Deploy an intranet penetration client on the intranet server and establish a persistent encrypted connection between the intranet penetration client and the public proxy server.

[0065] S30. Between the intranet penetration client and the public network proxy server, encrypted heartbeat packets are sent periodically at a preset frequency, and it is determined whether encrypted heartbeat packets are continuously lost.

[0066] The payload of the encrypted heartbeat packet includes identification information, timestamp, and connection status verification information; the connection status verification information includes at least one of the following: the number of currently established virtual sub-connections, the byte count of the most recent successful transmission and reception, and the key fingerprint of the most recent key roll.

[0067] Specifically, the intranet penetration client 30 sets a timer on the intranet side to send encrypted heartbeat packets to the public network proxy server 20 at a preset frequency; the intranet penetration client 30 maintains a counter, which is used to record the number of consecutively lost encrypted heartbeat packets.

[0068] Furthermore, the total timeout T for triggering the connection rebuild process. out Calculate using the following formula: (5) Among them, T out The total timeout for triggering the connection rebuild process, in seconds; T h The interval for sending encrypted heartbeat packets, in seconds; N th T represents the preset loss threshold, measured in times; ε represents the network jitter tolerance margin, measured in seconds.h initial value, N th The initial values ​​of and ε can be preset based on empirical values.

[0069] S40. Determine whether the number of consecutive lost encrypted heartbeat packets exceeds the preset loss threshold; if yes, proceed to S50; if no, continue to S30.

[0070] S50. If the number of consecutive lost encrypted heartbeat packets exceeds the preset loss threshold, determine that the connection between the intranet penetration client and the public network proxy server is unstable, trigger the connection reconstruction process, and restore the data stream being transmitted based on the connection status verification information.

[0071] Specifically, the connection reconstruction process includes closing the current connection, re-initializing encryption parameters, and attempting to re-establish the connection. After the connection is re-established, the intranet penetration client 30 compares the connection status verification information with the public network proxy server 20. For the data stream that was being transmitted when the connection was interrupted, the transmission is automatically resumed based on the number of bytes transmitted, thereby achieving breakpoint resume transmission.

[0072] S60. Send update notifications to the public network proxy server and the intranet penetration client at preset time intervals.

[0073] S70. Determine whether high-risk intelligence has been received from the threat intelligence subscription source; if yes, proceed to S80; if no, continue to proceed to S60 at the preset time interval.

[0074] S80. Immediately trigger the emergency update process to update the security policies and encryption algorithms of the public network proxy server and the intranet penetration client.

[0075] S90. Obtain historical access logs and analyze them based on a machine learning anomaly detection model to build a traffic baseline model.

[0076] The historical access log includes at least one of the following fields: timestamp, source IP address, device fingerprint, user ID, request URL, response byte count, and data level label.

[0077] S100 performs traffic monitoring based on a traffic baseline model, identifies abnormal access behavior, and triggers secondary authentication or alarms when abnormal access behavior is detected.

[0078] Specifically, for the feature vector x of the real-time access log, an anomaly score S(x) is calculated based on the traffic baseline model. The anomaly score S(x) is calculated using the following formula: (6) Where S(x) is the anomaly score of the feature vector x of the real-time access log; x iw is the i-th eigenvalue of the eigenvector x; n is the number of eigendimensional dimensions of the eigenvector x; i Let Σw be the weight of the i-th feature, and Σw i =1;μ i σ is the mean of the i-th dimension feature based on the flow baseline model; i Let S(x) be the standard deviation of the i-th feature based on the traffic baseline model, when the anomaly score S(x) ≥ τ s When the access behavior corresponding to the real-time access log is determined to be abnormal access behavior, τ s This is a preset threshold for abnormal scoring.

[0079] Optionally, the intranet penetration client 30 can be deployed on the intranet server in either an integrated deployment or a standalone deployment manner.

[0080] Optionally, the public proxy server 20 can be replaced by a distributed cluster, in which multiple nodes handle all requests for the same session through consistent hashing or session stickiness mechanisms.

[0081] Optionally, after step S63, the method further includes: the watermark tracing unit 57 docks with the consortium blockchain node to write the event fingerprint of each embedded watermark event into the consortium blockchain; wherein the event fingerprint includes session ID, user ID, device fingerprint, timestamp, and SM3 hash of watermark parameters.

[0082] Optionally, in the event of a suspected data breach, watermark extraction and decoding are performed on intercepted or suspicious samples, and the session, user, device, and time corresponding to the breach event are identified by combining the audit logs on the public network proxy server 20.

[0083] The technical solution provided by this invention establishes a security protection system covering the entire lifecycle of visualized data by setting up two-way identity authentication based on device fingerprint and trusted execution environment, encrypted heartbeat keep-alive and breakpoint resume based on state verification, emergency updates based on threat intelligence, abnormal detection of behavioral profiles based on machine learning, and watermark tracing based on consortium blockchain.

[0084] Figure 5This is a schematic diagram of an electronic device structure for a visualization system data protection method based on intranet penetration, provided as an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptops, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframes, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices; wherein wearable devices include at least one of helmets, glasses, or watches. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0085] like Figure 5 As shown, the electronic device 60 includes at least one processor 61 and a memory communicatively connected to the at least one processor 61. The memory includes at least one of a read-only memory (ROM) 62 and a random access memory (RAM) 63. The memory stores a computer program executable by the at least one processor. The processor 61 can perform various appropriate actions and processes based on the computer program stored in the ROM 62 or loaded from storage unit 68 into the RAM 63. The RAM 63 may also store various programs and data required for the operation of the electronic device 60. The processor 61, ROM 62, and RAM 63 are interconnected via a bus 64. An input / output (I / O) interface 65 is also connected to the bus 64.

[0086] Multiple components in electronic device 60 are connected to I / O interface 65, including: input unit 66, which includes, but is not limited to, a keyboard and mouse; output unit 67, which includes, but is not limited to, a display and speakers; storage unit 68, which includes, but is not limited to, a hard disk and an optical disk; and communication unit 69, which includes, but is not limited to, a network interface card (NIC), a modem, and a wireless communication transceiver. Communication unit 69 allows electronic device 60 to exchange information and / or data with other devices through computer networks and / or telecommunications networks, including, but not limited to, the Internet.

[0087] Processor 61 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 61 include, but are not limited to, at least one of a central processing unit (CPU), a graphics processing unit (GPU), a dedicated artificial intelligence (AI) computing chip, a processor running machine learning model algorithms, a digital signal processor (DSP), a controller, and a microcontroller. Processor 61 performs the various methods and processes described above, such as a data protection method for a visualization system based on intranet penetration.

[0088] In some embodiments, the intranet-based visualization system data protection method can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 68. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 60 via ROM 62 and / or communication unit 69. When the computer program is loaded into RAM 63 and executed by processor 61, one or more steps of the intranet-based visualization system data protection method described above can be performed. Alternatively, in other embodiments, processor 61 can be configured to perform the intranet-based visualization system data protection method by any other suitable means, including but not limited to firmware configuration.

[0089] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transferring data and instructions to the storage system, at least one input device, and at least one output device.

[0090] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0091] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0092] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device for displaying information to a user; and a keyboard and pointing device through which the user provides input to the electronic device. The display device includes, but is not limited to, a cathode ray tube (CRT) monitor or a liquid crystal display (LCD) monitor; the pointing device includes, but is not limited to, a mouse or a trackball. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, including but not limited to visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including but not limited to sound input, voice input, or tactile input.

[0093] The systems and technologies described herein can be implemented in computing systems that include backend components, middleware components, frontend components, or any combination thereof; wherein the backend components include, but are not limited to, data servers; the middleware components include, but are not limited to, application servers; and the frontend components include, but are not limited to, user computers with a graphical user interface or web browser through which users can interact with the implementations of the systems and technologies described herein. The components of the system can be interconnected via digital data communication of any form or medium, including, but not limited to, communication networks. Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0094] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product within the cloud computing service system.

[0095] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0096] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A data protection method for a visualization system based on intranet penetration, characterized in that, include: S1. Deploy the intermediate proxy service on the public network proxy server and configure port mapping rules; S2. Deploy an intranet penetration client on the intranet server. The intranet penetration client actively initiates a connection to the public proxy server to establish a persistent encrypted connection, and reuses multiple virtual sub-connections on the persistent encrypted connection. S3. Receive external network requests initiated by external access devices based on the intermediate proxy service and perform multi-level authentication. S4. If the external network request passes authentication, the external network request is mapped to the corresponding service port on the internal network server using the port mapping rule. S5. The internal network server responds to the external network request and generates corresponding visual response data; S6. The visualized response data is processed sequentially by the visualized data protection module, including data classification, sensitive content identification and desensitization, digital watermark embedding, dynamic key negotiation, multi-layer hybrid encryption, and fragment obfuscation, to obtain multiple encrypted fragments. The sensitive content identification and desensitization are completed on the intranet server side. The fragment obfuscation is to divide the obtained encrypted payload into K fragment bodies and add fragment headers, where K is an integer greater than or equal to 2. S7. The K fragments are sent out of order to the public network proxy server via the multiple virtual sub-connections. The public network proxy server forwards the K fragments to the external access device based only on the fragment header without decrypting the fragments. The external access device reassembles and decrypts the fragments based on the fragment header to obtain the desensitized visual response data for visualization. In step S6, the data classification includes assigning classification labels to the visualized response data according to preset rules. These classification labels include public level L0, internal level L1, and confidential level L2. Public level L0 corresponds to data that can be disclosed to any external visitor; internal level L1 corresponds to data that is only disclosed to authenticated users; and confidential level L2 corresponds to data that is only disclosed to authorized users. Sensitive content identification and desensitization are performed on the visualized response data whose classification label is internal level L1 or confidential level L2. The sensitive content includes faces, license plates, personnel identification documents, and sensitive fields consisting of at least one of ID card numbers, mobile phone numbers, bank card numbers, and addresses. The fragment header includes at least one field selected from session ID, stream ID, fragment sequence number, total number of fragments, random offset, and CRC checksum; the K is calculated based on the length N of the encrypted payload and the hierarchical tag using the following formula: ； Where K is the number of fragments of the encrypted payload; N is the length of the encrypted payload in bytes; B0 is the basic fragment unit length in bytes; γ(L) is the hierarchical adjustment factor, which increases as the hierarchical label level L increases; `+` is the floor function; `max` is the maximum value operator.

2. The data protection method for a visualization system based on intranet penetration according to claim 1, characterized in that, In step S6, the multi-layer hybrid encryption includes differential encryption of the watermarked data based on the hierarchical label: Data with the classification label set to public level L0 will only be protected for integrity. The data with the hierarchical label of the internal level L1 is encrypted using a symmetric encryption algorithm; For data with the classification label of confidentiality level L2, further attribute-based encryption or identity-based encryption is applied on top of the encryption using the symmetric encryption algorithm.

3. The data protection method for a visualization system based on intranet penetration according to claim 1, characterized in that, In step S6, the dynamic key negotiation includes: A key exchange handshake is performed once when each of the aforementioned virtual sub-connections is established, and a session master key is generated; Multiple sets of utility keys are derived from the session master key based on the key derivation function. The utility keys include data encryption keys, message authentication keys, and watermark keys. When the session duration exceeds a preset time threshold or the amount of data transmitted exceeds a preset traffic threshold, key rollover is triggered at time t. r Calculate using the following formula: ; Among them, t r t0 is the key rollover trigger time; t0 is the start time of this session; T max V is the preset time threshold; max The preset flow threshold; R avg This represents the real-time average transmission rate for this session; min is the minimum value operator.

4. The data protection method for a visualization system based on intranet penetration according to claim 1, characterized in that, In step S6, the digital watermark embedding includes embedding a digital watermark into keyframes or charts in the desensitized visual response data; wherein, the watermark content of the digital watermark includes a hash value of at least one of session ID, user ID, device fingerprint, and timestamp; the digital watermark embedding is implemented using at least one or more of the following techniques in combination: frequency domain watermarking based on discrete wavelet transform; frequency domain watermarking based on discrete cosine transform; robust watermarking based on quantization index modulation; and invisible markings for vector graphics.

5. The data protection method for a visualization system based on intranet penetration according to claim 1, characterized in that, In step S2, establishing a persistent encrypted connection includes: The intranet penetration client collects the host's hardware fingerprint upon first startup. The hardware fingerprint includes at least one of the following: CPU serial number, motherboard UUID, network card MAC address, and storage medium serial number. The hardware fingerprint is hashed to form a device fingerprint identifier. The device fingerprint identifier is bound together with a pre-set device private key and stored in the trusted execution environment provided by the operating system or the sealed storage area of ​​the hardware security module. When performing two-way authentication between the intranet penetration client and the public network proxy server, the public network proxy server first verifies whether the client certificate submitted by the intranet penetration client is in the trusted certificate list, and then verifies whether the device fingerprint submitted by the intranet penetration client is consistent with the trusted device list; if both the client certificate verification and the device fingerprint verification pass, the persistent encrypted connection is established.

6. The data protection method for a visualization system based on intranet penetration according to claim 1, characterized in that, After the persistent encrypted connection is established, the method further includes: The intranet penetration client and the public network proxy server periodically send encrypted heartbeat packets at a preset frequency; wherein, the payload of the encrypted heartbeat packet includes identification information, timestamp and connection status verification information, and the connection status verification information includes at least one of the number of currently established virtual sub-connections, the byte count of the most recent successful transmission and reception, and the key fingerprint of the most recent key roll. If the number of consecutive lost encrypted heartbeat packets exceeds a preset loss threshold, the persistent encrypted connection is determined to be unstable, triggering a connection reconstruction process that includes closing the current connection, re-initializing encryption parameters, and re-establishing the connection. After the connection is re-established, the intranet penetration client compares the connection status verification information with the public network proxy server. For the data stream that was being transmitted when the connection was lost, the transmission is automatically resumed based on the most recent successfully sent and received byte count in the connection status verification information, thus achieving breakpoint resume transmission.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data protection method for a visualization system based on intranet penetration as described in any one of claims 1-6.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the data protection method for a visualization system based on intranet penetration as described in any one of claims 1-6.

Images