A high-privilege operation entity data behavior management system based on multi-factor identity anchoring and non-repudiation evidence

Abstract

The application discloses a high-privilege operation entity data behavior management and control system based on multi-factor identity anchoring and non-repudiation evidence, and relates to the technical field of cross-border data security and internal control. The system comprises a multi-factor biological feature identity anchoring module, which generates a unique identity anchor point of a high-level manager through iris+ID card hashing, realizes the double-track binding of "high-level manager identity hashing+operation entity hashing" of an operation log, an AI semantic driven dynamic file grading module, which dynamically scores the sensitivity of a file and triggers secondary confirmation, a physical screen capture and image collection sensing module, which senses physical operation behavior in a combined manner of browser listening, operating system hook, camera light source monitoring and dynamic watermark, realizes flexible management of "leaving marks without interruption", a high-level manager flexible mark leaving and organization counterbalance submodule, which implements non-inductive mark leaving of a high-level manager and incorporates it into committee semi-annual review, and a non-repudiation evidence module, which realizes the non-tamperability of mark leaving data and the legal evidence effectiveness through third-party sovereign storage and block chain hashing evidence. The application realizes the traceability, non-repudiation and organization counterbalance closed loop of high-privilege operation entity data behavior under the premise of guaranteeing the operation experience of a high-level manager.

Description

Technical Field

[0001] This invention relates to the field of cross-border data security and organizational internal control technology, specifically to a high-privilege operation entity data behavior control system for organizations such as large Internet platforms, multinational technology groups and cross-border clearing systems. It is particularly suitable for deployment in the form of lightweight plug-ins or gateway sensing layers without modifying the underlying architecture of existing collaborative office systems, so as to achieve pre-classification, real-time recording, non-repudiable evidence storage and organizational checks and balances traceability of sensitive data operation behaviors of senior management. Technical Background

[0002] In recent years, the number of embezzlement cases filed globally has continued to rise. Large internet platforms and multinational technology groups are undergoing systemic changes in their internal organizational structures under the multiple pressures of rapid expansion, frequent restructuring, and a surge in cross-border business. The traditional governance framework of "personal trust + hierarchical authority" is rapidly losing its binding power under the constraints of full traceability, real-time transparency, and compliance pressures brought by digital constants. When every operation can be fully recorded, the presupposition of "no one would do this" is no longer sufficient to prevent behavioral deviations driven by structural interests.

[0003] Concurrently, a global regulatory network for ultimate beneficial ownership (UBO) transparency is rapidly expanding. The EU's Anti-Money Laundering Directive 6 (AMLD6) extends criminal liability to the actual controllers of legal entities; tax code-level data capture systems in several Latin American countries have achieved automatic code-level comparison of cross-border fund flows and counterparties; and multilateral cross-border financial information exchange agreements are continuously being upgraded, exposing the financial and decision-making behaviors of multinational corporations to unprecedented regulatory scrutiny. In this context, the cross-border flow of large accounts, the circulation of sensitive decision-making documents, and the approval processes of senior executives on large internet platforms are no longer merely internal management matters, but directly involve cross-border anti-money laundering compliance, data sovereignty, and the determination of the legal liability of senior executives.

[0004] However, the current internal control and compliance systems of large internet platforms and multinational technology groups still heavily rely on the "on-balance-sheet compliance" mindset in their technical architecture, and generally suffer from the following structural defects:

[0005] (I) Identity Blind Spots in Static Permission Systems. Existing collaborative office systems generally employ Role-Based Access Control (RBAC) or Access Control Lists (ACLs), granting permissions based on accounts. The underlying logic is that "the account holder is the operator." However, in the actual operation of large internet platforms, senior executives, due to high-intensity meeting schedules, cross-border time differences, multi-threaded decision-making burdens, and high internal turnover pressures, often authorize or tacitly allow their personal administrative assistants to operate their system accounts, which hold the highest approval authority and access to sensitive data. The system front-end can only recognize account login status, remaining completely oblivious to changes in the actual operator's identity, resulting in a separation of permissions from the operator's identity and making it untraceable. This phenomenon is particularly prevalent in large internet platforms and is known as "account holding on behalf of others" or "digital clones of senior executives," becoming the biggest identity black hole in compliance audits.

[0006] (II) Structural Leakage Risk of Micro-Information Nodes. Administrative assistants or staff members positioned close to senior executives are naturally at the core of micro-information capture. Through long-term, high-frequency interaction (including shared vehicles, private offices, and shared cabins on business trips), they can observe nonverbal cues (such as micro-expressions and unusual hand gestures) from senior executives during confidential calls and document signings, forming a priori perception of impending senior management reshuffles or cross-border mobility risks. Given the assistant's low level of ownership and job security within their own system, this priori information can easily be transformed into leverage for cross-organizational interest exchanges—sensitive documents or decision-making traces can be transmitted in advance to opposing factions or external competitors via external communication channels, forming an internal power struggle using "information pledges" as the medium of exchange. This risk is particularly prominent in the highly competitive organizational ecosystems of large internet platforms.

[0007] (III) The disconnect between physical world operations and system access control. The control boundaries of existing collaborative systems stop at the transmission control of data packets within the system, failing to extend to operational behaviors in the physical space. Assistants or office staff with high-frequency physical privileges can use external hardware devices (such as personal mobile phones or miniature recording devices) to take unauthorized screenshots and collect audio from highly sensitive data within the system, causing data assets to leak out physically in an irreversible manner. The system has neither the ability to detect such behavior nor any mechanism to block or trace it.

[0008] (iv) The "post-event collapse" of the audit system and the difficulty in determining responsibility. The existing compliance internal audit mechanism can only conduct delayed static audits of accounts and retrospectives of operational logs after a risk event occurs, economic losses become apparent, or regulatory intervention takes place. During critical decision-making windows (such as before the statutory time limit for cross-border fund transfers), there is a lack of proactive awareness and the ability to unilaterally anchor responsibility for ongoing instances of assistants exceeding their authority, cross-border data transfers, or abnormal operations by senior executives. More importantly, the existing log system is maintained and managed by the company's internal IT department, making it susceptible to technical tampering or selective deletion, severely undermining its credibility and non-repudiation as legal evidence. Summary of the Invention

[0009] This invention addresses all the shortcomings of the existing technologies by providing a high-privilege entity data behavior control system based on multi-factor identity anchoring and non-repudiation evidence storage. Its core governance philosophy is: not to use technological rigidity to counteract the flexibility of power, but rather to use the principle of "traceability as deterrence" and "source tracing as checks and balances," positioning the technological system as the data infrastructure for organizational governance, rather than a behavior blocker.

[0010] The aforementioned core philosophy is specifically embodied in the system architecture as follows: a "fully flexible, traceable but not disruptive" strategy is implemented for senior executives to ensure the system's acceptability and feasibility at high-level authority; a "tiered control and circuit breaker trigger" strategy is implemented for assistants involved in nominee shareholding operations to form effective constraints at key nodes; all traceable data is entered into a non-repudiable evidence storage system, coupling technical capabilities with organizational checks and balances to achieve "every abnormal behavior is traceable, and every trace can become the legal basis for initiating an inquiry procedure."

[0011] To achieve the above objectives, the present invention adopts the following technical solution:

[0012] (I) Multi-factor biometric identity anchoring module

[0013] This module establishes a unique and unforgeable identity anchor for each senior executive during the system registration process. The specific implementation method is as follows:

[0014] When an executive registers for the first time, their iris biometrics and ID information are collected simultaneously. After being stamped with a trusted timestamp by the National Time Service Center or an equivalent trusted time source, a unique identity hash value (hereinafter referred to as "executive identity hash") is generated for the executive using the national cryptographic SM3 or SHA-256 algorithm. This hash value forms a dual biological and legal binding relationship with the executive, and is non-transferable and cannot be impersonated.

[0015] After registration, executives can log in to the system daily using only their internal company phone number and a preset static password. The system backend associates the login credentials with the executive's identity hash through a mapping table, eliminating the need for additional biometric identification at the operational level and ensuring that the executive's work efficiency and user experience are not affected.

[0016] When an executive authorizes or tacitly permits his administrative assistant to log in to the system using the account, the login credentials themselves do not change. However, the system automatically identifies the current operator as being in a "proxy operation" state through the session context (such as login device fingerprint, login time pattern, operation behavior sequence, and other auxiliary features) and records the unique operation entity identifier of the current session (hereinafter referred to as "operation entity hash") in the system log.

[0017] Login logs and all subsequent operation logs simultaneously record both the "executive's identity hash" and the "operation entity hash," forming a dual-track identity anchoring record of "executive + operator." When a violation occurs and accountability needs to be pursued, the system can accurately pinpoint the actual physical operator within any operation time window, eliminating the problem of "identity ambiguity caused by account sharing."

[0018] (ii) AI-driven dynamic file classification module

[0019] When an entity (including the executive or their authorized assistant) opens or previews a sensitive file in the collaborative office system, this module automatically embeds itself in the system's front-end or back-end, initiating a file hierarchical analysis process based on semantic understanding using a large language model. The specific implementation method is as follows:

[0020] Based on the company's existing organizational structure permission table and file security level label system, the system extracts the permission level label (hereinafter referred to as "permission level value") of the file under the current department and role.

[0021] The system inputs the text content of the file (or the text embedded in the image after optical character recognition) into the AI ​​semantic analysis model deployed in the enterprise intranet isolation environment or the sovereign trusted execution environment. The model outputs a sensitivity score for the file, including but not limited to: the level of cross-border funds, the number of regulatory jurisdictions involved, the degree of UBO information disclosure, and the degree of impact on organizational stability, etc., a weighted comprehensive score.

[0022] The system combines "permission level value" and "AI sensitivity score" for judgment. If the overall rating is lower than the preset "general concern threshold", normal operation is allowed, and only the operation entity hash and file access timestamp are recorded in the background for post-event auditing.

[0023] If the overall rating reaches or exceeds the "important attention threshold", the system will automatically pop up a message after the operating entity completes the document reading or approval operation: "This document has entered the secondary confirmation process and will be transferred to the highest-level executive for final approval after your confirmation." At this time, the operation process enters a waiting state until the executive confirms through the pop-up window or mobile device before it can continue.

[0024] (III) Physical Screenshot and Image Acquisition Behavior Sensing Module

[0025] This module provides a multi-layered sensing and response mechanism for physical screen snapshots and external device recording in highly sensitive operation scenarios. The specific implementation method is as follows:

[0026] The system uses one or more of the following methods in combination as the sensing layer for screenshot / photo taking behavior:

[0027] Method A (Browser-side sensing): Embed a JavaScript listener in the web interface of the collaborative office system to capture key events such as screenshot shortcut key operations, clipboard operation events, and page visibility change events, serving as a lightweight basic sensing layer for screenshot or screen switching behaviors;

[0028] Method B (Operating System-Level Hook): Deploy a lightweight operating system API hook service on distributed terminal devices that are under the organization's control to listen for operating system screen capture API calls (including Windows BitBlt, macOS CGDisplayCreateImage, etc.) and capture the screenshot behavior of system-level screenshot tools and third-party screenshot software.

[0029] Method C (Terminal Camera Light Source Monitoring): Detect the presence of external imaging devices (such as personal mobile phones or miniature cameras) pointing at the screen to take pictures through the camera API or ambient light sensor of the terminal device. This includes, but is not limited to, the presence of non-human reflective surfaces in front of the screen, sudden changes in optical parameters caused by focusing actions, and video recording characteristics with a consistently stable frame rate.

[0030] Method D (Dynamic Watermark and Image Fingerprint Comparison): An invisible digital watermark or dynamic dot matrix watermark is superimposed on the interface of sensitive files. When a screenshot or photo is taken, the source terminal of the screenshot, the operation time and the hash of the operation entity are traced by comparing the image fingerprint extraction with the back-end watermark decoding. This method serves as an auxiliary tracing layer and does not rely on real-time blocking.

[0031] The triggering method employs a bidirectional parallel strategy: when any one or more of the above methods A, B, C, and D are activated, the response mechanism can be triggered independently or in conjunction with each other to minimize the detection blind spot. The methods are independent of each other and complementary to each other; the detection of any method can initiate the response process.

[0032] The response mechanism is as follows:

[0033] When the sensing layer detects a screenshot or photo-taking action, the system does not block the operation in the foreground (preserving the normal user experience of the operation entity and avoiding triggering adversarial avoidance behavior), but immediately generates a high-priority behavior trace event in the background.

[0034] The system also pops up a prompt box, requiring the entity performing the operation to complete the operation notes within 30 minutes. The notes should include at least: the purpose of the screenshot or photo, the intended use, and the recipient's information.

[0035] If the entity performing the operation completes the note within 30 minutes, the record of the action, along with the note content, will be stored in the non-repudiable evidence storage system for subsequent compliance review.

[0036] If an entity fails to complete the annotation within 30 minutes, the system automatically triggers a dual action of blocking and reporting: blocking the entity's further file access permissions in the current session, and simultaneously forwarding the unannotated event to the corresponding executive's terminal, notifying the executive: "Please handle this unannotated task within 30 minutes, as there may be a risk of information leakage." The executive then decides whether to restore permissions or initiate an internal investigation.

[0037] (iv) Sub-module of flexible record keeping and organizational checks and balances for senior executives

[0038] This invention implements an asymmetric control strategy between senior executives and ordinary operational entities (such as administrative assistants) to respect the objective reality of the power structure of large internet platform organizations.

[0039] For screenshots, photos, or documents taken by senior executives and sent out externally, the system will not trigger any foreground blocking, pop-ups, or note requests, thus not interfering with the executives' normal decision-making rhythm and operational experience, in order to maintain their sense of control and efficiency within the organization. This design is based on a deep consideration of organizational behavior—senior executives hold organizational power and capital, and have a natural sensitivity and aversion to being "monitored." Rigid control at this level will trigger systemic execution resistance and even organizational political backlash, making the system unfeasible.

[0040] The system fully records such operations in the background, including but not limited to: operation time, operation file identifier, operation type (screenshot / photo / copy / send), operation terminal device fingerprint, and operation environment context. All trace data is stored at the sovereign level through the following non-repudiation evidence storage module.

[0041] All executive behavior data is kept secret and is not accessible for real-time access to query or modify by the company's internal IT department, internal auditors, or any organizational role that may be directly managed by executives, in order to avoid interference with and dismantling of the chain of evidence by the company's internal power structure.

[0042] The audit logs are only accessible during the semi-annual review process of the Joint Internal Audit and Compliance Committee, and can only be accessed after obtaining authorization from the committee chair, legal representative, and external independent compliance representative. Based on the audit logs, the committee conducts quality reviews of senior management's data manipulation activities during the reporting period. The review conclusions are incorporated into senior management's KPI assessments and promotion considerations, forming a complete governance chain of "technical auditing—organizational checks and balances—personnel closed loop."

[0043] (v) Non-repudiable evidence storage and sovereign-level storage modules

[0044] This module is responsible for storing and protecting all trace data from tampering. The specific implementation method is as follows:

[0045] Storage subject isolation: Trace data is not stored in the enterprise's internal database, data warehouse, or any storage medium accessible to the IT department. The system encrypts the trace data and transmits it in real time to a third-party sovereign-level storage node independent of the enterprise, including but not limited to: nationally authorized electronic data judicial evidence storage platforms, trusted timestamp service providers of the National Time Service Center, or independent third-party evidence storage nodes with sovereign-level data governance qualifications;

[0046] Blockchain hash notarization: The hash values ​​of the core metadata of the aforementioned trace data (including operation timestamps, executive identity hashes, operation entity hashes, operation behavior types, file identifiers, and device fingerprints) are synchronously uploaded to a permissioned blockchain or consortium blockchain network for notarization. Any modification to the original data by any notarization node will cause the hash verification to fail, resulting in a mismatch between the on-chain notarized hash and the original data hash. This ensures that any tampering by internal personnel (including executives, IT administrators, and system maintenance personnel) is discoverable and verifiable.

[0047] Access Control: Retrieval of the original data is strictly prohibited from being initiated by any unilateral request from any entity within the enterprise. Only after legal intervention by regulatory agencies, formal commencement of judicial proceedings, or the compliance committee's review process authorized by multi-signature, will the multi-signature parties jointly initiate a retrieval request to a third-party sovereign storage node. The storage node will then verify the validity of the multi-signature and provide the original data. After retrieval, the original data will be subjected to a secondary verification against the on-chain hash to confirm data integrity and its unaltered state.

[0048] This module's design ensures that all trace data stored in the system possesses irrefutable legal-grade evidentiary value, providing a data foundation that can be accepted by external authoritative institutions for regulatory inquiries, judicial evidence presentation, and internal accountability.

[0049] The collaborative relationship between the modules of this invention is as follows: the identity anchoring module provides a unique identity identifier for the entire system; the document classification module performs dynamic risk assessment in the middle of the operation chain to determine whether to trigger a secondary confirmation circuit breaker; the behavior sensing module performs real-time perception and response at the physical operation level; the senior management flexible traceability sub-module implements an asymmetric strategy for senior management; and the traceability data generated by all modules is finally integrated into the non-repudiable evidence storage module, forming a complete data chain closed loop from "who is operating" → "what was operated" → "how was it operated" → "who is responsible for it" → "the evidence is non-repudiable". Detailed Implementation

[0050] The technical solution will now be described in detail with reference to a preferred embodiment of the present invention. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of protection of the present invention.

[0051] Example 1: Executive Registration and Daily Login

[0052] Step S101: When senior executive A of a large internet platform uses the system for the first time, he enters his iris image and uploads an electronic copy of his ID card through a dedicated registration terminal (such as a security-hardened mobile device or a fixed collection station);

[0053] Step S102: The system calls the National Time Service Center's timestamp service to add a trusted timestamp to the collection time and identity information;

[0054] Step S103: The system uses the national cryptographic SM3 algorithm to calculate a 256-bit hash value for "iris feature value + ID card number + trusted timestamp", which serves as the unique identity hash of executive A and is stored in the system's secure isolation area.

[0055] Step S104: The system associates executive A with his / her internal company phone number and sets a login password. During daily logins, executive A or his / her authorized assistant B only needs to enter "phone number + password" to log in to the collaborative office system; the front-end experience is identical to existing collaborative systems.

[0056] Step S105: The system backend identifies the fingerprint and historical behavior patterns of the currently logged-in device to determine whether the current operation is a "proxy operation". If it is operated by executive A himself, the log records the executive's identity hash; if it is operated by assistant B, the log records both the executive's identity hash and the assistant B's operation entity hash (dynamically generated and bound by the device fingerprint and behavior pattern). The login log is written in "double hash" format.

[0057] Example 2: AI Semantic Classification and Secondary Confirmation Triggering

[0058] Step S201: Assistant B opens a cross-border fund transfer approval document F in the collaborative office system;

[0059] Step S202: The system extracts the security level label and permission level value of the department where file F is located from the enterprise's existing permission table, and at the same time inputs the content text of file F into the AI ​​semantic analysis model deployed in the enterprise's intranet isolation environment;

[0060] Step S203: The sensitivity score of the AI ​​model output file F includes a weighted composite score of three dimensions: "cross-border quota level", "number of jurisdictions involved" and "UBO information disclosure depth", with a composite value of 87 (out of 100).

[0061] Step S204: The system integrates the permission level value with the AI ​​comprehensive score to determine whether file F belongs to the "important attention threshold" or above;

[0062] Step S205: After Assistant B completes the approval form for document F and clicks submit, the system pops up a prompt window: "This document has entered the second confirmation process and will be transferred to the highest-level executive A for final approval after your confirmation." After Assistant B confirms, the document is transferred to executive A's pending approval list;

[0063] Step S206: Executive A completes the final confirmation via a pop-up notification on the mobile device, and document F is approved. Throughout the entire operation path, both Assistant B's operation entity hash and Executive A's executive identity hash are recorded in the background.

[0064] Example 3: Screenshot sensing and 30-minute note circuit breaker

[0065] Step S301: When Assistant B is working on file F, he presses the PrintScreen key on the keyboard to take a screenshot;

[0066] Step S302: The system captures the key event through the browser-side JavaScript listener (Method A) and simultaneously captures the screen capture API call through the operating system-level hook (Method B), triggering bidirectional sensing at the same time;

[0067] Step S303: The system does not block Assistant B's screenshot behavior. The screenshot image is saved normally to Assistant B's local clipboard or desktop. However, the system immediately generates a high-priority trace event in the background, recording the operation time, file identifier, operation entity hash, and screenshot behavior type.

[0068] Step S304: The system displays a pop-up message: "Please complete the remarks for this operation within 30 minutes, explaining the purpose and usage of the screenshot. If the remarks are not completed within 30 minutes, the system will automatically terminate this session and notify Executive A."

[0069] Step S305: Assistant B completes the remarks within 28 minutes, filling in the content as "For cross-border quota comparison reference, not to be sent to the public for the time being";

[0070] Step S306: The system encrypts the behavior traces and notes, transmits them in real time to a third-party sovereign-level storage node, and generates a hash value for on-chain storage. The session then resumes normal operation.

[0071] Example 4: Automatic blocking and reporting of cases with incomplete comments

[0072] Step S401: Assistant C failed to complete the annotation within 30 minutes after taking the screenshot;

[0073] Step S402: The system automatically triggers a blocking action, and Assistant C's current session file access permissions are suspended, preventing it from opening or previewing any sensitive files;

[0074] Step S403: The system forwards the event "This task has not been noted within 30 minutes" to the executive's terminal, with a pop-up notification: "Please handle this unmarked task within 30 minutes, as there may be a risk of information leakage."

[0075] Step S404: The executive chooses, based on the actual situation, whether to restore Assistant C's access permissions (e.g., if it is determined that the screenshot was for work purposes) or to initiate an internal compliance inquiry procedure. The entire incident is documented and entered into the non-repudiable evidence storage system.

[0076] Example 5: Flexible Record Keeping by Senior Management and Committee Review

[0077] Step S501: When reviewing decision documents for a cross-border M&A project, executive A took a picture of the screen with his personal mobile phone, intending to send it to the overseas partner via instant messaging.

[0078] Step S502: The system detects the focusing action of the external imaging device through the terminal camera light source monitoring (method C), but does not trigger any foreground blocking, pop-up window or note requirements, and the operation experience of executive A is completely uninterrupted;

[0079] Step S503: The system backend leaves a complete record of the operation time, file identifier, executive identity hash, and behavior type "external device photo". The record data is encrypted and transmitted to a third-party sovereign-level storage node and stored on the blockchain for evidence.

[0080] Step S504: During the semi-annual internal audit and compliance joint committee review in the following year, the committee, with multiple signatures of authorization, retrieved all behavioral data of executive A during the reporting period;

[0081] Step S505: The committee's review found that Executive A had multiple external device photographic records without corresponding business reporting explanations. In accordance with the organization's bylaws, this was included in the annual compliance quality score, directly impacting his annual KPI assessment and subsequent promotion evaluation. This review result also serves as part of the internal governance report issued by the internal audit committee to the board of directors, forming a complete organizational governance loop.

[0082] Example 6: Third-Party Evidence Preservation and On-Chain Verification – Verification of Evidence Non-Repudiation

[0083] Step S601: Suppose that the company's internal IT department or executive A attempts to delete or modify a record of an operation in the company's local database;

[0084] Step S602: Since the original trace data has been stored on a third-party sovereign storage node and the hash value has been recorded on the blockchain, the deletion or modification of the local database cannot affect the original text and the on-chain hash in the third-party node.

[0085] Step S603: When a regulatory agency or judicial procedure lawfully retrieves the trace data, the retrieving party obtains the original text from a third-party node, obtains the evidence hash from the blockchain, calculates the hash value of the original text, and compares it with the hash on the blockchain.

[0086] Step S604: If modifications have been made locally by the enterprise, the original hash of the third-party node still matches the hash on the chain (proving that the original text has not been tampered with), and the enterprise's local modification record becomes circumstantial evidence that "tampering attempt exists".

[0087] Step S605: This mechanism ensures that all trace data in the system is legally admissible, and no single entity (including the executive himself, the IT department, or the system maintenance party) can unilaterally eliminate or alter the evidence, thus achieving true non-repudiation.

[0088] Beneficial effects

[0089] Compared with the prior art, the present invention has the following significant advantages:

[0090] 1. Identity-anchored executive binding. An unforgeable unique identity anchor is generated for executives through iris scanning and ID card hashing. While maintaining a lightweight login experience, the operation log implements a dual-track binding of "executive identity hash + operation entity hash," resolving the fundamental flaw of "account sharing equals identity ambiguity" in traditional RBAC / ACL systems. Any operation can accurately pinpoint the actual physical operator, providing an irrefutable identity anchor for subsequent accountability.

[0091] 2. Intelligent and dynamic behavior classification. An AI semantic model is introduced to dynamically score file sensitivity in real time, replacing the traditional static security classification label determination. This enables the identification of file content that is "semantically sensitive but not covered by labels," achieving more accurate and flexible classification control and reducing false alarms and missed alarms.

[0092] 3. Composite sensing of physical screenshot / photo-taking behavior. This system combines four methods—browser-side monitoring, operating system-level hooks, camera light source detection, and dynamic watermarking—to form a bidirectional, parallel, multi-layered sensing network, filling the technological gap of existing systems that completely blindly detect physical space operations. The multiple sensing methods are independent and redundant; if one method fails, others can still trigger a response.

[0093] 4. A flexible governance design that "leaves traces but doesn't disrupt." This approach implements a completely seamless, flexible traceability strategy for senior executives, ensuring their normal work efficiency and sense of control are not interfered with. This guarantees the system's acceptability and feasibility in the real organizational environment of a large internet platform, avoiding the execution resistance and organizational political backlash that rigid technical controls face at high power levels. This design shifts the technical system from "confronting power" to "serving checks and balances," which is the core philosophical difference between this invention and all existing internal control systems.

[0094] 5. Sovereign-level protection with non-repudiable evidence. The trace data is stored on a third-party sovereign-level node that is inaccessible to the enterprise, and is supplemented by blockchain hash evidence. No internal personnel (including the IT department and senior executives) can unilaterally tamper with or delete it, giving the trace data legal-level evidentiary effect and truly realizing a governance closed loop of "traceability as checks and balances".

[0095] 6. A closed-loop system of checks and balances within the organization. Through the semi-annual review mechanism of the Joint Internal Audit and Compliance Committee, technical record-keeping is transformed into an objective basis for personnel assessment and promotion, elevating the technology system from a "monitoring tool" to a "data infrastructure for organizational governance," thus achieving a deep integration of technical means and organizational systems.

[0096] 7. Lightweight deployment without modifying the platform foundation. The system is deployed on top of existing collaborative office systems as a lightweight plugin or gateway sensing layer, without modifying the underlying architecture and existing permission system. This significantly reduces the system transformation costs of large-scale Internet platforms and the difficulty of cross-departmental coordination, enabling rapid deployment and scalability.

Claims

1. A high-privilege operation entity data behavior control system based on multi-factor identity anchoring and non-repudiation evidence storage, characterized in that, include: The identity anchoring module is configured to collect the biometric information and legal identity information of executives during the registration process, generate an identity anchor hash value that is uniquely bound to the executive, and map the login credentials to the identity anchor hash value during the daily login process. At the same time, it identifies whether the current operation entity is a nominee operation and records the executive's identity identifier and the actual operation entity identifier in the operation log to form a dual-track identity binding record. The file classification module is configured to respond to the access operation of the operation entity to sensitive files, extract the permission level value of the file based on the existing permission system, and score the sensitivity of the file content through an AI semantic analysis model. The permission level value and the sensitivity score are merged to determine the file level. Files that are determined to be above the important attention threshold are triggered for secondary confirmation and transferred to senior management for final review. The behavior sensing and response module is configured to detect the screenshot or external image acquisition behavior of the operating entity on the system display interface through one or more sensing methods, and trigger a response with a bidirectional parallel strategy. The response includes: generating a background trace event without interrupting the current operation, prompting the operating entity to complete the operation note within a specified time, and if the note is not completed within the specified time, automatically blocking the current session and reporting the unmarked event to the corresponding senior executive. The non-repudiation evidence module is configured to store all operation trace data in real time on an inaccessible third-party sovereign-level storage node within the enterprise, and synchronously store the hash value of the trace data on the blockchain network. Retrieval of trace data requires multi-signature authorization, and the integrity of the data is verified by on-chain hash after retrieval, thus achieving the immutability and non-repudiation of the trace data.

2. The system according to claim 1, characterized in that, In the identity anchoring module: The biometric information includes iris features, the legal identity information includes ID card information, and the identity anchor hash value is generated by the iris feature value, ID card number and trusted timestamp using the national cryptographic SM3 or SHA-256 algorithm. The login credentials for the daily login process are a combination of a phone number and a static password. The system backend associates the login credentials with the identity anchor hash value through a mapping table. When the actual login operation is a proxy operation, the system automatically identifies the entity through one or more auxiliary features, such as the device fingerprint of the current login device, the login time pattern, and the operation behavior sequence, and generates an operation entity hash, which is then written into the operation log along with the executive identity anchor hash value.

3. The system according to claim 1, characterized in that, In the file hierarchy module: The AI ​​semantic analysis model is deployed in an enterprise intranet isolated environment or a sovereign-level trusted execution environment. The sensitivity score includes at least one or more weighted dimensions of cross-border fund amount level, number of jurisdictions involved, degree of disclosure of beneficial ownership information, and degree of impact on organizational stability. The fusion judgment calculates the combined weighted value of the permission level and the sensitivity score. Files below the preset general attention threshold are automatically allowed and the operation entity hash and access timestamp are recorded in the background. Files that reach or exceed the preset important attention threshold trigger a secondary confirmation pop-up prompt, and the operation process enters a waiting state until the senior executive completes the final confirmation before it can continue.

4. The system according to claim 1, characterized in that, In the behavior sensing and response module, the sensing method includes one or more combinations of the following: Method A: Embed a JavaScript listener in the system's web interface to capture key events such as screenshot shortcuts, clipboard operations, and page visibility changes. Method B: Deploy an operating system-level API hook service on the terminal device to listen for operating system screen capture API calls; Method C: Detect the optical characteristics of an external imaging device pointing at the screen to take a picture via the terminal device's camera API or ambient light sensor; Method D: Overlay an invisible digital watermark or dynamic dot matrix watermark on the sensitive file interface, and trace the source of the screenshot by comparing the image fingerprint extraction with the back-end watermark decoding. When any one or more of the above methods A to D are activated, the response mechanism is triggered independently or in conjunction with each other.

5. The system according to claim 1, characterized in that, In the behavior sensing and response module: The specified time is 30 minutes, and the remarks shall at least include the purpose of the screenshot or photo of the operating entity, the intended use method, and the recipient information; If the entity performing the operation completes the remarks within the specified time, the behavior record along with the remarks will be stored in the non-repudiable evidence storage module. If the operating entity fails to complete the annotation within the specified time, the automatic blocking includes suspending the operating entity's file access permissions in the current session, and the reporting includes transferring the unannotated event and all its context data to the corresponding executive terminal and notifying the executive to handle it via a pop-up window.

6. The system according to claim 1, characterized in that, It also includes a sub-module for executive flexible record keeping and organizational checks and balances: For screenshots, photos, or documents taken by the executive himself, the behavior sensing and response module does not trigger foreground blocking, pop-up prompts, or note requirements, but only leaves a complete record in the background. The complete trace includes at least the operation time, operation file identifier, operation behavior type, operation terminal device fingerprint, and operation environment context. The data on executives' behavior is not open to real-time query or modification permissions by the company's internal IT department or organizational roles directly managed by the executives; The recorded data can only be accessed after the compliance review process has been initiated, and only with the authorization of multiple signatures from the Joint Audit and Compliance Committee. The review conclusions will be incorporated into the performance evaluation and promotion assessment of senior executives.

7. The system according to claim 1, characterized in that, In the non-repudiable evidence storage module: The third-party sovereign-level storage nodes include one or more of the following: a nationally authorized electronic data judicial evidence storage platform, a trusted timestamp service provider of the National Time Service Center, or a third-party independent evidence storage node with sovereign-level data governance qualifications. The blockchain network is a permissioned blockchain or a consortium blockchain; The trace data is encrypted before storage and evidence preservation. The original text and hash value are stored separately, and the original text cannot be deduced from the on-chain hash.

8. The system according to claim 1, characterized in that, In the non-repudiable evidence storage module: The retrieval of the aforementioned trace data will not be accepted by any single entity within the enterprise. Only after the regulatory agency intervenes in accordance with the law, the judicial process is formally initiated, or the compliance committee initiates a review process with multi-signature authorization, will the multi-signature entities jointly initiate a retrieval request to the third-party sovereign storage node. After retrieving the original text, a second verification is performed against the blockchain's evidence hash to confirm the data's integrity and that it has not been tampered with. Only then can it be used as the basis for internal accountability, regulatory inquiries, or judicial evidence.

9. The system according to claim 1, characterized in that, The system is deployed on top of the existing collaborative office system as a lightweight plug-in or gateway sensing layer, without modifying the underlying architecture and existing permission system of the collaborative office system.

10. The system according to any one of claims 1 to 9, characterized in that, The high-authority operating entities include senior executives of large internet platforms and multinational technology groups and their authorized administrative assistants or temporary operating agents. The sensitive documents include cross-border fund transfer approval documents, decision-making documents involving the disclosure of beneficial ownership information, and top-secret documents containing organizational restructuring or personnel changes.

11. A method for controlling the data behavior of high-privilege operation entities based on multi-factor identity anchoring and non-repudiation evidence storage, implemented using the system described in any one of claims 1 to 10, characterized in that, Includes the following steps: Step 1: During the registration process, collect the executive's biometric information and legal identity information, generate an identity anchor hash value that is uniquely bound to the executive, map the login credentials to this hash value during daily login, and record the executive's identity identifier and the actual operation entity identifier in the operation log respectively; Step 2: In response to the operation entity's access operation to sensitive files, extract the permission level value of the file and perform sensitivity scoring through AI semantic analysis model, integrate and determine the file level, and trigger a secondary confirmation flow for files above the important attention threshold to be transferred to senior management for final review. Step 3: Detect the screenshot or external image capture behavior of the operating entity on the system display interface through one or more sensing methods, generate a background trace event without interrupting the current operation, and prompt the user to complete the operation note within a specified time. If the note is not completed within the specified time, the current session will be automatically blocked and the unmarked event will be reported to the corresponding senior executive. Step 4: Store all operation trace data in real time on an inaccessible third-party sovereign storage node within the enterprise, and synchronously store the hash value of the trace data on the blockchain network. Retrieval of trace data requires multi-signature authorization, and the integrity of the data is verified by on-chain hash after retrieval.

12. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by the processor, they implement the method as described in claim 11.

13. The method according to claim 11, characterized in that, In step three: Screenshots, photos, or documents taken by senior executives will not trigger front-end blocking, pop-up prompts, or note requirements. Instead, they will be fully recorded in the background. The recorded data will be non-repudiated and preserved as evidence in step four, and will be included in the periodic review scope of the compliance committee. The review conclusions will serve as one of the bases for senior executive performance evaluation and promotion assessment.