Traceable invisible watermark adding method and system based on pluggable security module

Abstract

The application discloses a traceable invisible watermark adding method and system based on a pluggable security module. A display performs normal or security display control according to a solidified device type identifier; the security display performs random challenge, module certificate verification and signature verification on the in-place pluggable security module, and controls the display panel to be black when the module is off or authentication fails; after authentication, a secure element (SE) encrypts and signs watermark source data containing the SE unique identifier, enterprise code and time information, a security MCU completes encoding and dot matrix mapping, and an image processing and conversion chip writes directly renderable watermark pattern data into a top independent OSD layer. The scheme can realize trusted watermark adding, pluggable security control and screen shot information tracing on the basis of preserving the original video processing channel of the display.

Description

Technical Field

[0001] This application relates to the fields of display terminal information security and screen watermarking technology, specifically to a traceable invisible watermarking method and system based on a pluggable security module. Background Technology

[0002] With the widespread use of mobile shooting devices, capturing sensitive information displayed on a screen through photos or videos has become a significant avenue for information leakage. Software-based screen watermarking typically relies on the host operating system and applications, making it susceptible to damage from program closures, system reinstallation, or changes in the input source.

[0003] Chinese invention patent application CN113724124A discloses a method, system board, and device for implementing secure display based on invisible watermarking. It integrates an embedded system board within a liquid crystal display (LCD), generates an invisible watermark containing identifier and time information using an FPGA and processor, synthesizes the watermark with the pixel values ​​of the input video, and then outputs the processed video data to the display scaler motherboard. This solution can achieve cross-media watermarking independently of the host operating system and input source.

[0004] In the above solution, the embedded system board is fixedly combined with the display. The watermark board needs to receive, buffer, and process the complete video stream, which places high demands on the video interface bandwidth, storage capacity, and computing power, increasing the hardware cost and modification difficulty of the display. When the watermark component is removed, replaced, or counterfeited, the display cannot reliably identify the legitimacy of the watermark component, posing a risk that the displayed image will be unprotected by a trusted watermark. Summary of the Invention

[0005] To address the aforementioned shortcomings, the technical problem this application aims to solve is to provide a traceable invisible watermarking method and system based on a pluggable security module, in order to resolve the issues of existing hardware watermarking schemes having high requirements for complete video processing resources, lack of reliable verification of the legality of the watermarking module, and the possibility that the display may continue to output images even after the watermarking component has been removed.

[0006] Therefore, a first aspect of this application provides a method for adding a traceable invisible watermark based on a pluggable security module, comprising the following steps: When the display is powered on, the display control MCU issues a command to turn off the watermark or a command to add the watermark based on the device type identifier; different values ​​of the device type identifier represent ordinary displays and security displays, respectively. In response to the watermark disabling command, the watermark OSD layer is disabled, and the image processing and conversion chip processes the input data and outputs it to the display panel. In response to the watermarking instruction, the presence status of the pluggable security module is detected. When the module is in place, a random challenge is sent. When the module is out of place, the display panel is turned off. The Security Element (SE) uses the module's private key to sign the random challenge and returns the signature result and the module certificate. The display control MCU verifies the module certificate based on the root trust public key and verifies the signature result based on the module's public key. If the authentication is successful, the module's legal status is latched and normal display is allowed. If the authentication fails, the display panel is controlled to go black. The system continuously monitors the presence status of the pluggable safety module. When the module is removed, its legal status is cleared and the display panel is turned off. When the pluggable safety module is reinserted, it is re-authenticated. Once the authentication is successful, the normal display is restored. After the legal status is latched, the security element SE encrypts and signs the watermark source data containing the SE's unique identifier, enterprise code, and time information. The security MCU encodes and maps the processed watermark source data into watermark graphic data that can be directly rendered, and sends it to the image processing and conversion chip. The image processing and conversion chip writes the watermark graphic data into the top-level independent OSD layer, forming an invisible watermark that covers the displayed screen.

[0007] By adopting the above technical solution, normal video display can be maintained in ordinary displays, while in secure displays, the presence and authentication status of legitimate security modules are associated with normal display. The security element SE, security MCU, and image processing and conversion chip respectively complete the password processing, dot matrix generation, and OSD overlay. This reduces the burden of complete video processing and prevents the secure display from outputting images that are not protected by trusted watermarks when modules are missing or authentication fails.

[0008] In the above technical solution, preferably, the device type identifier is permanently stored in a one-time programmable memory area of ​​the display control MCU or in a write-protected non-volatile memory area. This implementation can reliably distinguish between ordinary displays and security displays through the protected hardware storage state, reducing the possibility of changing the device security type and display access policy during use.

[0009] In the above technical solution, preferably, the module certificate contains a module public key, and the module certificate is issued by the manufacturer's or enterprise's root of trust. The display control MCU generates a random challenge when the display is powered on or the pluggable security module is inserted, verifies the module certificate based on the root of trust public key, and verifies the signature result based on the module public key. This implementation can confirm that the access module belongs to the trusted module system, and improves the freshness of the authentication message by generating a random challenge for this authentication, reducing the risk of historical authentication messages being reused.

[0010] In the above technical solution, preferably, after successful authentication, the display control MCU maintains the module's legitimate state until the display is powered off or the pluggable security module is removed. When the pluggable security module is reinserted, a new random challenge is generated, and after successful authentication, the normal display of the display panel is restored. This implementation forms a closed-loop state control system that connects power-on authentication, on-site detection during operation, black screen removal after removal, and authentication upon reinsertion.

[0011] In the above technical solution, preferably, the display is provided with a watermark data transmission channel and a video data processing channel; the security element SE encrypts and signs the watermark source data, and the security MCU performs error correction encoding and dot matrix mapping on the processed watermark source data to generate the watermark graphic data, which is then sent to the image processing and conversion chip through the watermark data transmission channel; the image processing and conversion chip receives and processes the input data through the video data processing channel, and superimposes the watermark graphic data onto the processed input video image. This implementation allows the pluggable security module to centrally process the watermark source data, while the image processing and conversion chip retains its original video processing functions, reducing the need for repeated reception, buffering, and conversion of the complete input video stream.

[0012] Preferably, the above technical solution further includes: Acquire photographs or video frames formed by capturing the displayed image; Locate the display area in the photo or video frame and perform perspective correction on the display area; The watermark image is extracted from the display area, the watermark image is corrected and decoded to obtain encrypted watermark data and signature information, the encrypted watermark data is decrypted and the signature is verified to obtain the SE unique identifier, enterprise code and time information. The configuration record of the pluggable security module is queried based on the unique SE identifier to determine the responsible party.

[0013] A second aspect of this application provides a traceable invisible watermarking system for a display based on a pluggable security module, including a display control module, a pluggable security module, and a display panel. The display control module includes a display control MCU and an image processing and conversion chip. The display control MCU has a device type identifier embedded in it and stores the root public key of trust. The pluggable security module includes a security MCU, a security element SE, and a module in-situ interface. The security element SE stores the module private key, the module certificate, and the unique identifier of the SE. The display control MCU issues a watermark-off command or a watermark-adding command based on the device type identifier, where different values ​​of the device type identifier represent ordinary displays and security displays, respectively. In response to the watermark-off command, the watermark OSD layer is controlled to be in a closed state, and the image processing and conversion chip outputs the received input data to the display panel. In response to the watermark-adding command, the presence status of the pluggable security module is detected, and a random challenge is issued when the pluggable security module is in place. The security element (SE) uses the module's private key to sign the random challenge and returns the signature result and the module certificate. The display control MCU verifies the module certificate based on the root trust public key and verifies the signature result based on the module's public key. After successful authentication, the module's legal status is latched and normal display is allowed. The display control MCU continuously monitors the module's on-site status. If authentication fails or the module is removed, the legal status is cleared and the display panel is controlled to go black. When the pluggable security module is reinserted, it is re-authenticated. After successful authentication, normal display is restored. The security element SE is also used to encrypt and sign the watermark source data containing the SE's unique identifier, enterprise code, and time information; the security MCU is used to encode and map the processed watermark source data into watermark graphic data that can be directly rendered after the legal state is latched, and send it to the image processing and conversion chip; the image processing and conversion chip is used to write the watermark graphic data into the top-level independent OSD layer to form an invisible watermark covering the display screen.

[0014] In the above system, preferably, the pluggable security module further includes an independent real-time clock, a backup power supply, and an tamper detection circuit; the security element SE has a non-volatile log storage area, and the enterprise code and the unique identifier of the SE are stored in the security element SE; the independent real-time clock is powered by the backup power supply and generates the time information. This structure can provide time information separate from the host system time by an independent real-time clock, and persistently store tamper and operational anomaly events, providing a record basis for subsequent security audits.

[0015] In the aforementioned system, preferably, the secure MCU performs packetization and BCH error correction encoding on the encrypted and signed watermark source data, maps the encoding result to watermark graphic data, and sends the watermark graphic data carrying transmission error verification information through the SPI interface or I²C interface according to a preset refresh cycle. The image processing and conversion chip covers the display area with the watermark graphic data in a repetitive or interlaced arrangement, and forms an invisible watermark through pixel-level low-amplitude brightness differences, color differences, or a combination of both. This structure can improve the watermark recovery capability under screen capture conditions through error correction redundancy, spatial redundancy, and refresh mechanisms, and is compatible with commonly used low-pin-count communication interfaces and OSD rendering resources of displays.

[0016] In the above system, preferably, the security MCU is used to acquire tamper events detected by the tamper detection circuit, plug-in / plug-out events of the pluggable security module, and authentication events, and writes these events into the non-volatile log storage area of ​​the security element SE in chronological order to form an anomaly log. The non-volatile log storage area adopts a circular storage method where the oldest record is overwritten by a new record after the storage space is full. The pluggable security module also includes an authorized reading interface connected to the security element SE. The authorized reading interface is used to provide the anomaly log to an authorized reading device when the pluggable security module is detached from the display. This structure can continuously retain recent anomaly events within a limited storage space and supports offline authorized forensics of the pluggable security module. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the description of the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0018] Figure 1 An architecture diagram of a traceable invisible watermarking system based on a pluggable security module provided in an embodiment of this application; Figure 2 A flowchart illustrating a traceable invisible watermarking method based on a pluggable security module, provided in an embodiment of this application. Figure 3 This is a flowchart illustrating the process of restoring and tracing the source of a photograph or video frame formed by capturing and displaying an image, as described in this application.

[0019] The annotations in the attached figures are explained as follows: Display control module 10; Display control MCU 11; Scaler (image processing and conversion chip) 12; Video data processing channel 13; Watermark data transmission channel 14; Pluggable security module 20; Security MCU 21; Security element SE 22; Module in-situ interface 23; Independent real-time clock 24; Backup power supply 25; Tamper detection circuit 26; Authorized reading interface 27; Display panel 30; image acquisition device 40; traceability and analysis terminal 50; module configuration record library 60. Detailed Implementation

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are all within the protection scope of this application.

[0021] It should be noted that, in this application, "ordinary display" refers to a display whose device type identifier indicates a normal operating type and operates in a normal display mode; while "safety display" refers to a display whose device type identifier indicates a safe operating type, and which uses the pluggable safety module in place and authentication as a condition for normal display access. Whether a display is an ordinary display or a safety display is determined by a pre-set device type identifier and is independent of whether a pluggable safety module is currently installed.

[0022] The device type identifier can be written to the display control MCU during the display manufacturing or security configuration phase and permanently stored in the one-time programmable memory area of ​​the display control MCU, or permanently stored in a write-protected non-volatile memory area. In embodiments using one-time programmable memory areas, the device type identifier can be written via fuse bits, one-time programmable cells, or security configuration bits. In embodiments using non-volatile memory areas, hardware write protection, boot-up write protection, or trusted firmware-controlled access protection can be enabled after device configuration is completed, ensuring the device type identifier remains stable during display usage.

[0023] Standard displays always operate in normal display mode according to their device type identifier, with their watermark OSD layer remaining off. Security displays, based on their device type identifier, enter a security display control process, using the presence of a pluggable security module and successful authentication as prerequisites for normal display. If a security display detects that a pluggable security module has been removed during operation, it enters a black screen state; upon reinsertion of the pluggable security module, the display control MCU re-executes authentication, and resumes normal display upon successful authentication. This control process maintains the device type attribute of the security display and does not change the device type based on the current installation or absence of a pluggable security module.

[0024] The "traceable invisible watermark" referred to in this application means a watermark added to a display screen in the form of low-amplitude brightness difference, color difference, or a combination of both, and whose corresponding information can be recovered from a photograph or video frame formed by capturing the display screen. This watermark maintains low visual perceptibility under normal viewing conditions, and the data it carries can be recovered by a device with watermark analysis capabilities. The specific encryption algorithm, signature algorithm, error correction coding method, dot matrix size, and display intensity of the invisible watermark can be configured according to the application environment and hardware capabilities.

[0025] Please see Figure 1 This application provides a traceable invisible watermarking system based on a pluggable security module, comprising a display control module 10, a pluggable security module 20, and a display panel 30. The display control module 10 is disposed in the display, and the pluggable security module 20 is connected to the display via a detachable connection structure. The detachable connection structure can be a board-to-board connector, a card slot connector, a cable connector, or other structures capable of enabling power, communication signals, and presence signals.

[0026] The display control module 10 includes a display control MCU 11 and a Scaler (image processing and conversion chip) 12, hereinafter referred to as Scaler 12. The display control MCU 11 is used to read the device type identifier, output the watermark-off command or the watermark-adding command, detect the presence status of the pluggable security module 20, generate random challenges, verify the module certificate and signature results, latch the legal status of the module, and control the display status of the display panel 30.

[0027] The display control MCU 11 can be a microcontroller independently mounted on the display motherboard, or it can be a control unit that is paired with the Scaler 12 and capable of executing display control firmware. The display control MCU 11 has a storage area for storing the root trust key and can communicate with the control circuitry of the Scaler 12, the module in-place interface 23, and the display panel 30 via the control bus, register interface, or general purpose input / output interface.

[0028] The Scaler 12 is a chip in the display used to perform video signal reception, image scaling, image format conversion, image processing, display timing generation, and display data output. The Scaler 12 has OSD rendering resources, can receive watermark graphic data sent by the security MCU 21, write the watermark graphic data into the top-level independent OSD layer, and then overlay the top-level independent OSD layer with the processed input video image before outputting it to the display panel 30.

[0029] The Scaler 12 can employ a display controller chip with bitmap OSD, graphic OSD, or character dot matrix OSD capabilities. The OSD storage space, number of color palettes, number of layers, transparency control method, and graphic update method of the Scaler 12 can be determined based on the monitor model. This embodiment does not limit the specific manufacturer and model of the Scaler 12, as long as it can receive watermark graphic data and perform watermark overlay using independent OSD layers.

[0030] The display includes a video data processing channel 13 and a watermark data transmission channel 14. The video data processing channel 13 transmits external input data to the Scaler 12, where it is processed. The watermark data transmission channel 14 connects the pluggable security module 20 to the Scaler 12, transmitting watermark graphic data generated by the security MCU 21 to the Scaler 12. The Scaler 12 scales, converts the format, processes the colors, and performs timing conversions on the input data to create a video image suitable for display on the display panel 30. The input data and watermark graphic data are superimposed at the Scaler 12. The input data can come from an HDMI interface, DisplayPort interface, USB video interface, DVI interface, VGA interface, or other image input interfaces.

[0031] The watermark data transmission channel 14 is used to transmit watermark control information and watermark graphic data between the pluggable security module 20 and the Scaler 12. The watermark data transmission channel 14 can use an SPI interface, I²C interface, UART interface, parallel interface, shared memory interface, or other board-level communication interface. By setting up mutually distinct video data processing channels 13 and 14, complete input video data is processed along the video data processing channel 13, while watermark graphic data is transmitted along the watermark data transmission channel 14 and superimposed at the Scaler 12.

[0032] The pluggable security module 20 includes a security MCU 21, a security element SE 22, and a module-in-place interface 23. In some embodiments, the pluggable security module 20 also includes an independent real-time clock 24, a backup power supply 25, tamper detection circuitry 26, and an authorized read interface 27.

[0033] Under the above channel structure, the pluggable security module 20 does not need to receive or process complete input video data. The security element SE 22 and the security MCU 21 centrally complete the cryptographic processing, packet assembly, error correction coding and dot matrix mapping of the watermark source data. The scaler 12 retains the original video processing and display output functions of the display, thereby reducing the need for changes to the display video processing link.

[0034] The security MCU 21 is used to run the security module control program and perform tasks such as watermark source data organization, cryptographic operation calls, data packetization, error correction coding, dot matrix mapping, watermark printing control, and watermark graphic data transmission. The security MCU 21 can also acquire module presence status, tamper events, insertion / removal events, and authentication events, and write the corresponding events to the non-volatile log storage area of ​​the security element SE 22.

[0035] The Secure Element SE 22 is a secure chip with protected key storage and cryptographic capabilities. Each Secure Element SE 22 stores the corresponding module private key, module certificate, and SE unique identifier. Enterprise coding can be configured together with the Secure Element SE 22 during the module configuration phase and stored in the Secure Element SE 22 or in a secure storage area accessible only by authorized Secure Element SE 22 users.

[0036] The module private key is internally accessed by the secure element SE 22; the plaintext of the module private key does not need to be output to the secure MCU 21, display control MCU 11, or Scaler 12. The module certificate contains the module public key corresponding to the module private key and is issued by the manufacturer's or enterprise's root of trust. The display control MCU 11 stores the manufacturer's or enterprise's root of trust public key to verify the signing relationship of the module certificate.

[0037] The pluggable security module 20 does not need to be pre-bound to a specific display. Pluggable security modules 20 belonging to the same trust system, possessing valid module certificates, and capable of correctly signing random challenges can be installed and used on compatible secure displays. This configuration facilitates the replacement of the pluggable security module 20 during module maintenance, asset redeployment, module rotation, or security level adjustments.

[0038] The module configuration record library 60 can store the correspondence between the SE unique identifier and the enterprise, department, responsible person, usage area, equipment asset, or other responsible entity. Since the pluggable security module 20 does not need to be bound to a specific display, the SE unique identifier recovered from the watermark is used to identify the security module that generated the watermark, and then the corresponding responsible entity is identified through the module configuration record library 60.

[0039] The module-in-position interface 23 is used to provide the display control MCU 11 with the presence status of the pluggable safety module 20. The module-in-position interface 23 may include connector detection terminals, mechanical contacts, dedicated GPIO, module power supply detection terminals, or presence indication terminals output by the safety MCU 21. The module-in-position interface 23 can use a high level to indicate presence and a low level to indicate absence, or it can use the opposite level logic.

[0040] To reduce misjudgments caused by module insertion / removal transients or interface jitter, the display control MCU 11 can perform debouncing processing on the module presence signal. For example, the display control MCU 11 can confirm a change in presence status after detecting the same state within multiple consecutive sampling periods. Alternatively, it can detect the module presence status through hardware filtering circuits, timed confirmation mechanisms, or a combination of interrupts and polling.

[0041] An independent real-time clock 24 is used to generate time information in the watermark source data. The independent real-time clock 24 is powered by a backup power supply 25, enabling timing to continue even after the pluggable safety module 20 is removed from the display or after a power outage. The backup power supply 25 can be a button cell battery, a rechargeable battery, a supercapacitor, or other device capable of providing power to the independent real-time clock 24 during power outages.

[0042] The tamper detection circuit 26 is used to detect opening of the housing of the pluggable security module 20, removal of the shielding cover, disconnection of critical lines, abnormality of the detection circuit, or other preset disassembly behaviors. The tamper detection circuit 26 can use a micro switch, conductive circuit, photosensitive element, Hall element, pressure element, or a combination of multiple detection elements.

[0043] The security element SE 22 has a non-volatile log storage area. The security MCU 21 can write tamper events detected by the tamper detection circuit 26, plug-in / plug-out events of the pluggable security module 20, and authentication events into this non-volatile log storage area in chronological order to form an exception log. The exception log may include event type, event occurrence time, event result, and verification information.

[0044] The non-volatile log storage area can use a circular storage method. When the log storage space is full, the security MCU21 or the security element SE 22 controls the new record to overwrite the oldest record, so that the limited storage space can continuously store the newest abnormal events. The security element SE 22 can attach message authentication codes, signatures, or chained verification information to the log records to improve the credibility of the abnormal log during the reading and forensics process.

[0045] The authorization read interface 27 connects to either the security element SE 22 or the security MCU 21. When the pluggable security module 20 is detached from the display, an authorization read device can be connected via the authorization read interface 27 to read the exception log. The authorization read interface 27 can use a USB interface, a serial interface, a dedicated contact interface, or a near-field communication interface. The authorization read device can complete the read authorization via password, certificate, challenge response, or management key.

[0046] Tampering events, records of modules being removed, current authentication status, circuit anomaly status, and cumulative tampering counts are stored in the anomaly log and are not part of the watermark source data. By separating the display watermark payload from the anomaly log, the length and dot matrix density of the watermark source data can be controlled, and the anomaly log can be read using an independent authorization strategy.

[0047] The following is combined with Figure 2 This application describes a method for adding a traceable invisible watermark based on a pluggable security module, which includes steps 110 to 170.

[0048] Step 110: When the monitor is powered on, issue a watermark-off command or a watermark-adding command according to the device type identifier. Different values ​​of the device type identifier represent ordinary monitors and security monitors, respectively.

[0049] Specifically, after the display is powered on, the display control MCU 11 initializes the base clock, display interface, module in-situ interface 23, Scaler 12, and display panel 30, and reads the device type identifier from the protected storage area. The display control MCU 11 determines whether the display is a general-purpose display or a security display based on the value of the device type identifier.

[0050] When the device type identifier indicates a standard display, the display control MCU 11 issues a watermark-off command; when the device type identifier indicates a security display, the display control MCU 11 issues a watermark-adding command. The watermark-off and watermark-adding commands can be represented as state machine events within the display control MCU 11, firmware function call results, register control values, or control commands sent to the Scaler 12 via the control bus.

[0051] Step 120: In response to the watermark-off command, the watermark OSD layer is turned off, and the input data is processed by Scaler 12 and output to the display panel 30.

[0052] Specifically, when the device type identifier indicates a general-purpose display, the display control MCU 11 responds to the watermark-off command, turning off the watermark OSD layer of the Scaler 12. The Scaler 12 receives external input data through the video data processing channel 13, performs scaling, format conversion, color processing, and timing conversion on the external input data, and outputs the processed display data to the display panel 30.

[0053] The standard display always operates in normal display mode according to the device type identifier, and whether or not the pluggable safety module 20 is connected does not change the device type or watermark control status. Even if the pluggable safety module 20 is detected at the module connection position of the standard display, the display control MCU 11 still disables the watermark OSD layer according to the control logic corresponding to the standard display.

[0054] Step 130: In response to the watermarking instruction, the presence status of the pluggable security module 20 is detected. If present, a random challenge is sent. If absent, the display panel 30 is controlled to go black.

[0055] Specifically, when the device type identifier indicates a safety-type display, the display control MCU 11 responds to the watermark addition command by detecting the presence status of the pluggable safety module 20 via the module presence interface 23. When the module presence interface 23 indicates that the pluggable safety module 20 is in an off-position state, the display control MCU 11 controls the display panel 30 to go black.

[0056] A black screen can be achieved by disabling the video data output enable of the Scaler 12, enabling the Scaler 12 to output a black test pattern, disabling the display timing of the display panel 30, disabling the backlight enable, or a combination of the above methods. The specific method for achieving a black screen can be selected based on the type of display panel 30, the monitor's power supply architecture, and the security level.

[0057] The safety display maintains its safety display control state even when the pluggable safety module 20 is removed, and its device type identifier still indicates that it is a safety display. The display control MCU 11 does not switch the safety display to a normal display based on the removal status of the pluggable safety module 20, but instead maintains the control logic that uses the module's presence and successful authentication as the normal display access conditions.

[0058] When the module-in-place interface 23 indicates that the pluggable safety module 20 is in the in-place state, the display control MCU 11 generates a random challenge and sends the random challenge to the safety MCU 21 via the communication interface. After receiving the random challenge, the safety MCU 21 submits the random challenge to the safety element SE 22.

[0059] The random challenge can be generated by the hardware random number generator inside the display control MCU 11, or by a pseudo-random number generator with sufficient entropy. The display control MCU 11 can also combine start-up counters, clock jitter, sampling noise, and a random seed to generate the random challenge. The length of the random challenge can be 128 bits, 192 bits, 256 bits, or other lengths suitable for the selected signature algorithm and security level.

[0060] Each time the display is powered on for authentication or the pluggable security module 20 is reinserted, a new random challenge is generated. The random challenge is used to characterize the freshness of the current authentication process, distinguishing the signature result generated in this authentication from the signature results generated in previous authentication processes.

[0061] Step 140: The secure element SE 22 uses the module's private key to sign a random challenge and returns the signature result and the module certificate. The display control MCU 11 verifies the module certificate based on the root trust public key and verifies the signature result based on the module's public key. If the authentication is successful, the module's legal status is latched and normal display is allowed. If the authentication fails, the display panel 30 is controlled to go black.

[0062] Specifically, the secure element SE 22 uses the module's private key to perform a signature operation on authentication data that includes at least a random challenge, generating a signature result. The authentication data may also include the authentication protocol version, module certificate identifier, authentication phase identifier, or a temporary identifier generated on the display side. This additional information can be used to extend the authentication protocol, but it does not change the role of the random challenge in characterizing the freshness of the authentication.

[0063] After the secure element SE 22 completes the signing, it returns the signing result to the secure MCU 21. The secure MCU 21 then sends the signing result and module certificate to the display control MCU 11. The module certificate contains the module's public key corresponding to its private key and is issued by the manufacturer's or enterprise's root of trust.

[0064] The display control MCU 11 first verifies the module certificate using the root trust public key to confirm the signing relationship between the module certificate and the preset trust system. The display control MCU 11 can also check the module certificate's format, version, scope of use, validity status, and purpose. After successful module certificate verification, the display control MCU 11 obtains the module public key from the module certificate and uses it to verify whether the signature result matches the randomly sent challenge.

[0065] When both module certificate verification and signature result verification pass, the display control MCU 11 confirms successful authentication and latches the module's valid status in the volatile status register, controlled memory, or state machine. The module's valid status indicates that the currently in-situ pluggable security module 20 has passed authentication during this power-on cycle or this insertion cycle.

[0066] After successful authentication, the display control MCU 11 allows the Scaler 12 to output a normal display image to the display panel 30. If authentication fails, the display control MCU 11 clears or retains the invalid status of any unset modules and controls the display panel 30 to go black.

[0067] The aforementioned random challenge, signature result, and module certificate transmission constitute authentication data transmission when the display is powered on or the pluggable security module 20 is reinserted. The random challenge verifies the freshness of the authentication message, the digital signature verifies the possession of the module's private key, and the module certificate establishes a trust relationship between the module's public key and the manufacturer's or enterprise's root of trust.

[0068] After successful authentication, the MCU 11 latch module's valid status is displayed. Subsequent transmitted watermarked graphic data is graphic data that can be directly rendered by Scaler 12, eliminating the need to repeatedly perform module certificate verification and random challenge signature verification for each packet of watermarked graphic data using the information generated during the authentication process.

[0069] Step 150: Continuously monitor the presence status of the pluggable safety module 20. When it is removed, clear the module's legal status and control the display panel 30 to go black. When the pluggable safety module 20 is reinserted, re-authenticate. After successful authentication, the normal display is restored.

[0070] Specifically, during the module's valid state latching period, the display control MCU 11 continuously or periodically reads the module's presence interface 23. The detection period can be determined according to the scheduling period of the display control task, for example, set to 1 millisecond to 100 milliseconds, or a combination of module presence signal interruption and periodic detection can be used.

[0071] When the module in-position interface 23 indicates that the pluggable safety module 20 has changed from the in-position state to the out-of-position state, the display control MCU 11 clears the module's legal status and controls the Scaler 12 to stop normal screen output or controls the display panel 30 to go black. The "immediate black screen upon departure" mentioned here means that after the module's departure state has been normally detected and confirmed, the black screen control is executed within the response time required by the display control system.

[0072] After the pluggable security module 20 is reinserted, the module presence interface 23 re-outputs the presence status. The display control MCU 11 generates a new random challenge and re-executes the module certificate verification and random challenge signature verification. The reinserted pluggable security module 20 can be the original module before it was removed, or it can be another compatible module belonging to the same trust system.

[0073] After successful authentication, the display control MCU 11 re-latches the module's valid state and restores the normal display of Scaler 12 and display panel 30. If the re-inserted module fails authentication, the display control MCU 11 keeps the module's valid state un-latched and maintains the black screen state of display panel 30.

[0074] Step 160: After the latch module is in a valid state, the security element SE 22 encrypts and signs the watermark source data containing the SE unique identifier, enterprise code and time information. The security MCU 21 encodes and maps the processed watermark source data into watermark graphic data that can be directly rendered, and sends the watermark graphic data to Scaler 12.

[0075] Specifically, after the module's legal status is latched, the security MCU 21 reads the SE unique identifier and enterprise code stored in the security element SE 22, and obtains the current time information from the independent real-time clock 24. The SE unique identifier, enterprise code, and time information are then organized into watermark source data according to a preset data format.

[0076] The SE unique identifier is used to identify the security element SE 22 in the pluggable security module 20. The enterprise code is used to characterize the enterprise or management domain to which the security element SE 22 belongs. The time information is used to characterize the current watermark generation time or the time range corresponding to the current watermark graphic.

[0077] The watermark source data does not require the display serial number to be included. The pluggable security module 20 does not need to be bound to a specific display. After watermark parsing, the security module that generated the watermark is first determined based on the SE unique identifier, and then the corresponding enterprise, department, responsible person or other responsible entity is determined based on the configuration records stored in the module configuration record library 60.

[0078] The secure MCU 21 submits the watermark source data to the secure element SE 22. The secure element SE 22 performs encryption and signing on the watermark source data. Encryption is used to convert the SE's unique identifier, enterprise code, and time information into cryptographic data, and signing is used to verify the source and integrity of the recovered data.

[0079] The encryption and signature algorithms used by the Secure Element SE 22 are not specifically limited and can be selected based on the algorithms supported by the Secure Element SE 22. For example, the encryption algorithm can be SM4, AES, public-key encryption, or other cryptographic algorithms, and the signature algorithm can be SM2, ECDSA, RSA, or other algorithms that can verify the source and integrity of data.

[0080] After completing the cryptographic operation, the secure element SE 22 returns the encryption and signature results to the secure MCU 21. The secure MCU 21 then assembles the processed watermark source data into packets according to a preset frame format. The resulting data frames may include a synchronization header, protocol version, payload length, encrypted payload, signature field, error correction field, and transmission check field.

[0081] The synchronization header identifies the start position of the data frame, the protocol version distinguishes the data organization and encoding rules, and the payload length determines the data range of the encrypted payload and signature fields. The specific field order, field length, and encoding method can be configured according to the cryptographic algorithm, watermark capacity, and business needs.

[0082] The security MCU 21 performs error correction coding on the packaged data. In one embodiment, the security MCU 21 uses BCH error correction coding to convert the bit sequence to be protected into codewords containing information bits and check bits. The parameters of the BCH error correction coding can be determined based on the watermark dot array size, expected shooting distance, display resolution, degree of local occlusion, and allowable watermark density.

[0083] In addition to BCH error correction coding, the secure MCU 21 can also employ RS error correction coding, Hamming codes, low-density parity-check codes, repetition coding, or a combination of multiple error correction methods. Error correction coding is used to compensate for bit errors in the watermark caused by shooting, image compression, video encoding, partial occlusion, motion blur, and image noise.

[0084] After completing the error correction encoding, the security MCU 21 performs dot matrix mapping on the encoding result, mapping the encoded bits to two-dimensional logic units. Each logic unit can correspond to a dot, a group of dots, a luminance modulation unit, or a chrominance modulation unit in the watermark graphic.

[0085] Watermark patterns can also include positioning markers, direction markers, synchronization markers, and version markers. Positioning markers are used to determine the location of the watermark block, direction markers are used to determine the orientation of the watermark block, synchronization markers are used to determine the arrangement period of the logical units, and version markers are used to determine the data format and decoding rules used by the current watermark.

[0086] The watermark graphic data formed after raster mapping can be in the form of bitmaps, indexed images, point coordinate tables, or graphic command sequences. The watermark graphic data has already undergone cryptographic encoding and raster mapping, making it data that can be directly received and rendered by Scaler 12's OSD function. Scaler 12 does not need to decrypt the watermark graphic data to obtain the watermark raster.

[0087] In one parameter example, the basic watermark block generated by the security MCU 21 consists of 32×32 logic units, each corresponding to 8×8 display pixels, thus forming a 256×256 pixel basic watermark block. The watermark graphic data can use a 2-bit index format, with different indices representing transparency, positive brightness difference, negative brightness difference, or chromaticity difference, respectively.

[0088] Following the example above, the basic watermark block can occupy approximately 16KB of storage space. This size, number of logical units, and bit depth are merely examples and can be adjusted in practical applications based on the resolution of the display panel 30, the OSD storage capacity of the Scaler 12, acceptable visual intensity, and expected shooting distance.

[0089] The security MCU 21 sends the watermark graphic data to the Scaler 12 through the watermark data transmission channel 14. When the watermark data transmission channel 14 uses the SPI interface, the SPI clock frequency can be set to no less than 10MHz to meet the update requirements of the bitmap OSD data; when using the I²C interface, a 1MHz high-speed mode or other communication rates adapted to the amount of watermark data can be used.

[0090] The watermark image data can carry a CRC checksum or other transmission error verification information. The Scaler 12 or the display control MCU 11 can determine whether sporadic bit errors have occurred during the board-level transmission of the watermark image data based on the verification information. When verification fails, it can request the security MCU 21 to resend the watermark image data, or retain the previously verified watermark image.

[0091] The verification information carried in the watermark image data is used to detect communication noise, interface interference, or occasional transmission errors. This verification information does not serve as the authentication function of the pluggable security module 20, nor does it indicate the use of the authentication information from the power-on authentication process to perform cryptographic replay protection or tamper protection verification on each subsequent packet of watermark image data.

[0092] The secure MCU 21 can update the watermark source data and watermark graphic data according to a preset refresh cycle. In one embodiment, the refresh cycle is set to 30 seconds. After each refresh cycle, the secure MCU 21 obtains new time information from the independent real-time clock 24, reorganizes the watermark source data, and calls the secure element SE 22 for encryption and signing.

[0093] The refresh cycle can be set from 10 to 60 seconds, or other lengths can be used depending on the traceability time precision, interface bandwidth, Scaler 12's OSD refresh capability, and business strategy. When updating watermark graphic data, Scaler 12 can write new data to a backup OSD buffer and switch the buffer during the image fading phase or at the preset layer switching time to reduce visible flickering newly generated by the watermark.

[0094] In step 170, Scaler 12 writes the watermark graphic data into the top-level independent OSD layer, forming an invisible watermark that covers the display screen.

[0095] Specifically, after receiving the watermark graphic data and completing transmission error verification, Scaler 12 writes the watermark graphic data to the top-level independent OSD layer. The top-level independent OSD layer is set above the input video frame and is stored and refreshed independently of the external input video data.

[0096] Scaler 12 can overlay watermark graphic data onto the processed input video image using hardware bitmap blending, palette indexing, transparency control, pixel overlay, or character dot matrix mapping. The watermark graphic data does not need to be transmitted to the pluggable security module 20 along with the complete input video data, nor does it need to be output as a complete display image by the pluggable security module 20.

[0097] To create an invisible watermark that covers the entire display area, the base watermark blocks can be repeated horizontally and vertically along the display area. Alternatively, preset offsets can be set between adjacent rows or columns to create staggered watermark patterns. Repeated or staggered arrangements increase the probability of including complete watermark blocks or mergeable watermark fragments when only a portion of the display area is retained in the captured image.

[0098] For a 1920×1080 resolution display panel 30, multiple watermark copies can be set within the effective display area according to the basic watermark block size. For a higher resolution display panel 30, the number of watermark copies can be increased, the basic watermark block size can be increased, or the correspondence between logical units and display pixels can be adjusted.

[0099] Invisible watermarks can be formed through pixel-level low-amplitude brightness differences, chromaticity differences, or a combination of both. Taking 8-bit color components as an example, a brightness change of 1 to 2 gray levels can be applied to the position corresponding to the watermark point relative to the original display data, or a corresponding amplitude of chromaticity change can be applied to the chromaticity channel.

[0100] Scaler 12 can perform amplitude limiting based on the current pixel value to prevent color component overflow or underflow after watermark overlay. The pixel-level low amplitude difference mentioned in this article refers to the use of Scaler 12's OSD layer to produce a low amplitude effect on the brightness or chromaticity of the display pixels, without requiring direct control of the physical RGB sub-pixels of the display panel 30.

[0101] The transparency, color palette, and blending mode of the watermark OSD layer can be configured according to the displayed content, display panel characteristics, and predetermined shooting conditions. For example, a negative brightness difference can be used for a display with high overall brightness; a positive brightness difference can be used for a display with low overall brightness; or a watermark color palette with fixed transparency can be used.

[0102] When Scaler 12 supports brightness statistics for the display area, it can also select the direction of watermark difference or the watermark intensity based on the brightness range of a local area. The watermark display intensity can be calibrated between normal viewing comfort and the reliability of screen capture recovery, so that the watermark maintains low visibility at a predetermined viewing distance and can be recovered by the traceability and analysis terminal 50.

[0103] Because the invisible watermark is added internally to the monitor through a separate top-level OSD layer, the source device of the external input data does not need to participate in watermark generation. Switching video input interfaces, changing input sources, or reinstalling the operating system on the external host does not change the device type control, module authentication, or OSD watermark addition process of the security monitor.

[0104] In a further embodiment, the method of this application also includes watermark recovery and source tracing of photographs or video frames formed by capturing and displaying the image, such as... Figure 3 As shown, it may specifically include steps 180 to 210.

[0105] Step 180: Acquire the photo or video frame formed by the captured display screen.

[0106] Specifically, the image acquisition device 40 can be a mobile phone camera, a camera, a law enforcement recording device, or a video camera. The image acquisition device 40 captures images of the display panel 30 to form photos or videos. For videos, the source tracing and analysis terminal 50 can select one or more video frames from the video.

[0107] When selecting video frames, the frame to be analyzed can be determined based on factors such as image sharpness, display area integrity, exposure status, motion blur level, and reflection. The shooting process may introduce perspective distortion, moiré patterns, compression distortion, noise, partial occlusion, and display refresh stripes; subsequent processing can correct for these imaging effects.

[0108] Step 190: Locate the display area in the photo or video frame and perform perspective correction on the display area.

[0109] Specifically, the source tracing and analysis terminal 50 can determine the display area using the display border lines, the four corners of the screen, the rectangular outline, preset visual markers, or a machine vision model. After determining the four corner points of the display area, a homography transformation matrix is ​​established based on the four corner points to transform the quadrilateral display area formed by the oblique view into a rectangular display area that is approximately viewed from the front.

[0110] When a photo or video frame includes only a portion of the display area, the source analysis terminal 50 can estimate the local geometric relationship based on the visible screen edges, watermark positioning marks, and dot matrix arrangement period, and perform rotation, scaling, and perspective correction on the local display area.

[0111] Step 200: Extract the watermark image from the display area, perform error correction and decoding on the watermark image to obtain encrypted watermark data and signature information, decrypt the encrypted watermark data and perform signature verification to obtain the SE unique identifier, enterprise code and time information.

[0112] Specifically, after perspective correction is completed, the source analysis terminal 50 separates the brightness channel or chroma channel of the corrected display area and performs noise reduction, background suppression, local contrast enhancement and threshold processing to extract watermark dot matrix candidates.

[0113] For moiré patterns generated by the pixel grid of the display panel 30 and sensor sampling of the image acquisition device 40, frequency domain filtering, bilateral filtering, mean filtering, multi-frame fusion, or other image processing methods can be used to reduce interference. Positioning and orientation marks in the watermark pattern can be used to estimate the logical unit spacing, watermark block rotation angle, and effective load area.

[0114] The source tracing and analysis terminal 50 restores the extracted watermark dot matrix into an encoded bit sequence according to the dot matrix mapping rules corresponding to the embedding terminal, and performs BCH error correction decoding or other corresponding error correction decoding on the encoded bit sequence. If multiple watermark copies exist in the display area, multiple candidate watermark blocks can be decoded separately.

[0115] The source tracing and analysis terminal 50 can perform multi-copy fusion based on the location confidence, transmission verification results, error correction results, and bit-by-bit confidence of each candidate watermark block. For example, it can perform majority voting on corresponding bits in multiple watermark copies to compensate for the impact of image content, reflection, cropping, or partial occlusion on some watermark copies.

[0116] After error correction and decoding, the source tracing and parsing terminal 50 obtains the encrypted payload and signature field, and performs decryption and signature verification using a parsing algorithm corresponding to the encryption and signature processing of the secure element SE 22. Upon successful signature verification, it obtains the unique SE identifier, enterprise code, and time information carried in the watermark source data.

[0117] The keys used for watermark parsing can be configured according to the enterprise's security management system. For example, the parser can store the corresponding decryption key and signature verification public key, or it can complete decryption and signature verification through a controlled key service. The specific key deployment method does not change the processing logic of watermark traceability based on SE unique identifier, enterprise code, and time information.

[0118] Step 210: Query the configuration record of the pluggable safety module 20 based on the SE unique identifier to determine the responsible party.

[0119] Specifically, the source tracing and analysis terminal 50 uses the unique SE identifier obtained from the analysis as a query condition to access the module configuration record database 60. The module configuration record database 60 returns the enterprise, department, responsible person, usage area, or equipment asset configuration record corresponding to the pluggable security module 20 based on the unique SE identifier.

[0120] The traceability and analysis terminal 50 can compare the enterprise code with the enterprise information in the module configuration record, and combine this with the time information in the watermark to determine the module configuration status within the corresponding time range. When the pluggable security module 20 has been transferred between different responsible entities, the valid configuration records within the corresponding time period can be queried based on the time information.

[0121] In one mass production implementation, the display control module 10 includes a Scaler 12 supporting bitmap OSD functionality and a matching display control MCU 11. The display motherboard is equipped with standardized module sockets and routes the SPI clock, SPI data, module power supply, ground, and module in-situ signals to the pluggable safety module 20.

[0122] The pluggable security module 20 includes a low-power security MCU 21, a security element SE 22, a module in-situ interface 23, an independent real-time clock 24, a backup power supply 25, an tamper detection circuit 26, and an authorized read interface 27. The module's private key and module certificate are written to the security element SE 22 during the security module manufacturing or security configuration phase, and the manufacturer's or enterprise's root key is written to the display control MCU 11.

[0123] This implementation can provide two configurations: a standard display and a security display. The standard display has its device type identifier set to a standard value; upon power-up, the watermark OSD layer is disabled, and it operates in normal mode. The security display has its device type identifier set to a security value, and upon power-up, it detects the pluggable security module 20 and performs authentication.

[0124] During normal operation of the secure display, the secure MCU 21 can generate watermark graphic data at a refresh cycle of 30 seconds. The basic watermark block uses 32×32 logic units and a size of 256×256 pixels, and is sent to the Scaler 12 via the SPI interface. The Scaler 12 covers the display area with the basic watermark blocks in an interleaved manner, and superimposes them using one or two grayscale differences in brightness, color, or a combination of both.

[0125] During the module removal test, after the display control MCU 11 detects that the module's in-place interface 23 has changed from an in-place state to an out-of-place state, it clears the module's valid status and controls the display panel 30 to go black. After re-inserting the original pluggable security module 20 or other compatible modules in the same trust system, the display control MCU 11 generates a new random challenge and re-verifies the module certificate and signature results.

[0126] After successful re-authentication, the display control MCU 11 restores the normal display of the display panel 30. If the module certificate carried by the inserted pluggable security module 20 does not belong to the trust system corresponding to the trust root stored in the display control MCU 11, or if the signature result does not match the current random challenge, the display control MCU 11 maintains the black screen state of the display panel 30.

[0127] In the screen capture test, the image acquisition device 40 captures images of the display panel 30 from the front or at an angle. The traceability and analysis terminal 50 locates the display area, performs perspective correction, watermark dot matrix extraction, multi-copy fusion, and BCH error correction decoding, and then performs decryption and signature verification to obtain the SE unique identifier, enterprise code, and time information.

[0128] The source tracing and analysis terminal 50 queries the configuration record database 60 based on the SE unique identifier to obtain the responsible entity information corresponding to the pluggable security module 20. Through the time information contained in the watermark, the time or time range corresponding to the captured image can also be determined, providing a technical basis for querying the responsible entity after the displayed content is leaked.

[0129] In this application, the functional division between the security element SE 22, the security MCU 21, and the scaler 12 can be adjusted accordingly. For example, the security MCU 21 can be located in the same package or on the same circuit board as the security element SE 22; some assembly operations can be performed by the security application in the security element SE 22; and the dot matrix buffer can be located in the internal memory or external memory of the security MCU 21.

[0130] The Scaler 12 can directly receive the complete watermark bitmap, or it can generate an OSD bitmap based on the point coordinate table sent by the security MCU 21. As long as the security element SE 22 is responsible for storing the protected key and performing the corresponding cryptographic operations, the security MCU 21 is responsible for organizing, encoding, and mapping the watermark data, and the Scaler 12 is responsible for video processing and OSD layer overlay, the corresponding watermark addition function can be realized.

[0131] The authentication algorithm, encryption algorithm, signature algorithm, error correction encoding method, communication interface, and watermark dot matrix parameters can all be selected based on the security level and hardware capabilities. Module certificates can adopt manufacturer certificate systems, enterprise certificate systems, or hierarchical certificate chains. The watermark renewal cycle can be a fixed cycle or triggered by preset security policies or changes in display status.

[0132] In summary, compared with the prior art, the technical solutions of this application have the following beneficial effects: First, by forming an interconnected processing flow through device type determination, pluggable security module authentication, on-site detection during operation, and watermark graphic overlay, ordinary displays can operate in normal display mode, while secure displays can display normally under the condition that the pluggable security module is in place and the authentication is successful. The security element, security MCU, and scaler respectively complete password processing, watermark graphic generation, and OSD layer overlay, realizing the addition of invisible watermarks based on trusted hardware.

[0133] Second, by embedding the device type identifier into the one-time programmable storage area of ​​the display control MCU or a write-protected non-volatile storage area, the display can execute the corresponding display control strategy according to the device type determined during the manufacturing or configuration stage, thereby improving the stability of the device type identifier and the display access conditions for safety-type displays.

[0134] Third, a module certificate containing the module's public key is issued through the manufacturer's or enterprise's root of trust. A random challenge is generated when the display is powered on or the pluggable security module is inserted. The root of trust's public key can be used to verify the issuance relationship of the module certificate, and the module's public key can be used to verify the security element's signature result on the random challenge. This confirms that the access module belongs to the trusted module system and improves the freshness of the authentication message.

[0135] Fourth, by latching the module's legal status after successful identity authentication, terminating the legal status when the display loses power or the pluggable security module is removed, and re-authenticating based on a new random challenge after the pluggable security module is reinserted, a secure display control closed loop can be formed that connects power-on authentication, legal status maintenance, black screen upon module removal, and re-insertion authentication.

[0136] Fifth, by forming independent video data processing channels and watermark data transmission channels, the complete input video data is processed by the Scaler, and the watermark graphic data generated by the security element and the security MCU is sent to the Scaler through an independent transmission path. The two types of data are superimposed at the Scaler, thereby reducing the reception and processing of complete input video data by the pluggable security module and reducing the modification to the original video processing link of the display.

[0137] Sixth, by locating the display area in a photo or video frame and performing perspective correction, the watermark image is extracted from the corrected display area. After error correction decoding, decryption, and signature verification, the SE unique identifier, enterprise code, and time information are obtained. Then, based on the SE unique identifier, the configuration record of the pluggable security module is queried. This allows the watermark information to be recovered from the image data formed by the captured display screen and the corresponding responsible party to be identified.

[0138] Seventh, by constructing a traceable invisible watermarking system consisting of a display control module, a pluggable security module, and a display panel, and with the display control MCU, security element, security MCU, and scaler respectively undertaking the functions of device type control, module identity authentication, cryptographic operation, dot matrix generation, and OSD overlay, a modular hardware structure can be used to realize display access control and trusted invisible watermarking for secure displays.

[0139] Eighth, by setting an independent real-time clock, backup power supply and tamper detection circuit in the pluggable security module, and setting a non-volatile log storage area in the security element, time information can be maintained after the display is powered off or the pluggable security module is removed from the display, and a hardware foundation is provided for persistent recording of tamper events, plugging events and authentication events.

[0140] Ninth, the encrypted and signed watermark source data is packetized, BCH error-correcting encoded, and dot matrix mapped by a secure MCU. The watermark graphic data carrying transmission error verification information is periodically sent via SPI or I²C interface. The Scaler uses a repeating or staggered arrangement to form low-amplitude brightness and / or color differences, which can improve the transmission reliability of watermark graphic data, screen recovery capability, and display area coverage, while maintaining low visual perceptibility.

[0141] Tenth, by writing anti-tampering events, plug-in / plug-out events, and authentication events into the non-volatile log storage area of ​​the security element in chronological order, and using a circular storage method where new records overwrite the earliest records, and providing anomaly logs when the pluggable security module is removed from the display through an authorized read interface, it can continuously save newer anomaly events within a limited storage space, and support offline authorized reading and security forensics of the security module.

[0142] Finally, it should be noted that the terms "comprising," "including," or any other variations thereof as used herein are intended to cover non-exclusive inclusion, such that a process, method, apparatus, or system that comprises a list of elements may include not only the elements expressly listed, but also other elements not expressly listed, or elements inherent to the process, method, apparatus, or system. Unless further specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, apparatus, or system that includes that element.

[0143] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit the scope of protection of this application. Those skilled in the art can modify, replace or combine the relevant technical features based on the disclosure of this application; all equivalent modifications, equivalent replacements or improvements made within the scope of the technical concept and claims of this application shall fall within the scope of protection of this application.

Claims

1. A method for adding a traceable invisible watermark based on a pluggable security module, characterized in that, Includes the following steps: When the display is powered on, the display control MCU issues a command to turn off the watermark or a command to add the watermark based on the device type identifier; different values ​​of the device type identifier represent ordinary displays and security displays, respectively. In response to the watermark-off command, the watermark OSD layer is turned off, and the image processing and conversion chip processes the input data and outputs it to the display panel. In response to the watermarking instruction, the presence status of the pluggable security module is detected. When the module is in place, a random challenge is sent. When the module is out of place, the display panel is turned off. The Security Element (SE) uses the module's private key to sign the random challenge and returns the signature result and the module certificate. The display control MCU verifies the module certificate based on the root trust public key and verifies the signature result based on the module's public key. If the authentication is successful, the module's legal status is latched and normal display is allowed. If the authentication fails, the display panel is controlled to go black. The system continuously monitors the presence status of the pluggable safety module. When the module is removed, its legal status is cleared and the display panel is turned black. When the pluggable safety module is reinserted, it is re-authenticated. After successful authentication, the normal display is restored. After the legal status is latched, the security element SE encrypts and signs the watermark source data containing the SE's unique identifier, enterprise code, and time information. The security MCU encodes and maps the processed watermark source data into watermark graphic data that can be directly rendered, and sends it to the image processing and conversion chip. The image processing and conversion chip writes the watermark graphic data into the top-level independent OSD layer, forming an invisible watermark that covers the display screen.

2. The method according to claim 1, characterized in that, The device type identifier is embedded in the one-time programmable storage area of ​​the display control MCU or in a non-volatile storage area with write protection.

3. The method according to claim 1, characterized in that, The module certificate contains the module's public key, and the module certificate is issued by the manufacturer's or enterprise's root of trust. The display control MCU generates a random challenge when the display is powered on or when the pluggable security module is inserted, verifies the module certificate based on the root of trust's public key, and verifies the signature result based on the module's public key.

4. The method according to claim 1, characterized in that, After successful authentication, the display control MCU maintains the module's legal status until the display is powered off or the pluggable security module is removed. When the pluggable security module is reinserted, a new random challenge is generated. After completing authentication based on the new random challenge, the normal display of the display panel is restored.

5. The method according to claim 1, characterized in that, The display is equipped with a watermark data transmission channel and a video data processing channel; The security element SE encrypts and signs the watermark source data, and the security MCU performs error correction encoding and dot matrix mapping on the processed watermark source data to generate the watermark graphic data, which is then sent to the image processing and conversion chip through the watermark data transmission channel. The image processing and conversion chip receives and processes input data through the video data processing channel, and superimposes the watermark graphic data onto the processed input video image.

6. The method according to claim 1, characterized in that, Also includes: Acquire photographs or video frames formed by capturing the displayed image; Locate the display area in the photo or video frame and perform perspective correction on the display area; The watermark image is extracted from the display area, the watermark image is corrected and decoded to obtain encrypted watermark data and signature information, the encrypted watermark data is decrypted and the signature is verified to obtain the SE unique identifier, enterprise code and time information. The configuration record of the pluggable security module is queried based on the unique SE identifier to determine the responsible party.

7. A traceable invisible watermarking system for displays based on a pluggable security module, characterized in that, Includes a display control module, a pluggable safety module, and a display panel; The display control module includes a display control MCU and an image processing and conversion chip. The display control MCU has a device type identifier embedded in it and stores the root public key of trust. The pluggable security module includes a security MCU, a security element SE, and a module in-situ interface. The security element SE stores the module's private key, module certificate, and SE unique identifier. The display control MCU issues a watermark-off command or a watermark-adding command based on the device type identifier, where different values ​​of the device type identifier represent ordinary displays and security displays, respectively. In response to the watermark-off command, the watermark OSD layer is controlled to be in a closed state, and the image processing and conversion chip outputs the received input data to the display panel. In response to the watermark-adding command, the presence status of the pluggable security module is detected, and a random challenge is issued when the pluggable security module is in place. The security element (SE) uses the module's private key to sign the random challenge and returns the signature result and the module certificate. The display control MCU verifies the module certificate based on the root trust public key and verifies the signature result based on the module's public key. After successful authentication, the module's legal status is latched and normal display is allowed. The display control MCU continuously monitors the module's on-site status. If authentication fails or the module is removed, the legal status is cleared and the display panel is controlled to go black. When the pluggable security module is reinserted, it is re-authenticated. After successful authentication, normal display is restored. The security element SE is also used to encrypt and sign the watermark source data containing the SE's unique identifier, enterprise code, and time information; the security MCU is used to encode and map the processed watermark source data into watermark graphic data that can be directly rendered after the legal state is latched, and send it to the image processing and conversion chip; the image processing and conversion chip is used to write the watermark graphic data into the top-level independent OSD layer to form an invisible watermark covering the display screen.

8. The system according to claim 7, characterized in that, The pluggable security module also includes an independent real-time clock, a backup power supply, and an anti-tamper detection circuit; the security element SE has a non-volatile log storage area, the enterprise code and the unique identifier of the SE are stored in the security element SE, and the independent real-time clock is powered by the backup power supply and generates the time information.

9. The system according to claim 7, characterized in that, The secure MCU is used to package and BCH error correction encoding the encrypted and signed watermark source data, map the encoding result into watermark graphic data, and send the watermark graphic data to the image processing and conversion chip through the SPI interface or I²C interface according to a preset refresh cycle. The watermark graphic data carries verification information for detecting transmission errors; the image processing and conversion chip is used to cover the display area with the watermark graphic data in a repeating or interlaced manner, and to form an invisible watermark through pixel-level low-amplitude brightness differences, color differences, or a combination of both.

10. The system according to claim 8, characterized in that, The security MCU is used to acquire the tampering events detected by the tamper detection circuit, the pluggable security module pluggable events, and the authentication events, and write the events in chronological order into the non-volatile log storage area of ​​the security element SE to form an exception log; The non-volatile log storage area adopts a circular storage method in which the new record overwrites the oldest record after the storage space is full; The pluggable security module also includes an authorized reading interface connected to the security element SE. The authorized reading interface is used to provide the exception log to the authorized reading device when the pluggable security module is detached from the display.

Images