WO2020087877A1

WO2020087877A1 - Privacy information tracing and evidence collection method, apparatus, and system

Info

Publication number: WO2020087877A1
Application number: PCT/CN2019/083047
Authority: WO
Inventors: 李凤华; 李晖; 牛犇; 张玲翠
Original assignee: 中国科学院信息工程研究所; 西安电子科技大学
Priority date: 2018-10-30
Filing date: 2019-04-17
Publication date: 2020-05-07
Also published as: CN109583229B; CN109583229A

Abstract

Disclosed in the embodiments of the present invention are a privacy information tracing and evidence collection method, apparatus, and system, the method comprising: generating evidence sample data of information; the evidence sample data comprises any combination of one or more of the following: privacy information, tracing record information of the privacy information, and privacy violation behaviour determining criteria of the privacy information; and storing the evidence sample data in the information.

Description

Method, device and system for tracing and obtaining evidence of private information

Technical field

This article involves but is not limited to information application technology, especially a privacy information traceability forensics method, device and system.

Background technique

With the continuous and rapid development of information technology and network technology, the widespread and dynamic flow of user privacy information between multiple information systems and multiple boundaries has become the norm. At the same time, the leakage and dissemination of some sensitive information will seriously damage the privacy rights of stakeholders. It has attracted the attention of relevant state departments, strengthened the supervision of personal privacy information on the Internet, and dealt with the occurrence of privacy leaks. It is also more and more important to carry out traceability forensics.

In the process of spreading private information across information systems, traceability information needs to be widely exchanged in different information systems. The existing private information traceability and forensics method focuses on a single information system, mainly relying on border control and post-audit technology. When private information leaves or enters this information system, it records the transmission path of private information for leakage after the incident Security audit and forensic analysis, and after the private information flows out of the information system boundary, it loses control and traceability forensics. Related technologies have not effectively addressed the issue of traceability forensics in the scenario of multi-application systems and multi-boundary privacy information widespread dynamic transmission. Program.

Summary of the invention

The following is an overview of the topics detailed in this article. This summary is not intended to limit the scope of protection of the claims.

An embodiment of the present invention provides a method for forensic traceability of private information, including:

Generate evidence sample data of the information; the evidence sample data includes any combination of one or more of the following: privacy information, traceability record information of the privacy information, and privacy violation behavior judgment standards of the privacy information;

Save the evidence sample data into the information.

Wherein, the private information may include private information content and private information location; the private information may be generated in the following manner:

Obtain the privacy information content from the information, determine the location of the privacy information content in the information to obtain the location of the privacy information.

Wherein, the traceability record information of the private information may be generated in the following manner: it is determined that the generated traceability record information is credible, and a traceability record function is used to generate the traceability record information according to the operation behavior of the operation subject on the privacy information.

Wherein, the traceability record function may include any combination of one or more of the following: mapping function, hash function, encryption function, signature function;

Among them, the mapping function can be set as any combination of one or more of the operation subject, operation object, operation behavior and the environment in which the operation behavior occurs to establish the mapping relationship;

The hash function, encryption function and signature function can be set to prevent the traceability record information from being maliciously tampered with, or can be set to prevent the malicious operation subject from denying the operation during the forensics process.

Wherein, the operation subject may include any one of the following:

Information owner, information forwarder, information receiver, information sending device, information receiving device, information transmission device;

The operation behavior may include at least one of the following:

Private information dissemination operation behavior, private information processing operation behavior;

The traceability record information may include: any combination of one or more of the operation subject, operation object, the operation behavior and the environment in which the operation behavior occurs, and / or the operation subject, operation object, and operation The mapping relationship between behaviors and any combination of one or more of the operating behavior occurrence environments.

Among them, the following standards can be used to generate the privacy violation judgment criteria:

A judgment criterion for privacy violation behavior of the privacy information is generated according to the privacy protection requirements for the privacy information; wherein the privacy protection requirements include at least one of the following:

Privacy protection algorithm type, protection strength, privacy effect.

Among them, the description language and format of the criteria for determining privacy violations based on private information may include but not limited to: Extensible Markup Language (XML, Extensible Markup Language), Extensible Access Control Markup Language (XACML, Extensible Access Control Control Markup Language) , Security Statement Markup Language (SAML, Security Assertion Markup Language), Authorization Definition Language (ASL, Authorization, Specification, Language), template language, custom language format.

Wherein, the judgment criterion of privacy violation behavior may include, but not limited to, a correspondence between any combination of one or more of an operation subject, an operation object, an operation behavior, an operation attribute, and a constraint condition.

Wherein, the operation subject may include at least one of the following:

The operation object / operation object may be set to describe the operated private information;

The operation behavior may include any combination of one or more of the following: private information dissemination operation, private information processing operation;

The operation attribute may be set to describe attribute conditions that should be satisfied to perform the operation behavior, including, but not limited to, any combination of one or more of trigger conditions, environmental information, use range, and media type.

The trigger condition may be set to describe a condition for activating the judgment of privacy violation behavior, including any combination of one or more of the following:

Leave or enter the system boundary, leave or enter the network boundary, before sending private information, before receiving private information, custom rules;

The system boundary may include, but is not limited to, any combination of one or more of the following: information system boundaries of different management scopes in countries / provinces / municipalities, information system boundaries of different management scopes in industries / groups / enterprises / departments, and differences within enterprises Business information system boundaries, boundaries between different functional modules in the same information system, etc.

The network boundary may include, but is not limited to, any combination of one or more of the following: country / province / city network gateways, operator network gateways, enterprise network gateways, enterprise internal network security domain boundaries, etc.

The environmental information may include, but is not limited to, any combination of one or more of the following:

Role, time, space location, equipment, network, operating system;

The usage range may be set to describe application scenarios of privacy operations, including but not limited to any combination of one or more of the following:

Set to print, set to display, set to removable storage medium exchange, set to network transmission;

The mobile storage medium may include, but is not limited to, any combination of one or more of the following: an optical disk, a U disk, a mobile hard disk, and the like.

Among them, there is no restriction on the type of the network transmitted by the network, which may include, but is not limited to, any combination of one or more of the following: wired network, wireless network; wherein the network protocol for the network transmission is also not limited, and may include But it is not limited to Ethernet, WiFi, ad hoc, etc.

The media type may be set to a media format describing the private information file, including but not limited to any combination of one or more of the following: text, pictures, audio, video, hypermedia;

The constraint condition may be set as a permission to describe the operation behavior, where the constraint condition may include but is not limited to: allowed or not allowed.

The private information dissemination operation may include any combination of one or more of the following:

Download, view, forward, cut, comment, mark;

The private information processing operation may include any combination of one or more of the following:

Generalization, anonymity, difference, concealment, mosaic, filtering, encryption, hiding.

Among them, saving the evidence sample data in the information may include:

Save the evidence sample data into the information in any combination of one or more of the following ways: binding, embedding, appending.

The binding method is a way to establish a connection between private information and evidence sample data, and the two types of data need not be stored in the same location;

The embedding method refers to storing the evidence sample data in a custom area in the original format of the private information file;

The appending method refers to modifying the file format of the original private information, modifying it into a custom file format, and setting a newly added custom field to store evidence sample data.

An embodiment of the present invention provides a device for tracing and obtaining evidence of privacy information, including:

Evidence sample data generation module, set to generate evidence sample data of information; the evidence sample data includes but is not limited to: one or more of the privacy information, the traceability record information of the privacy information and the privacy violation behavior judgment standard of the privacy information Any combination of

The evidence sample data storage module is configured to save the evidence sample data in the information.

An embodiment of the present invention provides a privacy information traceability and forensics device, which includes a processor and a computer-readable storage medium. The computer-readable storage medium stores instructions. When the instructions are executed by the processor, the foregoing Any kind of privacy information traceability and forensics method.

An embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. The computer program is characterized in that, when the computer program is executed by a processor, the steps of any one of the foregoing privacy information traceability forensics methods are implemented.

Obtain information based on review requirements;

Obtaining evidence sample data from the information, wherein the evidence sample data includes: any combination of one or more of the privacy information, the traceability record information of the privacy information, and the privacy violation judgment standard of the privacy information;

Determine whether there is a privacy violation in the traceability record information according to the privacy violation judgment standard, and generate a privacy violation judgment result;

Trace the source of privacy violations according to the judgment result of privacy violations, and generate privacy violation evidence chain data.

Among them, judging whether there is a privacy violation in the traceability record information according to the privacy violation judgment standard may include:

Generate review items;

Screening the traceability record information according to the review items to generate behavioral forensics information;

When the behavioral forensics information is credible, it is determined whether the behavioral forensics information has a privacy violation behavior according to the privacy violation behavior judgment standard, and a privacy violation behavior judgment result is generated.

Wherein, the screening of the traceability record information according to the review item and generating behavior forensics information may include:

From the traceability record information, the traceability record information within the range defined by the review item is selected as behavior forensics information.

Wherein, the judging whether the behavior forensics information has privacy violation according to the privacy violation judgment standard may include:

When the privacy violation behavior judgment standard includes the operation subject and the operation object, the operation subject in the acquisition privacy violation judgment standard is the operation subject in the behavior forensics information, and the operation object is the operation attribute corresponding to the operation object in the behavior forensics information, Any combination of one or more of operating behaviors and constraints;

When the privacy violation behavior judgment standard includes the operation subject, but not the operation object, the acquisition of the privacy violation behavior judgment standard is one of the operation attributes, operation behaviors, and constraints corresponding to the operation subject in the behavior forensics information. Or any combination of multiple;

When the privacy violation judgment standard does not include the operation subject, but includes the operation object, the acquisition of the privacy violation behavior judgment standard is one of the operation attributes, operation behaviors, and constraints corresponding to the operation object in the behavior forensics information. Or any combination of multiple;

Compare the obtained operation attributes with the operation behavior occurrence environment in the behavior forensics information, and compare the obtained operation behaviors and constraints with the operation behavior in the behavior forensics information;

When at least one of the following is satisfied, it is determined that there is a privacy violation in the behavioral forensics information: the operating environment of the operation subject in the behavioral forensics information exceeds the obtained operation attributes; Operating behavior;

When all operation behaviors of the operation subject in the behavior forensics information do not exceed the operation behaviors allowed under the constraints, and the environment in which all operation behaviors occur does not exceed the obtained operation attributes, it is determined that there is no privacy violation in the behavior forensics information.

Among them, the judgment result of privacy violation behavior may include any combination of one or more of the following:

Whether there is an infringement, the type of operation infringement, the degree of infringement, and the output format of the judgment result of privacy infringement.

Among them, the method may further include:

Make security guarantee for the privacy violation evidence chain.

Wherein, the security guarantee for the privacy infringement evidence chain may include any combination of one or more of the following:

Generate audit information of the privacy violation evidence chain;

Calculating the integrity check value of any combination of one or more of the privacy violation evidence chain and audit information;

Digitally sign any combination of one or more of the privacy violation evidence chain generation user and the privacy violation evidence chain reception user.

Wherein, the audit information can be set to record the acquisition record of the forensic sample data in the privacy violation evidence chain, and can include any one or more of the following: any combination of the following: violation of privacy violation judgment results, information sources, forensics personnel, Handle person

The integrity check value may be set to ensure that any combination of one or more of the privacy violation evidence chain and the audit information is not maliciously tampered with;

The digital signature may be set to ensure that the privacy violation evidence chain is not tampered with maliciously during the submission process.

The information acquisition module is set to acquire information according to the review requirements;

The evidence sample data acquisition module is configured to obtain evidence sample data from the information, the evidence sample data including: one or more of the privacy information, the traceability record information of the privacy information, and the privacy violation judgment criteria of the privacy information Any combination of

The privacy violation judgment module is set to judge whether there is a privacy violation in the traceability record information according to the privacy violation judgment standard, and generate a privacy violation judgment result;

The privacy infringement evidence chain generation module is set to trace the source of the privacy infringement behavior based on the result of the privacy infringement behavior judgment and generate the privacy infringement evidence chain.

An embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, any of the steps of the above-mentioned privacy information traceability and forensics method is implemented.

An embodiment of the present invention also proposes a privacy information traceability and forensics system, including:

Evidence sample data generating device, set to generate evidence sample data of information; the evidence sample data includes: any combination of one or more of the privacy information, the traceability record information of the privacy information and the privacy violation behavior judgment standard of the privacy information ; Save the evidence sample data to the information;

The privacy information traceability and forensics equipment is set to obtain information according to the review requirements; to obtain evidence sample data from the information, the evidence sample data includes: privacy information, the traceability record information of the privacy information, and the privacy violation behavior judgment standard Any combination of one or more types; determine whether there is a privacy violation in the traceability record information according to the privacy violation judgment standard, and generate a privacy violation behavior judgment result; perform a privacy violation behavior traceability based on the privacy violation behavior judgment result, and generate privacy violation evidence chain.

Wherein, the evidence sample data may include: any combination of one or more of the privacy information, the traceability record information of the privacy information, and the privacy violation judgment criteria of the privacy information; storing the evidence sample data to the information in. The embodiment of the present invention realizes the traceability and forensics of private information by storing evidence sample data in the information. Since the evidence sample data can be transferred along with the information, it overcomes the problem of the traditional traceability forensics method focusing on a single information system and improves the The ability of traceability and forensics of private information, especially the issue of traceability and forensics in the scenario of multi-application systems and multi-boundary random flow of private information.

After reading and understanding the drawings and detailed description, other aspects can be understood.

Brief description of the drawings

FIG. 1 is a flowchart of a method for tracing and obtaining evidence of privacy information according to an embodiment of the present invention;

FIG. 2 is a schematic structural diagram of a privacy information traceability and forensics device according to an embodiment of the present invention;

FIG. 3 is a flowchart of a method for forensic traceability of private information according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of the structure of a privacy information traceability and forensics device according to an embodiment of the invention;

FIG. 5 is a schematic structural diagram of a privacy information traceability and forensics system according to an embodiment of the present invention.

Elaborate

In the case of no conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other.

Referring to FIG. 1, an embodiment of the present application proposes a method for forensic traceability of private information, including:

Step 100: Generate evidence sample data of the information; the evidence sample data includes but is not limited to: any combination of one or more of private information, the traceability record information of the private information, and the privacy violation judgment criteria of the private information.

In an exemplary embodiment, the privacy information is set to describe some or all of the information that the information owner does not want to disclose. The privacy information includes but is not limited to the privacy information content and the location of the privacy information.

In an exemplary embodiment, the private information content includes but is not limited to at least one of the following:

Sensitive words in text, sensitive areas in pictures, sensitive segments in audio, sensitive frames in video.

The location of private information includes but is not limited to at least one of the following:

Page, chapter, paragraph, line, sequence number, coordinates, layer, number of pixels, time period, audio track, layer, frame sequence number.

In an exemplary embodiment, private information is generated in the following manner:

In an exemplary embodiment, any one of the following methods may be used to obtain private information content from information: automatic extraction, manual acquisition, automatic pattern recognition acquisition, and the like.

For example, keywords in blog posts can be automatically extracted, and the extracted keywords are private information content;

As another example, manually calibrating the sensitive corpus in the recording, the marked sensitive corpus is the content of private information;

In another example, a face recognition algorithm is used to identify the face area in the picture; a text recognition algorithm (OCR, Optical, Character, Recognition) is used to identify the ID number in the photo, and the area where the ID number is located is the content of the privacy information.

After obtaining the content of the private information, the location of the private information is determined. For example, when the automatic extraction method is used to obtain the private information content, the private information content is also obtained while extracting the private information content; when the manual information acquisition method is used to obtain the private information content, the private information location can be manually input; when the pattern recognition is used automatically When obtaining the content of private information in the acquisition mode, the location of the private information is obtained while identifying the content of the private information.

In an exemplary embodiment, any operation subject can generate private information. However, once the privacy information is generated, the generated private information cannot be deleted in the subsequent information transfer process. During the subsequent transfer process, the operation subject can only generate new Privacy information.

In an exemplary embodiment, the traceability record information of the private information may be generated in the following manner:

Determine that the generated traceability record information is credible, and use the traceability record function to generate the traceability record information according to the operation behavior of the operation subject on the privacy information.

In an exemplary embodiment, judging that the generated traceability record information is credible refers to ensuring that the traceability record information is not tampered with or forged by malicious users during the transfer process through hashing, encryption, and signature mechanisms.

The traceability record function generates the traceability record information by using the operation subject, the operation object (that is, private information), the operation behavior, and the environment in which the operation behavior occurs as input information.

The traceability record function includes any combination of one or more of the following: a mapping function, a hash function, an encryption function, and a signature function.

In an exemplary embodiment, the mapping function is configured to establish a mapping relationship by any combination of one or more of an operation subject, an operation object, an operation behavior, and an environment in which the operation behavior occurs.

The hash function, encryption function and signature function are set to prevent the traceability record information from being maliciously tampered with, or to prevent the malicious operation subject from denying the operation during the forensics process. The hash function, encryption function and signature function are set to ensure the confidentiality and integrity of the traceability record information in the process of information transfer, and the requirements of the traceability record information can not be forged and tampered with.

For example, the mapping function can be used to bind the corresponding relationship of any combination of one or more of the operation subject, operation object, operation behavior and the environment in which the operation behavior occurs. It can be that one operation subject corresponds to one operation behavior (one-to-one mapping) It can also correspond to multiple operations (one-to-many mapping).

In another example, a hash function is used to store the hash value of the privacy information in the traceability record information as the status of the privacy information at the time of the current operation record. Before storing the traceability record next time, first verify the hash value of the current private information. Calculate the hash value of the current privacy information, and compare the calculated hash value with the hash value of the privacy information in the generated traceability record information. If the two do not match, it means that the privacy information has been tampered with.

As another example, encryption technology can also be used to ensure the integrity of traceability record information, and only trusted subjects with keys can record operation records. That is to say, when the generated traceability record information can be decrypted by the specified key, it means that the generated traceability record information is reliable; when the generated traceability record information cannot be decrypted by the specified key, it means that the generated traceability record The information is not credible.

As another example, the encryption function and signature function can be used to ensure that the traceability record information cannot be forged and tampered during the propagation process. For example, a viable anti-tampering method can be used to encrypt private information. Each time the private information is processed, the private information must be decrypted by authorized software, and the authorized software faithfully records user operations. The authorized software uses the private key of each user in the process of disseminating the private information to sign the operation behavior, starting from the signature of the first private information processor, and then each user needs to record the previous traceability record information with his own operation Signatures form a nested signature structure to prevent malicious users from tampering with traceability records.

In an exemplary embodiment, the operation behavior is set to describe the operation performed by the operation subject on the content of private information, including but not limited to any combination of one or more of the following:

Private information dissemination operation behavior, private information processing operation behavior.

Among them, private information dissemination operations include but are not limited to any combination of one or more of the following:

Download, view, forward, cut, comment, mark.

Among them, private information processing operations include but are not limited to any combination of one or more of the following:

In an exemplary embodiment, the traceability record information includes: an operation subject, an operation object, any combination of one or more of the operation behavior and the environment in which the operation behavior occurs, and / or the operation subject, operation object, The mapping relationship between the operation behavior and any combination of one or more of the operation behavior occurrence environments.

In an exemplary embodiment, the operating behavior occurrence environment includes but is not limited to at least one of the following:

Operating time, operating space location, operating equipment, operating network, operating system operating system.

In an exemplary embodiment, a judgment criterion for privacy violation behavior of privacy information may be generated according to a privacy protection requirement for privacy information; or a judgment criterion for privacy violation behavior may be generated according to manual settings.

In an exemplary embodiment, the privacy protection requirements can be set manually.

In an exemplary embodiment, the privacy protection requirements can be translated into machine-recognizable information, that is, privacy violation behavior judgment standards.

In an exemplary embodiment, the privacy protection requirements can be translated into machine-recognizable information in at least one of the following ways: natural language analysis, template language, etc.

In an exemplary embodiment, the privacy protection requirement may refer to the user's desire to protect the privacy information in the image file; including but not limited to at least one of the following: privacy protection algorithm type, protection strength, privacy effect (such as but not limited to The visual effect after privacy treatment).

In an exemplary embodiment, the description language and format of the privacy infringement judgment standard include but are not limited to: XML, ACML, SAML, ASL, template language, and custom language format.

In an exemplary embodiment, the types of privacy protection algorithms include reversible privacy protection algorithms and non-recoverable privacy protection algorithms. The reversible privacy protection algorithm refers to that the processed privacy information can be restored to the original information through reverse calculation, including but Not limited to at least one of the following: encryption, encoding, and information hiding; the non-recoverable privacy protection algorithm means that after privacy protection, private information cannot be restored, including but not limited to at least one of the following: confusion, disturbance, differential privacy, generalization , Anonymity, cover-up;

In an exemplary embodiment, the protection strength can be divided into mild, moderate, and severe according to the information security level; in order to achieve the corresponding privacy protection level, the parameters of the privacy protection algorithm need to be set, and usually the privacy protection effect The better the parameters, the less information available after processing.

In an exemplary embodiment, the privacy effect refers to the readable effect of the privacy information after processing by the privacy protection algorithm, and generally refers to an attacker's assessment of the probability of pushing back the privacy information through the processed information.

In an exemplary embodiment, the privacy information processing operation is set to describe the privacy protection technology that the operation subject can perform on the privacy information, including but not limited to at least one of the following:

The operation attributes set to describe the attribute conditions that should be satisfied to perform the operation include, but are not limited to, any combination of one or more of trigger conditions, environmental information, use range, and media type.

In an exemplary embodiment, the trigger condition is set to describe a condition for activating the judgment of privacy violation behavior, including any combination of one or more of the following:

The system boundary includes but is not limited to any combination of one or more of the following: information system boundaries in different management scopes of countries / provinces / cities, information system boundaries in different management scopes of industries / groups / enterprises / departments, and different businesses within enterprises Information system boundaries, boundaries between different functional modules in the same information system, etc.

The network boundary includes, but is not limited to, any combination of one or more of the following: country / province / city network gateways, operator network gateways, enterprise network gateways, enterprise internal network security domain boundaries, etc.

In an exemplary embodiment, the criteria for determining the privacy violation behavior include: the operation behavior of the operation subject under the operation attribute with or without the constraint on the operation object;

Or, if the operation subject is not included in the privacy violation judgment standard, it means that all the operation subjects have or do not have the operation behavior under the constraints of the operation object under the operation attribute; or, the privacy violation behavior judgment standard does not include the operation In the case of an object, it means that the operation subject has or does not have the operation behavior under the constraint conditions for all the operation objects under the operation attributes; or, other operation authority restriction methods are adopted, which are not limited in the embodiments of the present invention.

The information generator and / or the information communicator may correspond to different triggering conditions, different environmental information, different use scopes, different media types, and need to set different operation behavior permissions for different operation subjects and / or operation objects.

Step 101: Save the evidence sample data into the information.

In an exemplary embodiment, the generated evidence sample data is saved into the information in any combination of one or more of the following ways: binding, embedding, appending, etc.

In an exemplary embodiment, the binding method is a method of establishing a connection between private information and evidence sample data, and the two types of data need not be stored in the same location;

For example, in a picture file in the JPEG format, evidence sample data may be embedded in the EXIF metadata of the JPEG picture file, and the embedding form is not limited by the embodiment of the present invention;

In the text file, the evidence sample data can be appended to the end of the file, and the appended form is not limited by the embodiment of the present invention;

Evidence sample data can also be bound to the information in the form of another file through links and other techniques.

Of course, other storage methods may also be used, and the embodiment of the present invention does not limit the storage method.

In an exemplary embodiment, steps 100 and 101 may be performed when the operation subject needs to perform a privacy information propagation operation or a privacy information processing operation on the information, or may be performed after the operation subject performs the privacy information processing operation on the information.

Referring to FIG. 2, another embodiment of the present application proposes a privacy information traceability and forensics device, including:

The evidence sample data generation module 201 is configured to generate evidence sample data of information; the evidence sample data includes but is not limited to: privacy information, traceability record information of privacy information, and one or more judgment standards of privacy violation behavior of privacy information random combination;

The evidence sample data storage module 202 is configured to save the evidence sample data in the information.

Referring to FIG. 3, another embodiment of the present application proposes a privacy information traceability and forensics method, including:

Step 300: Obtain information according to the review requirements.

In an exemplary embodiment, the review requirement is set to describe the requirement that the traceability and forensic personnel review the traceability record information of the private information under different review scenarios to query whether there is a privacy violation.

In an exemplary embodiment, the review requirements include but are not limited to at least one of the following:

Review scenario, review objectives, review time, review equipment, review network, review system.

In an exemplary embodiment, the review scenario includes but is not limited to at least one of the following:

Investigations after privacy leaks, regular privacy audits, and privacy leak warnings.

In an exemplary embodiment, when the review scenario is an investigation after a privacy leak event occurs, the leaked information is obtained.

When the review scenario is a conventional privacy audit, each forwarded information is obtained periodically or periodically.

When the review scenario is a privacy leak warning, each forwarded information is obtained in real time.

The review objectives, review time, review equipment, review network, and review system can be used as the basis for review information screening.

Step 301: Obtain evidence sample data from the information. In an exemplary embodiment, the evidence sample data includes: one of privacy information, the traceability record information of the privacy information, and the privacy violation behavior judgment standard of the privacy information Or any combination of multiple.

In an exemplary embodiment, the criteria for determining the privacy information, traceability record information, and privacy violation behavior are the same as those in the foregoing embodiment, and details are not described here. It should be noted that the criteria for determining privacy violations may or may not be included in the evidence sample data. When the criteria for determining privacy violations are included in the evidence sample data, they are obtained directly from the evidence sample data. Yes; when the criterion of privacy violation behavior is not included in the evidence sample data, it can be generated when needed, and the generation method is the same as the previous embodiment, and will not be repeated here.

Step 302: Determine whether there is a privacy violation in the traceability record information according to the privacy violation judgment standard, and generate a privacy violation judgment result.

In an exemplary embodiment, determining whether there is a privacy violation in the traceability record information according to the privacy violation judgment standard includes:

Generate a review item; filter the traceability record information in the evidence sample data according to the review item to generate behavioral forensic information; when the behavioral forensic information is credible, determine whether the behavioral forensic information exists according to the privacy violation behavior judgment standard Privacy violations, generate privacy violations judgment results.

When the behavioral forensics information is not credible, this process is ended.

In an exemplary embodiment, the manner of determining whether the behavioral forensics information is credible is the same as the manner of determining whether the traceability record information is credible in the foregoing embodiment, and details are not described herein again.

In an exemplary embodiment, the review items can be set manually; or the review items can be generated according to the review requirements.

In an exemplary embodiment, at least one of the following ways may be used to generate the review items: template matching, manual input, natural language processing, and the like.

For example, you can perform keyword matching on the description text of the review requirements of the specified grammar template. The matched keywords are the review items. For example: when the review requirement is to check the records of July and August 2018, the review time "2018" can be automatically extracted. From July 1, 2014 to August 31, 2018.

As another example, according to the situation of the review requirements, manually input more detailed contents of the review items, thereby saving the time for troubleshooting.

In another example, the review requirements are analyzed through natural language processing methods; the review requirements records are trained through training history, and the review requirements model is constructed; when the new review requirements corpus needs to be processed, the fields match the review items therein.

The above methods can be combined arbitrarily. For example, after the natural language processing method identifies the review item, it can continue to use the manual input method for confirmation.

In an exemplary embodiment, the review item is set to describe the filtering classification criteria of the traceability record information, including but not limited to at least one of the following:

Specify the time interval, the specified location range, the specified operation subject, and the specified operation behavior.

Among them, the operation behavior includes but is not limited to at least one of the following: privacy information dissemination operation behavior, privacy information processing operation behavior.

In the embodiment of the present invention, screening the traceability record information according to the review item to generate behavior forensics information includes:

From the traceability record information, the traceability record information within the scope defined by the review item is selected as the behavior forensics information.

For example, when the review item is a specified time interval, the behavioral forensics information is the traceability record information corresponding to the specified time interval, that is, the traceability record information whose time is within the specified time interval.

When the review item is the specified location range, the behavioral forensics information is the traceability record information corresponding to the specified location range, that is, the traceability record information of the location within the specified location range.

When the review item is the designated operation subject, the behavior forensics information is the traceability record information corresponding to the designated operation subject, that is, the same traceability record information of the operation subject and the designated operation subject.

When the review item is the specified operation behavior, the behavior forensics information is the traceability record information corresponding to the specified operation behavior, that is, the traceability record information with the same operation behavior as the specified operation behavior.

In an exemplary embodiment, the result of determining the privacy violation behavior includes any combination of one or more types:

In the embodiment of the present invention, judging whether the behavior forensics information has a privacy violation according to the privacy violation behavior judgment standard includes:

When at least one of the following is satisfied: the operating environment of the operation subject in the behavioral forensics information exceeds the obtained operation attributes; when the operation behavior of the operation subject in the behavioral forensics information exceeds the allowed operation behavior under the constraint conditions, the behavioral forensics information is determined There are privacy violations in

Step 303: Trace the source of the privacy violation according to the result of the privacy violation, and generate a privacy violation evidence chain.

In an exemplary embodiment, the privacy infringement evidence chain refers to a certification chain formed by a series of objective facts and true traceability record information, which can prove the privacy infringement process. The chain of evidence is a concept in the legal field, and does not refer to a linked list of data structures in the computer field, and its presentation form may be a point, chain, tree, or graph structure.

The privacy infringement evidence chain includes at least one node, and each node includes at least one of the following:

Privacy violation subject, privacy violation environment, privacy information dissemination operation behavior, privacy information processing operation behavior.

In an exemplary embodiment, when the privacy information propagation operation behavior in the traceability record information exceeds the operation authority of the operation subject in the traceability record information, and the privacy information propagation operation behavior is the download authority or the viewing authority, it is determined that the privacy violation subject is not The operation subject in the traceability record information, the privacy violation subject should be the operation subject in the traceability record that spreads the privacy information to the user;

When the privacy information dissemination operation behavior in the traceability record information exceeds the operation authority of the operation subject in the traceability record information, and the privacy information dissemination operation behavior is the forwarding authority or the cutting authority or the comment authority or the marking authority, it is determined that the privacy infringement subject is the The operation subject in the traceability record information;

When the privacy information processing operation in the traceability record information exceeds the operation authority of the operation subject in the traceability record information, the privacy violation subject is determined to be the operation subject in the traceability record information;

When the operating environment in the traceability record information exceeds the access restriction condition of the operation subject in the traceability record information, the privacy violation subject is determined to be the operation subject in the traceability record information.

Once all the subjects of privacy infringement are identified, all subjects of privacy infringement can be marked in the privacy infringement evidence chain.

In an exemplary embodiment, the method further includes:

Make security guarantee for the privacy violation evidence chain.

In an exemplary embodiment, the security guarantee for the privacy infringement evidence chain includes any combination of one or more of the following:

Generate audit information of the privacy violation evidence chain;

In an exemplary embodiment, the audit information is configured to record the acquisition record of the forensic sample data in the privacy violation evidence chain, including any combination of any one or more of the following: the judgment result of privacy violation behavior, the information source , Forensics personnel, handlers;

In an exemplary embodiment, the forensic personnel are qualified evidence collection staff.

The handling person is a staff member who has the authority to receive and transmit the evidence chain.

The integrity check value is set to ensure that the content of any combination of one or more of the privacy violation evidence chain and the audit information is not maliciously tampered with;

The digital signature is set to ensure that the privacy infringement evidence chain is not tampered with maliciously during the submission process.

Referring to FIG. 4, another embodiment of the present application proposes a privacy information traceability and forensics device, including:

The information obtaining module 401 is set to obtain information according to the review requirements;

The evidence sample data obtaining module 402 is configured to obtain evidence sample data from the information, wherein the evidence sample data includes but is not limited to: privacy information, traceability record information of the privacy information, and the privacy violation behavior judgment standard of the privacy information Any combination of one or more types;

The privacy violation judgment module 403 is set to judge whether there is a privacy violation in the traceability record information according to the privacy violation judgment standard, and generate a privacy violation judgment result;

The privacy infringement evidence chain generation module 404 is configured to trace the source of the privacy infringement behavior according to the result of the privacy infringement behavior judgment and generate the privacy infringement evidence chain.

Referring to FIG. 5, another embodiment of the present application proposes a privacy information traceability and forensics system, including:

The evidence sample data generating device 501 is configured to generate evidence sample data of information; wherein, the evidence sample data includes: one or more of: privacy information, traceability record information of the privacy information, and privacy violation judgment criteria of the privacy information Any combination of; save the evidence sample data into the information;

The privacy information traceability and forensics device 502 is configured to obtain information according to the review requirements; obtain evidence sample data from the information; determine whether there is a privacy violation in the traceability record information according to the privacy violation behavior judgment standard; The result of the privacy violation behavior is traced to the source of the privacy violation behavior to generate a privacy violation evidence chain.

The implementation process of the above-mentioned evidence sample data generation device 501 and the privacy information traceability and forensics device 502 is the same as the implementation process of the foregoing embodiment, and will not be repeated here.

The technical solution of the present application will be exemplarily described below through application examples.

Example 1 Evidence sample data is generated in real time during the circulation of the picture, and the evidence sample data is saved in the picture and circulated together with the picture. First, define the privacy information: obtain the coordinates of the privacy area in the picture by manual annotation or image recognition algorithm. The horizontal and vertical coordinates of the upper left and lower right corners can be used to describe a rectangular area, and the privacy area of the picture information can be marked to generate privacy. information. In this step, private information refers to clearly marked image privacy areas, including but not limited to image privacy content and location of image privacy information. In this example, assuming that the information is a private picture of a private party, Alice marked two privacy areas in the picture, the user's "face area" and the "image area where the jewelry is located". For the subsequent process, please refer to the privacy information traceability and forensics method shown in FIG. 1.

In this example, suppose Alice encrypted and forwarded the privacy area in the picture to Bob, and at the same time set the hope that the "image area where the jewelry is located" is only shared within the scope of classmates, and other users are not allowed to do more on the "face area" Mosaic and blur processing. Bob forwards the "image area where the jewelry is located" to Carol in the classmates and David outside the classmates, and Carol mosaics the "face area" in the picture. +

Example 2 For the traceability and forensics analysis based on the pictures transferred in Example 1, the process can refer to the privacy information traceability and forensics method shown in FIG. 3. In this example, the forensic function called by Alice verifies the confidentiality and integrity of the result of the privacy violation judgment to determine the authenticity of the traceability information. The forensic function traces the source of David's private information through David's viewing behavior to Bob and determines that Bob is the subject of privacy violations; through Carol's mosaic processing, it is determined that Carol is another subject of privacy violations, and finally determines all privacy violations The results are packaged into a privacy infringement evidence chain. Those of ordinary skill in the art may understand that all or some of the steps, systems, and functional modules / units in the method disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical The components are executed in cooperation. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those of ordinary skill in the art, the term computer storage medium includes both volatile and non-volatile implemented in any method or technology configured to store information (such as computer-readable instructions, data structures, program modules, or other data) Sex, removable and non-removable media. Computer storage media include but are not limited to RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices, or may Any other medium configured to store the desired information and be accessible by the computer. In addition, it is well known to those of ordinary skill in the art that the communication medium generally contains computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium .

Claims

A method for forensic traceability of private information, including:

Generate evidence sample data of the information; the evidence sample data includes any combination of one or more of the following: privacy information, traceability record information of the privacy information, and privacy violation behavior judgment standards of the privacy information;

Save the evidence sample data into the information.
The privacy information traceability and forensics method according to claim 1, wherein the privacy information includes privacy information content and privacy information location; the privacy information is generated in the following manner:

Obtain the privacy information content from the information, determine the location of the privacy information content in the information to obtain the location of the privacy information.
The privacy information traceability and forensics method according to claim 1, wherein the traceability record information of the privacy information is generated in the following manner:

It is determined that the generated traceability record information is credible, and a traceability record function is used to generate the traceability record information according to the operation behavior of the operation subject on the private information.
The method for forensic traceability of private information according to claim 3, wherein the traceability record function includes any combination of one or more of the following: a mapping function, a hash function, an encryption function, and a signature function;

Among them, the mapping function is set to be any combination of one or more of the operation subject, operation object, operation behavior and the environment in which the operation behavior occurs to establish the mapping relationship;

The hash function, encryption function and signature function are set to prevent the traceability record information from being maliciously tampered with, or set to prevent the malicious operation subject from denying the operation during the forensics process;

Or, wherein, the operation subject includes any one of the following:

Information owner, information forwarder, information receiver, information sending device, information receiving device, information transmission device;

The operation behavior includes any combination of one or more of the following:

Private information dissemination operation behavior, private information processing operation behavior;

The traceability record information includes: any combination of one or more of the operation subject, operation object, the operation behavior and the environment in which the operation behavior occurs, and / or the operation subject, operation object, and operation behavior The mapping relationship between any combination of one or more of the operating environment.
The privacy information traceability and forensics method according to claim 1, wherein the privacy violation judgment criterion of the privacy information is generated in the following manner:

A judgment criterion for privacy violation of the privacy information is generated according to the privacy protection requirement for the privacy information; wherein the privacy protection requirement includes any one or more of the following combinations:

Privacy protection algorithm type, protection strength, privacy effect.
The privacy information tracing and forensic method according to claim 5, wherein the privacy violation behavior judgment standard includes: any combination of one or more of an operation subject, an operation object, an operation attribute, an operation behavior, and a constraint Corresponding relationship; where,

The operation subject includes any one of the following:

Information owner, information forwarder, information receiver, information sending device, information receiving device, information transmission device;

The operation object is set to describe the privacy information being operated;

The operation behavior includes any combination of one or more of the following: private information dissemination operation and private information processing operation;

The operation attribute is set to describe the attribute conditions that should be satisfied to perform the operation behavior, including: any combination of one or more of the trigger condition, environmental information, use range, and media type;

Wherein, the trigger condition is set to describe a condition for activating the judgment of privacy violation behavior, including any combination of one or more of the following:

Leave or enter the system boundary, leave or enter the network boundary, before sending private information, before receiving private information, custom rules;

The environmental information includes any combination of one or more of the following:

Role, time, space location, equipment, network, operating system;

The scope of use is set to describe application scenarios of privacy operations, including any combination of one or more of the following:

Set to print, set to display, set to removable storage medium exchange, set to network transmission;

The media type is set to a media format describing the private information file, including any combination of one or more of the following: text, pictures, audio, video, hypermedia;

The constraint condition is set as a permission to describe the operation behavior, wherein the constraint condition includes: allowed or not allowed.
The private information traceability and forensics method according to claim 1, wherein the saving of evidence sample data in the information includes:

Save the evidence sample data into the information in any combination of one or more of the following ways: binding, embedding, appending.
A computer-readable storage medium on which a computer program is stored, wherein, when the computer program is executed by a processor, the steps of the privacy information traceability forensic method according to any one of claims 1 to 7 are implemented.
A method for forensic traceability of private information, including:

Obtain information based on review requirements;

Obtain evidence sample data from the information, where the evidence sample data includes: any combination of one or more of the privacy information, the traceability record information of the privacy information, and the privacy violation judgment standard of the privacy information;

Determine whether there is a privacy violation in the traceability record information according to the privacy violation judgment standard, and generate a privacy violation judgment result;

Trace the source of privacy violations according to the judgment result of privacy violations, and generate privacy violation evidence chain data.
The privacy information traceability and forensics method according to claim 9, wherein the judging whether a privacy violation exists in the traceability record information according to the privacy violation behavior judgment standard includes:

Generate review items;

Screening the traceability record information according to the review items to generate behavioral forensics information;

When the behavioral forensics information is credible, it is determined whether the behavioral forensics information has privacy violations according to the privacy violation behavior judgment standard, and a privacy violation behavior judgment result is generated.
The privacy information traceability forensics method according to claim 10, wherein the screening of the traceability record information according to the review item and generating behavior forensics information include:

From the traceability record information, the traceability record information within the range defined by the review item is selected as behavior forensics information.
The privacy information traceability and forensics method according to claim 10, wherein the judging whether the behavior forensics information has a privacy violation according to a privacy violation behavior judgment standard includes:

When the privacy violation behavior judgment standard includes the operation subject and the operation object, the operation subject in the acquisition privacy violation judgment standard is the operation subject in the behavior forensics information, and the operation object is the operation attribute corresponding to the operation object in the behavior forensics information, Any combination of one or more of operating behaviors and constraints;

When the privacy violation behavior judgment standard includes the operation subject, but not the operation object, the acquisition of the privacy violation behavior judgment standard is one of the operation attributes, operation behaviors, and constraints corresponding to the operation subject in the behavior forensics information. Or any combination of multiple;

When the privacy violation judgment standard does not include the operation subject, but includes the operation object, the acquisition of the privacy violation behavior judgment standard is one of the operation attributes, operation behaviors, and constraints corresponding to the operation object in the behavior forensics information. Or any combination of multiple;

Compare the obtained operation attributes with the operation behavior occurrence environment in the behavior forensics information, and compare the obtained operation behaviors and constraints with the operation behavior in the behavior forensics information;

When at least one of the following is satisfied, it is determined that there is a privacy violation in the behavioral forensics information: the operating environment of the operation subject in the behavioral forensics information exceeds the obtained operation attributes; Operating behavior;

When all operation behaviors of the operation subject in the behavior forensics information do not exceed the operation behaviors allowed under the constraints, and the environment in which all operation behaviors occur does not exceed the obtained operation attributes, it is determined that there is no privacy violation in the behavior forensics information.
The privacy information traceability and forensic method according to claim 12, wherein the result of the privacy violation determination includes any combination of one or more of the following:

Whether there is an infringement, the type of operation behavior infringed, the degree of infringement, and the output format of the judgment result of privacy infringement.
A computer-readable storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the privacy information traceability forensic method according to any one of claims 9 to 13 are implemented.
A privacy information traceability and forensics system, including:

Evidence sample data generating device, set to generate evidence sample data of information; the evidence sample data includes: any combination of one or more of the privacy information, the traceability record information of the privacy information and the privacy violation behavior judgment standard of the privacy information ; Save the evidence sample data to the information;

The privacy information traceability and forensics equipment is set to obtain information according to the review requirements; to obtain evidence sample data from the information, the evidence sample data includes: privacy information, the traceability record information of the privacy information, and the privacy violation behavior judgment standard Any combination of one or more types; determine whether there is a privacy violation in the traceability record information according to the privacy violation judgment standard, and generate a privacy violation behavior judgment result; perform a privacy violation behavior traceability based on the privacy violation behavior judgment result, and generate privacy violation evidence chain.