WO2022134160A1

WO2022134160A1 - Tamperproof evidence obtaining method, system and apparatus, storage medium, and electronic device

Info

Publication number: WO2022134160A1
Application number: PCT/CN2020/141205
Authority: WO
Inventors: 匡立中; 蔡亮; 李伟; 张帅; 陈威涛
Original assignee: 杭州趣链科技有限公司
Priority date: 2020-12-23
Filing date: 2020-12-30
Publication date: 2022-06-30
Also published as: CN112632637A

Abstract

Disclosed are a tamperproof evidence obtaining method, system and apparatus, a storage medium, and an electronic device. The method comprises: receiving an evidence obtaining instruction; in response to the evidence obtaining instruction, acquiring a target evidence, obtaining a string file corresponding to the target evidence, and obtaining an evidence obtaining parameter when acquiring the target evidence; binding the string file corresponding to the target evidence and the evidence obtaining parameter, and then sending the string file and the evidence obtaining parameter to a server-side; and the server-side generating a corresponding target evidence obtaining file according to the string file of the target evidence, obtaining a hash value of the target evidence obtaining file using a hash algorithm, binding the hash value of the target evidence and the evidence obtaining parameter, and then sending the hash value and the evidence obtaining parameter to a blockchain to perform on-chain evidence storage.

Description

Tamper-proof forensics method, system, device, storage medium and electronic device

This disclosure requires all of the invention patent applications with the application number 202011539659.6 and the invention name "tamper-proof evidence collection method, system, device, storage medium and electronic device" submitted to the State Intellectual Property Office of the People's Republic of China on December 23, 2020 is incorporated by reference into this disclosure in its entirety.

field

The present disclosure generally relates to the field of blockchain technology, and more particularly, to a tamper-resistant forensics method, system, apparatus, storage medium, and electronic device.

background

In the prior art, when using a mobile phone to collect evidence, the implementation method is as follows: using the sensor of the mobile phone to collect evidence such as taking pictures and videos, storing the corresponding forensic files in the mobile phone, and transmitting the forensic files from the inside of the mobile phone to the back-end server. This method of forensics has the following problems: the evidence file will be stored in the mobile phone and then transmitted from the mobile phone, so the user can replace or tamper with the evidence file before the evidence file is stored in the mobile phone and transmitted to the server. As a result, the evidence files transmitted to the back-end server are not real evidence files, that is, the authenticity of the evidence files cannot be guaranteed.

Overview

In a first aspect, the present disclosure relates to a tamper-resistant forensics method, the method comprising:

The terminal device receives the forensic instruction;

The terminal device collects the target evidence in response to the forensics instruction, obtains the string file corresponding to the target evidence, and obtains the forensics parameters when collecting the target evidence;

The terminal device binds the string file corresponding to the target evidence with the forensic parameters and sends it to the server.

In some embodiments, acquiring target evidence in response to the forensic instruction, acquiring a string file corresponding to the target evidence includes:

The forensic method used to obtain the evidence of the target to be collected according to the forensic instruction;

Determine the forensics collection module to be called according to the forensics method;

Control the forensics collection module to collect the target evidence according to the forensics method, and generate a string file corresponding to the target evidence;

The string file corresponding to the target evidence is used to generate the target forensics file corresponding to the target evidence, and the file type of the target forensics file is related to the forensics method.

In certain embodiments, the forensic parameters include forensic time information and/or forensic space information.

In some embodiments, if the forensics method is to collect evidence by taking pictures in discontinuous forensics, the forensic collection module is controlled to collect the target evidence according to the evidence collection method, and a character string file corresponding to the target evidence is generated, including:

Control the camera module to shoot the target evidence, and generate the first character string file corresponding to the target evidence,

The first string file is used to generate the first target forensics file corresponding to the target evidence,

The file type of the first target forensic file is a picture.

In some embodiments, if the evidence collection method is to collect evidence by video recording in the continuous evidence collection, the forensic collection module is controlled to collect the target evidence according to the evidence collection method, and a string file corresponding to the target evidence is generated, including:

Control the camera module to record the target evidence, and generate the second string file corresponding to the target evidence,

The second string file is used to generate the second target forensic file corresponding to the target evidence,

The file type of the second target forensic file is a video file.

In some embodiments, if the evidence collection method is to collect evidence by recording in the continuous evidence collection, the forensic collection module is controlled to collect the target evidence according to the evidence collection method, and a string file corresponding to the target evidence is generated, including:

Control the recording module to record the target evidence, and generate the third string file of the target evidence,

The third string file is used to generate the third target forensics file corresponding to the target evidence,

The file type of the third target forensic file is an audio file.

In some embodiments, if the forensics method is to collect evidence by screen recording in the continuous forensics method, the forensic collection module is controlled to collect the target evidence according to the evidence collection method, and a string file corresponding to the target evidence is generated, including:

Control the screen recording module to record the target evidence, and generate the fourth string file of the target evidence,

The fourth string file is used to generate the fourth target forensics file corresponding to the target evidence,

The file type of the fourth target forensic file is a screen recording file.

Target evidence is generated by the end device.

In some embodiments, if the forensics method is continuous forensics, the string file corresponding to the target evidence is bound with the corresponding forensics parameters and sent to the server, including:

Using live streaming technology, the continuous substring file corresponding to the target evidence and the bound sub-forensic parameters are sent to the server in real-time and in the form of streaming;

The string file corresponding to the target evidence includes consecutively obtained substring files;

Sub-forensics parameters are forensic parameters when obtaining the corresponding sub-string file.

In a second aspect, the present disclosure relates to a tamper-proof forensics method, which is applied to the server side, and the method includes:

Receive the string file of the target evidence sent by the terminal device and the corresponding forensic parameters;

Generate the corresponding target forensics file according to the string file of the target evidence;

using a hash algorithm to obtain the hash value of the target forensic file; and

Bind the hash value of the target evidence and the forensic parameters and send it to the blockchain for on-chain evidence storage.

In a third aspect, the present disclosure relates to a tamper-resistant forensic system comprising:

The terminal device is used to receive the forensic instruction, collect the target evidence in response to the forensic instruction, obtain the corresponding string file, and obtain the forensics parameters when collecting the target evidence, and bind the string file corresponding to the target evidence with the corresponding forensics parameters. sent to the server; and

The server side is used to receive the string file and forensics parameters of the target evidence sent by the terminal device, generate the corresponding target forensics file according to the string file of the target evidence, use a hash algorithm to obtain the hash value of the target forensics file, and convert the target After the hash value of the evidence is bound to the forensic parameters, it is sent to the blockchain for on-chain evidence storage.

In a fourth aspect, the present disclosure relates to a tamper-resistant forensics device, which is applied to terminal equipment, and the device includes:

The instruction receiving module is used to receive the forensic instruction;

The string file acquisition module is used to collect the target evidence in response to the forensic instruction, and obtain the string file corresponding to the target evidence;

A parameter acquisition module, used to acquire forensic parameters when collecting target evidence; and

The first sending module is used to bind the string file corresponding to the target evidence with the corresponding forensic parameters and send it to the server.

In a fifth aspect, the present disclosure relates to a tamper-proof forensics device, which is applied to a server, and the device includes:

The receiving module is used to receive the string file and forensic parameters of the target evidence sent by the terminal device;

The string file and forensic parameters of the target evidence are obtained by the terminal device receiving the forensic instruction and collecting the target evidence in response to the forensic instruction;

The forensic file generation module is used to generate the corresponding target forensic file according to the string file of the target evidence;

a calculation module for obtaining the hash value of the target forensic file by adopting a hash algorithm; and

The second sending module is used to bind the hash value of the target evidence with the forensic parameters and send it to the blockchain for on-chain storage.

In a sixth aspect, the present disclosure relates to a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, causes the processor to execute the tamper-proof forensics method of the present disclosure.

In a seventh aspect, the present disclosure relates to an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes the tamper-proof forensics method of the present disclosure when executing the program.

In some embodiments, the terminal device receives the forensic instruction, collects the target evidence in response to the forensic instruction, obtains the string file corresponding to the target evidence, and obtains the forensics parameters when collecting the target evidence, and converts the string file corresponding to the target evidence to the target evidence. After the forensic parameters are bound, they are sent to the server. The server generates the corresponding target forensics file according to the string file of the target evidence, uses the hash algorithm to obtain the hash value of the target forensics file, and combines the hash value of the target evidence with the forensics parameters. After binding, send it to the blockchain for on-chain deposit.

In some embodiments, the target evidence obtained through the present disclosure will not be stored in the terminal device, but will be directly transmitted to the server side, preventing users from tampering with the target evidence using the terminal device, ensuring the authenticity of the evidence, and at the same time through the blockchain Storing the hash of the target evidence further ensures that the evidence cannot be tampered with or replaced. Prevent evidence from being tampered with after storage to achieve the effect of preserving evidence.

Brief Description of Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the disclosure and together with the description serve to explain the principles of the disclosure.

In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the accompanying drawings required in the description of the embodiments or the prior art. It is obvious to those skilled in the art that In other words, on the premise of no creative labor, other drawings can also be obtained based on these drawings.

FIG. 1 is a schematic flowchart of a tamper-proof forensics method provided by an embodiment of the present disclosure;

2 is a schematic flowchart of a tamper-proof forensics method provided by another embodiment of the present disclosure;

3 is a sequence diagram of a tamper-proof forensics method provided by an embodiment of the present disclosure;

FIG. 4 is a sequence diagram of a tamper-proof forensics method according to another embodiment of the present disclosure.

detail

In order to make the purposes, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present disclosure. Obviously, the described embodiments These are some, but not all, embodiments of the present disclosure. Based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present disclosure.

Unless otherwise defined, all techniques used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. The terminology used herein is for the purpose of describing the embodiments of the present disclosure only and is not intended to limit the present disclosure.

Before further detailed description of the embodiments of the present disclosure, the terms and terms involved in the embodiments of the present disclosure are explained, and the nouns and terms involved in the embodiments of the present disclosure are applicable to the following explanations.

(1) Transaction (Transaction), which is equivalent to the computer term "transaction". Transaction includes operations that need to be submitted to the blockchain network for execution, not just transactions in a business context. The term "transaction" is used, and embodiments of the present disclosure follow this convention.

For example, the Deploy transaction is used to install the specified smart contract to the node in the blockchain network and is ready to be invoked; the Invoke transaction is used to append the transaction record in the blockchain by invoking the smart contract, And operate the state database of the blockchain, including update operations (including adding, deleting, and modifying key-value pairs in the state database) and query operations (that is, querying key-value pairs in the state database).

(2) Blockchain is a storage structure of encrypted and chained transactions formed by blocks.

(3) Blockchain Network, a set of nodes that incorporate new blocks into the blockchain through consensus.

(4) Ledger is a general term for blockchain (also known as ledger data) and a state database synchronized with the blockchain, where the blockchain records transactions in the form of files in the file system; the state database It records transactions in the blockchain in the form of different types of key (Key) value (Value) pairs to support fast query of transactions in the blockchain.

(5) Smart Contracts, also known as Chaincode or application code, are programs deployed in the nodes of the blockchain network, and the nodes execute the smart contracts called in the received transactions to update the state database. The key value of the data to update or query operation.

(6) Consensus is a process in the blockchain network, which is used to reach an agreement on the transactions in the block among the multiple nodes involved, and the agreed block will be appended to the block chain. At the end, the mechanisms for achieving consensus include Proof of Work (PoW, Proof of Work), Proof of Stake (PoS, Proof of Stake), Proof of Equity Authorization (DPoS, Delegatd Proof-of-Stake), Proof of Elapsed Time (PoET, Proof of Elapsed Time), etc.

FIG. 1 is a schematic flowchart of a tamper-proof forensics method provided by an embodiment of the present disclosure. Referring to Figure 1, the method is applied to a terminal device, including the following steps:

S100A: Receive a forensic instruction.

Specifically, a forensics application (forensics APP or forensics application software) is installed on the terminal device. The interface of the forensics application is provided with multiple forensic options, and the user can collect target evidence according to different forensic methods by selecting different forensic options. The target forensic files finally generated from the target evidence collected by different forensics methods have different file types or storage types.

The target evidence is an event that occurs in the real world or an objective thing that actually exists. For example, the target evidence is events or things that exist in the real world, such as the scene of a traffic accident, fraudulent text messages, chat records or voices, and fake products that can be collected, captured, and recorded.

The forensic instruction is an instruction sent by the user to the terminal device by operating the forensic application in order to collect the target evidence. The forensic instruction is used to instruct the terminal device how to collect the evidence of the forensic target.

Target evidence can be stored in different file types by forensic applications. For example, the target evidence can be collected in the form of pictures and stored as a picture file, the target evidence can also be collected in the form of video and stored as a video file, and the target evidence can also be collected in the form of audio and stored as an audio file. The target evidence is collected in the form of screen recording and stored as a screen recording file.

Of course, the specific forensic method for collecting and storing the target evidence is determined by the properties of the target evidence and the user's desired storage form.

For example, if the target evidence is an event happening in the real world, the target evidence can be collected and stored in the form of video or pictures, and if the target evidence is an event with sound, it can also be collected and stored in the form of audio.

If the target evidence is generated by an electronic product (such as a terminal device), such as chat records or transaction records, etc., the target evidence can be collected and stored in the form of screen recording or screen capture.

The forensic method in which the target evidence is finally obtained also needs to be determined according to the user's wishes.

The terminal device may be an electronic device with a collection function, such as a mobile phone, a tablet, a notebook computer, a smart watch, and a sports bracelet.

S200A: In response to the forensics instruction, collect target evidence, obtain a string file corresponding to the target evidence, and obtain evidence collection parameters when collecting the target evidence.

Specifically, after the terminal device responds to the forensics instruction, it calls its own forensics collection module to collect the target evidence according to the instruction of the forensics instruction, and the terminal device collects the target evidence and generates a string file corresponding to the target evidence.

The string file is written in a computer language and is not easily understood by the user, and is used to generate the target forensics file corresponding to the target evidence.

String files can be generated from the memory of the terminal device.

The target forensic file is an electronic file that is easy to be understood by the user and can truly restore or reflect the target evidence. For example, the target forensics file is a photo file of the target evidence, or a video file of the target evidence, or a screen recording file of the target evidence.

After the string file is compiled by the computer, the corresponding photo file, video video file or screen recording file can be generated.

For example, the mobile phone controls the camera module to collect the target object in front of the camera. When the camera module collects the target, the processing module of the mobile phone will first generate a string file corresponding to the target object. After the acquisition is completed, the processing module of the mobile phone will process the string file. Compile to obtain the image file or video file of the target thing. The image file or the video file is the target forensic file of the target thing.

Forensic parameters include forensic time information and/or forensic space information when collecting target evidence.

The forensic time information is the collection time of collecting the target evidence or the completion time of completing the evidence collection, and the forensic space information is the geographic location information of the collected target evidence. The geographic location information includes latitude and longitude.

S300A: The terminal device binds the string file corresponding to the target evidence with the forensic parameters and sends it to the server.

Specifically, the terminal device can send the string file and the forensic parameters to the server in a real-time manner, that is, while collecting and generating, and send it at the same time; or send it at one time after the collection is completed. The specific sending method is determined according to the forensic method, which is determined by the forensic instruction sent by the user.

Although the terminal device collects the target evidence and obtains the string file corresponding to the target evidence, the terminal device does not generate the target forensics file corresponding to the target evidence according to the string file. Therefore, the terminal device does not store the target forensic file, and the user cannot modify the target forensic file through the terminal device, nor can the target forensic file be replaced. Therefore, it is preliminarily guaranteed that the electronic file of the target evidence, that is, the target forensic file will not be tampered or replaced by the user in the middle, preventing The user maliciously tampered with the evidence obtained by using the loophole to ensure the authenticity of the evidence.

FIG. 2 is a schematic flowchart of a tamper-proof forensics method provided by another embodiment of the present disclosure. Referring to Figure 2, the method is applied to the server side and includes the following steps:

S100B: Receive the character string file of the target evidence and the corresponding evidence collection parameters sent by the terminal device.

S200B: Generate a corresponding target forensic file according to the character string file of the target evidence.

Specifically, after receiving the string file and the forensic parameters sent by the terminal device, the server side compiles the string file of the target evidence to generate the target forensics file. Target forensic documents are documents that are accepted by the public and are easily understood by the public. For example, picture files, video files, audio files, screen recording files, etc. A target forensic file is a visual representation or electronic storage of the target's evidence.

S300B: Use the hash algorithm to obtain the hash value of the target forensic file.

S400B: After binding the hash value of the target evidence and the forensic parameters, send it to the blockchain for on-chain storage.

Specifically, after the server converts the target forensic file into a binary file, it uses the SHA-256 function to convert the binary file into a hexadecimal hash value, and the hexadecimal hash value is the target evidence. hash value.

The server side binds the hash value of the target evidence with the forensic parameters, and sends it to the blockchain to store the evidence on the chain.

On-chain evidence storage is to take the hash value and forensic parameters corresponding to the target evidence as the extra field in a transaction on the blockchain, and bind the hash value in the above transaction with the forensic parameters and send it to the blockchain, so that The consensus of all authorized nodes on the blockchain is synchronized, so that the deposit certificate is fixed and cannot be tampered with.

Due to the non-tampering characteristics of the blockchain, by storing the hash value and forensic parameters of the target evidence on the blockchain, the target evidence can be further prevented from being tampered with and the authenticity of the target evidence can be guaranteed.

In some embodiments, step S200A specifically includes:

S210A: Obtain the evidence collection method adopted for collecting the target evidence according to the evidence collection instruction.

Specifically, the terminal device is provided with a variety of forensic collection modules, such as a camera module, a camera module, a recording module, a screen recording module, and a screen capture module, which are not limited to this. The camera module and the camera module can be integrated into one camera module.

The terminal device obtains the forensic instruction through the forensic application program, and the forensic instruction carries the information of the forensic method. For example, if the forensic instruction is photo forensics, the forensics method is to take photos. If the forensic instruction is video forensics, the forensics method is to take video forensics. If the forensic instruction is to obtain evidence by recording, the method of obtaining evidence is to obtain evidence by recording. If the forensic instruction is to take screen-recording, the forensic method is to take screen-recording. If the forensic instruction is to take screenshots, the forensics method is to take screenshots.

S220A: Determine the forensic collection module to be called according to the forensic method.

Specifically, the terminal device determines which forensics collection module configured by itself is to be invoked according to the forensics method. If the forensics method is to obtain evidence by taking pictures, the forensic collection module to be called is the camera module. If the evidence collection method is to collect evidence by video recording, the forensic collection module to be called is the camera module. If the evidence collection method is to collect evidence by recording, the forensic collection module to be called is the recording module. If the evidence collection method is to obtain evidence by screen recording, the forensic collection module to be called is the screen recording module. If the forensics method is to take screenshots, the forensics collection module to be called is the screenshot module.

S230A: Control the forensics collection module to collect target evidence according to the evidence collection method, and generate a string file corresponding to the target evidence.

Specifically, the terminal device controls the photographing module to collect the target evidence in a photographing manner, and at the same time, the terminal device generates a character string file corresponding to the target evidence, and the character string file is used to generate an image of the target evidence.

Or, the terminal device controls the camera module to collect the target evidence in a video recording manner, and at the same time, the terminal device generates a character string file corresponding to the target evidence, and the character string file is used to generate a video of the target evidence.

Or, the terminal device controls the recording module to collect the target evidence according to the recording method, and at the same time, the terminal device generates a string file corresponding to the target evidence, and the string file is used to generate a recording of the target evidence.

Or, the terminal device controls the screen recording module to collect the target evidence according to the screen recording method, and at the same time, the terminal device generates a string file corresponding to the target evidence, and the string file is used to generate the screen recording of the target evidence. In this embodiment, the target evidence is the evidence locally generated in the terminal device. For example, chat records and other information generated and displayed on electronic devices.

Or, the terminal device controls the screenshot module to collect the target evidence according to the screenshot method, and at the same time, the terminal device generates a string file corresponding to the target evidence, and the string file is used to generate a screenshot of the target evidence. In this embodiment, the target evidence is the evidence locally generated in the terminal device. For example, chat records, shopping records and other information generated and displayed on electronic devices.

The file type of the target forensic file is one of pictures, videos, audio recordings, screen recordings and screenshots.

In some embodiments, if the forensics method includes discontinuous forensics and continuous forensics.

The discontinuous forensics include taking pictures and taking screenshots.

Among them, continuous evidence collection includes video collection, audio recording and screen recording.

In some embodiments, if the forensics method is taking pictures by taking pictures in discontinuous forensics, then step S230A specifically includes:

Control the photographing module to photograph the target evidence, and generate the first character string file corresponding to the target evidence;

The file type of the first target forensic file is a picture.

Specifically, if the evidence collection method is to obtain evidence by taking a photo, the final storage form of the target evidence is a photo, and the photo belongs to a discontinuous file. The terminal device obtains, according to the forensics instruction, that the forensics method is to take pictures for evidence, calls its own camera module to capture the target evidence, and generates a first character string file corresponding to the target evidence.

The first string file is used to generate a first target forensic file whose file type is a picture file.

In some embodiments, if the evidence collection method is to obtain evidence by video recording in the continuous evidence collection, step S230A specifically includes:

The file type of the second target forensic file is a video file.

Specifically, if the evidence collection method is to obtain evidence by video recording, the final storage form of the target evidence is video recording, which is a continuous file. The terminal device obtains, according to the forensics instruction, that the forensics method is to obtain evidence by video recording, and calls its own camera module to record the target evidence, and generates a second character string file corresponding to the target evidence.

The second string file is used to generate a second target forensic file whose file type is a video file.

In some embodiments, if the evidence collection method is to obtain evidence by recording in the continuous evidence collection, step S230A specifically includes:

The file type of the third target forensic file is an audio file.

Specifically, if the evidence collection method is to obtain evidence by recording, the final storage form of the target evidence is recording, and the recording is a continuous file. The terminal device obtains according to the forensics instruction that the forensics method is to obtain evidence by recording, and calls its own recording module to record the target evidence, and generates a third string file corresponding to the target evidence.

The third string file is used to generate a third target forensic file whose file type is an audio file or a recording file.

In some embodiments, if the forensics method is to obtain evidence by screen recording in the continuous forensics, step S230A specifically includes:

The file type of the fourth target forensic file is a screen recording file.

Target evidence is generated locally by the end device.

Specifically, if the evidence collection method is to obtain evidence by means of screen recording, the final storage form of the target evidence is screen recording, and the recording screen belongs to a continuous file. The terminal device obtains, according to the forensics instruction, that the forensics method is to obtain evidence by screen recording, and invokes its own screen recording module to record the target evidence, and generates a fourth string file corresponding to the target evidence.

The specific operations of the screen recording are: determine the target evidence as the recording object; record the screen display content and audio source of the target evidence to form a screen recording file.

The fourth string file is used to generate a fourth target forensic file whose file type is a screen recording file.

In some embodiments, if the forensics method is to take screenshots in discontinuous forensics, step S230A specifically includes:

Control the screenshot module to take screenshots of the target evidence, and generate the fifth string file of the target evidence,

The fifth string file is used to generate the fifth target forensics file corresponding to the target evidence,

The file type of the fifth target forensic file is a screenshot file,

Target evidence is generated locally by the end device.

Specifically, if the evidence collection method is to obtain evidence by means of screenshots, the final storage form of the target evidence is screenshots, and the screenshots belong to discontinuous files. The terminal device obtains, according to the forensics instruction, that the forensics method is to take screenshots, and invokes its own screen capture module to take screenshots of the target evidence, and generates a fifth string file corresponding to the target evidence.

The fifth string file is used to generate a fifth target forensic file whose file type is a screenshot file.

In some embodiments, if the evidence collection method is continuous evidence collection, step S300A specifically includes:

The string file corresponding to the target evidence includes consecutively obtained substring files; and

Specifically, if the forensics method is continuous forensics, the target forensics files corresponding to the target evidence are continuous files, such as video, screen recording, and audio. Therefore, the terminal equipment collects target evidence through continuous forensics within a period of time. The generated string file is also composed of substring files obtained at each acquisition moment. In this embodiment, the substring files and corresponding subforensic parameters obtained at each collection moment will be sent by the terminal device to the server in real time. The sub-forensics parameters include the time of collection and/or the geographic location information at the time of collection.

Of course, the present disclosure can also use the completion time as the forensic time information after the target evidence collection is completed. Before the collection is not completed, the sub-forensic parameters are not sent, and only the sub-string file is sent in real time. When the collection is completed, the last sub-character The forensic parameters are carried after the string file.

Because when the forensics method is continuous forensics, the string file corresponding to the target evidence is a continuous stream file. In order to prevent the substring file from being stored in the terminal device and prevent users from tampering, it is necessary to store the substring file in the string file. It is sent to the server in real time.

The live streaming technology specifically refers to the substring file corresponding to the video, audio or screen recording collected in real time by the terminal device in the form of push stream, from the start of recording, from the terminal device to the server in real time, until the end of forensics.

Specifically, the terminal device calls the mobile live streaming SDK, and transmits the string file corresponding to the video or audio recording or screen recording to the server in real time. Mobile live streaming is a mobile live streaming service, which is an extension of the live streaming service and mobile scenarios. The data obtained from the video or audio recording or screen recording of the terminal device can be transmitted to the server in the form of streaming.

In some embodiments, the forensic parameters include forensic time information and/or forensic space information when the target evidence is collected.

The acquisition method of latitude and longitude is as follows: the user registers an authentication account on the location service platform through the terminal device, creates a new application for the platform service of the Android system or IOS system, and obtains the corresponding AppKey and AppSecret.

When collecting the target evidence or after completing the target evidence collection, the terminal device uses the AppKey and AppSecret to call the API of the location service platform to obtain the latitude and longitude from the location service platform.

In certain embodiments, the present disclosure provides a tamper-resistant forensic system comprising:

In certain embodiments, the present disclosure provides a tamper-resistant forensic apparatus, applied to terminal equipment, comprising:

The instruction receiving module 100A is used to receive the forensic instruction;

A string file acquisition module 200A, configured to collect target evidence in response to a forensics instruction, and obtain a string file corresponding to the target evidence;

A parameter acquisition module 300A, used to acquire forensic parameters when collecting target evidence; and

The first sending module 400A is configured to bind the character string file corresponding to the target evidence with the corresponding forensic parameters and send it to the server.

In certain embodiments, the present disclosure provides a tamper-resistant forensic device, applied to a server, comprising:

The receiving module 100B is used to receive the character string file of the target evidence sent by the terminal device and the corresponding forensic parameters;

A forensic file generation module 200B, configured to generate a corresponding target forensic file according to the character string file of the target evidence;

The calculation module 300B is used to obtain the hash value of the target forensic file by adopting a hash algorithm;

The second sending module 400B is used to bind the hash value of the target evidence with the forensic parameters, and then send it to the blockchain to store the evidence on the chain.

FIG. 3 is a sequence diagram of a tamper-proof forensics method provided by an embodiment of the present disclosure. Referring to FIG. 3 , the terminal device initiates non-persistent forensics, collects target evidence in a non-persistent forensics manner, and generates a string file. The terminal device requests the latitude and longitude from the location service platform through the latitude and longitude interface of the location service platform, and the location service platform returns the latitude and longitude to the terminal device through the latitude and longitude interface. The terminal device organizes the forensic evidence to send the string file, the forensic latitude and longitude, and the forensic time to the server. The server receives the string file, the forensic latitude and longitude, and the forensic time, generates the target forensic file according to the string file, and obtains the hash value of the target forensic file. The server sends the hash value, forensic latitude and longitude, and forensic time of the target forensic file to the blockchain for storage.

FIG. 4 is a sequence diagram of a tamper-proof forensics method provided by another embodiment of the present disclosure. Referring to Figure 4, the terminal device initiates continuous forensics, collects target evidence in continuous forensics, generates substring files in real time, calls the mobile live streaming SDK, and sends the substring files to the server in real time in the form of streaming. When the terminal device completes the collection and forensics, it requests the latitude and longitude from the location service platform through the latitude and longitude interface of the location service platform, and the location service platform returns the latitude and longitude to the terminal device through the latitude and longitude interface. The terminal device also sends a forensics completion instruction to the server when the forensics collection is completed. The terminal device organizes the forensic evidence, obtains the longitude, latitude and forensic time and sends it to the server. When the server side receives the forensics completion instruction, it obtains a string file according to the substring file obtained in real time, generates a target forensics file according to the string file, and obtains the hash value of the target forensics file. At the same time, the server obtains the forensic latitude and longitude and the forensic time. The server sends the obtained hash value of the target forensic file, forensic latitude and longitude, and forensic time to the blockchain for storage.

The terminal device of the present disclosure is installed with a mobile terminal application APP, which realizes the use of the collection and forensics module of the terminal device to collect evidence such as taking pictures and videos. When the user completes taking pictures or videos, the evidence files are not stored in the mobile phone, but are directly transmitted to the backend server. , to prevent malicious tampering by the user after the evidence is generated in the mobile phone and transmitted to the server. At the same time, after the evidence is uploaded to the backend server, the corresponding evidence file is immediately hashed and stored on the chain. Let the evidence be prevented from being tampered with during the process from generation to on-chain deposit. The present disclosure prevents evidence from being tampered with after being stored, so as to achieve the effect of preserving evidence and ensuring the authenticity of evidence.

In certain embodiments, an electronic device is provided that includes a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor executing the computer program to perform the steps of: receiving a forensic instruction, responsive to forensic The instruction collects the target evidence, obtains the string file corresponding to the target evidence, and obtains the forensics parameters when collecting the target evidence, binds the string file corresponding to the target evidence and the forensics parameters and sends it to the server.

In some embodiments, the present disclosure provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor, where the processor implements the following steps when executing the computer program: receiving an information sent by a terminal device. The string file and forensics parameters of the target evidence, generate the corresponding target forensics file according to the string file of the target evidence, use the hash algorithm to obtain the hash value of the target forensics file, and bind the hash value of the target evidence to the forensics parameters After that, it is sent to the blockchain for on-chain deposit.

When the processor executes the computer program, the tamper-proof forensic method of the present disclosure is also implemented.

In certain embodiments, the present disclosure provides a computer-readable storage medium having a computer program stored thereon, and the computer program, when executed by a processor, implements the steps of: receiving a forensic instruction, acquiring target evidence in response to the forensic instruction, and acquiring target evidence The corresponding string file and the forensic parameters when collecting the target evidence are obtained, and the string file corresponding to the target evidence and the forensic parameters are bound and sent to the server.

In some embodiments, the present disclosure provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the following steps: receiving a string file and forensic parameters of the target evidence sent by the terminal device, Generate the corresponding target forensic file according to the string file of the target evidence, use the hash algorithm to obtain the hash value of the target forensic file, bind the hash value of the target evidence with the forensic parameters, and send it to the blockchain for uploading. Evidence.

The computer program also implements the tamper-resistant forensic method of the present disclosure when executed by the processor.

It should be noted that, in this document, relational terms such as "first" and "second" etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these There is no such actual relationship or sequence between entities or operations. Moreover, the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device that includes a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in a process, method, article or apparatus that includes the element.

The above descriptions are only specific embodiments of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure is not to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

A tamper-proof forensics method, applied to a terminal device, includes:

receive forensic instructions;

collecting target evidence in response to the forensic instruction, obtaining a character string file corresponding to the target evidence, and obtaining forensic parameters when collecting the target evidence; and

The string file corresponding to the target evidence and the forensic parameters are bound and sent to the server.
The method of claim 1, wherein the forensic parameters include forensic time information and/or forensic space information when the target evidence is collected.
The method according to claim 1 or 2, wherein the acquiring target evidence in response to the forensic instruction, acquiring a character string file corresponding to the target evidence comprises:

Obtain the forensics method used to collect the target evidence according to the forensics instruction;

Determine the forensic collection module to be invoked according to the forensic method; and

controlling the forensic collection module to collect the target evidence according to the forensics method, and generate a character string file corresponding to the target evidence;

The character string file corresponding to the target evidence is used to generate a target forensics file corresponding to the target evidence, and the file type of the target forensics file is related to the forensics method.
The method of claim 3, wherein

If the forensics method is to collect evidence by taking pictures in discontinuous forensics, the control of the forensics collection module to collect the target evidence according to the evidence collection method, and to generate a character string file corresponding to the target evidence, including:

Controlling the photographing module to photograph the target evidence, and generating a first character string file corresponding to the target evidence,

wherein the first character string file is used to generate the first target forensic file corresponding to the target evidence,

The file type of the first target forensic file is a picture;

If the forensics method is to collect evidence by video recording in the continuous evidence collection, then the control of the forensic collection module to collect the target evidence according to the evidence collection method, and generating the character string file corresponding to the target evidence includes:

Controlling the camera module to record the target evidence, and generating a second character string file corresponding to the target evidence,

wherein the second string file is used to generate a second target forensic file corresponding to the target evidence,

The file type of the second target forensic file is a video recording file;

If the forensic collection method is to collect evidence by recording in the continuous forensics collection, the control of the forensic collection module to collect the target evidence according to the evidence collection method, and the generation of the character string file corresponding to the target evidence includes:

Control the recording module to record the target evidence, and generate the third string file of the target evidence,

wherein the third string file is used to generate a third target forensics file corresponding to the target evidence,

The file type of the third target forensic file is an audio file;

If the forensics method is to obtain evidence by screen recording in continuous forensics, the control of the forensics collection module to collect the target evidence according to the evidence collection method, and the generation of a string file corresponding to the target evidence includes:

controlling the screen recording module to record the target evidence, and generating a fourth string file of the target evidence,

The fourth character string file is used to generate a fourth target forensic file corresponding to the target evidence,

The file type of the fourth target forensic file is a screen recording file,

The target evidence is generated by the terminal device.
A method as claimed in any one of claims 1 to 4, wherein

If the forensics method is continuous forensics, the method of binding the string file corresponding to the target evidence and the forensics parameters and sending it to the server includes:

Using live streaming technology, the continuous substring file corresponding to the target evidence and the bound sub-forensics parameters are sent to the server in real-time in the form of streaming;

The character string file corresponding to the target evidence includes continuously acquired substring files;

The sub-forensics parameters are forensic parameters when acquiring the corresponding substring file.
A tamper-proof forensics method, applied to the server side, includes:

Receive the string file of the target evidence sent by the terminal device and the corresponding forensic parameters;

Generate a corresponding target forensic file according to the string file of the target evidence;

using a hash algorithm to obtain a hash value of the target forensic file; and

After binding the hash value of the target evidence and the forensic parameters, it is sent to the blockchain for on-chain evidence storage.
A tamper-resistant forensic system that includes:

The terminal device is used to receive a forensic instruction, collect target evidence in response to the forensic instruction, acquire a corresponding string file, and acquire forensic parameters when collecting the target evidence, and associate the string file corresponding to the target evidence with the corresponding forensics The parameters are bound and sent to the server; and

The server side is configured to receive the string file of the target evidence and the corresponding forensic parameters sent by the terminal device, generate the corresponding target forensics file according to the string file of the target evidence, and use a hash algorithm to obtain the The hash value of the target forensics file, after binding the hash value of the target evidence and the forensics parameters, send it to the blockchain for on-chain evidence storage.
A tamper-proof forensics device, applied to terminal equipment, the device includes:

The instruction receiving module is used to receive the forensic instruction;

a string file acquisition module, configured to collect target evidence in response to the forensic instruction, and obtain a string file corresponding to the target evidence;

A parameter acquisition module, used to acquire forensic parameters when collecting target evidence; and

The first sending module is configured to bind the character string file corresponding to the target evidence with the corresponding forensic parameters and send it to the server.
A tamper-proof forensics device, applied to a server, the device includes:

The receiving module is used to receive the string file of the target evidence sent by the terminal device and the corresponding forensic parameters;

A forensics file generation module, used for generating a corresponding target forensics file according to the character string file of the target evidence;

A calculation module, used for adopting a hash algorithm to obtain the hash value of the target forensic file; and

The second sending module is used to bind the hash value of the target evidence with the forensic parameters, and send it to the blockchain to store the evidence on the chain.
A computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, wherein when the computer program is executed by the processor, the processor causes the processor to execute the tamper-proof forensics method according to any one of claims 1 to 6.
An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the tamper-resistant forensics described in any one of claims 1 to 6 when the processor executes the program method.