Specific embodiment
To keep the purposes, technical schemes and advantages of the application clearer, below in conjunction with the application specific embodiment and
Technical scheme is clearly and completely described in corresponding attached drawing.Obviously, described embodiment is only the application one
Section Example, instead of all the embodiments.Based on the embodiment in the application, those of ordinary skill in the art are not doing
Every other embodiment obtained under the premise of creative work out, shall fall in the protection scope of this application.
Below in conjunction with attached drawing, the technical scheme provided by various embodiments of the present application will be described in detail.
It is implemented to solve existing internet infringement evidence obtaining scheme, notary public is needed to participate in, it is time-consuming and laborious
Problem with high costs, this specification embodiment provide a kind of record screen evidence collecting method based on block chain.This specification embodiment
The executing subject of the method for offer can be, but not limited to record screen evidence obtaining software etc. and can be configured as executing the embodiment of the present invention mention
At least one of party's subtraction unit of confession.
For ease of description, hereafter executing subject in this way is to be able to carry out for the record screen evidence obtaining software of this method,
The embodiment of this method is introduced.It is appreciated that it is that one kind is shown that the executing subject of this method, which is record screen evidence obtaining software,
The explanation of example property, is not construed as the restriction to this method.
Specifically, a kind of reality for record screen evidence collecting method based on block chain that this specification one or more embodiment provides
Existing flow diagram is as shown in Figure 1, comprising:
Step 110, it is requested in response to the starting for shielding evidence obtaining software to record, starts screen recording function on destination host;
Optionally, the starting for shielding evidence obtaining software to record is requested, and can be by the infringed or the personnel of judiciary etc.
What the evidence obtaining personnel of infringement evidence initiated.In order to guarantee record screen evidence obtaining process not by the interference of other factors, this specification is implemented
It is executed in the virtual machine that record screen evidence obtaining process in example can create in cloud platform, that is to say, that destination host can be cloud
The virtual machine created in platform.
Step 120, the operating status of destination host is obtained, which includes safe condition;
Optionally, in order to improve the confidence level that file is shielded in record, this specification embodiment is loaded in the address to infringement resource
Resource carry out record screen before, the safe condition of destination host can also be obtained, it can pass through the peace on operational objective host
Total inspection software, such as antivirus software, determine whether destination host invades the insecurity factors such as wooden horse, virus and lead to recording
Record screen file trust reduces.Specifically, the operating status of destination host is obtained, comprising:
Search for the safety inspection software in destination host;
Start the security check function in the safety inspection software in destination host, to obtain the safe shape of destination host
State.
It should be understood that the security check function in the safety inspection software in starting destination host, and complete safety inspection
After looking into, it will usually show safety inspection result in the display interface of the safety inspection software of destination host.If destination host
In there is no insecurity factor, then can prompt the printed words such as " safety " or " security level is higher ";And if occurring not in destination host
Safety factor can then prompt the printed words such as " danger " or " security level is lower ".In order to accurately obtain the safety inspection of destination host
The safety inspection of software is looked into as a result, can judge that this is aobvious by the display interface of image recognition technology poll safety inspection software
Show in interface with the presence or absence of printed words such as " safety ", " security level is higher ", " danger " and " security level is higher ".
Optionally, in order to guarantee that destination host can normally access the address of infringement resource, to obtain infringement evidence, this theory
Operating status in bright book embodiment further includes network connection state, obtains the operating status of destination host, comprising:
Start the host file of destination host, whether there is infringement resource in the host file of the determination destination host
Address and ip mapping relations, it is described infringement resource address by the starting request carrying;
If obtaining target master there is no the mapping relations of the address of infringement resource and ip in the host file of destination host
The network connection state of machine.
It should be understood that the mapping for being typically stored with the higher domain name addresses of destination host visitation frequency and ip in host file is closed
System, to improve the domain name mapping speed of the higher domain name addresses of these visitation frequencies, and since the infringement address of infringement resource is logical
It is often to be accessed in destination host for the first time, address and the ip of infringement resource will not be then preserved in the host file of the destination host
Mapping relations.It therefore, can be by starting the host file of destination host, to determine in the host file whether existing invade
The address of resource and the mapping relations of ip are weighed, if the address of infringement resource and the mapping relations of ip are not present in the host file,
Then show that the destination host not over the mapping relations for the address and ip for adding infringement resource in host file, provides infringement
It is forged the address in source.
It, can be by starting cmd.exe, and in the window of pop-up if the host file of destination host is normally started
The domain name addresses for inputting ipconfig and tracert+ infringement resource determines the address ip and the target master of destination host respectively
The address ip of machine to infringement resource domain name addresses between routing condition.In practical applications, it is inputted in the window of pop-up
After the domain name addresses of ipconfig and tracert+ infringement resource, the content shown in the window of pop-up can be intercepted, is passed through
Image recognition technology come obtain destination host the address ip and destination host the address ip to infringement resource domain name addresses it
Between routing condition.
Optionally, in order to further confirm that destination host operating status confidence level, operating status further includes time shape
State obtains the operating status of destination host, comprising:
Access the address at time calibration in network center;
On the corresponding page in address at time calibration in network center, the time state of destination host is obtained.
Specifically, it may search for and open the browser of destination host, and input time calibration in network center in a browser
Address, for example can be the address at China national time service center, and on the corresponding page in the address at time calibration in network center, it intercepts
The temporal information of display obtains the time state of destination host finally by image recognition technology.
Step 130, after the operating status for obtaining destination host, access starts the target infringement resource carried in request
Address;
After the operating status for obtaining destination host, it can input in starting request and take in the browser of destination host
The address of the target infringement resource of band, the resource in address to load target infringement resource.
Step 140, after the completion of the resource in the address of target infringement resource loads, terminate screen recording, and generate record
Shield file;
Optionally, since the resource type in webpage includes a variety of, for example the formats such as picture, video, voice, text is interior
Hold, in order to ensure the resource in the address of the infringement resource in the recorded file of acquisition can be by completely typing, this specification
Record screen evidence obtaining software in embodiment can detecte the load progress of the resource in the address of infringement resource, and in infringement resource
When the load progress of resource in address is completed, terminate screen recording.By taking video resource as an example, if the address of target infringement resource
In resource include video resource, after the completion of resource load in the address of target infringement resource, terminate screen recording, and raw
Cheng Luping file, comprising:
When the playback progress of video resource in the address of target infringement resource is completed, terminate screen recording, and generate
Record screen file.
It should be understood that video resource is when playing, it will usually playing progress bar is shown, in order to protect in the record screen file of generation
Complete video resource is stayed, the record screen evidence obtaining software in this specification embodiment can be in the address for detecting target infringement resource
In video resource playback progress complete when, terminate screen recording, and generate record screen file.
Step 150, the Hash information of record screen file is uploaded in block chain.
It should be understood that the Hash information of record screen file, refers to and passes through the cryptographic Hash that keyed Hash function obtains to record screen file.
Keyed Hash function, for example, the SHA-256HASH algorithm in bit coin, the KECCAK-256HASH algorithm in ether mill, etc..
It should be understood that the Hash information of file is shielded in record in the embodiment of the present application, it can be and a Hash is carried out to record screen file
The cryptographic Hash that operation obtains, or pass through the cryptographic Hash that twice or repeatedly Hash operation obtains.
Optionally, in order to improve the confidence level that file is shielded in record, the Hash information that will record screen file is uploaded in block chain, is wrapped
It includes:
Obtain at the time of the Hash information, the information of destination host, starting screen recording function of file are shielded in record and terminate screen
At the time of curtain recording function;Wherein, the information of destination host includes the hardware device of the IP address of destination host, destination host
Identifier;
Will the record screen Hash information of file, the information of destination host, starting screen recording function at the time of and terminate screen
It is packaged at the time of recording, to obtain the file after being packaged;
File after packing is uploaded in block chain.
It optionally, is the Hash information convenient for quickly searching record screen file from block chain, in the Hash that will record screen file
After information is uploaded in block chain, the method also includes:
Obtain the block address of the Hash information for the storage record screen file that block chain returns.
Optionally, in order to block chain return storage record screen file Hash information block address and record screen file into
Row backup, after obtaining the block address of Hash information for the storage record screen file that block chain returns, the method is also
Include:
Block address and record screen file are associated;
Block address after association is stored with record screen file into default cloud storage space.
It should be understood that this is default for the ease of obtaining the block address being stored in default cloud storage space and record screen file
Cloud storage space also produces and returns based on after storage association after storing the block address after association and record screen file
Block address and record screen file storage address generate access address.
As shown in Fig. 2, applying the schematic diagram in actual scene for the method that this specification embodiment provides, comprising:
S21, infringer starts record screen evidence obtaining software on the destination host of cloud platform, and submits the network address of infringement resource,
So that record screen evidence obtaining software starts screen recording function;
S22, record screen evidence obtaining software obtain the operating status of destination host, specifically include:
S221, the safety inspection software that record screen is collected evidence on software search destination host, and start the safety inspection software
Security check function passes through after the security check function of the safety inspection software is completed to the safety inspection of destination host
Image recognition technology obtain the safety inspection of the safety inspection software as a result, the i.e. destination host safe condition;
S222, the host file in evidence obtaining software search destination host is shielded in record, and opens the host file, if the host is literary
There is no the mapping relations of the address of infringement resource and ip in part, then show the network address of infringement resource not in destination host
Host file addition domain name and ip pairs of mode be maliciously tampered, at this point, record screen evidence obtaining software opened in destination host
Cmd.exe executes ipconfig and tracert respectively to obtain the road of the address ip of destination host and the network address to infringement resource
By situation;
S223, record screen evidence obtaining software starts the browser in destination host, and inputs the address at time calibration in network center, such as
China national time service center, to obtain the trusted time information for recording screen evidence obtaining;
S23, the network address of record screen evidence obtaining software input infringement resource in the browser in destination host;
S24, record screen evidence obtaining software then terminate to shield after the corresponding resource load of network address for detecting infringement resource is completed
Curtain is recorded, and generates record screen file;
S25, record screen evidence obtaining software calculate record screen file cryptographic Hash, and by the cryptographic Hash of the record screen file, record screen the time,
(wherein, which can be stored in preset cloud storage space, the storage of the record screen file for the storage position of record screen file
Address can be returned to obtain by preset cloud storage space) and the address destination host ip be packaged, then will be on the file after packing
It reaches in block chain.
Cryptographic Hash and its relevant information (such as the record screen time, record screen file of record screen file are searched for the ease of the later period
Storage position and destination host ip), record shield evidence obtaining software the file after packing is uploaded in block chain after, the record screen
Evidence obtaining software can also receive the block address of block chain return.It should be understood that the corresponding area of block address that the block chain returns
Block is used to store the cryptographic Hash and its relevant information of record screen file.
When carrying out record screen evidence obtaining, it is able to respond and is requested in the starting for shielding evidence obtaining software to record, started on destination host
The operating statuses such as screen recording function, then the safe condition that obtains destination host, the operating status for obtaining destination host it
Afterwards, the address of the target infringement resource carried in access starting request, and can be in the resource in the address that target encroaches right resource
After the completion of load, terminate screen recording, generates record screen file, the Hash information of the record screen file is finally uploaded to block chain
In.
On the one hand, the generation method of the feature and Hash information that can not be distorted based on the information recorded in block chain is not
It is authentic and valid can to verify its by its Hash information when using the record screen file as infringement evidence in the later period for reversible feature
Property, improve the confidence level of the infringement evidence of acquisition;On the other hand, record screen file also carries out the operating status of destination host
Record, if the bright destination host of the Running Status Table be it is safe and reliable, can further increase record screen file confidence level, thus
Reliability of the record screen file as infringement evidence can be realized independent of notary public, while also greatly simplifying evidence obtaining stream
Journey reduces evidence obtaining cost.
Fig. 3 is the structural schematic diagram for the record screen apparatus for obtaining evidence 300 based on block chain that this specification embodiment provides.It please join
Fig. 3 is examined, in a kind of Software Implementation, the record screen apparatus for obtaining evidence 300 based on block chain may include start unit 301, obtain
Unit 302, access unit 303, generation unit 304 and uploading unit 305, in which:
Start unit 301 requests in response to the starting for shielding evidence obtaining software to record, starts screen recording function on destination host
Energy;
Acquiring unit 302, obtains the operating status of the destination host, and the operating status includes safe condition;
Access unit 303 carries in the access starting request after the operating status for obtaining the destination host
The address of target infringement resource;
Generation unit 304 terminates screen recording after the completion of the resource in the address of target infringement resource loads,
And generate record screen file;
The Hash information of the record screen file is uploaded in block chain by uploading unit 305.
The record screen apparatus for obtaining evidence based on block chain provided using this specification embodiment, on the one hand, based in block chain
The irreversible feature of generation method for the feature and Hash information that the information of record can not distort, can use in the later period should
Its real effectiveness verified by its Hash information when record screen file is as infringement evidence, improve the infringement evidence of acquisition can
Reliability;On the other hand, record screen file also records the operating status of destination host, if Running Status Table improving eyesight mark master
Machine be it is safe and reliable, then can further increase record screen file confidence level, so as to independent of notary public realize record
Shield reliability of the file as infringement evidence, while also greatly simplifying forensics process, reduces evidence obtaining cost.
Optionally, in one embodiment, the acquiring unit 302, is used for:
Search for the safety inspection software in the destination host;
Start the security check function in the safety inspection software in the destination host, to obtain the destination host
Safe condition.
Optionally, in one embodiment, the operating status further includes network connection state, the acquiring unit
302, it is used for:
Start the host file of the destination host, whether there is infringement in the host file of the determination destination host
It requests to carry by the starting in the address of the address of resource and the mapping relations of ip, the infringement resource;
If obtaining institute there is no the mapping relations of the address of infringement resource and ip in the host file of the destination host
State the network connection state of destination host.
Optionally, in one embodiment, the operating status further includes time state, the acquiring unit 302, is used
In:
Access the address at time calibration in network center;
On the corresponding page in address at the time calibration in network center, the time state of the destination host is obtained.
Optionally, in one embodiment, the uploading unit 305, is used for:
It obtains the Hash information of the record screen file, the information of the destination host, start the screen recording function
At the time of moment and the end screen recording;Wherein, the information of the destination host include the destination host IP address,
The identifier of the hardware device of the destination host;
By the record screen Hash information of file, the information of the destination host, the starting screen recording function when
It carves and terminates to be packaged at the time of the screen recording, to obtain the file after being packaged;
File after the packing is uploaded in block chain.
Optionally, in one embodiment, if the resource in the address of target infringement resource includes video resource,
The generation unit 304, is used for:
When the playback progress of video resource in the address of target infringement resource is completed, terminate screen recording, and
Generate record screen file.
Optionally, in one embodiment, the Hash information of the record screen file is uploaded to area in uploading unit 305
After in block chain, described device further include:
Address acquisition unit 306 obtains the block of the Hash information for the storage record screen file that the block chain returns
Address.
Optionally, in one embodiment, the storage that the block chain returns is obtained in the address acquisition unit 306
After the block address of the Hash information of the record screen file, described device further include:
The block address and record screen file are associated by associative cell 307;
Storage unit 308, by after the association the block address and the record screen file store to default cloud storage
In space.
The method that record screen apparatus for obtaining evidence 300 based on block chain can be realized the embodiment of the method for FIG. 1 to FIG. 2, specifically may be used
With reference to the record screen evidence collecting method based on block chain of FIG. 1 to FIG. 2 illustrated embodiment, repeat no more.
Fig. 4 is the structural schematic diagram for the electronic equipment that one embodiment of this specification provides.Referring to FIG. 4, in hardware
Level, the electronic equipment include processor, optionally further comprising internal bus, network interface, memory.Wherein, memory can
It can include memory, such as high-speed random access memory (Random-Access Memory, RAM), it is also possible to further include non-easy
The property lost memory (non-volatile memory), for example, at least 1 magnetic disk storage etc..Certainly, which is also possible to
Including hardware required for other business.
Processor, network interface and memory can be connected with each other by internal bus, which can be ISA
(Industry Standard Architecture, industry standard architecture) bus, PCI (Peripheral
Component Interconnect, Peripheral Component Interconnect standard) bus or EISA (Extended Industry Standard
Architecture, expanding the industrial standard structure) bus etc..The bus can be divided into address bus, data/address bus, control always
Line etc..Only to be indicated with a four-headed arrow in Fig. 4, it is not intended that an only bus or a type of convenient for indicating
Bus.
Memory, for storing program.Specifically, program may include program code, and said program code includes calculating
Machine operational order.Memory may include memory and nonvolatile memory, and provide instruction and data to processor.
Processor is from the then operation into memory of corresponding computer program is read in nonvolatile memory, in logical layer
The record screen apparatus for obtaining evidence based on block chain is formed on face.Processor executes the program that memory is stored, and is specifically used for executing
It operates below:
It is requested in response to the starting for shielding evidence obtaining software to record, starts screen recording function on destination host;
The operating status of the destination host is obtained, the operating status includes safe condition;
After the operating status for obtaining the destination host, the target infringement resource carried in the starting request is accessed
Address;
After the completion of resource in the address of target infringement resource loads, terminate screen recording, and generates record screen text
Part;
The Hash information of the record screen file is uploaded in block chain.
When carrying out record screen evidence obtaining, it is able to respond and is requested in the starting for shielding evidence obtaining software to record, started on destination host
The operating statuses such as screen recording function, then the safe condition that obtains destination host, the operating status for obtaining destination host it
Afterwards, the address of the target infringement resource carried in access starting request, and can be in the resource in the address that target encroaches right resource
After the completion of load, terminate screen recording, generates record screen file, the Hash information of the record screen file is finally uploaded to block chain
In.
On the one hand, the generation method of the feature and Hash information that can not be distorted based on the information recorded in block chain is not
It is authentic and valid can to verify its by its Hash information when using the record screen file as infringement evidence in the later period for reversible feature
Property, improve the confidence level of the infringement evidence of acquisition;On the other hand, record screen file also carries out the operating status of destination host
Record, if the bright destination host of the Running Status Table be it is safe and reliable, can further increase record screen file confidence level, thus
Reliability of the record screen file as infringement evidence can be realized independent of notary public, while also greatly simplifying evidence obtaining stream
Journey reduces evidence obtaining cost.
The record screen evidence collecting method based on block chain disclosed in the above-mentioned FIG. 1 to FIG. 2 illustrated embodiment such as this specification can answer
It is realized in processor, or by processor.Processor may be a kind of IC chip, the processing energy with signal
Power.During realization, each step of the above method can pass through the integrated logic circuit or software of the hardware in processor
The instruction of form is completed.Above-mentioned processor can be general processor, including central processing unit (Central Processing
Unit, CPU), network processing unit (Network Processor, NP) etc.;It can also be digital signal processor (Digital
Signal Processor, DSP), specific integrated circuit (Application Specific Integrated Circuit,
ASIC), field programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic
Device, discrete gate or transistor logic, discrete hardware components.It may be implemented or execute this specification one or more
Disclosed each method, step and logic diagram in embodiment.General processor can be microprocessor or the processor
It can be any conventional processor etc..The step of method in conjunction with disclosed in this specification one or more embodiment, can be straight
Connect and be presented as that hardware decoding processor executes completion, or in decoding processor hardware and software module combination executed
At.Software module can be located at random access memory, and flash memory, read-only memory, programmable read only memory or electrically-erasable can
In the storage medium of this fields such as programmable memory, register maturation.The storage medium is located at memory, and processor reads storage
Information in device, in conjunction with the step of its hardware completion above method.
The electronic equipment can also carry out the record screen evidence collecting method based on block chain of FIG. 1 to FIG. 2, and this specification is herein no longer
It repeats.
Certainly, other than software realization mode, other implementations are not precluded in the electronic equipment of this specification, such as
Logical device or the mode of software and hardware combining etc., that is to say, that the executing subject of following process flow is not limited to each
Logic unit is also possible to hardware or logical device.
The embodiment of the present application also proposed a kind of computer readable storage medium, the computer-readable recording medium storage one
A or multiple programs, the one or more program include instruction, and the instruction is when by the portable electronic including multiple application programs
When equipment executes, the portable electronic device can be made to execute the record screen evidence collecting method of embodiment illustrated in fig. 1, and be specifically used for holding
The following operation of row:
It is requested in response to the starting for shielding evidence obtaining software to record, starts screen recording function on destination host;
The operating status of the destination host is obtained, the operating status includes safe condition;
After the operating status for obtaining the destination host, the target infringement resource carried in the starting request is accessed
Address;
After the completion of resource in the address of target infringement resource loads, terminate screen recording, and generates record screen text
Part;
The Hash information of the record screen file is uploaded in block chain.
In short, being not intended to limit the protection of this specification the foregoing is merely the preferred embodiment of this specification
Range.With within principle, made any modification, changes equivalent replacement all spirit in this specification one or more embodiment
Into etc., it should be included within the protection scope of this specification one or more embodiment.
System, device, module or the unit that above-described embodiment illustrates can specifically realize by computer chip or entity,
Or it is realized by the product with certain function.It is a kind of typically to realize that equipment is computer.Specifically, computer for example may be used
Think personal computer, laptop computer, cellular phone, camera phone, smart phone, personal digital assistant, media play
It is any in device, navigation equipment, electronic mail equipment, game console, tablet computer, wearable device or these equipment
The combination of equipment.
Computer-readable medium includes permanent and non-permanent, removable and non-removable media can be by any method
Or technology come realize information store.Information can be computer readable instructions, data structure, the module of program or other data.
The example of the storage medium of computer includes, but are not limited to phase change memory (PRAM), static random access memory (SRAM), moves
State random access memory (DRAM), other kinds of random access memory (RAM), read-only memory (ROM), electric erasable
Programmable read only memory (EEPROM), flash memory or other memory techniques, read-only disc read only memory (CD-ROM) (CD-ROM),
Digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape magnetic disk storage or other magnetic storage devices
Or any other non-transmission medium, can be used for storage can be accessed by a computing device information.As defined in this article, it calculates
Machine readable medium does not include temporary computer readable media (transitory media), such as the data-signal and carrier wave of modulation.
It should also be noted that, the terms "include", "comprise" or its any other variant are intended to nonexcludability
It include so that the process, method, commodity or the equipment that include a series of elements not only include those elements, but also to wrap
Include other elements that are not explicitly listed, or further include for this process, method, commodity or equipment intrinsic want
Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including described want
There is also other identical elements in the process, method of element, commodity or equipment.
All the embodiments in this specification are described in a progressive manner, same and similar portion between each embodiment
Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Especially for system reality
For applying example, since it is substantially similar to the method embodiment, so being described relatively simple, related place is referring to embodiment of the method
Part explanation.