CN111143883B

CN111143883B - Digital content evidence obtaining method, device and equipment based on block chain

Info

Publication number: CN111143883B
Application number: CN201911415052.4A
Authority: CN
Inventors: 韩喆; 王春霈
Original assignee: Alipay Hangzhou Information Technology Co Ltd
Current assignee: Alipay Hangzhou Information Technology Co Ltd
Priority date: 2019-12-31
Filing date: 2019-12-31
Publication date: 2021-08-03
Anticipated expiration: 2039-12-31
Also published as: WO2021135641A1; CN111143883A

Abstract

In the digital content forensics method based on the blockchain, a first node receives a forensics task of digital content. And selecting a plurality of second nodes from the plurality of nodes, and sending an execution instruction of the forensics task to each second node in the plurality of second nodes. And receiving a plurality of forensics results returned by the second nodes after the second nodes complete the corresponding forensics tasks. And judging whether the plurality of evidence obtaining results are matched or not. And if the first evidence obtaining result is matched with the first evidence obtaining result, selecting any first evidence obtaining result from the plurality of evidence obtaining results as an evidence storing result. Storing the certificate result in the local storage, and broadcasting the certificate result to other nodes except the first node in the plurality of nodes so that the other nodes store the certificate result after performing consensus verification on the certificate result.

Description

Digital content evidence obtaining method, device and equipment based on block chain

Technical Field

One or more embodiments of the present disclosure relate to the field of computer technologies, and in particular, to a method, an apparatus, and a device for obtaining evidence of digital content based on a blockchain.

Background

In the field of current digital copyright protection, the phenomenon of stealing digital contents such as pictures, videos and the like often occurs. The main reasons are as follows: first, few security mechanisms are available to protect the copyright of digital content, and the processing steps are complicated, the evidence-obtaining means is single, and wide and convenient copyright protection services cannot be provided for all social circles. Secondly, the user can self-evidence that there are many non-standard, non-safe factors, which easily causes the original proper right not to be complained. Therefore, how to effectively evidence digital content becomes a problem to be solved.

In the conventional technology, the forensics of the digital content is usually realized based on a client + server architecture. Taking the digital content as the web screenshot as an example, the evidence obtaining process is as follows: when a client needs to capture a webpage, a request containing the address of the webpage to be captured is sent to the server, then the server captures the webpage and stores the webpage capture on the server. However, in the above process, the request sent by the client to the server and the screenshot saved on the server may be tampered with. Therefore, there is a need to provide a more reliable method of forensics of digital content.

Disclosure of Invention

One or more embodiments of the present specification describe a method, an apparatus, and a device for forensics of digital content based on a blockchain, which can improve the reliability of acquired digital content.

In a first aspect, a block chain-based digital content forensics method is provided, including:

receiving a forensics task for digital content;

selecting a plurality of second nodes from the plurality of nodes, and sending an execution instruction of a forensics task to each second node in the plurality of second nodes;

receiving a plurality of forensics results returned by the second nodes after the second nodes execute the corresponding forensics tasks;

judging whether the plurality of evidence obtaining results are matched or not; if the first evidence obtaining result is matched with the first evidence obtaining result, selecting any first evidence obtaining result from the plurality of evidence obtaining results as an evidence storing result;

and locally storing the evidence storing result, and broadcasting the evidence storing result to other nodes except the first node in the plurality of nodes so that the other nodes store the evidence storing result after performing consensus verification on the evidence storing result.

In a second aspect, a block chain-based digital content forensics method is provided, including:

receiving an execution instruction of a forensics task sent by any first node in the plurality of first nodes;

in response to the execution indication, executing the forensics task to obtain a forensics result;

returning the forensics result to the first node;

receiving a forensics result determined by the first node at least based on the forensics result;

performing consensus verification on the evidence storing results received from the first nodes by adopting a consensus algorithm based on the evidence storing results received from other first nodes;

and if the consensus verification passes, storing the evidence storing result received from the first node.

In a third aspect, a block chain-based digital content forensics apparatus is provided, including:

a receiving unit for receiving a forensic task of digital content;

a selecting unit, configured to select a plurality of second nodes from the plurality of nodes;

the sending unit is used for sending an execution instruction of the evidence obtaining task to each second node in the plurality of second nodes selected by the selecting unit;

the receiving unit is further configured to receive multiple forensics results returned by the second nodes after the second nodes perform the corresponding forensics tasks;

the judging unit is used for judging whether the plurality of evidence obtaining results received by the receiving unit are matched or not;

the selecting unit is further used for selecting any first forensics result from the plurality of forensics results as a forensics result if the first forensics result is matched with the forensics result;

the storage unit is used for locally storing the evidence storing result selected by the selection unit;

the sending unit is further configured to broadcast the certificate storing result to other nodes except the first node in the plurality of nodes, so that the other nodes store the certificate storing result after performing consensus verification on the certificate storing result.

In a fourth aspect, a device for forensics of digital content based on a blockchain is provided, including:

a receiving unit, configured to receive an execution instruction of a forensics task sent by any first node in the plurality of first nodes;

an execution unit, configured to execute the forensics task in response to the execution instruction received by the receiving unit to obtain a forensics result;

a sending unit, configured to return the forensics result to the first node;

the receiving unit is further configured to receive a forensics result determined by the first node at least based on the forensics result;

the consensus unit is used for performing consensus verification on the evidence storing results received from the first nodes by adopting a consensus algorithm based on the evidence storing results received from other first nodes by the receiving unit;

and the storage unit is used for storing the evidence storing result received from the first node if the consensus unit passes the consensus verification.

In a fifth aspect, a blockchain-based digital content forensics apparatus is provided, comprising:

a memory;

one or more processors; and

one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs when executed by the processors implement the steps of:

receiving a forensics task for digital content;

selecting a plurality of second nodes from a plurality of nodes of a block chain, and sending an execution instruction of a forensics task to each second node in the plurality of second nodes;

In a sixth aspect, a blockchain-based digital content forensics apparatus is provided, comprising:

a memory;

one or more processors; and

receiving an execution instruction of a forensics task sent by any first node in a plurality of first nodes of a block chain;

returning the forensics result to the first node;

In one or more embodiments of the present disclosure, a first node in a blockchain is responsible for receiving a forensics task, and after receiving the forensics task, a plurality of second nodes are selected from the blockchain to perform a corresponding forensics task. And then, after receiving the plurality of evidence obtaining results returned by the second nodes, the first node judges whether the plurality of evidence obtaining results are matched, determines a corresponding evidence obtaining result from the plurality of evidence obtaining results under the condition of matching, and issues the evidence obtaining result on the block chain. That is, the scheme provided in this specification can acquire digital content based on a blockchain, thereby ensuring the security and reliability of the forensics process. In addition, in the scheme, the first node in the block chain is set to be responsible for indicating the execution mode of the evidence-obtaining task, so that the computing resource can be greatly saved.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present disclosure, and it is obvious for those skilled in the art to obtain other drawings based on the drawings without creative efforts.

Fig. 1 is a schematic view of an application scenario of a digital content forensics method based on a blockchain provided in the present specification;

fig. 2 is a flowchart of a block chain-based digital content forensics method according to an embodiment of the present disclosure;

fig. 3 is a flowchart of a block chain-based digital content forensics method according to another embodiment of the present disclosure;

fig. 4 is a schematic diagram of a block chain-based digital content forensics apparatus according to an embodiment of the present disclosure;

fig. 5 is a schematic diagram of a digital content forensics apparatus based on a blockchain according to another embodiment of the present disclosure;

fig. 6 is a schematic diagram of a digital content forensics device based on a blockchain according to an embodiment of the present disclosure.

Detailed Description

The scheme provided by the specification is described below with reference to the accompanying drawings.

Before describing the solution provided in the present specification, the inventive concept of the present solution will be explained below.

The block chain technology is an internet database technology and is characterized by decentralization, openness and transparency, no tampering and trustiness. Thus, the present scheme may introduce a block chaining technique.

After introducing the blockchain technique, for nodes in the blockchain, a part of the nodes may be selected to be responsible for broadcasting the forensic task and sending the task execution instruction, and the part of the nodes may also be referred to as a set of committee nodes (or a set of first nodes). It should be noted that the set of committee nodes are periodically replaced, e.g., every hour.

For the task execution node (i.e. the second node) in the blockchain, the corresponding forensics task is executed only when the task execution instruction sent by the valid committee node is received. Therefore, the problem that when any node possibly sends a task execution instruction without distinguishing each node, the computing resources are greatly wasted can be avoided. In addition, the existing blockchain architecture can be compatible (namely, a plurality of core nodes of the blockchain have accounting rights, and other nodes only have verification functions).

In addition, to further ensure the reliability of the forensic content, the committee node may select several nodes from the nodes of the blockchain to perform the corresponding forensic tasks. Here, each of the selected number of nodes may be referred to as a second node. Then, based on the forensics result returned by each of the several nodes, the final forensics result is determined (the determination mode is described later).

After selecting the evidence-saving result, the committee node may broadcast the evidence-saving result on the blockchain. It will be appreciated that for a generic node on the blockchain other than the committee node, it may receive the credentialing results sent by each of a set of committee nodes. Thereafter, it may determine and store the final evidence-saving result from the plurality of evidence-saving results transmitted by each committee node by using a consensus algorithm. Therefore, for the common node, the final stored evidence storing result is subjected to double verification, namely, the committee node is firstly subjected to first verification and then subjected to second verification by a consensus algorithm, so that the correctness and the validity of the evidence storing result can be greatly improved.

The present invention has been made in view of the above-mentioned problems, and it is an object of the present invention to provide a novel and improved method for manufacturing a display device.

Fig. 1 is a schematic view of an application scenario of a digital content forensics method based on a blockchain provided in this specification. In fig. 1, the blockchain may include a plurality of nodes, which may include a set of first nodes. Specifically, the user may issue a forensic task of digital content to a certain first node in the blockchain based on the corresponding client. The first node may then broadcast the forensics task over the blockchain, such that each first node in the set of first nodes may receive the forensics task.

Taking a certain first node in the group of first nodes as an example, after receiving the forensics task, the first node may select a plurality of second nodes from the plurality of nodes of the blockchain, and send an execution instruction of the forensics task to each of the plurality of second nodes. After each second node executes the corresponding forensics task, the corresponding forensics result can be returned to the first node. The first node judges whether the plurality of forensics results are matched. And if the first evidence obtaining result is matched with the first evidence obtaining result, selecting any first evidence obtaining result from the plurality of evidence obtaining results as an evidence storing result. And locally storing the evidence storing result, and broadcasting the evidence storing result to other nodes except the first node in the plurality of nodes so that the other nodes store the evidence storing result after performing consensus verification on the evidence storing result.

Fig. 2 is a flowchart of a block chain-based digital content forensics method according to an embodiment of the present disclosure. The execution subject of the method may be the first node of the block chain in fig. 1. As shown in fig. 2, the method may specifically include:

at step 202, a forensic task for digital content is received.

Here, the forensic task of the digital content may be directly received by the first node from the client, or may be received by the first node when the forensic task is broadcast by another first node on the blockchain.

It should be noted that, when the client sends the forensics task, a corresponding digital signature/certificate may be added. Alternatively, the other first nodes may add corresponding digital signatures/certificates when broadcasting the forensics task. The first node may thus verify the identity of the client or other first node based on the digital signature/certificate, whereby the trustworthiness of the communication between the client and the first node as well as the plurality of first nodes may be ensured.

In step 202, the digital content may include, but is not limited to, a web screenshot, a video file, an audio file, and the like. Taking the web screenshot as an example, the corresponding forensics task may be a screenshot task or a capture task. Taking a video file or an audio file as an example, the corresponding forensics task may be a recording task or the like.

Taking the digital content as the web screenshot as an example, the forensics task may include the uid of the user and the URL address of the web page to be screenshot.

Step 204, selecting a plurality of second nodes from the plurality of nodes of the block chain, and sending an execution instruction of the forensics task to each of the plurality of second nodes.

The second nodes may be selected from all nodes of the blockchain based on a predefined node selection rule, or may be selected from predetermined nodes of the blockchain. The predetermined node here is only responsible for the execution of the forensic task. It will be appreciated that when the plurality of second nodes are selected based on the first manner, the plurality of second nodes may comprise the first node itself. That is, the first node in this specification may also be responsible for the execution of the forensic task. In addition, when the second node is selected from the preset nodes, the selection efficiency of the second node can be greatly improved.

Taking the digital content as the web screenshot as an example, the instruction for performing the forensics task may include the uid of the user and the URL address of the web page to be screenshot. After receiving the execution instruction, any second node may start a docker container based on a docker image file downloaded in advance. And running a pre-packaged browser in the docker container. And loading a webpage to be captured based on the URL address in the running browser, and capturing the screenshot of the webpage to be captured to obtain the webpage screenshot. It can be understood that, in this example, the obtained screenshot of the web page is the forensics result obtained by any one of the second nodes.

It should be noted that, in this specification, the first node is responsible for sending an execution instruction of the forensics task, and therefore, after receiving the execution instruction of the forensics task, any second node may verify the validity of the first node according to a predefined validity verification rule. And if the validity verification is passed, executing a forensics task.

It should be appreciated that when the first node needs to be periodically replaced, the corresponding validity verification rules may also be periodically updated. For example, assume that at t, the validity verification rule is: node id% t is 0, then at t +1, the validity verification rule may be updated as: node id% (t +1) ═ 0.

And step 206, receiving a plurality of forensics results returned by each second node after the corresponding forensics task is completed.

For example, the first node may receive a plurality of web page screenshots sent by a plurality of second nodes selected by the first node.

And step 208, judging whether the plurality of evidence obtaining results are matched.

In one example, the determining process may specifically include: and calculating the similarity between every two evidence obtaining results of the plurality of evidence obtaining results. The plurality of forensic results are divided into at least one group based on similarity between two forensic results of the plurality of forensic results. And judging whether the plurality of forensics results are matched or not based on the number of the forensics results in at least one group. For example, when there is a first packet in the at least one packet whose number of forensic results is greater than the first threshold, it is determined that the plurality of forensic results match.

For example, taking digital content as a web screenshot, the similarity between every two forensics results can be calculated based on image similarity algorithms such as a perceptual hash algorithm, an ORB algorithm, a histogram statistical algorithm and the like.

In addition, the above determination process may have other steps. Taking the digital content as the web screenshot as an example, the method can further include the following steps: and judging whether the attribute information (such as size or height) corresponding to the multiple web page screenshots is equal, and/or judging whether the corresponding screenshot of the multiple evidence obtaining results is matched, and the like. The sub-screen shot herein may be taken based on predefined screen shot rules (e.g., square or rounded areas in the web page where the background color is white). The judgment of whether the sub-screenshots are matched or not can also be realized based on a picture similarity algorithm, attribute information and the like, and the specific judgment process is the same as that described above and is not repeated herein.

Certainly, in practical application, the judgment of whether the multiple evidence obtaining results are matched or not can be directly realized based on whether the corresponding sub-screenshots are matched or not, that is, the scheme only concerns the core content (namely the content corresponding to the sub-screenshots) without requiring that each evidence obtaining result is completely the same, and further the application range or the use scene of the scheme is enlarged.

In this specification, the first node may ensure security and reliability of obtaining the forensic result by selecting a plurality of second nodes to execute the forensic task.

And step 210, if the first evidence obtaining result is matched with the first evidence obtaining result, selecting any first evidence obtaining result from the plurality of evidence obtaining results as an evidence storing result.

Taking the digital content as the web screenshot as an example, if a plurality of web screenshots are matched, any one of the web screenshots can be selected as a final evidence storing result.

It should be noted that if the plurality of forensics results do not match, the first node may broadcast information of forensics failure on the blockchain. Of course, the information may not be broadcast, and the description is not limited thereto. In addition, the first node may select an erroneous forensics result from the plurality of forensics results and determine a second node that transmits the erroneous forensics result. And counting the determined times of sending the wrong evidence obtaining result by the second node. And if the times are larger than a preset threshold value, broadcasting the determined second node on the block chain. Thereby, a function of supervising the second node is realized.

Step 212, storing the certificate result in the local storage, and broadcasting the certificate result to other nodes except the first node in the plurality of nodes, so that the other nodes store the certificate result after performing consensus verification on the certificate result.

Here, the process of the first node storing the certificate result in the local storage may specifically be: and generating the target transaction based on the evidence storing result and the content information related to the evidence storing result. The generated target transaction is stored locally. In an implementation manner, after the first node generates the target transaction, the target transaction may be recorded in a transaction pool, and then the target transaction is written in the transaction details of the block corresponding to the first node together with other transactions. The content information may include any one or more of: the Hash value corresponding to the evidence storing result, the initiator (such as a user id) of the evidence obtaining task, the information of the first node, the information of the second node and the evidence obtaining time.

Further, the other nodes may be classified into two types, where one type is a committee node (i.e., other first node) and the other type is a node other than the committee node (hereinafter, referred to as a common node). For each of the other first nodes, if the forensics result is successfully obtained, that is, if the forensics results obtained by the first node match with the forensics results obtained by the corresponding second nodes, after receiving the forensics result sent by the first node, the first node may not perform any operation. And if the forensic result acquisition thereof fails, that is, if a plurality of forensic results acquired by the corresponding number of second nodes do not match, it performs the same consensus verification operation as the normal node (as described below).

For a normal node, it performs the consensus verification operation as follows. Specifically, the common node receives a plurality of evidence storing results broadcasted by each first node. And then performing consensus verification on the evidence storing results received from the first nodes by adopting a consensus algorithm based on the evidence storing results received from other first nodes. The consensus algorithm herein may include, but is not limited to, a Practical Byzantine Fault Tolerance (PBFT) algorithm, a Proof of Work (POW) algorithm, a Proof of entitlement (POS) algorithm, and a Proof of delegation entitlement (DPOS) algorithm, among others. And if the consensus verification passes, storing the evidence storing result received from the first node. The specific storage process is the same as that of the first node, and is not repeated here.

It should be noted that, for other nodes, when generating corresponding target transactions, the content information related to the evidence-saving result may be sent by the first node together with the evidence-saving result when broadcasting the above-mentioned evidence-saving result.

It should be further noted that, for the evidence storing result stored in the blockchain, if the user or the judicial institution needs to extract or verify the evidence storing result, the user only needs to query or acquire the evidence storing result on the blockchain based on the Hash value corresponding to the evidence storing result.

In summary, in the embodiments of the present specification, since the blockchain has the traceable and tamper-proof characteristics, it is inherently an excellent evidence preservation approach, and therefore after the evidence is generated through the trusted processing link, the evidence is preserved on the same trusted blockchain, so that the value of the evidence can be maximized. In addition, the embodiment of the specification is suitable for obtaining evidence of various types of digital contents, and only different matching mechanisms are required to be set for different types.

The above embodiment is an explanation of the present solution with a first node in a block chain as an execution subject, and the present solution is described below with a second node as an execution subject.

Fig. 3 is a flowchart of a block chain-based digital content forensics method according to another embodiment of the present disclosure. The execution subject of the method may be the second node of the block chain in fig. 1. As shown in fig. 3, the method may specifically include:

step 302, receiving an execution instruction of a forensics task sent by any first node in a plurality of first nodes.

Here, the forensics tasks sent by the client or other first nodes on the blockchain may be received first by the first node described above. And then, the first node selects the second node and sends an execution instruction of the evidence-obtaining task to the second node.

And step 304, responding to the execution instruction, and executing a forensics task to obtain a forensics result.

In one example, the second node may verify the validity of the first node according to a predefined validity verification rule before performing the forensics task. And if the validity verification is passed, executing a forensics task.

Taking the digital content as the web screenshot as an example, the execution instruction of the forensics task may include the uid of the user and the URL address of the web page to be screenshot. After receiving the execution instruction, the second node may start a docker container based on the docker image file downloaded in advance. And running a pre-packaged browser in the docker container. And loading a webpage to be captured based on the URL address in the running browser, and capturing the screenshot of the webpage to be captured to obtain the webpage screenshot. It can be understood that, in this example, the obtained screenshot of the web page is the forensics result obtained by the second node.

Step 306, returning the forensics result to the first node.

And step 308, receiving a forensics result determined by the first node at least based on the forensics result.

Specifically, the first node may receive forensics results returned by the plurality of second nodes. The first node may then determine whether the plurality of forensics results match. For example, the determination of whether the multiple forensic results match may be made based on the similarity between two forensic results of the multiple forensic results. In addition, the determination of whether the multiple evidence results match may also be performed based on the attribute information (e.g., size or height) corresponding to each of the multiple web page screenshots and/or the sub-screenshots corresponding to each of the multiple evidence results.

And if the first evidence obtaining result is matched with the first evidence obtaining result, selecting any first evidence obtaining result from the plurality of evidence obtaining results as an evidence storing result.

And 310, performing consensus verification on the evidence storing results received from the first nodes by adopting a consensus algorithm based on the evidence storing results received from other first nodes.

It is understood that, in this specification, each second node in the blockchain may receive the evidence storing result broadcasted by each first node in the group of first nodes on the blockchain. After receiving the evidence storing result sent by each first node, the consensus verification can be carried out based on the consensus algorithm.

The consensus algorithm may be a PBFT algorithm.

In step 312, if the consensus verification passes, the authentication result received from the first node is stored.

As described above, the second node may receive the content information related to the certificate-deposit result in addition to the certificate-deposit result broadcast by the first node. The content information here may be recorded by the first node when the process of obtaining the certification result is performed. Which may include, but is not limited to, a Hash value corresponding to the forensics result, an initiator of the forensics task (e.g., a user id), information of the first node, information of the second node, and forensics time, etc.

The process of the second node storing the verification result may specifically be: and generating the target transaction based on the evidence storing result and the content information related to the evidence storing result. The generated target transaction is stored locally.

It should be noted that, in this specification, the certificate storage result stored by the second node is actually subjected to double verification, that is, the first node is firstly verified for the first time, and then is verified for the second time by the consensus algorithm, so that the correctness and validity of the certificate storage result can be greatly improved.

In summary, the embodiments of the present disclosure protect all processes by using multiple forensics, checksums and consensus, and the evidence is traceable and easy to verify. In addition, the scheme can be applied to other scenes, for example, when fault tolerance and verification of redundant data are required in an unreliable network, the redundant data is regarded as the same evidence through the scheme, and the correctness of the final result can be ensured by utilizing a committee voting and consensus mechanism.

By combining the two embodiments, the solution provided by the present specification can solve the following problems:

firstly, the problem of risk in the evidence obtaining process is solved. The scheme ensures that the processing link forms a credible closed loop and multi-node verification is added, so that the whole process has the capability of resisting potential threats, and the obtained evidence has strong public credibility.

Second, the problem of evidence preservation risk is solved. According to the scheme, the Hash value is calculated according to the verified result, and then the evidence is linked and stored together with the key information in the processing flow, so that the risk existing in the evidence storage is solved, and the evidence can be verified and traced.

Thirdly, the problem of inconvenient evidence verification is solved. This scheme makes user or judicial agency when needing the proof of verification through the mode of keeping evidence cochain, can take the Hash value from the chain fast and verify, also can check the source of proof simultaneously, greatly promotes the treatment effeciency.

Corresponding to the above digital content forensics method based on a blockchain, an embodiment of the present specification further provides a digital content forensics apparatus based on a blockchain, where the blockchain includes a plurality of nodes, and the plurality of nodes includes at least a first node. The apparatus is implemented by a first node, and as shown in fig. 4, the apparatus may include:

a receiving unit 402, configured to receive a forensic task of digital content.

The digital content herein includes any one of: web screenshots, audio files, video files, and the like. The evidence obtaining task comprises any one of the following: screenshot task, grabbing task and recording task.

A selecting unit 404 is configured to select a plurality of second nodes from the plurality of nodes.

A sending unit 406, configured to send an instruction to execute the forensic task to each of the plurality of second nodes selected by the selecting unit 404.

The receiving unit 402 is further configured to receive multiple forensics results returned by each second node after the corresponding forensics task is completed.

A judging unit 408, configured to judge whether the plurality of forensics results received by the receiving unit 402 match.

The determining unit 408 may specifically be configured to:

and calculating the similarity between every two evidence obtaining results of the plurality of evidence obtaining results.

The plurality of forensic results are divided into at least one group based on similarity between two forensic results of the plurality of forensic results.

And judging whether the plurality of forensics results are matched or not based on the number of the forensics results in at least one group.

The determining unit 408 may further specifically be configured to:

and judging whether a first group with the number of the forensics results larger than a first threshold exists in at least one group. If the first packet exists, it is determined that the plurality of forensics results match.

Optionally, if the forensics result is a web screenshot, the determining unit 408 may further be specifically configured to:

and judging whether the plurality of evidence obtaining results are matched or not based on the attribute information corresponding to the plurality of evidence obtaining results and/or the matching results of the sub-screenshots corresponding to the plurality of evidence obtaining results.

The selecting unit 404 is further configured to select an arbitrary first forensics result from the multiple forensics results as a forensics result if the determining unit 408 determines that the first forensics result matches the forensics result.

The storage unit 410 is configured to locally store the evidence storing result selected by the selecting unit 404.

The storage unit 410 may be specifically configured to:

and generating the target transaction based on the evidence storing result and the content information related to the evidence storing result.

The target transaction is stored locally.

The content information includes any one or more of: the Hash value corresponding to the evidence storing result, the initiator of the evidence obtaining task, the information of the first node, the information of the second node and the evidence obtaining time.

The sending unit 406 is further configured to broadcast the authentication result to other nodes except the first node in the plurality of nodes, so that the other nodes store the authentication result after performing consensus verification on the authentication result.

Optionally, the apparatus may further include: a statistical unit (not shown in the figure).

The selecting unit 404 is further configured to select an incorrect forensics result from the multiple forensics results and determine a second node that sends the incorrect forensics result if the multiple forensics results are not matched.

And the counting unit is used for counting the determined times of the error evidence obtaining result sent by the second node.

The sending unit 406 is further configured to broadcast the determined second node on the block chain if the number of times counted by the counting unit is greater than a predetermined threshold.

The functions of each functional module of the device in the above embodiments of the present description may be implemented through each step of the above method embodiments, and therefore, a specific working process of the device provided in one embodiment of the present description is not repeated herein.

In the digital content forensics device based on the blockchain provided by one embodiment of the present specification, the receiving unit 402 receives the forensics task of the digital content. The selecting unit 404 selects a plurality of second nodes from the plurality of nodes. The sending unit 406 sends an instruction to execute the forensic task to each of the selected second nodes. The receiving unit 402 receives a plurality of forensics results returned by each second node after the corresponding forensics task is completed. The judgment unit 408 judges whether or not the plurality of forensic results match. If the first forensics result is matched with the second forensics result, the selecting unit 404 selects any first forensics result from the plurality of forensics results as a forensics result. The storage unit 410 stores the authentication result locally. The sending unit 406 broadcasts the authentication result to other nodes except the first node in the plurality of nodes, so that the other nodes store the authentication result after performing consensus verification on the authentication result. This can improve the reliability of the acquired digital content.

Corresponding to the above digital content forensics method based on a blockchain, an embodiment of the present specification further provides a digital content forensics apparatus based on a blockchain, where the blockchain includes a plurality of nodes, and the plurality of nodes includes a plurality of first nodes and second nodes. The apparatus is implemented by a second node, and as shown in fig. 5, the apparatus may include:

a receiving unit 502, configured to receive an instruction to execute a forensics task sent by any first node in the plurality of first nodes.

An execution unit 504, configured to execute the forensics task in response to the execution instruction received by the receiving unit 502 to obtain a forensics result.

The execution unit 504 may specifically be configured to:

and verifying the validity of the first node according to a predefined validity verification rule.

And if the validity verification is passed, executing a forensics task.

A sending unit 506, configured to return a forensics result to the first node.

The receiving unit 502 is further configured to receive a forensics result determined by the first node at least based on the forensics result.

A consensus unit 508, configured to perform consensus verification on the evidence storing results received from the first node by using a consensus algorithm based on the evidence storing results received by the receiving unit 502 from other first nodes.

The consensus algorithm here may be a practical Byzantine fault tolerant PBFT algorithm.

A storage unit 510, configured to store the certification result received from the first node if the consensus unit 508 passes the consensus verification.

An embodiment of the present disclosure provides a device for forensics of digital content based on a blockchain, which can improve the reliability of acquired digital content.

Corresponding to the above digital content forensics method based on blockchain, an embodiment of the present specification further provides a forensics apparatus, which may include: memory 602, one or more processors 604, and one or more programs. Wherein the one or more programs are stored in the memory 602 and configured to be executed by the one or more processors 604, the programs when executed by the processors 604 implement the steps of:

a forensic task of digital content is received.

And selecting a plurality of second nodes from the plurality of nodes, and sending an execution instruction of the forensics task to each second node in the plurality of second nodes.

And receiving a plurality of forensics results returned by the second nodes after the second nodes complete the corresponding forensics tasks.

And judging whether the plurality of evidence obtaining results are matched or not. And if the first evidence obtaining result is matched with the first evidence obtaining result, selecting any first evidence obtaining result from the plurality of evidence obtaining results as an evidence storing result.

Storing the certificate result in the local storage, and broadcasting the certificate result to other nodes except the first node in the plurality of nodes so that the other nodes store the certificate result after performing consensus verification on the certificate result.

The evidence obtaining device provided by one embodiment of the specification can improve the credibility of the acquired digital content.

Corresponding to the above digital content forensics method based on blockchain, another embodiment of the present disclosure may also provide a forensics apparatus as shown in fig. 6, that is, the forensics apparatus may include: memory 602, one or more processors 604, and one or more programs. Wherein the one or more programs are stored in the memory 602 and configured to be executed by the one or more processors 604. Except that the program when executed by the processor 604 performs the steps of:

and receiving an execution instruction of the evidence obtaining task sent by any first node in the plurality of first nodes.

In response to the execution indication, a forensics task is executed to obtain a forensics result.

And returning the evidence obtaining result to the first node.

And receiving a evidence storing result determined by the first node at least based on the evidence obtaining result.

And performing consensus verification on the evidence storing results received from the first nodes by adopting a consensus algorithm based on the evidence storing results received from other first nodes.

The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the apparatus embodiment, since it is substantially similar to the method embodiment, the description is relatively simple, and for the relevant points, reference may be made to the partial description of the method embodiment.

The steps of a method or algorithm described in connection with the disclosure herein may be embodied in hardware or may be embodied in software instructions executed by a processor. The software instructions may consist of corresponding software modules that may be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. Of course, the storage medium may also be integral to the processor. The processor and the storage medium may reside in an ASIC. Additionally, the ASIC may reside in a server. Of course, the processor and the storage medium may reside as discrete components in a server.

Those skilled in the art will recognize that, in one or more of the examples described above, the functions described in this invention may be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media may be any available media that can be accessed by a general purpose or special purpose computer.

The foregoing description has been directed to specific embodiments of this disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.

The above-mentioned embodiments, objects, technical solutions and advantages of the present specification are further described in detail, it should be understood that the above-mentioned embodiments are only specific embodiments of the present specification, and are not intended to limit the scope of the present specification, and any modifications, equivalent substitutions, improvements and the like made on the basis of the technical solutions of the present specification should be included in the scope of the present specification.

Claims

1. A method of digital content forensics based on a blockchain, the blockchain comprising a plurality of nodes including at least a first node, wherein the first node is periodically replaced; the method is performed by the first node and comprises:

receiving a forensics task for digital content;

judging whether the plurality of evidence obtaining results are matched or not so as to realize the first verification of the evidence obtaining results; if the first evidence obtaining result is matched with the first evidence obtaining result, selecting any first evidence obtaining result from the plurality of evidence obtaining results as an evidence storing result;

2. The method of claim 1, wherein said determining whether the plurality of forensics results match comprises:

calculating the similarity between every two evidence obtaining results of the plurality of evidence obtaining results;

dividing the plurality of evidence obtaining results into at least one group based on the similarity between every two evidence obtaining results of the plurality of evidence obtaining results;

and judging whether the plurality of forensics results are matched or not based on the number of forensics results in the at least one group.

3. The method of claim 2, said determining whether the plurality of forensics results match based on a number of forensics results in the at least one packet, comprising:

judging whether a first group with the number of the forensics results larger than a first threshold exists in the at least one group; if the first packet exists, determining that the plurality of forensics results match.

4. The method of claim 2, wherein the forensic result is a web screenshot; whether a plurality of results of collecting evidence match is judged, still include:

5. The method of claim 1, the storing the forensic result locally, comprising:

generating a target transaction based on the evidence saving result and content information related to the evidence saving result;

storing the target transaction locally;

6. The method of claim 1, further comprising:

if the plurality of forensics results are not matched, selecting an incorrect forensics result from the plurality of forensics results, and determining a second node sending the incorrect forensics result;

counting the determined times of sending the wrong evidence obtaining result by the second node;

and if the number of times is larger than a preset threshold value, broadcasting the determined second node on the block chain.

7. The method of any of claims 1-6, the digital content comprising any of: web screenshots, audio files and video files; the forensics task includes any one of: screenshot task, grabbing task and recording task.

8. A method of digital content forensics based on a blockchain, the blockchain comprising a plurality of nodes including a number of first nodes and second nodes, wherein the first nodes are periodically replaced; the method is performed by the second node and comprises:

returning the forensics result to the first node;

9. The method of claim 8, the performing the forensics task, comprising:

verifying the validity of the first node according to a predefined validity verification rule;

and if the validity verification passes, executing the evidence obtaining task.

10. The method of claim 8 or 9, the consensus algorithm being a practical Byzantine Fault tolerant PBFT algorithm.

11. A digital content forensics device based on a blockchain, the blockchain comprising a plurality of nodes including at least a first node, wherein the first node is periodically replaced; the apparatus, implemented by the first node, comprises:

a receiving unit for receiving a forensic task of digital content;

the judging unit is used for judging whether the plurality of evidence obtaining results received by the receiving unit are matched so as to realize the first verification of the evidence obtaining results;

the selecting unit is further configured to select any first forensics result from the plurality of forensics results as a forensics result if the judging unit judges that the first forensics result matches the forensics result;

12. The apparatus according to claim 11, wherein the determining unit is specifically configured to:

13. The apparatus according to claim 12, wherein the determining unit is further specifically configured to:

14. The apparatus of claim 12, wherein the forensic result is a web screenshot; the determining unit is further specifically configured to:

15. The apparatus of claim 11, the storage unit to be specifically configured to:

storing the target transaction locally;

16. The apparatus of claim 11, further comprising: a counting unit;

the selecting unit is further configured to select an incorrect forensics result from the plurality of forensics results and determine a second node that sends the incorrect forensics result if the plurality of forensics results are not matched;

the statistical unit is used for counting the determined times of the wrong evidence obtaining result sent by the second node;

the sending unit is further configured to broadcast the determined second node on the block chain if the number of times counted by the counting unit is greater than a predetermined threshold.

17. The apparatus of any of claims 11-16, the digital content comprising any of: web screenshots, audio files and video files; the forensics task includes any one of: screenshot task, grabbing task and recording task.

18. A digital content forensics device based on a blockchain, the blockchain comprising a plurality of nodes including a number of first nodes and second nodes, wherein the first nodes are periodically replaced; the apparatus, implemented by the second node, comprises:

a sending unit, configured to return the forensics result to the first node;

19. The apparatus of claim 18, the execution unit to:

and if the validity verification passes, executing the evidence obtaining task.

20. The apparatus of claim 18 or 19, the consensus algorithm being a practical byzantine fault-tolerant PBFT algorithm.

21. A forensic device comprising:

a memory;

one or more processors; and

receiving a forensics task for digital content;

and locally storing the evidence storing result, and broadcasting the evidence storing result to other nodes except the first node in the plurality of nodes so that the other nodes store the evidence storing result after performing consensus verification on the evidence storing result, wherein the first node is replaced periodically.

22. A forensic device comprising:

a memory;

one or more processors; and

receiving an execution instruction of a forensics task sent by any first node in a plurality of first nodes of a block chain; wherein the first node is periodically replaced;

returning the forensics result to the first node;