CN111159474B

CN111159474B - Multi-line evidence obtaining method, device and equipment based on block chain and storage medium

Info

Publication number: CN111159474B
Application number: CN202010261387.1A
Authority: CN
Inventors: 崔冉
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2020-04-03
Filing date: 2020-04-03
Publication date: 2020-09-04
Anticipated expiration: 2040-04-03
Also published as: CN111159474A

Abstract

The application discloses a multi-line evidence obtaining method, device, equipment and storage medium based on a block chain, and belongs to the technical field of block chains. In the embodiment of the application, a forensics instruction is sent to at least two node devices in response to a forensics request for a target forensics address, so that at least two pieces of video data obtained by recording the content displayed by the target forensics address by the at least two node devices are obtained, the at least two pieces of video data are stored in a local database of the current node device, and key information of the at least two pieces of video data is stored in a block chain.

Description

Multi-line evidence obtaining method, device and equipment based on block chain and storage medium

Technical Field

The present disclosure relates to the field of block chain technologies, and in particular, to a method, an apparatus, a device, and a storage medium for multi-line forensics based on a block chain.

Background

With the development of technology, the speed of network propagation is faster and faster, and people can propagate various contents to other people through the network for sharing. However, there are many infringement behaviors, for example, some contents are not allowed by the original author to be put on a certain website for the user to browse or download, and at this time, it is necessary to store the forensic data through forensics so as to facilitate the subsequent right maintenance.

At present, the evidence obtaining method is that a party installs an application program on a mobile device, and relevant information such as a screenshot or a website address is sent to a centralized server through the application program and is stored by the server.

According to the method, the evidence is obtained by the party and the evidence obtaining result is sent to the server for storage, so that the labor cost is high, and the evidence obtaining method is low in efficiency. And the evidence obtaining data obtained by the method is easy to be tampered, and the authenticity of the evidence obtaining data cannot be ensured.

Disclosure of Invention

The embodiment of the application provides a multi-line evidence obtaining method, device, equipment and storage medium based on a block chain, which can improve the evidence obtaining efficiency, ensure that obtained evidence obtaining data is not easy to be tampered, and ensure the authenticity, accuracy and reliability of the evidence obtaining data. The technical scheme is as follows:

in one aspect, a multiline forensics method based on a block chain is provided, and is applied to a node device in a block chain system, and the method includes:

receiving a forensics request for a target forensics address;

responding to the forensics request, and sending forensics instructions to at least two node devices in the blockchain system indicated by the forensics request, wherein the forensics instructions carry the target forensics address;

receiving at least two pieces of video data sent by the at least two pieces of node equipment, wherein the at least two pieces of video data are obtained by recording the content displayed by the target forensics address in response to the forensics instruction;

storing the at least two video data into a local database of the node device, and acquiring a block generated based on key information of the at least two video data;

adding the tile onto a blockchain in response to a consensus that the tile passes through the blockchain system.

In one possible implementation, the generating of the block includes:

extracting key information of the at least two video data;

performing hash calculation on the key information and the log file to obtain hash values of the key information and the log file;

and generating the block by taking the key information and the hash value of the log file as the content of the block main body of the block.

In one possible implementation, the method further includes:

and sending a forensics failure notice in response to the similarity between any video data and other video data being less than or equal to a similarity threshold.

In one possible implementation manner, the sending a forensics instruction by using the IP addresses of the at least two node devices as target addresses in response to the forensics request includes:

responding to the forensics request, and broadcasting a forensics instruction to node equipment in the blockchain system, wherein the forensics instruction is used for instructing the node equipment of the target address to forensics the target forensics address.

In one possible implementation, the certificate of authenticity includes at least one of a name, a size, a time of authenticity, an encoding, a digital fingerprint, a certificate number, a certificate holder, a certificate number, a platform account number, and a validity period of the video data, and the tile height.

In one possible implementation, the method further comprises any one of:

responding to a notarization request, acquiring video data indicated by the notarization request from a local database, sending the video data to target node equipment, and receiving a notarization result sent by the target node equipment;

responding to a certificate storing and viewing request, acquiring at least one item of video data indicated by the certificate storing and viewing request or a certificate storing certificate corresponding to the video data from a local database, and sending the at least one item of the video data and the certificate storing certificate corresponding to the video data to electronic equipment corresponding to the certificate storing and viewing request.

In one aspect, a block chain based multiline forensics device is provided, the device comprising:

the receiving module is used for receiving a forensics request of a target forensics address;

a sending module, configured to send a forensics instruction to at least two node devices in a block chain system indicated by the forensics request in response to the forensics request, where the forensics instruction carries the target forensics address;

the receiving module is further configured to receive at least two pieces of video data sent by the at least two pieces of node equipment, where the at least two pieces of video data are obtained by recording content shown by the target forensics address in response to the forensics instruction;

the storage module is used for storing the at least two pieces of video data into a local database of the node equipment and acquiring a block generated based on key information of the at least two pieces of video data;

the storage module is further configured to add the tile to a chain of tiles in response to a consensus of the tile by the system of tiles.

In one possible implementation, the generating of the block includes:

extracting key information of the at least two video data;

generating the block based on the key information.

In one possible implementation, the extracting key information of the at least two video data includes any one of:

extracting summary information of the at least two video data;

performing target recognition on the at least two video data, and intercepting at least one image frame including a target according to a target recognition result;

performing voice recognition on the at least two video data to obtain text data corresponding to the at least two video data;

and extracting popup information or jump information in the at least two pieces of video data.

In one possible implementation manner, the performing object recognition on the at least two video data, and intercepting at least one image frame including an object according to a result of the object recognition includes:

performing target recognition on the at least two video data to obtain a target recognition result, wherein the target recognition result is used for indicating the position of at least one image frame comprising a target in the at least two video data;

intercepting the at least one image frame including the object from the at least two video data according to a position of the at least one image frame including the object in the at least two video data.

In a possible implementation manner, the performing speech recognition on the at least two video data to obtain text data corresponding to the at least two video data includes:

extracting audio track data from the at least two video data;

and performing voice recognition on the audio track data, and converting the audio track data into text data, wherein the text data comprises text content corresponding to the audio track data in the at least two pieces of video data, or the text data comprises the text content corresponding to the audio track data in the at least two pieces of video data and position information of the text content in the at least two pieces of video data.

In one possible implementation manner, the extracting of the popup information or the skip information in the at least two pieces of video data includes:

and extracting information corresponding to the identification information from the at least two video data as the popup information or the jump information according to the identification information of the popup information or the jump information.

In one possible implementation, the generating the block based on the key information includes:

performing hash calculation on the block content of the previous block of the blocks to obtain a hash value of the previous block;

performing hash calculation on the key information to obtain a hash value of the key information;

and generating the block by taking the hash value of the previous block as the content of the block head of the block and taking the hash value of the key information as the content of the block body of the block.

In one possible implementation, the generating of the block includes:

extracting key information of the at least two video data;

In a possible implementation manner, the receiving module is further configured to receive at least two log files sent by the at least two node devices, where the log files are used to record cleanliness of video data recorded by the node devices, and the cleanliness is used to indicate a degree that the video data includes malicious data.

In one possible implementation, the apparatus further includes:

the first generation module is used for detecting the cleanliness of the at least two video data and generating a log file, wherein the log file is used for recording the cleanliness of the at least two video data, and the cleanliness is used for indicating the degree that the video data comprise malicious data.

In one possible implementation, the generating of the block includes:

comparing the at least two video data;

and in response to the similarity between the at least two video data being greater than a similarity threshold, performing the block generating step.

In one possible implementation, the sending module is further configured to send a forensics failure notification in response to a similarity between any video data and other video data being less than or equal to a similarity threshold.

In one possible implementation, the forensics request carries IP addresses of at least two node devices;

and the sending module is used for responding to the evidence obtaining request, and sending an evidence obtaining instruction by taking the IP addresses of the at least two node devices as target addresses.

In a possible implementation manner, target clients are installed on the at least two node devices, and the target clients are configured to respond to the forensics instruction, automatically access the target forensics address, and record content displayed by the target forensics address to obtain video data.

In one possible implementation, the apparatus further includes:

a first obtaining module, configured to obtain a block height of the block on the block chain;

and the second generation module is used for generating a certificate of authenticity based on the block height and the information of the video data.

In one possible implementation, the apparatus further includes:

the second acquisition module is used for responding to a notarization request and acquiring the video data indicated by the notarization request from a local database; the sending module is further used for sending the video data to target node equipment; the receiving module is further configured to receive a notarization result sent by the target node device.

In one possible implementation, the apparatus further includes:

the third acquisition module is used for responding to the evidence checking request and acquiring at least one of the video data indicated by the evidence checking request or the evidence checking certificate corresponding to the video data from a local database; the sending module is further configured to send at least one of the video data and the certificate of credit corresponding to the video data to the electronic device corresponding to the certificate of credit viewing request.

In one possible implementation manner, the sending module is configured to broadcast a forensics instruction to node devices in the blockchain system in response to the forensics request, where the forensics instruction is used to instruct the node devices of the target address to forensics the target forensics address.

In one aspect, an electronic device is provided that includes one or more processors and one or more memories having at least one program code stored therein, the at least one program code being loaded by the one or more processors and executed to implement the operations performed by the blockchain-based multi-line forensics method of any of the possible implementations described above.

In one aspect, a storage medium is provided, in which at least one program code is stored, the at least one program code being loaded into and executed by a processor to perform operations performed to implement the blockchain based multiline forensics method according to any one of the possible implementations described above.

The beneficial effects brought by the technical scheme provided by the embodiment of the application at least comprise: in the embodiment of the application, a forensics instruction is sent to at least two node devices in response to a forensics request for a target forensics address, so that at least two pieces of video data obtained by recording the content displayed by the target forensics address by the at least two node devices are obtained, the at least two pieces of video data are stored in a local database of the current node device, and key information of the at least two pieces of video data is stored in a block chain.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

Fig. 1 is a schematic structural diagram of a blockchain system according to an embodiment of the present disclosure;

fig. 2 is a schematic structural diagram of a block chain according to an embodiment of the present disclosure;

fig. 3 is a flowchart of a new block generation process provided in an embodiment of the present application;

fig. 4 is an alternative structural diagram of the distributed system 400 applied to the blockchain system according to the embodiment of the present application;

FIG. 5 is an alternative Block Structure (Block Structure) diagram provided in an embodiment of the present application;

fig. 6 is a flowchart of a multiline forensics method based on a block chain according to an embodiment of the present disclosure;

fig. 7 is a flowchart of a multiline forensics method based on a block chain according to an embodiment of the present application;

fig. 8 is a schematic diagram of a forensic information collection page provided by an embodiment of the present application;

fig. 9 is a schematic diagram of a message delivery process provided in an embodiment of the present application;

fig. 10 is a schematic diagram of a certificate of authenticity provided in an embodiment of the present application;

FIG. 11 is a schematic diagram of a witness check provided by an embodiment of the present application;

fig. 12 is a flowchart of a multiline forensics method based on a block chain according to an embodiment of the present application;

fig. 13 is a flowchart of a multiline forensics method based on a block chain according to an embodiment of the present application;

fig. 14 is a schematic structural diagram of a block chain-based multiline forensics apparatus according to an embodiment of the present disclosure;

fig. 15 is a schematic structural diagram of a terminal 1500 according to an embodiment of the present disclosure;

fig. 16 is a schematic structural diagram of a server 1600 according to an embodiment of the present application.

Detailed Description

To make the objects, technical solutions and advantages of the present application more clear, embodiments of the present application will be described in further detail below with reference to the accompanying drawings.

The terms "first," "second," and the like in this application are used for distinguishing between similar items and items that have substantially the same function or similar functionality, and it should be understood that "first," "second," and "nth" do not have any logical or temporal dependency or limitation on the number or order of execution.

The term "at least one" in this application refers to one or more than one, "at least two" refers to two or more than two, e.g., at least two node devices refers to two or more than two node devices.

Hereinafter, terms related to the present application are explained.

The block chain is a multi-party common maintenance, transmission and access safety is guaranteed by using cryptography, and a data consistent storage, difficult tampering and repudiation prevention accounting technology, namely a distributed accounting book technology, can be realized. The blockchain is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, a consensus mechanism and an encryption algorithm. A block chain (Blockchain), which is essentially a decentralized database, is a series of data blocks associated by using a cryptographic method, and each data block contains information of a batch of network transactions, so as to verify the validity (anti-counterfeiting) of the information and generate a next block. The blockchain may include a blockchain underlying platform, a platform product services layer, and an application services layer.

The block chain underlying platform can comprise processing modules such as user management, basic service, intelligent contract and operation monitoring. The user management module is responsible for identity information management of all blockchain participants, and comprises public and private key generation maintenance (account management), key management, user real identity and blockchain address corresponding relation maintenance (authority management) and the like, and under the authorization condition, the user management module supervises and audits the transaction condition of certain real identities and provides rule configuration (wind control audit) of risk control; the basic service module is deployed on all block chain node equipment and used for verifying the validity of the service request, recording the service request to storage after consensus on the valid request is completed, for a new service request, the basic service firstly performs interface adaptation analysis and authentication processing (interface adaptation), then encrypts service information (consensus management) through a consensus algorithm, transmits the service information to a shared account (network communication) completely and consistently after encryption, and performs recording and storage; the intelligent contract module is responsible for registering and issuing contracts, triggering the contracts and executing the contracts, developers can define contract logics through a certain programming language, issue the contract logics to a block chain (contract registration), call keys or other event triggering and executing according to the logics of contract clauses, complete the contract logics and simultaneously provide the function of upgrading and canceling the contracts; the operation monitoring module is mainly responsible for deployment, configuration modification, contract setting, cloud adaptation in the product release process and visual output of real-time states in product operation, such as: alarm, monitoring network conditions, monitoring node equipment health status, and the like.

The platform product service layer provides basic capability and an implementation framework of typical application, and developers can complete block chain implementation of business logic based on the basic capability and the characteristics of the superposed business. The application service layer provides the application service based on the block chain scheme for the business participants to use.

In the embodiment of the application, the node devices in the blockchain system can be used for automatically obtaining the evidence, and the user management module can maintain the generation of the public and private keys and the authority management when the user management module interacts among the node devices. And the evidence obtaining data is stored in a node device in a centralized manner, and key information of the evidence obtaining data is subjected to chain linking after consensus by a consensus algorithm.

Referring to the blockchain system shown in fig. 1, a blockchain system 100 refers to a system for data sharing between nodes, and the blockchain system may include a plurality of nodes 101, and the plurality of nodes 101 may refer to respective clients in the blockchain system. Each node 101 may receive input information and maintain shared data within the blockchain system based on the received input information while operating normally. In order to ensure the information intercommunication in the blockchain system, information connection can exist between each node in the blockchain system, and the nodes can transmit information through the information connection. For example, when an arbitrary node in the blockchain system receives input information, other nodes in the blockchain system acquire the input information according to a consensus algorithm, and store the input information as data in shared data, so that the data stored on all nodes in the blockchain system are consistent.

For example, when a certain node 101 receives a forensics request for a target forensics address, a forensics instruction may be sent to the node 101 that needs to forensics, where the forensics instruction carries the target forensics address. After receiving the forensics instruction, the node 101 that needs to forensics can forensics the target forensics address to obtain video data, and send the video data to the node 101 that receives the forensics request, the node 101 stores the video data, after the node 101 and the node device in the block chain system can recognize the block that includes the key information of the video data, the block chain is performed, so that the node 101 in the block chain system maintains the key information of the video data, and the key information is shared data.

Each node in the blockchain system has a corresponding node identifier, and each node in the blockchain system can store node identifiers of other nodes in the blockchain system, so that the generated block can be broadcast to other nodes in the blockchain system according to the node identifiers of other nodes. Each node may maintain a node identifier list as shown in the following table, and store the node name and the node identifier in the node identifier list correspondingly. The node identifier may be an IP (Internet Protocol) address and any other information that can be used to identify the node, and table 1 only illustrates the IP address as an example.

TABLE 1

Node name	Node identification
		Node
1	117.114.151.174
		Node 2	117.116.189.145
…	…
		Node N	119.123.789.258

Each node in the blockchain system stores one identical blockchain. The block chain is composed of a plurality of blocks, and in the above example, a block on the block chain is a block after the block chain including the key information of the video data. Referring to fig. 2, a block chain is composed of a plurality of blocks, a starting block includes a block header and a block main body, the block header stores an input information characteristic value, a version number, a timestamp and a difficulty value, and the block main body stores input information; the next block of the starting block takes the starting block as a parent block, the next block also comprises a block head and a block main body, the block head stores the input information characteristic value of the current block, the block head characteristic value of the parent block, the version number, the timestamp and the difficulty value, and the like, so that the block data stored in each block in the block chain is associated with the block data stored in the parent block, and the safety of the input information in the block is ensured. For example, in the above example, for a block including key information of video data, the block body of the block stores the key information, and the block header stores therein a key information feature value of the block and a block header feature value, a version number, a timestamp, a difficulty value, and the like of a previous block.

When each block in the block chain is generated, referring to fig. 3, when a node where the block chain is located receives input information (for example, the video data), the input information is checked, after the check is completed, the input information is stored in the memory pool, and the hash tree for recording the input information is updated; and then, updating the updating time stamp to the time when the input information is received, trying different random numbers, and calculating the characteristic value for multiple times, so that the calculated characteristic value can meet the following formula:

wherein the content of the first and second substances,SHA256a eigenvalue algorithm for calculating eigenvalues;version(version number) is version information of the related block protocol in the block chain;prev_hasha block header feature value of a parent block of the current block;merkle_rootis the characteristic value of the input information;ntimean update time that is an update timestamp;nbitsdetermining the current difficulty value within a period of time, and determining again after the fixed time period is exceeded;xis a random number;TARGETas a threshold value of the characteristic value, the threshold value of the characteristic value may be based onnbitsAnd (5) determining to obtain.

Therefore, when the random number meeting the formula is obtained through calculation, the information can be correspondingly stored, and the block head and the block main body are generated to obtain the current block. And then, the node where the block chain is located respectively sends the newly generated blocks to other nodes in the block chain system where the newly generated blocks are located according to the node identifications of the other nodes in the block chain system, the newly generated blocks are verified by the other nodes, and the newly generated blocks are added to the block chain stored in the newly generated blocks after the verification is completed.

The blockchain system related to the embodiment of the present application may be a distributed system formed by connecting a client, a plurality of nodes (any form of computing devices in an access network, such as servers and user terminals) through a network communication form.

Referring To fig. 4, fig. 4 is an optional structural diagram of a distributed system 400 applied To a blockchain system according To an embodiment of the present application, and the distributed system is formed by a plurality of nodes 200 (any form of computing devices in an access network, such as servers and user terminals) and clients 300, a Peer-To-Peer (P2P, Peer-To-Peer) network is formed between the nodes 200, and the P2P Protocol is an application layer Protocol running on top of a Transmission Control Protocol (TCP). In a distributed system, any machine, such as a server or a terminal, can join to become the node 200, and the node 200 includes a hardware layer, an intermediate layer, an operating system layer, and an application layer.

Referring to the functions of each node 200 in the blockchain system shown in fig. 4, the functions involved include the following three.

1) Routing, a basic function that node 200 has, is used to support communication between nodes 200.

The node 200 may have the following two functions in addition to the routing function.

2) The application is used for being deployed in a block chain, realizing specific services according to actual service requirements, recording data related to the realization function to form recording data, carrying a digital signature in the recording data to represent the source of the recording data, and sending the recording data to other nodes 200 in the block chain system, so that the other nodes 200 add the recording data to a temporary block when the source and integrity of the recording data are verified successfully.

For example, the service implemented by the application includes the following three kinds 2.1 to 2.3.

2.1) wallet, for providing the function of transaction of electronic money, including initiating transaction (i.e. sending the transaction record of current transaction to other nodes 200 in the blockchain system, after the other nodes 200 are successfully verified, as the response of acknowledging transaction validity, storing the record data of transaction into the temporary blocks of blockchain; of course, the wallet also supports the querying of the electronic money remaining in the electronic money address.

2.2) sharing the account book, which is used for providing functions of operations such as storage, query and modification of the account data, sending the record data of the operations on the account data to other nodes 200 in the block chain system, and after the other nodes 200 verify that the record data is valid, storing the record data in a temporary block as a response for acknowledging that the account data is valid, and also sending confirmation to the node 200 initiating the operations. For example, the video data obtained by the evidence in the above example may be used as the above account data, and the video data is linked, so that the nodes 200 in the blockchain system each store the key information of the video data.

2.3) Intelligent contracts, computerized agreements, which can enforce the terms of a contract, implemented by codes deployed on a shared ledger for execution when certain conditions are met, for completing automated transactions according to actual business requirement codes, such as querying the logistics status of goods purchased by a buyer, transferring the buyer's electronic money to the merchant's address after the buyer signs for the goods; of course, smart contracts are not limited to executing contracts for trading, but may also execute contracts that process received information.

3) A blockchain comprising a series of blocks (blocks) that follow each other in chronological order of generation, new blocks being never removed once they have been added to the blockchain, and blocks having recorded therein recorded data (e.g., video data) submitted by nodes 200 in the blockchain system.

Referring to fig. 5, fig. 5 is an optional schematic diagram of a Block Structure (Block Structure) provided in the embodiment of the present application, where each Block includes a hash value of a current Block storing a transaction record (e.g., video data in the above example) (a hash value of the current Block) and a hash value of a previous Block, and the blocks are connected by the hash values to form a Block chain. The block may include information such as a time stamp at the time of block generation. A block chain (Blockchain), which is essentially a decentralized database, is a string of data blocks associated by using cryptography, and each data block contains related information for verifying the validity (anti-counterfeiting) of the information and generating a next block.

Fig. 6 is a flowchart of a block chain-based multiline forensics method according to an embodiment of the present disclosure, which may be applied to any node device in a block chain system, and referring to fig. 6, the method may include the following steps.

600. A node device receives a forensics request for a target forensics address.

The forensics request is used for instructing the node device to execute forensics-related operations based on the forensics request, for example, sending forensics instructions to the node device with the forensics function. The forensics request can be sent to the node device by the terminal in response to forensics operation, and can also be triggered by the node device in response to forensics operation.

601. And the node equipment responds to the forensics request and sends forensics instructions to at least two node equipments in the block chain system indicated by the forensics request, wherein the forensics instructions carry the target forensics address.

The blockchain system may include at least two node devices capable of providing a forensics function, where the forensics request indicates which node devices are required to forensics, for example, the forensics request includes identification information of the at least two node devices, and it is determined by the identification information which node devices are to be sent forensics instructions for forensics.

The target forensic address may be a web site. And sending the target evidence obtaining address to the node equipment, wherein the node equipment can access the target evidence obtaining address so as to display corresponding content, and corresponding video data can be obtained as evidence obtaining data by recording the displayed content. Therefore, only the address needing to be subjected to evidence obtaining (namely the target evidence obtaining address) needs to be determined and sent to the block chain system, the block chain system can execute the evidence obtaining step based on the target evidence obtaining address to obtain corresponding evidence obtaining data, the evidence obtaining data are automatically obtained, the evidence obtaining is not required to be carried out by a party, and the evidence obtaining efficiency is high.

602. The node device receives at least two pieces of video data sent by the at least two pieces of node device, and the at least two pieces of video data are obtained by recording the content shown by the target forensics address in response to the forensics instruction.

After the at least two node devices receive the evidence obtaining instruction, the target evidence obtaining address can be obtained through evidence obtaining to obtain at least two video data, and therefore the node devices can collect the at least two video data and use the at least two video data as evidence obtaining data. According to the method, the data interaction is carried out among the node devices through the block chain technology, the multi-line evidence obtaining can be completed, and compared with the single-side evidence obtaining, the obtained evidence obtaining data has more authenticity, accuracy and credibility.

603. The node device stores the at least two video data into a local database of the node device, and acquires a block generated based on key information of the at least two video data.

The local database is a database in the node equipment, is stored in the local database, can be conveniently extracted from the local database during subsequent checking or notarization of video data, and is more convenient to access.

The block is based on key information of the at least two video data, the key information including key contents of the at least two video data, and the block including the key information can chain the essential contents of the video data, thereby reducing the data volume of the chain.

604. The node apparatus adds the block to the blockchain in response to a consensus that the block passed through the blockchain system.

In the embodiment of the application, the evidence obtaining instruction is sent to the at least two node devices, so that the at least two video data obtained by recording the content displayed by the target evidence obtaining address by the at least two node devices are obtained, the at least two video data are stored in the local database of the current node device, the key information of the at least two video data is stored in the block chain, the node devices in the block chain system automatically record the video data and store the key information in the block chain in the process, manual participation is not needed, a multi-line evidence obtaining mode is adopted instead of obtaining evidence by a party, the labor cost is reduced, and the evidence obtaining efficiency is improved.

Moreover, since the key information of the video data is linked, the key information of the video data cannot be tampered by using the non-tampering property of the data on the block link, and if the video data is tampered, the key information can be quickly acquired, so that the forensic data obtained by the forensic method is not easily tampered, the authenticity, the accuracy and the credibility of the forensic data can be ensured, and the notarial pressure can be reduced to a certain extent in the subsequent notarization.

Fig. 7 is a flowchart of a multiline forensics method based on a blockchain according to an embodiment of the present disclosure, where the method may be applied to an electronic device, where the electronic device may be any node device in a blockchain system, and the electronic device may be a terminal or a server, which is not limited in this embodiment of the present disclosure. Referring to fig. 7, the method may include the following steps.

701. A node device receives a forensics request for a target forensics address.

The forensics request is used for instructing the node device to send a forensics instruction to the node device indicated by the forensics request based on the forensics request. The target forensics address may be a website address, for example, the website address may be an e-commerce website address, a video page address, or a commodity detail page address.

For the forensics request, the forensics request may be sent to the node device by the terminal, or may be triggered on the node device, which may specifically include the following two implementation manners, and which implementation manner is specifically adopted is not limited in the embodiment of the present application.

In a first possible implementation, the forensics request may be sent by the terminal to the node apparatus in response to a forensics operation. Specifically, the user may perform a forensics operation on the terminal, and the terminal may send a forensics request to the node device in response to the forensics operation when detecting the forensics operation. The terminal may also be a node device in the blockchain system, or may also be a device outside the blockchain system, which is not limited in this embodiment of the present application.

In a second possible implementation, the forensics request may be triggered by the node device in response to a forensics operation. Specifically, the user may perform the forensics operation on the node device, and the node device may receive the forensics request triggered by the forensics operation when detecting the forensics operation.

For the target forensic address, the number of the target forensic addresses may be one or more than one. If the number of the target forensic addresses is at least two, the at least two target forensic addresses in the forensic request may be arranged in a target format. In one possible implementation, the target format is: the at least two target forensic addresses are separated by English marks. For example, the forensics request includes two target forensics addresses: com, the two target forensic addresses may be separated by an English semicolon, and the format may be: https:// jd.com, https:// twitter.com.

In a specific example, the explanation is given by taking an example that a user performs a forensics operation on a terminal to trigger the terminal to send a forensics request to a blockchain system, and forensics is performed and stored by the blockchain system. The terminal can provide a forensics information collecting page, the forensics information collecting page at least comprises a forensics address input box and node equipment options, a user can input a target forensics address in the forensics address input box, and node equipment needing forensics is selected in the node equipment options. Of course, the forensic information collection page may further include input boxes of other information, for example, input boxes of a forensic name, a forensic label, and the like. The user can input the evidence obtaining information in the evidence obtaining information collecting page, the evidence obtaining operation can be carried out after the user inputs the evidence obtaining information, and the terminal can respond to the evidence obtaining operation and send an evidence obtaining request to the node equipment. In a possible embodiment, the terminal may further verify the forensics information input by the user, and after the forensics information is verified, send a forensics request to the node device.

For example, the forensics information collecting page may be as shown in fig. 8, and the forensics information collecting page may include an input box 801 of a forensics name, an input box 802 of a forensics label, a candidate virtual machine 803, and an input box 804 of a forensics address, where the candidate virtual machine 803 is a candidate node device. In the evidence obtaining process, evidence obtaining can be carried out through the main virtual machine and the at least one standby virtual machine. Different virtual machines can be located in different areas, and the IP addresses of the virtual machines are different, so that evidence obtained through multi-line forensics in different places can be guaranteed to be more authentic. The user may name the video data obtained by this forensics, and input the name into the input box 801 of the forensics name, for example, the name may be: and automatically recording screen evidence for infringement and evidence collection. The user can also set a forensics label for this forensics, and the user can input the forensics label in the input box 802, and the forensics label can identify the characteristics of this forensics, for example, the forensics label can identify the purpose of this forensics (e.g., infringement, reimbursement, etc.). Of course, other information may be identified, which is not limited in the embodiments of the present application. After subsequent forensics, the forensics tag and the video data obtained by this forensics can be correspondingly stored, the video data obtained by this forensics can be searched through the forensics tag, or the type of the video data or the purpose of this forensics can be checked through checking the forensics tag of the video data, and the like. The user may select the primary virtual machine and the standby virtual machine from the candidate virtual machines 803, for example, the user may select the virtual machine in beijing as the primary virtual machine and the virtual machine in shanghai, guangzhou as the standby virtual machine. Or, the forensics information collecting page may default to a main virtual machine and a standby virtual machine, and the user may confirm to use the default virtual machine or may reselect the virtual machine according to the own requirement. It should be noted that the forensics steps required to be executed by the primary virtual machine and the standby virtual machine are consistent, and the forensics sequence executed by the primary virtual machine and the standby virtual machine is not primary or secondary. After the user selects the virtual machine, a target forensics address may be input in the forensics address input box 804, and the number of the target forensics addresses may be one, or may be two or more, which is not limited in the embodiment of the present application. After the user fills in the forensics information, forensics operation can be performed, for example, the forensics operation can be triggering operation performed on a "start screen recording" button 805, the terminal detects the forensics operation, verifies the information recorded by the user, and sends a forensics request to the node device after the verification is correct.

702. And the node equipment responds to the forensics request and sends forensics instructions to at least two node equipments in the block chain system indicated by the forensics request, wherein the forensics instructions carry the target forensics address.

The at least two node devices indicated by the forensics request may be at least two node devices default or selected by the user in step 701. After receiving the forensics request, the node device may send a forensics instruction carrying a target forensics address to the at least two node devices in the blockchain system, so as to instruct the at least two node devices to forensics the target forensics address.

The forensics request may carry identification information of at least two node devices, and the node device may send a forensics instruction to the at least two node devices according to the identification information of the at least two node devices.

In one possible implementation, the identification information may be an Internet Protocol (IP) address, that is, the forensics request carries IP addresses of at least two node devices. Accordingly, the step 702 may be: and the node equipment responds to the forensics request, and sends forensics instructions by taking the IP addresses of the at least two node equipments as target addresses. The node equipment with different IP addresses is used for obtaining the evidence of the same target evidence obtaining address, so that the problem that video data obtained by obtaining the evidence of the target evidence obtaining address through a single IP address is inaccurate can be avoided, and the accuracy and the authenticity of evidence obtaining data are effectively guaranteed.

In a possible implementation manner, the process of sending the forensics instruction to the at least two node devices may be implemented by broadcasting a forensics instruction, and specifically, in step 702, the node device may broadcast the forensics instruction to the node devices in the blockchain system in response to the forensics request, where the forensics instruction is used to instruct the node device of the target address to forensics the target forensics address.

Specifically, the forensic instruction may carry identification information of the at least two node devices, and when any node device receives the broadcasted forensic instruction, the identification information of the at least two node devices carried by the forensic instruction may be extracted and compared with the identification information of the any node device. When the identification information of any node device is not matched with the identification information of the at least two node devices, the forensics instruction can be ignored.

Specifically, the identification information may be the IP address, and the matching in the matching process may be the IP address of any node device and the IP addresses of at least two node devices carried by the forensics instruction, which is not described in detail herein.

In a specific example, the foregoing broadcasting manner may adopt a RabbitMQ as a Message middleware Protocol, where the MQ means a Message Queue, and for a Message (for example, the foregoing forensic instruction) that needs to be forwarded, AMQP (Advanced Message Queuing Protocol) may be used to implement broadcasting of the forensic instruction. AMQP is a communication network protocol for store-and-forward messages in distributed systems.

In the above protocol, a message may be delivered from a "producer" (producer/publisher) to a "consumer" (consumer) through a "message broker" (broker), and specifically, as shown in fig. 9, the delivery process of the message may include the following five steps.

1. The message is issued by "producer 901" to "switch 902" (exchange).

2. Switch 902 routes (distributes) messages to queues (queues) 903 according to the binding.

3. "Consumer 904" retrieves the message in "queue 903".

4. In AMQP, "queue 903", "switch 902", "bind", is referred to as an "entity" (entity).

5. "message acknowledgement": when the "consumer 904" is allowed to receive the message, it notifies the "message broker" at which point the message will be removed from the "queue 903" by the "message broker".

In this embodiment, the "message" may be a forensic instruction, the "producer 901" may be the node device, and the "consumer 904" may be the at least two node devices. Or the "consumer" may be a node device in the blockchain system including the at least two node devices, and the forensic instruction may be broadcast to all node devices subscribed to the message queue.

In one possible implementation manner, the forensics request may include a forensics keyword, so that in step 702, the forensics instruction sent by the node device to the at least two node devices in response to the forensics request may also include the forensics keyword. And in the subsequent forensics process of the at least two node devices, the content related to the forensics keyword in the content displayed by the target forensics address can be recorded to obtain video data. Specifically, the node device may match the forensic keyword with the content displayed by the target forensic address, and record the matched content according to a matching result to obtain video data.

703. The node device receives at least two pieces of video data sent by the at least two pieces of node device, and the at least two pieces of video data are obtained by recording the content shown by the target forensics address in response to the forensics instruction.

After the step 702, after each node device of the at least two node devices receives the forensics instruction, the target forensics address carried by the forensics instruction may be extracted, the content shown by the target forensics address is recorded to obtain video data, and then the video data is sent to the node device, so that the node device receives at least two video data.

The recording process can be that each node device in at least two node devices can access the target evidence obtaining address through a browser, display the content of the target evidence obtaining address, start a screen recording function, record the displayed content, and finish the screen recording function after detecting that the content display of the target evidence obtaining address is finished, so that video data is obtained.

In a possible implementation manner, the process of automatically recording the video data by the at least two node devices may be implemented by a target client, that is, the target client is installed on the at least two node devices, and is configured to respond to the forensics instruction, automatically access the target forensics address, and record the content displayed by the target forensics address to obtain the video data.

For example, the target client may be a cloud desktop client, which may run in a virtual machine environment. The cloud desktop client is mainly used for monitoring and receiving the website and the video link which need to be recorded in the node equipment message broadcast, then automatically opening a browser, automatically accessing the website or the video link, automatically starting a screen recording control function, and finally uploading the recorded video data to the node equipment.

For the process of automatically recording video data, after receiving a message (evidence-obtaining instruction), the cloud desktop client analyzes the message, and automation is realized based on a selenium technology. The selenium is used for testing a world wide web application program and can simulate user operation. The automated process comprises: the cloud desktop client automatically opens the browser, automatically accesses the website, and automatically plays the video if the website has the video. Meanwhile, a WebSocket technology can be adopted to control screen recording software, wherein the WebSocket is a protocol which is provided by HTML5 (HyperText Markup Language 5, fifth edition HyperText Markup Language) and is used for carrying out full duplex communication on a single TCP connection. For example, in one specific example, the screen recording Software may be OBS Studio (Open broadcast recording Software) screen recording Software. The cloud desktop client can send a screen recording start and stop instruction based on a ws (websocket) protocol. And after the screen recording is finished, acquiring a path of the latest recorded video data, and uploading the video data to the node equipment sending the evidence obtaining instruction.

704. The node device stores the at least two video data in a local database of the node device.

After receiving the at least two pieces of video data, the node device may store the at least two pieces of video data in a local database of the node device, so as to facilitate subsequent notarization of the at least two pieces of video data, or for a user to subsequently view video data obtained by this forensics. The video data are stored in the local database, original data obtained by evidence obtaining can be completely reserved, the data obtained by evidence obtaining can be backtracked according to the stored information, and follow-up access is convenient and fast.

In a possible implementation manner, the node device may also send the at least two video data to other node devices in the blockchain system, and the other node devices store the at least two video data in local databases of the other node devices, so as to implement data synchronization of each node device in the blockchain system.

705. The node apparatus acquires a block generated based on key information of the at least two video data.

In step 705, the block may be generated by the node device, or may be generated and then broadcasted by another node device, and the node device receives the block broadcasted by the other node device, which is not limited in this embodiment of the present application.

In a possible implementation manner, after receiving the at least two video data in step 704, the node device may send the at least two video data to other node devices, so as to implement data synchronization of each node device in the blockchain system, and may also send any video data in the at least two video data to other node devices, so that the node device and a node device in other node devices that is out of the blockchain system can process the video data and generate a block, and node devices other than the node device that is out of the blockchain system can also recognize the block commonly according to the video data.

In another possible implementation manner, after receiving the at least two pieces of video data in step 704, the node device may extract key information of the at least two pieces of video data or key information of any one of the at least two pieces of video data, and send the key information to other node devices, so that the node device and a block exit node device in the other node devices can generate a block according to the key information, and a node device other than the block exit node device can recognize the block together according to the key information.

It should be noted that the foregoing provides two possible implementation manners, and the embodiment of the present application is not limited to which specific manner is adopted.

For the generation process of the block, the block may be generated based on the key information of the at least two video data, and specifically, the generation process of the block may be implemented by the following step one and step two.

Step one, the node equipment extracts key information of the at least two video data.

The node apparatus may link key information representing key content of the video data. Specifically, the key information may be different kinds of information, and may be set by a related technician according to a requirement, for example, the key information may be identification information for uniquely identifying the at least two pieces of video data, or the key information may be evidence information, such as some people in the video data, some behavior information, and the like. Four possible key information are provided below.

In case one, the node device extracts summary information of the at least two video data.

In the first situation, the node device may use the summary information of the video data as the key information, and may ensure that the content of the video data can be summarized through the summary information, and reduce the uplink data amount, thereby reducing the storage burden while ensuring the validity of the uplink data. The summary information may also be referred to as a video summary. The video abstract can be an abstract in different forms, and the video abstract can also be a condensed version of the video, so that the video content can be simply summarized.

For example, the summary information may be a video composed of key frames. The node device may extract key frames in the at least two pieces of video data, and synthesize the key frames to obtain a new video, which may be summary information of the original video data. The key frame is an I frame in the image frame group, and is an intra-frame coding image which is compressed by removing image space redundant information as much as possible during video compression and transmits data volume. Therefore, the process of extracting the key frame is a process of extracting an I frame in the image frame group.

For another example, the node device may extract moving objects through moving object analysis in an automatic or semi-automatic manner, analyze the moving tracks of the objects, and combine different moving objects spliced into a common background scene to obtain summary information.

For another example, the node device may further directly perform hash calculation on any video data of the at least two pieces of video data to obtain a hash value of the any video data, and use the hash value as the digest information. The embodiment of the present application does not specifically limit which manner is used.

And secondly, the node equipment identifies the target of the at least two video data and intercepts at least one image frame comprising the target according to the target identification result.

In case two, the data used by the node device to generate the tile is in the form of an image frame. When the evidence obtaining requirement lies in tracking the motion track or form transition of the target, the video is identified, the image frame where the target is located is identified, the image frame can be used as an evidence, and the image frame without the target can not be used as a key information chain. For example, the target may be a human face, and for example, the target may be a vehicle with a certain license plate number, and the like. The number of the targets may be one or more, and the embodiment of the present application is not limited thereto. Therefore, the node device can identify the target by means of target identification, and the image frame including the target is cut out as a key information chain.

Specifically, in the second case, the node device may perform object recognition on the at least two video data, and obtain an object recognition result, where the object recognition result is used to indicate a position of at least one image frame including an object in the at least two video data. The node device may intercept the at least one image frame including the object from the at least two video data according to a position of the at least one image frame including the object in the at least two video data. Through the image frame intercepting step, the uplink data volume is reduced, and the storage burden can be effectively reduced.

The target identification process may be: and the node equipment performs feature extraction on each image frame in the at least two pieces of video data to obtain image features, wherein the image features can comprise at least one of color features, texture features, shape features or space features, the image features are matched with the model library, and at least one item of information of the name, the posture or the position of a matched target is output. The above target may be a person, an object, a character, a pattern, etc., and the target recognition process may also be implemented by a target recognition model, and the embodiment of the present application does not limit the form of the target and the implementation manner of the target recognition.

Through the target identification process, some important image frames in the video data are used as key information uplink, the storage burden is reduced, and simultaneously, the uplink information form is converted.

And thirdly, performing voice recognition on the at least two video data by the node equipment to obtain text data corresponding to the at least two video data.

In case three, the data used by the node device to generate the tile is text data. Specifically, the node device may extract audio track data from the at least two pieces of video data, perform speech recognition on the audio track data, and convert the audio track data into text data.

Among them, the technology of voice recognition is a technology of converting a voice signal into a corresponding text or command. Specifically, the speech recognition process may be to perform framing and windowing on the audio track data by the node device to obtain at least one speech segment, perform fourier transform on the at least one speech segment to obtain a corresponding spectral feature, and the node device may further process the spectral feature, for example, input the spectral feature into a mel filter to obtain a mel spectral feature, or may directly perform a subsequent matching step based on the spectral feature. After the node device obtains the spectrum feature, the spectrum feature may be matched with a known phoneme, and a phoneme corresponding to the spectrum feature is determined, so as to obtain text data corresponding to the audio track data. Of course, the speech recognition process may also be implemented by a speech recognition model, which is not limited in this embodiment of the present application.

For the text data, in one possible implementation, the text data may include text content corresponding to audio track data in the at least two video data. In another possible implementation manner, the text data includes text content corresponding to audio track data in the at least two video data and position information of the text content in the at least two video data. Through the position information, the text content can be associated with the video data, and the video data can be effectively traced.

Through the voice recognition technology, the video data are converted into the text data, the text data are easier to process, the data volume is small, the uplink data volume is greatly reduced while the key content of the video data can be uplink, the storage cost is reduced, and the processing efficiency is effectively improved.

And in case four, the node equipment extracts popup information or jump information in the at least two video data.

In the fourth case, if the requirement of the forensics is to extract the popup information or the skip information in the target forensics address, and the at least two pieces of video data received by the node device may include information other than the popup information or the skip information, therefore, in order to reduce the data volume of the uplink, the node device may extract the popup information or the skip information from the at least two pieces of video data, and use the extracted popup information or the skip information as the key information uplink.

In a possible implementation manner, the identification information of different information may be different, for example, the pop-up window information or the skip information corresponds to one identification information, the normal video playing content corresponds to another identification information, and the normal page display information corresponds to other identification information. Specifically, the extraction process may be: the node device may extract information corresponding to the identification information from the at least two pieces of video data as the popup information or the skip information according to the identification information of the popup information or the skip information.

In the fourth situation, the content required by the evidence obtaining requirement is extracted from the video data, and the required content is linked in a targeted manner, so that the linked content is ensured not to include redundant information, the linked data volume is reduced, the storage cost is reduced, and meanwhile, the user requirement is met.

It should be noted that, only four kinds of key information are provided, the video data is processed to obtain the key information including the key content, and the key information is linked, so that the linked data size can be reduced, and the storage load can be reduced.

Of course, the key information may be set by a related technician as required, for example, in the second case, the node device may further generate a motion trajectory of the target according to at least one image frame, and use the motion trajectory as the key information. For another example, in the fourth case, the node device may intercept, from the video data, an image frame corresponding to the pop-up information or the skip information according to the pop-up information or the skip information, and use the image frame as the key information. The embodiments of the present application do not limit this.

And step two, the node equipment generates the block based on the key information.

After the node equipment extracts the key information, a block is generated based on the key information, and the block is uplinked subsequently.

Specifically, the node device may perform hash calculation on the content of the block of the previous block of the block to obtain a hash value of the previous block, perform hash calculation on the key information to obtain a hash value of the key information, use the hash value of the previous block as the content of the block header of the block, use the hash value of the key information as the content of the block body of the block, and generate the block. The generation process of the block may specifically refer to the embodiments shown in fig. 2 and fig. 3, and of course, the contents of the block header of the block may further include a version number, a timestamp, a difficulty value, and the like, which is not described herein in detail.

In a possible implementation manner, the block generation process may further include a log file, in addition to the key information based on the video data, where the log file is used to record cleanliness of the video data, and the cleanliness is used to indicate a degree that the video data includes malicious data. In this implementation, the log file may be generated and transmitted to the node device by at least two node devices that record the video data, in which case the node device may receive at least two log files. The log file may also be generated by the node device after receiving at least two video data, and the node device may generate one log file to record the condition of the at least two video data.

Specifically, the log file is acquired in the following two ways.

In a first mode, a node device receives at least two log files sent by the at least two node devices, where the log files are used to record cleanliness of video data recorded by the node device, and the cleanliness is used to indicate a degree that the video data includes malicious data.

And in the second mode, the node equipment detects the cleanliness of the at least two video data and generates a log file, wherein the log file is used for recording the cleanliness of the at least two video data, and the cleanliness is used for indicating the degree of the video data including malicious data.

In one possible implementation mode, the node device can match the video data with a malicious database, obtain the ratio of the matched data to the video data, and use the ratio as the cleanliness of the video data. The malicious database comprises a plurality of malicious data. Of course, the detection process may also be implemented by a detection model, which is not limited in the embodiment of the present application.

Correspondingly, the node device can also uplink the key information of the video data and the log file together, and the cleanliness of the video data can be clearly known through the log file. The block generation process may be: the node equipment extracts the key information of the at least two pieces of video data, carries out hash calculation on the key information and the log file to obtain hash values of the key information and the log file, and generates a block by taking the key information and the hash values of the log file as the content of the block main body of the block. Of course, the process of generating the block may further include a process of performing hash calculation on the previous block to obtain the content of the block header of the block, which is the same as the above-mentioned second step, and is not repeated here.

In a possible implementation manner, the at least two pieces of video data obtained by recording the content shown by the same target forensics address by the at least two pieces of node equipment should be the same, if the video data recorded by a certain piece of node equipment is different from the video data recorded by other piece of node equipment, there may be a problem with the video data, a failure may occur in the recording process, the recording process may be invaded and interfered by other software, and the data is tampered, so that the authenticity and accuracy of the recorded video data cannot be guaranteed.

In this implementation, the generating of the block may be performed after the at least two video data are compared to find that the similarity is high. Specifically, the node device may compare the at least two video data, and in response to that the similarity between the at least two video data is greater than the similarity threshold, perform the generating step of the block. By carrying out comparative analysis on the at least two video data, the authenticity and the accuracy of the at least two video data are further ensured.

After comparing the at least two video data, there is another possible scene: the similarity between any video data and other video data is less than or equal to a similarity threshold. In this scenario, the node device may send a forensics failure notification in response to the similarity between any video data and other video data being less than or equal to a similarity threshold. The node equipment needs to re-obtain evidence based on the evidence obtaining request, and generates a block when the similarity is found to meet the condition by the comparison, and chains the block.

706. The node apparatus adds the block to the blockchain in response to a consensus that the block passed through the blockchain system.

After the block is generated, the block may be broadcasted to other node devices in the blockchain system by the node device generating the block, each node device in the blockchain system may share the block, and when the block passes the sharing, the node device may add the block to the blockchain configured by the node device.

It should be noted that all node devices in the blockchain system can perform the step 706 to ensure that the blockchain maintained by the node devices in the blockchain system is consistent.

Through the steps, the current node equipment stores the at least two video data in a local database of the current node equipment, and stores key information of the at least two video data to the block chain, the video data is automatically recorded by the node equipment in the block chain system, and is not certified by a party, so that the labor cost is reduced, and because the key information of the video data is added to the block chain through the block chain technology and the data on the block chain cannot be tampered once being linked, the key information can be subsequently extracted from the block chain to verify whether the video data in the local database is tampered, so that the evidence obtaining data can be guaranteed to be not tampered by utilizing the non-tampering and verifying process of the block chain data, the authenticity of the evidence obtaining data can be guaranteed, and the evidence obtaining efficiency is also improved.

For the verification process, when receiving an acquisition request for video data, the node device may extract key information of the video data from the blockchain, and verify the video data based on the key information. If the video data passes the verification, the node equipment can respond to the video data and send the video data to the corresponding electronic equipment; if the video data is not verified, the node device may send an acquisition failure notification informing that the video data has been changed.

In a possible implementation manner, after the node device stores the block in the block chain, a certificate of authenticity may be generated according to the video data and the information of the block, so that the information of the video data and the block for storing the key information of the video data may be clearly known through the certificate of authenticity. Specifically, the generation process of the certificate of authenticity may be: the node device may obtain a block height of the block on the blockchain, and generate a certificate of authenticity based on the block height and information of the video data. The user can confirm that the evidence obtaining data is successfully linked through the evidence certificate and know some information on the corresponding chain, the evidence certificate can also be used as an electronic certificate for obtaining evidence at this time, and the relevant information for obtaining evidence at this time can be traced through the electronic certificate.

The position of the block on the blockchain can be known through the height of the block, and the content of the video data can be roughly known through the information of the video data. In one possible implementation, the certificate of authenticity includes at least one of a name, a size, a time of authenticity, an encoding, a digital fingerprint, a certificate number, a certificate holder, a certificate number, a platform account number, and a validity period of the video data, and a block height.

For example, as shown in fig. 10, the certificate may include basic information 1001 and information 1002 of the certificate, the information 1002 may include information of video data and blocks, the basic information 1001 of the certificate may include a certificate number, a certificate holder, a certificate number, a platform account number, a certificate validity period, and the like, and the information of the video data and the blocks may include an evidence name, a certificate storage time, an evidence size, an evidence code, a digital fingerprint, an Identification (ID) of a block chain, and the like.

In a specific possible embodiment, after the node device generates the certificate of authenticity, the certificate of authenticity may also be stored in the local database, so that both the video data and the certificate of authenticity stored in the local database may be provided for the user to view. Specifically, a user may perform a witness check operation on the electronic device, and the electronic device sends a witness check request to the node device in response to the witness check operation, and the node device receives the witness check request, and may obtain, in response to the witness check request, at least one of the video data indicated by the witness check request or a witness certificate corresponding to the video data from the local database, and send the at least one of the video data or the witness certificate corresponding to the video data to the electronic device corresponding to the witness check request. The function is looked over through providing the user, and the user can look over whether the video data that the evidence was obtained accords with own demand, if not conform to, also can readjust the information of collecting evidence again and carry out the evidence collection again to the video data that the assurance was obtained of collecting evidence can satisfy the user demand, improves the practicality of above-mentioned method of collecting evidence. The user can also confirm that the forensic data has been successfully uplink through the certificate of evidence, and know some information of uplink, and the certificate of evidence can also be used as an electronic certificate for this forensic.

In a specific possible embodiment, in addition to the video data, the node device may further extract, in response to the witness request, a log file corresponding to the video data from the blockchain, and send the log file to the electronic device corresponding to the witness request.

For example, as shown in (1) in fig. 11, when the user wants to view the present certificate of credit, the node device may send video data 1102 and a log file 1103 to the electronic device. The electronic device may display the video data and the log file, where the log file may adopt a PDF (Portable Document Format), and certainly, the user may also perform a viewing operation on the video data, the electronic device may play the video data in response to the viewing operation, and the electronic device may also display the virtual machine 1101 (that is, a node device) selected by this forensics, such as beijing, shanghai, and seoul. As shown in (2) in fig. 11, if it is desired to view information of a tile on the blockchain, the tile information may also be presented through the front end by obtaining the tile information of the blockchain, where the tile information may include information of the uplink tile, such as tile height, time of entering the chain, node of leaving the chain, node ID, status of the node device, and the like, and may also include transaction data in the tile (for the tile added to the blockchain in step 706, the transaction data may include key information of the video data).

The user can look over this information of collecting evidence, also can look over the video data that the collecting evidence obtained, can also look over corresponding log file, through this function of looking over, the user can be directly perceived, clearly understand this data that the collecting evidence obtained, can also clearly learn video data's cleanliness through log file, therefore the visual effectual of collecting evidence data, the display effect is good.

In a possible implementation manner, the video data obtained by the forensics needs to be notarized, and the video data is used as evidence after notarization, so that the node device can respond to a notarization request and automatically send the video data to the notarization. Specifically, the node device may respond to the notarization request, obtain the video data indicated by the notarization request from the local database, send the video data to the target node device, and receive a notarization result sent by the target node device. The target node device is used for extracting video data from the node device for notarization, and for example, the target node device can be a node device of a notarization department.

Wherein the target node device can verify the authenticity, validity and relevance of the content of the video data. For the certified notarization result, if the certification is passed, the notarization result can adopt the form of an electronic signature or an electronic notarization, and if the certification is failed, the notarization result can adopt the form of message notification.

In particular, if the verification passes, in one possible implementation, the target node device may add an electronic signature to the video data in response to the verification passing, the electronic signature being used to identify that the video data has passed the notarization. In another possible implementation manner, the target node device may send, in response to the verification passing, an electronic notarization corresponding to the video data, where the electronic notarization may verify the passing notarization result, and may also include identification information of the video data, for example, a forensics name in forensics information corresponding to the video data. Of course, the electronic public certificate may also include a signature of a notary, and the specific content of the electronic public certificate is not limited in the embodiment of the present application.

If the verification fails, the target node device may return a verification failure notification, where the verification failure notification is used to notify that notarization of the video data fails. Specifically, the verification failure notification may further include a notarization failure reason. Thus, after receiving the verification failure notification, the node device can notify the user to re-obtain evidence for notarization.

By sending the notarization request to the node equipment, the node equipment automatically sends the video data to the target node equipment for notarization without obtaining the notarization by the party, so that the notarization efficiency is improved, and the process has no manual participation and can effectively ensure the authenticity and the accuracy of the video data.

In the embodiment of the application, a forensics instruction is sent to at least two node devices in response to a forensics request for a target forensics address, so that at least two pieces of video data obtained by recording the content displayed by the target forensics address by the at least two node devices are obtained, the at least two pieces of video data are stored in a local database of the current node device, and key information of the at least two pieces of video data is stored in a block chain.

A specific example is provided below to explain a specific flow of the multiline forensics method based on the block chain, as shown in fig. 12, the multiline forensics method based on the block chain may be executed by a server 1201 of a service platform, where the server is a node device in the block chain system, the server 1201 of the service platform, a device 1202 of a user, N virtual cloud desktop clients 1203 and a judicial organization 1204 are connected, and the N virtual cloud desktop clients 1203 are N node devices in the block chain system. Wherein N is an integer greater than 1.

In the forensics method, a user can input forensics information in different places by operating on the device 1202 where the user is located, the device 1202 where the user is located can send the forensics information in different places to the server 1201 where the service platform is located by means of forensics request, and the server 1201 where the service platform is located can store the forensics information in different places. The server 1201 where the service platform is located can also broadcast a forensics instruction to the N virtual cloud desktop clients 1203 in a message broadcasting manner, where the forensics instruction includes the remote forensics information, at least two virtual cloud desktop clients 1203 indicated in the remote forensics information can monitor the forensics instruction, perform processing such as screen recording in response to the forensics instruction, obtain screen recording data (i.e., video data), and upload the screen recording data to the server 1201 where the service platform is located, and after receiving the at least two screen recording data, the server 1201 where the service platform is located can store the screen recording data into a local database of the server 1201 where the service platform is located. For the at least two screen recording data, a contract is also called, key information of the screen recording data is written into a recording contract as a record, the record is linked, namely, the record is used as a block content generation block through the execution of the recording contract, and the block is added to the block chain. The server 1201 where the service platform is located can also send at least two screen recording data to a judicial institution for notarization.

Specifically, the steps performed by the above-mentioned devices are explained in detail by the embodiment shown in fig. 13. As shown in fig. 13, the multiple devices are named as user equipment, a front end (here, a front end engine provided by the service platform), a back end service (here, a server where the service platform is located), and a cloud desktop client (here, a node device for forensics) according to their positions in the service logic. In the method flow, the user equipment can access the front-end platform, write and record the evidence obtaining information (namely the evidence obtaining information and the allopatric evidence obtaining information) on the screen in a filling mode, after the user finishes filling, the front end can check the information, and after the information is checked to be correct, the information is submitted to the back end service. The back-end service can process the received information and send out message broadcast. The message broadcasting can be broadcasted in a message queue mode to all cloud desktop clients subscribing to the message queue, wherein the message broadcasting comprises the cloud desktop client selected by a user, the cloud desktop clients can analyze and process the message after receiving the message, open a browser, automatically access a website, control screen recording software to obtain screen recording data and upload the screen recording data, and the uploading step is to submit information (namely screen recording data and video data) such as a recorded video file to a back end. The user can inquire the detail information of recording screen evidence collection through the front end, and the detail information of recording screen evidence collection is provided for the front end by the back end.

In the multi-line evidence obtaining method based on the block chain, access to evidence storing data is realized based on the technical characteristics of the block chain, electronic data cannot be tampered, and the reliability of the evidence storing data can be guaranteed. The cloud desktop evidence obtaining mode is adopted in the evidence obtaining process, the cloud desktop is a clean tool, the recorded video file is operated by the background cloud desktop instead of the front-end user, so that the tampering operation of the user on the evidence storing file is avoided, the provided evidence is more convincing, and the legality and authenticity of the evidence are ensured.

The remote multiline mode is also adopted to further prove the credibility of the used virtual machine for evidence. Specifically, the evidence contents acquired by the multiple virtual machines are the same, so that the evidence cannot be tampered, the situation that evidence data is lost or tampered easily due to single evidence in the related technology is avoided, and the defects of high cost, low efficiency, difficulty in acquiring letters and the like gradually appear. In the traditional evidence storage, once the center is attacked, the data of the evidence is easily lost or tampered under the centralized evidence storage. In addition, supervision can be realized through multiple lines in different places in the whole process, the reliability of data is high, evidence identification is facilitated, and the trust ratio of evidence in litigation is improved. The key information is stored through the block chain, and the storage is independent of an electronic medium, so that the storage cost is also reduced.

All the above optional technical solutions may be combined arbitrarily to form optional embodiments of the present application, and are not described herein again.

Fig. 14 is a schematic structural diagram of a block chain-based multiline forensics apparatus according to an embodiment of the present application, please refer to fig. 14, which includes the apparatus.

A receiving module 1401, configured to receive a forensics request for a target forensics address;

a sending module 1402, configured to respond to the forensics request, send a forensics instruction to at least two node devices in the blockchain system indicated by the forensics request, where the forensics instruction carries the target forensics address;

the receiving module 1401 is further configured to receive at least two pieces of video data sent by the at least two pieces of node equipment, where the at least two pieces of video data are obtained by recording content shown by the target forensics address in response to the forensics instruction;

a storage module 1403, configured to store the at least two pieces of video data in a local database of the node device, and obtain a block generated based on key information of the at least two pieces of video data;

the storage module 1403 is further configured to add the block to the blockchain in response to the consensus of the block through the blockchain system.

In one possible implementation, the generating of the block includes:

extracting key information of the at least two video data;

based on the key information, the block is generated.

extracting summary information of the at least two video data;

carrying out target recognition on the at least two video data, and intercepting at least one image frame comprising a target according to a target recognition result;

and extracting popup information or skip information in the at least two video data.

In one possible implementation, the performing object recognition on the at least two video data, and intercepting at least one image frame including an object according to the object recognition result includes:

the at least one image frame including the object is cut out from the at least two video data according to a position of the at least one image frame including the object in the at least two video data.

extracting the audio track data in the at least two video data;

In one possible implementation, the extracting of the pop-window information or the skip information in the at least two video data includes:

performing hash calculation on the block content of the previous block of the block to obtain a hash value of the previous block;

In one possible implementation, the generating of the block includes:

extracting key information of the at least two video data;

In a possible implementation manner, the receiving module 1401 is further configured to receive at least two log files sent by the at least two node devices, where the log files are used to record cleanliness of video data recorded by the node devices, and the cleanliness is used to indicate a degree that the video data includes malicious data.

In one possible implementation, the apparatus further includes:

In one possible implementation, the generating of the block includes:

comparing the at least two video data;

and performing the block generating step in response to the similarity between the at least two video data being greater than the similarity threshold.

In one possible implementation, the sending module 1402 is further configured to send a forensics failure notification in response to a similarity between any video data and other video data being less than or equal to a similarity threshold.

the sending module 1402 is configured to send a forensics instruction by using the IP addresses of the at least two node devices as target addresses in response to the forensics request.

In a possible implementation manner, a target client is installed on the at least two node devices, and the target client is configured to automatically access the target forensics address in response to the forensics instruction, and record content shown by the target forensics address to obtain video data.

In one possible implementation, the apparatus further includes:

the first acquisition module is used for responding to the notarization request and acquiring the video data indicated by the notarization request from the local database; the sending module 1402 is further configured to send the video data to a target node device; the receiving module 1401 is further configured to receive a notarization result sent by the target node device.

In one possible implementation, the apparatus further includes:

the third acquisition module is used for responding to the evidence checking request and acquiring at least one item of video data indicated by the evidence checking request or an evidence checking certificate corresponding to the video data from the local database; the sending module 1402 is further configured to send at least one of the video data and the certificate of credit corresponding to the video data to the electronic device corresponding to the certificate of credit viewing request.

In one possible implementation, the sending module 1402 is configured to broadcast a forensics instruction to node devices in the blockchain system in response to the forensics request, where the forensics instruction is used to instruct the node devices of the target address to forensics the target forensics address.

The device provided by the embodiment of the application sends the evidence obtaining instruction to the at least two node devices by responding to the evidence obtaining request, so as to obtain the at least two video data obtained by recording the content shown by the target evidence obtaining address by the at least two node devices, store the at least two video data in the local database of the current node device, and store the key information of the at least two video data in the block chain, and the node devices in the block chain system automatically record the video data and store the key information in the block chain instead of obtaining evidence by the parties, so that the labor cost is reduced, the obtained evidence obtaining data cannot be tampered, the authenticity of the evidence obtaining data can be ensured, and the evidence obtaining efficiency is also improved.

It should be noted that: in the multi-line forensics apparatus based on the block chain according to the above embodiment, only the division of the functional modules is used for illustration when forensics is performed, and in practical applications, the function distribution may be completed by different functional modules according to needs, that is, the internal structure of the electronic device is divided into different functional modules, so as to complete all or part of the functions described above. In addition, the block chain-based multi-line forensics apparatus provided in the above embodiment and the block chain-based multi-line forensics method embodiment belong to the same concept, and specific implementation processes thereof are detailed in the block chain-based multi-line forensics method embodiment, and are not described here again.

The electronic device may be provided as a terminal shown in fig. 15 described below, or may be provided as a server shown in fig. 16 described below, which is not limited in this embodiment of the present application.

Fig. 15 is a schematic structural diagram of a terminal 1500 according to an embodiment of the present application, where the terminal 1500 may be: a smart phone, a tablet computer, an MP3 player (Moving Picture Experts Group Audio Layer III, motion video Experts compression standard Audio Layer 3), an MP4 player (Moving Picture Experts Group Audio Layer IV, motion video Experts compression standard Audio Layer 4), a notebook computer, or a desktop computer. Terminal 1500 may also be referred to as user equipment, a portable terminal, a laptop terminal, a desktop terminal, or other names.

In general, terminal 1500 includes: a processor 1501 and memory 1502.

Processor 1501 may include one or more processing cores, such as a 4-core processor, an 8-core processor, or the like. The processor 1501 may be implemented in at least one hardware form of a DSP (Digital Signal Processing), an FPGA (Field-Programmable Gate Array), and a PLA (Programmable Logic Array). Processor 1501 may also include a main processor and a coprocessor, where the main processor is a processor for processing data in an awake state, and is also called a Central Processing Unit (CPU); a coprocessor is a low power processor for processing data in a standby state. In some embodiments, the processor 1501 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content required to be displayed on the display screen. In some embodiments, processor 1501 may also include an AI (Artificial Intelligence) processor for processing computational operations related to machine learning.

The memory 1502 may include one or more computer-readable storage media, which may be non-transitory. The memory 1502 may also include high-speed random access memory, as well as non-volatile memory, such as one or more magnetic disk storage devices, flash memory storage devices. In some embodiments, a non-transitory computer readable storage medium in the memory 1502 is configured to store at least one instruction for execution by the processor 1501 to implement the blockchain based multi-line forensics methods provided by the various embodiments herein.

In some embodiments, the terminal 1500 may further include: a peripheral interface 1503 and at least one peripheral. The processor 1501, memory 1502, and peripheral interface 1503 may be connected by buses or signal lines. Various peripheral devices may be connected to peripheral interface 1503 via buses, signal lines, or circuit boards. Specifically, the peripheral device includes: at least one of radio frequency circuitry 1504, touch screen display 1505, camera assembly 1506, audio circuitry 1507, positioning assembly 1508, and power supply 1509.

The peripheral interface 1503 may be used to connect at least one peripheral related to I/O (Input/Output) to the processor 1501 and the memory 1502. In some embodiments, the processor 1501, memory 1502, and peripheral interface 1503 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 1501, the memory 1502, and the peripheral interface 1503 may be implemented on separate chips or circuit boards, which is not limited in this embodiment.

The Radio Frequency circuit 1504 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency circuitry 1504 communicates with communication networks and other communication devices via electromagnetic signals. The radio frequency circuit 1504 converts an electrical signal into an electromagnetic signal to transmit, or converts a received electromagnetic signal into an electrical signal. Optionally, the radio frequency circuit 1504 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a subscriber identity module card, and so forth. The radio frequency circuit 1504 can communicate with other terminals via at least one wireless communication protocol. The wireless communication protocols include, but are not limited to: metropolitan area networks, various generation mobile communication networks (2G, 3G, 4G, and 5G), Wireless local area networks, and/or WiFi (Wireless Fidelity) networks. In some embodiments, the radio frequency circuit 1504 may also include NFC (Near Field Communication) related circuits, which are not limited in this application.

The display screen 1505 is used to display a UI (User Interface). The UI may include graphics, text, icons, video, and any combination thereof. When the display screen 1505 is a touch display screen, the display screen 1505 also has the ability to capture touch signals on or over the surface of the display screen 1505. The touch signal may be input to the processor 1501 as a control signal for processing. In this case, the display screen 1505 may also be used to provide virtual buttons and/or a virtual keyboard, also referred to as soft buttons and/or a soft keyboard. In some embodiments, display 1505 may be one, providing the front panel of terminal 1500; in other embodiments, display 1505 may be at least two, each disposed on a different surface of terminal 1500 or in a folded design; in still other embodiments, display 1505 may be a flexible display disposed on a curved surface or a folded surface of terminal 1500. Even further, the display 1505 may be configured in a non-rectangular irregular pattern, i.e., a shaped screen. The Display 1505 can be made of LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode), and other materials.

The camera assembly 1506 is used to capture images or video. Optionally, the camera assembly 1506 includes a front camera and a rear camera. Generally, a front camera is disposed at a front panel of the terminal, and a rear camera is disposed at a rear surface of the terminal. In some embodiments, the number of the rear cameras is at least two, and each rear camera is any one of a main camera, a depth-of-field camera, a wide-angle camera and a telephoto camera, so that the main camera and the depth-of-field camera are fused to realize a background blurring function, and the main camera and the wide-angle camera are fused to realize panoramic shooting and VR (Virtual Reality) shooting functions or other fusion shooting functions. In some embodiments, camera assembly 1506 may also include a flash. The flash lamp can be a monochrome temperature flash lamp or a bicolor temperature flash lamp. The double-color-temperature flash lamp is a combination of a warm-light flash lamp and a cold-light flash lamp, and can be used for light compensation at different color temperatures.

The audio circuitry 1507 may include a microphone and speaker. The microphone is used for collecting sound waves of a user and the environment, converting the sound waves into electric signals, and inputting the electric signals to the processor 1501 for processing or inputting the electric signals to the radio frequency circuit 1504 to realize voice communication. For stereo capture or noise reduction purposes, multiple microphones may be provided, each at a different location of the terminal 1500. The microphone may also be an array microphone or an omni-directional pick-up microphone. The speaker is used to convert electrical signals from the processor 1501 or the radio frequency circuit 1504 into sound waves. The loudspeaker can be a traditional film loudspeaker or a piezoelectric ceramic loudspeaker. When the speaker is a piezoelectric ceramic speaker, the speaker can be used for purposes such as converting an electric signal into a sound wave audible to a human being, or converting an electric signal into a sound wave inaudible to a human being to measure a distance. In some embodiments, the audio circuitry 1507 may also include a headphone jack.

The positioning component 1508 is used to locate a current geographic position of the terminal 1500 to implement navigation or LBS (location based Service). The positioning component 1508 may be a positioning component based on the united states GPS (global positioning System), the chinese beidou System, the russian graves System, or the european union's galileo System.

Power supply 1509 is used to power the various components in terminal 1500. The power supply 1509 may be alternating current, direct current, disposable or rechargeable. When the power supply 1509 includes a rechargeable battery, the rechargeable battery may support wired charging or wireless charging. The rechargeable battery may also be used to support fast charge technology.

In some embodiments, the terminal 1500 also includes one or more sensors 1510. The one or more sensors 1510 include, but are not limited to: acceleration sensor 1511, gyro sensor 1512, pressure sensor 1513, fingerprint sensor 1514, optical sensor 1515, and proximity sensor 1516.

The acceleration sensor 1511 may detect the magnitude of acceleration on three coordinate axes of the coordinate system established with the terminal 1500. For example, the acceleration sensor 1511 may be used to detect components of the gravitational acceleration in three coordinate axes. The processor 1501 may control the touch screen display 1505 to display the user interface in a landscape view or a portrait view according to the gravitational acceleration signal collected by the acceleration sensor 1511. The acceleration sensor 1511 may also be used for acquisition of motion data of a game or a user.

The gyroscope sensor 1512 can detect the body direction and the rotation angle of the terminal 1500, and the gyroscope sensor 1512 and the acceleration sensor 1511 cooperate to collect the 3D motion of the user on the terminal 1500. The processor 1501 may implement the following functions according to the data collected by the gyro sensor 1512: motion sensing (such as changing the UI according to a user's tilting operation), image stabilization at the time of photographing, game control, and inertial navigation.

Pressure sensor 1513 may be disposed on a side bezel of terminal 1500 and/or underneath touch display 1505. When the pressure sensor 1513 is disposed on the side frame of the terminal 1500, the holding signal of the user to the terminal 1500 may be detected, and the processor 1501 performs left-right hand recognition or shortcut operation according to the holding signal collected by the pressure sensor 1513. When the pressure sensor 1513 is disposed at a lower layer of the touch display 1505, the processor 1501 controls the operability control on the UI interface according to the pressure operation of the user on the touch display 1505. The operability control comprises at least one of a button control, a scroll bar control, an icon control and a menu control.

The fingerprint sensor 1514 is configured to capture a fingerprint of the user, and the processor 1501 identifies the user based on the fingerprint captured by the fingerprint sensor 1514, or the fingerprint sensor 1514 identifies the user based on the captured fingerprint. Upon recognizing that the user's identity is a trusted identity, the processor 1501 authorizes the user to perform relevant sensitive operations including unlocking the screen, viewing encrypted information, downloading software, paying, and changing settings, etc. The fingerprint sensor 1514 may be disposed on the front, back, or side of the terminal 1500. When a physical key or vendor Logo is provided on the terminal 1500, the fingerprint sensor 1514 may be integrated with the physical key or vendor Logo.

The optical sensor 1515 is used to collect ambient light intensity. In one embodiment, processor 1501 may control the brightness of the display on touch screen 1505 based on the intensity of ambient light collected by optical sensor 1515. Specifically, when the ambient light intensity is high, the display brightness of the touch display screen 1505 is increased; when the ambient light intensity is low, the display brightness of the touch display screen 1505 is turned down. In another embodiment, the processor 1501 may also dynamically adjust the shooting parameters of the camera assembly 1506 based on the ambient light intensity collected by the optical sensor 1515.

A proximity sensor 1516, also known as a distance sensor, is typically provided on the front panel of the terminal 1500. The proximity sensor 1516 is used to collect the distance between the user and the front surface of the terminal 1500. In one embodiment, when the proximity sensor 1516 detects that the distance between the user and the front surface of the terminal 1500 gradually decreases, the processor 1501 controls the touch display 1505 to switch from the bright screen state to the dark screen state; when the proximity sensor 1516 detects that the distance between the user and the front surface of the terminal 1500 gradually becomes larger, the processor 1501 controls the touch display 1505 to switch from the breath screen state to the bright screen state.

Those skilled in the art will appreciate that the configuration shown in fig. 15 does not constitute a limitation of terminal 1500, and may include more or fewer components than shown, or some components may be combined, or a different arrangement of components may be employed.

Fig. 16 is a schematic structural diagram of a server 1600 according to an embodiment of the present application, where the server 1600 may generate a relatively large difference due to different configurations or performances, and may include one or more processors (CPUs) 1601 and one or more memories 1602, where the memory 1602 stores at least one program code, and the at least one program code is loaded and executed by the processors 1601 to implement the blockchain-based multi-line forensics method according to the embodiments. Of course, the server 1600 may also have components such as a wired or wireless network interface, a keyboard, and an input/output interface, so as to perform input/output, and the server 1600 may also include other components for implementing device functions, which are not described herein.

In an exemplary embodiment, a computer readable storage medium, such as a memory, including at least one program code executable by a processor in an electronic device to perform the above-described blockchain based multi-line forensics method is also provided. For example, the computer-readable storage medium may be a ROM (Read-Only Memory), a RAM (Random-Access Memory), a CD-ROM (Compact disc-Read-Only Memory), a magnetic tape, a floppy disk, an optical data storage device, and the like.

It will be understood by those skilled in the art that all or part of the steps for implementing the above embodiments may be implemented by hardware, or may be implemented by a program instructing relevant hardware, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a magnetic disk or an optical disk, etc.

The above description is only exemplary of the present application and should not be taken as limiting, as any modification, equivalent replacement, or improvement made within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. An allopatric multiline forensics method based on a block chain, which is applied to a node device in a block chain system, and comprises the following steps:

receiving a forensics request for a target forensics address, wherein the forensics request carries Internet Protocol (IP) addresses and forensics keywords of at least two node devices;

responding to the forensics request, sending a forensics instruction by taking the IP addresses of the at least two node devices as target addresses, wherein the forensics instruction carries the target forensics address and the forensics keyword, and the at least two node devices are located in different areas;

receiving at least two pieces of video data sent by the at least two pieces of node equipment, wherein the at least two pieces of video data are obtained by recording the content displayed by the target forensics address and the content matched with the forensics keyword in response to the forensics instruction;

comparing the at least two video data;

in response to the fact that the similarity between the at least two pieces of video data is larger than a similarity threshold, storing the at least two pieces of video data into a local database of the node equipment, and acquiring a block generated based on key information of the at least two pieces of video data;

2. The method of claim 1, wherein the generating of the block comprises:

extracting key information of the at least two video data;

generating the block based on the key information.

3. The method according to claim 2, wherein said extracting key information of said at least two video data comprises any one of:

extracting summary information of the at least two video data;

4. The method of claim 3, wherein the performing object recognition on the at least two video data, and intercepting at least one image frame including an object according to the object recognition result comprises:

5. The method according to claim 3, wherein the performing speech recognition on the at least two video data to obtain text data corresponding to the at least two video data comprises:

extracting audio track data from the at least two video data;

6. The method of claim 3, wherein the extracting the popup information or the skip information in the at least two video data comprises:

7. The method of claim 2, wherein generating the block based on the key information comprises:

8. The method of claim 1, further comprising any of:

receiving at least two log files sent by the at least two node devices, wherein the log files are used for recording the cleanliness of video data recorded by the node devices, and the cleanliness is used for indicating the degree that the video data comprise malicious data;

and detecting the cleanliness of the at least two video data, and generating a log file, wherein the log file is used for recording the cleanliness of the at least two video data, and the cleanliness is used for indicating the degree of the video data including malicious data.

9. The method according to claim 1, wherein a target client is installed on the at least two node devices, and the target client is configured to automatically access the target forensics address in response to the forensics instruction, and record content shown by the target forensics address to obtain video data.

10. The method of claim 1, further comprising:

acquiring the block height of the block on the block chain;

and generating a certificate of authenticity based on the block height and the information of the video data.

11. An allopatric multiline forensics device based on a blockchain, the device comprising:

the system comprises a receiving module, a processing module and a processing module, wherein the receiving module is used for receiving a forensics request for a target forensics address, and the forensics request carries Internet Protocol (IP) addresses and forensics keywords of at least two node devices;

a sending module, configured to send a forensics instruction in response to the forensics request, with the IP addresses of the at least two node devices being target addresses, where the forensics instruction carries the target forensics address and the forensics keyword, and the at least two node devices are located in different areas;

the receiving module is further configured to receive at least two pieces of video data sent by the at least two pieces of node equipment, where the at least two pieces of video data are obtained by recording, in response to the forensics instruction, content shown by the target forensics address and content matched with the forensics keyword;

the storage module is used for comparing the at least two video data; in response to the fact that the similarity between the at least two pieces of video data is larger than a similarity threshold, storing the at least two pieces of video data into a local database of the node equipment, and acquiring a block generated based on key information of the at least two pieces of video data;

the storage module is further configured to add the tile to a blockchain in response to the consensus of the tile through the blockchain system.

12. An electronic device, comprising one or more processors and one or more memories having at least one program code stored therein, the at least one program code being loaded and executed by the one or more processors to perform operations performed by the blockchain-based multi-wire forensics method of any of claims 1-10.

13. A storage medium having stored therein at least one program code, which is loaded and executed by a processor to perform operations performed by a blockchain based multiline forensics method according to any one of claims 1 to 10.