CN111986166A - Validity identification method and system for multimedia evidence content - Google Patents
Validity identification method and system for multimedia evidence content Download PDFInfo
- Publication number
- CN111986166A CN111986166A CN202010768878.5A CN202010768878A CN111986166A CN 111986166 A CN111986166 A CN 111986166A CN 202010768878 A CN202010768878 A CN 202010768878A CN 111986166 A CN111986166 A CN 111986166A
- Authority
- CN
- China
- Prior art keywords
- evidence
- execution environment
- content
- task
- forensics
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 71
- 230000004044 response Effects 0.000 claims abstract description 20
- 238000012795 verification Methods 0.000 claims description 31
- 238000004590 computer program Methods 0.000 claims description 4
- 230000008569 process Effects 0.000 description 18
- 238000004891 communication Methods 0.000 description 10
- 238000010586 diagram Methods 0.000 description 8
- 230000006870 function Effects 0.000 description 7
- 238000012545 processing Methods 0.000 description 6
- 238000012550 audit Methods 0.000 description 3
- 238000012552 review Methods 0.000 description 3
- 208000028399 Critical Illness Diseases 0.000 description 2
- 238000012512 characterization method Methods 0.000 description 2
- 238000012790 confirmation Methods 0.000 description 2
- 238000005034 decoration Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000007246 mechanism Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000008520 organization Effects 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000004883 computer application Methods 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
- 208000024891 symptom Diseases 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06T—IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- G06T7/00—Image analysis
- G06T7/0002—Inspection of images, e.g. flaw detection
- G06T7/0004—Industrial image inspection
- G06T7/001—Industrial image inspection using an image reference approach
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q50/00—Systems or methods specially adapted for specific business sectors, e.g. utilities or tourism
- G06Q50/10—Services
- G06Q50/18—Legal services; Handling legal documents
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06T—IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- G06T2207/00—Indexing scheme for image analysis or image enhancement
- G06T2207/10—Image acquisition modality
- G06T2207/10016—Video; Image sequence
Abstract
The specification discloses a method and a system for identifying validity of multimedia evidence content, wherein at least one execution environment requirement is specified for any evidence obtaining task. The method comprises the following steps: the client executes forensics operation aiming at any forensics task, wherein the forensics operation comprises the following steps: generating evidence content in a multimedia format, simultaneously recording execution environment information when the evidence obtaining operation is executed, and associating the generated evidence content with the recorded execution environment information to obtain an association result; feeding back the correlation result to a server as a response of the forensics task; and the server matches the execution environment information with the specified execution environment requirement of the evidence obtaining task, and judges the validity of the evidence content according to the matching result.
Description
Technical Field
The embodiment of the specification relates to the technical field of computer application, in particular to a method and a system for identifying validity of multimedia evidence content.
Background
At present, many scenes include a evidence obtaining link, and an evidence obtaining party is often required to obtain evidence. For example, when verifying the authenticity of information for collecting donations, a third-party organization needs to be entrusted to collect evidence.
The process of obtaining evidence usually includes shooting related images or videos, recording voice and the like, and then using multimedia such as the acquired images, videos or voices as evidence for auditing information. For example, when auditing donation application information of a patient, multimedia evidence contents such as medical record images, patient and relatives images, images of hospital-related certificates and the like can be acquired, and then auditing is performed based on the acquired multimedia evidence contents.
However, multimedia evidence content can be counterfeited, e.g., modifying images to hide important information, processing video to provide erroneous information. At present, the effectiveness of multimedia evidence content is difficult to identify, and only the subjective integrity of a evidence obtaining party can be relied on.
Therefore, it is difficult to guarantee the authenticity and reliability of the result of the audit from the customer.
Disclosure of Invention
In order to guarantee authenticity and reliability of an audit result from the aspect of visitors, the specification provides a validity identification method and a validity identification system for multimedia evidence contents. The technical scheme is as follows.
A validity identification method aiming at multimedia evidence content, at least one execution environment requirement is specified for any evidence obtaining task, and the method comprises the following steps:
the client executes forensics operation aiming at any forensics task, wherein the forensics operation comprises the following steps: generating evidence content in a multimedia format, simultaneously recording execution environment information when the evidence obtaining operation is executed, and associating the generated evidence content with the recorded execution environment information to obtain an association result;
feeding back the correlation result to a server as a response of the forensics task;
and the server matches the execution environment information with the specified execution environment requirement of the evidence obtaining task, and judges the validity of the evidence content according to the matching result.
A system for identifying validity of multimedia evidence content, specifying at least one execution environment requirement for any forensic task, the system comprising:
the client executes the evidence obtaining operation aiming at any evidence obtaining task, wherein the evidence obtaining operation comprises the following steps: generating evidence content in a multimedia format, simultaneously recording execution environment information when the evidence obtaining operation is executed, and associating the generated evidence content with the recorded execution environment information to obtain an association result; feeding back the correlation result to a server as a response of the forensics task;
and the server side matches the execution environment information with the specified execution environment requirement of the evidence obtaining task, and judges the validity of the evidence content according to a matching result.
By the technical scheme, the execution environment information is added outside the evidence content, so that the server side can identify and verify whether the evidence content is acquired under the requirement of the execution environment of the evidence obtaining task according to the execution environment information, the validity of the evidence content can be identified objectively, and the authenticity and the reliability of an auditing result are ensured.
Drawings
In order to more clearly illustrate the embodiments of the present specification or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the embodiments of the present specification, and other drawings can be obtained by those skilled in the art according to the drawings.
FIG. 1 is a schematic diagram of a structure of a correlation result provided in an embodiment of the present disclosure;
fig. 2 is a schematic flowchart of a validity identification method for multimedia evidence content according to an embodiment of the present specification;
fig. 3 is a schematic diagram illustrating a method for identifying validity of multimedia evidence content according to an embodiment of the present disclosure;
fig. 4 is a schematic structural diagram of an effectiveness identification system for multimedia evidence content provided by an embodiment of the present specification;
fig. 5 is a schematic structural diagram of an apparatus for configuring a method according to an embodiment of the present disclosure.
Detailed Description
In order to make those skilled in the art better understand the technical solutions in the embodiments of the present specification, the technical solutions in the embodiments of the present specification will be described in detail below with reference to the drawings in the embodiments of the present specification, and it is obvious that the described embodiments are only a part of the embodiments of the present specification, and not all the embodiments. All other embodiments that can be derived by one of ordinary skill in the art from the embodiments given herein are intended to be within the scope of protection.
At present, evidence obtaining links are included in a plurality of scenes, a plurality of evidence obtaining tasks exist, and evidence obtaining methods are often needed to obtain evidence according to the requirements of the evidence obtaining tasks. Wherein, the evidence obtaining party can be an organization or a person sent to obtain evidence.
For example, in an information review scenario, the donation platform needs to review donation information initiated by a user and determine whether the user's situation is true. When the confirmation is specifically carried out, the donation platform sends employees to the location of the user for confirmation and evidence collection, or the donation platform entrusts a third-party evidence collection mechanism to collect evidence and confirms according to the obtained evidence.
The evidence obtaining process may specifically include operations of image shooting, video shooting, voice recording and the like, and then the evidence obtaining party uses multimedia such as the obtained image, video or voice as evidence content for information auditing or publicity.
For example, when reviewing donation information of an intensive patient, the forensics may take multimedia such as images of hospital-related certificates, images of the patient and relatives, and video of the place where the patient resides as evidence content for the forensics task, and then perform review based on the obtained multimedia evidence content.
The obtained multimedia is used as evidence content, and the validity of the obtained multimedia needs to be determined during auditing, so that the evidence content is prevented from being counterfeited. However, multimedia is easy to be counterfeited, and it is technically difficult to accurately identify whether the multimedia is counterfeited or not, so that the validity of the evidence content of the multimedia cannot be identified, and it is difficult to objectively ensure the authenticity and reliability of the auditing result only by relying on the subjective integrity of the evidence taker.
In practical situations, multimedia counterfeiting includes at least the following three cases.
1) Providing the modified multimedia as evidentiary content. The following two examples are for illustrative purposes only.
a. Under the condition that the evidence obtaining task needs the medical record images to prove the identity and the symptoms of the patient, the evidence obtaining party modifies the medical record images and modifies the patient names in the images into other patient names.
b. Under the condition that the evidence obtaining task requires the interview videos of the neighbors of the patient to prove the patient's moral, the evidence obtaining party clips the interview videos and deletes the interview segments of which the neighbors consider the patient's moral to be low.
2) Providing erroneous multimedia as evidentiary content. The following two examples are for illustrative purposes only.
a. In the case where the forensics task requires taking an image of a first hospital for evidencing the forensics' visit to the first hospital, the forensics provide an image of a second hospital as evidentiary content.
b. In the case where the forensic task requires a recording from an attending physician at a first hospital to introduce the patient's condition for evidence of the patient's condition, the forensics provide a recording from a physician at a second hospital as evidence.
3) Providing outdated multimedia as evidentiary content. The following two examples are for illustrative purposes only.
a. In the case where an critically ill patient has passed, the forensics provide past relevant multimedia evidence content for the critically ill patient for application for donation.
b. In the case where the forensics task requires taking an image of the first hospital for evidencing that the forensics went to the first hospital, the forensics provide the image of the first hospital taken two years ago as evidence content.
Of course, multimedia counterfeiting may be a combination of at least two of the above, e.g., providing outdated and modified multimedia as evidence content.
In order to ensure the authenticity and reliability of the result of the verification from the customer, it is necessary to prevent or identify the multimedia forgery. The present specification provides a method for identifying validity of multimedia evidence content, which associates multimedia evidence content with remark information, where the remark information is used to record environment information, such as location information and time information, of the multimedia evidence content when the multimedia evidence content is acquired, so as to determine whether the environment (location, time, etc.) of the multimedia evidence content when the multimedia evidence content is acquired meets the execution environment requirements of a forensics task, and further determine validity of the multimedia evidence content according to the association result.
The execution environment requirement of the forensics task can be the environment limitation of the forensics party in executing the forensics task, and at least comprises the following steps: location restrictions, or time restrictions.
For example, in the case that the execution environment requirements of the forensics task include the location range limitation of the first hospital and the time range limitation of y, month and z days of 20xx year, if the acquired multimedia evidence content meets the execution environment requirements, it is obvious that the evidence content is acquired in the first hospital of y, month and z days of 20xx year, so that the forensics are prevented to some extent from providing wrong or outdated multimedia as evidence, the validity of the evidence content is convenient to identify, and the authenticity and reliability of the auditing result can be ensured visually.
On the basis of the embodiment of the method, in order to prevent the multimedia from being modified or identify the modified multimedia, the correlation result can be uploaded in real time through a specific program, so that the forensics do not have the modified time; the time that the evidence content can be modified by the evidence obtaining party can be reduced by limiting the interval between the obtaining time of the multimedia evidence content and the uploading time of the associated result; the evidence obtaining party can not store the multimedia evidence content locally through a specific program and needs to upload the multimedia evidence content in real time; content authentication information can also be added to the correlation result, and if the multimedia is modified, the multimedia can be identified through the content authentication information.
Fig. 1 is a schematic structural diagram of a correlation result provided in this specification. Wherein, the correlation result may include: multimedia evidence content, location information, time information, and content verification information. Of course, the structure of the correlation result is merely an example, and does not limit the scope of the disclosure in the present specification.
Therefore, the validity identification method for the multimedia evidence content provided by the specification can be used for identifying the validity of the evidence content from the perspective by adding remark information to the multimedia evidence content, preventing the evidence content from being counterfeited, and ensuring the authenticity and reliability of an audit result.
The following explains the validity identification method for multimedia evidence content provided in this specification in detail.
Fig. 2 is a schematic flow chart of a method for identifying validity of multimedia evidence content according to the present disclosure. The method is applied to a system comprising a client and a server, wherein the server specifies at least one execution environment requirement for any evidence obtaining task.
The method may comprise at least the following steps S101-S103.
S101: and the client executes the evidence obtaining operation aiming at any evidence obtaining task.
The forensic operation may include: generating evidence content in a multimedia format, simultaneously recording execution environment information when evidence obtaining operation is executed, and associating the generated evidence content with the recorded execution environment information to obtain an association result.
S102: and feeding back the correlation result obtained in the evidence obtaining operation to the server as the response of the evidence obtaining task.
S103: and the server matches the execution environment information in the correlation result with the execution environment requirement specified by the evidence obtaining task, and judges the validity of the evidence content in the correlation result according to the matching result.
The execution environment information and the association result are explained below with respect to S101, respectively.
1) The context information is executed.
Since any forensics task is assigned at least one execution environment requirement, when forensics operation is executed for the forensics task, corresponding execution environment information needs to be acquired according to each execution environment requirement assigned by the forensics person.
The execution environment requirements may include at least: a location requirement when performing a forensic task, or a time requirement when performing a forensic task. Correspondingly, the acquired execution environment information may include at least: location information for performing the forensic task, or time information for performing the forensic task.
Therefore, recording the execution environment information when performing the forensics operation may include at least: and when the evidence obtaining operation is executed, the position of the client equipment is obtained and recorded, or the current time is obtained and recorded.
The obtained location of the client device and the current time may be associated with the multimedia evidence content, and matching is performed in S103 to determine validity of the evidence content and identify a counterfeit condition of the evidence content.
If the forensics provide wrong evidence content, the location requirement in the execution environment requirement cannot be met; if the forensics provide outdated evidence content, the time requirement in the execution environment requirements cannot be met; if the evidence content generated by the evidence obtaining party is not evidence content generated by the evidence obtaining operation, the execution environment information does not exist in the correlation result, and the requirement of the execution environment cannot be met.
The following further explains the position information in the execution environment information.
It should be noted that the location of the client device may be obtained by different positioning methods, such as a base station positioning method, a satellite positioning method, a network positioning method, and so on. Multiple positions can be obtained by using different positioning methods. The embodiment does not limit a specific positioning method, nor the number of the positions where the obtained client devices are located, thereby further improving the reliability of the evidence content validity identification.
For example, when the location of the client device is obtained, the GPS location is obtained according to a GPS positioning method, and then the corresponding IP location is determined according to the network IP currently accessed by the client. And taking the acquired GPS position and the acquired IP position as the positions of the client device, matching the two positions one by one when matching is carried out in the subsequent S103, and judging the validity of the evidence content according to the matching result.
Correspondingly, the position requirement when the forensics task is executed may specifically include: an actual geographic location requirement when performing the forensics task, or a network access location requirement when performing the forensics task.
The virtual positioning is usually realized by modifying the positioning information stored on the client device, and the positioning is directly carried out through the network accessed by the client device, specifically, the server determines the position information according to the network related information, but not directly acquires the positioning information stored on the client device according to the server, so that the fake of the virtual positioning can be effectively prevented. That is, the requirement for network access location can prevent forensics from making a fake by virtual positioning.
2) And (6) correlating the results.
The correlation result may include at least the proof content of the multimedia format generated in the forensic operation and the recorded execution environment information. In addition, the association result may further include content verification information for verifying whether the content of the evidence is modified, and the detailed explanation of the content verification information is performed later.
The correlation result can also be coded by adopting a coding format specified by the server, and the coding format can be only analyzed by the server, so that the cost and difficulty of evidence content counterfeiting are increased.
After the execution environment information and the correlation result are explained, two preferred embodiments are provided below.
1) In a preferred embodiment, the client device of the forensics party performs the forensics operation through a specific program, the client cannot view or modify the program, and cannot influence the performance of the forensics operation, but directly obtains the associated result through the forensics operation. That is, the process of the forensic operation, i.e., the process of generating the evidentiary content, the process of recording the execution environment information, and the process of generating the associated result, cannot be viewed or modified by the client of the forensic party.
The present description is not intended to limit the particular implementations, and the following example is intended to be illustrative only.
For example, a forensics client device performs a forensics operation by clicking on a "forensics" button, running a particular program in a trusted environment, where the program running in the trusted environment cannot be viewed or modified. The client performs operations such as image capturing, so that the correlation result can be directly generated.
Because the generation process of the evidence content, the recording process of the execution environment information, and the generation process of the associated result cannot be viewed or modified by the client of the forensics, the forensics cannot copy the generation process of the evidence content, the recording process of the execution environment information, or the generation process of the associated result, and the cost and difficulty of counterfeiting the evidence content are increased.
In the generation process of the evidence content, the evidence content can be coded by adopting a coding format specific to the server, and the evidence obtaining party is difficult to analyze and code under the condition that the coding format is not decoded.
In the recording process of the execution environment information, the recording can be carried out by adopting a recording mode specified by the server, and the evidence obtaining party is difficult to record under the condition that the recording mode is not known. For example, during video capture, current time information is recorded at regular intervals.
In the generation process of the correlation result, the generation mode specified by the server can be adopted for recording, and the forensics are difficult to generate the correlation result with the same structure under the condition that the generation mode is not known. For example, during audio recording, the recorded position information is encoded into an audio file using a specific format at regular intervals.
By the method, the cost and difficulty of evidence content counterfeiting can be further increased.
2) In another preferred embodiment, content verification information may be added to the correlation results in order to identify the evidence content that was modified. The present specification does not limit the specific form of the content authentication information, and the following two examples are only for illustrative purposes.
a. The content verification information may be an encryption result of encrypting the proof content (or the proof content + the execution environment information) with a key.
For example, in the forensics operation, the client acquires a key with valid time from the server, encrypts the evidence content (or the evidence content + the execution environment information), and adds the encrypted result as content verification information to the association result. After the server side obtains the association result, firstly, the server side determines that the current time is successfully matched with the valid time of the secret key, then, the secret key is used for decrypting the content verification information, and the decryption result and the evidence content (or the evidence content and the execution environment information) in the association result are compared, so that the verification result of the content is obtained.
b. The content verification information may be a processing result of processing the proof content (or the proof content + execution environment information) by a specific function.
For example, in the forensics operation, the client uses a specific function to process the evidence content (or the evidence content + the execution environment information), and adds the processing result as the content verification information to the association result. On the basis that the client cannot check the evidence obtaining operation, the client obviously cannot check a specific function, and the content verification information cannot be counterfeited. After the server side obtains the correlation result, the server side can use the same function to process the evidence content (or the evidence content + the execution environment information), and compare the processing result of the server side with the content verification information, so as to obtain the verification result of the content.
On the basis of the content verification information, the server in S103 determines validity of the evidence content according to the matching result, which may specifically include: and verifying whether the content of the correlation result is modified or not based on the content verification information in the correlation result, and judging the validity of the evidence content according to the verification result and the matching result.
For S102, in order to prevent the evidence content from being modified or identify the modified evidence content, the correlation result obtained by the forensics operation may be uploaded to the server in real time after the forensics operation is finished, so that the client does not have time to modify the evidence content; or the server side may record the time for uploading the association result, compare the time information in the association result with the time for uploading the association result, and determine a characteristic value of the gap for determining the validity of the evidence content in S103.
The present description does not limit the method of ensuring real-time upload of the correlation results, and the following two examples are for illustrative purposes only.
a. Through a specific program, the correlation result is not locally stored in the client device and is directly uploaded to the server in real time.
b. The time for uploading the correlation result is recorded by the server, so that when the server judges the validity of the evidence content in S103, the server may refer to the difference characterization value between the time information in the correlation result and the time for uploading the correlation result.
With respect to S103, after the execution of S102 is completed, S103 is not limited to be executed immediately.
When the server matches the execution environment information in the correlation result with the execution environment requirement specified by the forensics task, the embodiment does not limit the matching manner, and the following two examples are only used for illustrative explanation.
a. And matching the position point of the client equipment in the correlation result with the range of the position requirement in the execution environment requirement.
b. The point in time in the correlation result is matched to the point in time of the time requirement in the execution environment requirement.
In addition to "match success" and "match failure", the result of the match may also include a characterization value of the gap between the execution environment information and the execution environment requirements. For example, the duration of the difference between the time information and the time requirement.
After the matching result is obtained, the server side can judge the validity of the evidence content in the correlation result according to the matching result. The present embodiment does not limit the type of the validity determination result, and does not limit only two determination results, namely "valid" and "invalid", but may be determined according to actual requirements.
For example, in the case that the forensics task includes an investigation from the forensics party to the user's household location, if there is no difference between the location information in the association result and the location requirement (household location), that is, the household location includes the location information in the association result, the determination result is "validity level is 3"; if the position information in the correlation result is different from the position requirement (where the household registration is located), and the representation value of the difference is smaller than a preset threshold value, the effective grade is determined to be 2; if the characteristic value of the difference is larger than the preset threshold value, the judgment result is that the effective grade is 1. Wherein the higher the level of validity, the higher the validity of the evidence content. And then, comprehensively referring to the validity grade of each evidence content to determine whether the evidence content is valid.
In the embodiment of the method, the execution environment information and the content verification information are added in addition to the multimedia evidence content, and the additional information is matched and verified, so that the identification and verification on whether the evidence content in the multimedia format is counterfeit or not can be performed visually; the client cannot check or modify the process of evidence obtaining operation, so that the cost and difficulty of evidence content counterfeiting can be increased from the aspect of visitors; or based on a preset uploading mechanism, the evidence content in the multimedia format is prevented from being counterfeited from the customer. Therefore, authenticity and reliability of the auditing result are guaranteed.
For further understanding, as shown in fig. 3, the present specification also provides a schematic diagram of an effectiveness identification method for multimedia evidence content. The method flow principle shown in the figures is only an example and does not limit the scope of the present disclosure. The method may include the following steps.
S201: the client acquires a forensics task from the server and analyzes that the execution environment requirements appointed by the forensics task comprise a position requirement and a time requirement.
S202: and the client executes the evidence obtaining operation aiming at the evidence obtaining task to obtain a correlation result and feeds the correlation result back to the server in real time as the response of the evidence obtaining task. The operation of collecting evidence includes: and shooting the image, simultaneously recording the GPS position of the client equipment when the image is shot, the currently accessed network IP of the client and the current time of the client, and then associating the shot image with the recorded GPS position, network IP and current time to obtain an association result.
S203: and after receiving the correlation result, the server acquires the network position according to the network IP, and matches the GPS position and the network position with the position requirement appointed by the evidence obtaining task. If the matching is successful, executing S204; and if any position is not matched successfully, judging that the evidence content in the correlation result is invalid.
S204: and matching the current time in the correlation result with the time requirement specified by the forensics task. If the matching is successful, judging that the evidence content in the correlation result is valid; and if the matching is unsuccessful, judging that the evidence content in the correlation result is invalid.
Fig. 4 is a schematic structural diagram of a validity identification system for multimedia evidence content provided for the present specification. Specifying at least one execution environment requirement for any forensics task, the system may include: client and server.
The client may comprise a forensics unit 301 and a feedback unit 302. The forensics unit 301 may perform forensics operations for any forensics task; the feedback unit 302 may feed back the correlation result obtained by the forensics operation to the server as a response to the forensics task.
The server may comprise an obtaining unit 303 and a matching unit 304. The obtaining unit 303 may obtain the association result; the matching unit 304 may match the execution environment information in the correlation result with the execution environment requirement to which the forensics task is specified, and determine validity of the evidence content in the correlation result according to the matching result.
The forensic operation may include: generating evidence content in a multimedia format, simultaneously recording execution environment information when evidence obtaining operation is executed, and associating the generated evidence content with the recorded execution environment information to obtain an association result.
Wherein the execution environment requirements may include: position requirements when performing forensics tasks; correspondingly, the client can acquire and record the position of the client device when performing the evidence obtaining operation.
The execution environment requirements may also include: time requirements for performing the forensics task; correspondingly, the client can acquire and record the current time when performing the evidence obtaining operation.
The location requirements for performing the forensics task may include: the actual geographic location requirements when performing the forensics task; and/or network access location requirements when performing forensic tasks.
In addition, after the client obtains the association result, the association result can be fed back to the server in real time as the response of the forensics task under the condition that the association result is not stored locally.
The association result may further include content verification information, where the content verification information is used to verify whether the content of the association result is modified. Correspondingly, the server side verifies whether the content of the correlation result is modified or not based on the content verification information in the correlation result, and judges the validity of the evidence content according to the verification result and the matching result.
The present specification further provides a computer device, which at least includes a memory, a processor, and a computer program stored in the memory and executable on the processor, where the processor executes the program to implement a step performed by a client in the multimedia evidence content validity identification method shown in fig. 2, or a step performed by a server in the multimedia evidence content validity identification method shown in fig. 2.
Fig. 5 is a schematic diagram illustrating a more specific hardware structure of a computer device according to an embodiment of the present disclosure, where the device may include: a processor 1010, a memory 1020, an input/output interface 1030, a communication interface 1040, and a bus 1050. Wherein the processor 1010, memory 1020, input/output interface 1030, and communication interface 1040 are communicatively coupled to each other within the device via bus 1050.
The processor 1010 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an Application Specific Integrated Circuit (ASIC), or one or more Integrated circuits, and is configured to execute related programs to implement the technical solutions provided in the embodiments of the present disclosure.
The Memory 1020 may be implemented in the form of a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, or the like. The memory 1020 may store an operating system and other application programs, and when the technical solution provided by the embodiments of the present specification is implemented by software or firmware, the relevant program codes are stored in the memory 1020 and called to be executed by the processor 1010.
The input/output interface 1030 is used for connecting an input/output module to input and output information. The i/o module may be configured as a component in a device (not shown) or may be external to the device to provide a corresponding function. The input devices may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output devices may include a display, a speaker, a vibrator, an indicator light, etc.
The communication interface 1040 is used for connecting a communication module (not shown in the drawings) to implement communication interaction between the present apparatus and other apparatuses. The communication module can realize communication in a wired mode (such as USB, network cable and the like) and also can realize communication in a wireless mode (such as mobile network, WIFI, Bluetooth and the like).
It should be noted that although the above-mentioned device only shows the processor 1010, the memory 1020, the input/output interface 1030, the communication interface 1040 and the bus 1050, in a specific implementation, the device may also include other components necessary for normal operation. In addition, those skilled in the art will appreciate that the above-described apparatus may also include only those components necessary to implement the embodiments of the present description, and not necessarily all of the components shown in the figures.
The present specification further provides a computer readable storage medium, on which a computer program is stored, which when executed by a processor implements a step performed by a client in the multimedia evidence content validity identification method shown in fig. 2, or a step performed by a server in the multimedia evidence content validity identification method shown in fig. 2.
Computer-readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), Digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.
From the above description of the embodiments, it is clear to those skilled in the art that the embodiments of the present disclosure can be implemented by software plus necessary general hardware platform. Based on such understanding, the technical solutions of the embodiments of the present specification may be essentially or partially implemented in the form of a software product, which may be stored in a storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods described in the embodiments or some parts of the embodiments of the present specification.
The systems, devices, modules or units illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions. A typical implementation device is a computer, which may take the form of a personal computer, laptop computer, cellular telephone, camera phone, smart phone, personal digital assistant, media player, navigation device, email messaging device, game console, tablet computer, wearable device, or a combination of any of these devices.
The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the apparatus embodiment, since it is substantially similar to the method embodiment, it is relatively simple to describe, and reference may be made to some descriptions of the method embodiment for relevant points. The above-described apparatus embodiments are merely illustrative, and the modules described as separate components may or may not be physically separate, and the functions of the modules may be implemented in one or more software and/or hardware when implementing the embodiments of the present disclosure. And part or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of the embodiment. One of ordinary skill in the art can understand and implement it without inventive effort.
The foregoing is only a detailed description of the embodiments of the present disclosure, and it should be noted that, for those skilled in the art, many modifications and decorations can be made without departing from the principle of the embodiments of the present disclosure, and these modifications and decorations should also be regarded as protection for the embodiments of the present disclosure.
Claims (18)
1. A validity identification method aiming at multimedia evidence content, at least one execution environment requirement is specified for any evidence obtaining task, and the method comprises the following steps:
the client executes forensics operation aiming at any forensics task, wherein the forensics operation comprises the following steps: generating evidence content in a multimedia format, simultaneously recording execution environment information when the evidence obtaining operation is executed, and associating the generated evidence content with the recorded execution environment information to obtain an association result;
feeding back the correlation result to a server as a response of the forensics task;
and the server matches the execution environment information with the specified execution environment requirement of the evidence obtaining task, and judges the validity of the evidence content according to the matching result.
2. The method of claim 1, the execution environment requirements, comprising: position requirements when performing forensics tasks;
the recording of the execution environment information when the forensics operation is executed includes: and when the evidence obtaining operation is executed, obtaining the position of the client equipment and recording.
3. The method of claim 1, the execution environment requirements, comprising: time requirements for performing the forensics task;
the recording of the execution environment information when the forensics operation is executed includes: and when the evidence obtaining operation is executed, obtaining the current time and recording.
4. The method of claim 2, the location requirement when performing a forensics task, comprising:
the actual geographic location requirements when performing the forensics task;
and/or
Network access location requirements when performing forensic tasks.
5. The method according to claim 1, wherein the feeding back the correlation result to the server as a response of the forensics task comprises:
and after the correlation result is obtained, the correlation result is used as the response of the evidence obtaining task to be fed back to the server side in real time under the condition that the correlation result is not stored locally.
6. The method of claim 1, wherein the correlation result comprises content verification information, and the content verification information is used for verifying whether the content of the correlation result is modified;
the judging the validity of the evidence content according to the matching result includes:
and verifying whether the content of the correlation result is modified or not based on the content verification information in the correlation result, and judging the validity of the evidence content according to the verification result and the matching result.
7. A validity identification method aiming at multimedia evidence content, at least one execution environment requirement is specified for any evidence obtaining task, and the method comprises the following steps:
the server side acquires the response of the evidence obtaining task aiming at any evidence obtaining task;
the response of the forensics task is that the client executes forensics operation aiming at the forensics task to obtain a correlation result, and the correlation result is used as the response of the forensics task and is fed back to the server;
the operation of collecting evidence includes: generating evidence content in a multimedia format, simultaneously recording execution environment information when the evidence obtaining operation is executed, and associating the generated evidence content with the recorded execution environment information to obtain an association result;
and matching the execution environment information with the specified execution environment requirement of the evidence obtaining task, and judging the validity of the evidence content according to a matching result.
8. A validity identification method aiming at multimedia evidence content, at least one execution environment requirement is specified for any evidence obtaining task, and the method comprises the following steps:
the client executes forensics operation aiming at any forensics task, wherein the forensics operation comprises the following steps: generating evidence content in a multimedia format, simultaneously recording execution environment information when the evidence obtaining operation is executed, and associating the generated evidence content with the recorded execution environment information to obtain an association result;
and feeding back the correlation result to a server as a response of the evidence obtaining task so as to enable the server to match the execution environment information with the specified execution environment requirement of the evidence obtaining task, and judging the validity of the evidence content according to the matching result.
9. A system for identifying validity of multimedia evidence content, specifying at least one execution environment requirement for any forensic task, the system comprising:
the client executes the evidence obtaining operation aiming at any evidence obtaining task, wherein the evidence obtaining operation comprises the following steps: generating evidence content in a multimedia format, simultaneously recording execution environment information when the evidence obtaining operation is executed, and associating the generated evidence content with the recorded execution environment information to obtain an association result; feeding back the correlation result to a server as a response of the forensics task;
and the server side matches the execution environment information with the specified execution environment requirement of the evidence obtaining task, and judges the validity of the evidence content according to a matching result.
10. The system of claim 9, the execution environment requirements, comprising: position requirements when performing forensics tasks;
and the client acquires and records the position of the client equipment when the evidence obtaining operation is executed.
11. The system of claim 9, the execution environment requirements, comprising: time requirements for performing the forensics task;
and the client acquires and records the current time when the evidence obtaining operation is executed.
12. The system of claim 10, the location requirement when performing a forensics task, comprising:
the actual geographic location requirements when performing the forensics task;
and/or
Network access location requirements when performing forensic tasks.
13. The system of claim 9, wherein after obtaining the association result, the client feeds back the association result to the server in real time as a response to the forensics task without storing the association result locally.
14. The system of claim 9, wherein the correlation result comprises content verification information, and the content verification information is used for verifying whether the content of the correlation result is modified;
and the server side verifies whether the content of the association result is modified or not based on the content verification information in the association result, and judges the validity of the evidence content according to the verification result and the matching result.
15. An apparatus for identifying validity of multimedia evidence content, applied to a server, and specifying at least one execution environment requirement for any forensics task, the apparatus comprising:
the acquisition unit is used for acquiring the response of the evidence obtaining task aiming at any evidence obtaining task; the response of the forensics task is that the client executes forensics operation aiming at the forensics task to obtain a correlation result, and the correlation result is used as the response of the forensics task and is fed back to the server; the operation of collecting evidence includes: generating evidence content in a multimedia format, simultaneously recording execution environment information when the evidence obtaining operation is executed, and associating the generated evidence content with the recorded execution environment information to obtain an association result;
and the matching unit is used for matching the execution environment information with the execution environment requirement appointed by the evidence obtaining task and judging the validity of the evidence content according to a matching result.
16. An apparatus for identifying validity of multimedia evidence content, applied to a client, and specifying at least one execution environment requirement for any forensics task, the apparatus comprising:
the evidence obtaining unit is used for executing evidence obtaining operation aiming at any evidence obtaining task, and the evidence obtaining operation comprises the following steps: generating evidence content in a multimedia format, simultaneously recording execution environment information when the evidence obtaining operation is executed, and associating the generated evidence content with the recorded execution environment information to obtain an association result;
and the feedback unit is used for feeding back the correlation result to the server as the response of the evidence obtaining task so as to enable the server to match the execution environment information with the specified execution environment requirement of the evidence obtaining task, and judging the validity of the evidence content according to the matching result.
17. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the method of claim 7 when executing the program.
18. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the method of claim 8 when executing the program.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010768878.5A CN111986166A (en) | 2020-08-03 | 2020-08-03 | Validity identification method and system for multimedia evidence content |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010768878.5A CN111986166A (en) | 2020-08-03 | 2020-08-03 | Validity identification method and system for multimedia evidence content |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111986166A true CN111986166A (en) | 2020-11-24 |
Family
ID=73445659
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010768878.5A Pending CN111986166A (en) | 2020-08-03 | 2020-08-03 | Validity identification method and system for multimedia evidence content |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111986166A (en) |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20170019400A1 (en) * | 2014-06-11 | 2017-01-19 | Verie, Llc | Methods and systems for providing online verification and security |
| CN109447854A (en) * | 2018-11-12 | 2019-03-08 | 冰火之家(江苏)民宿管理有限公司 | A kind of source of houses evaluation method and system |
| CN109819101A (en) * | 2018-12-18 | 2019-05-28 | 法信公证云（厦门）科技有限公司 | A kind of evidence collecting method and Specialised mobile terminal of collecting evidence |
| CN110008728A (en) * | 2019-04-11 | 2019-07-12 | 苏州超擎图形软件科技发展有限公司 | Electronic evidence method for anti-counterfeit and device |
| CN110852427A (en) * | 2020-01-15 | 2020-02-28 | 支付宝(杭州)信息技术有限公司 | Evidence obtaining environment verification method and device and electronic equipment |
-
2020
- 2020-08-03 CN CN202010768878.5A patent/CN111986166A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20170019400A1 (en) * | 2014-06-11 | 2017-01-19 | Verie, Llc | Methods and systems for providing online verification and security |
| CN109447854A (en) * | 2018-11-12 | 2019-03-08 | 冰火之家(江苏)民宿管理有限公司 | A kind of source of houses evaluation method and system |
| CN109819101A (en) * | 2018-12-18 | 2019-05-28 | 法信公证云（厦门）科技有限公司 | A kind of evidence collecting method and Specialised mobile terminal of collecting evidence |
| CN110008728A (en) * | 2019-04-11 | 2019-07-12 | 苏州超擎图形软件科技发展有限公司 | Electronic evidence method for anti-counterfeit and device |
| CN110852427A (en) * | 2020-01-15 | 2020-02-28 | 支付宝(杭州)信息技术有限公司 | Evidence obtaining environment verification method and device and electronic equipment |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10176309B2 (en) | Systems and methods for authenticating video using watermarks | |
| US11323272B2 (en) | Electronic identification verification methods and systems with storage of certification records to a side chain | |
| US20220255737A1 (en) | Methods and systems for recovering data using dynamic passwords | |
| WO2018145127A1 (en) | Electronic identification verification methods and systems with storage of certification records to a side chain | |
| US20090070589A1 (en) | Method and apparatus for verifying authenticity of digital data using trusted computing | |
| CN110958319B (en) | Method and device for managing infringement and evidence-based block chain | |
| KR20210032316A (en) | Capture and display of authenticated data | |
| CN110022355B (en) | Storage method, verification method and equipment of environment data in specific scene | |
| EP3543891A1 (en) | A computer implemented method and a system for tracking of certified documents lifecycle and computer programs thereof | |
| Salamh et al. | What’s on the horizon? An in-depth forensic analysis of android and iOS applications | |
| CN111737675A (en) | Block chain-based electronic signature method and device | |
| US9735966B2 (en) | Secure transmission | |
| US20210099772A1 (en) | System and method for verification of video integrity based on blockchain | |
| US11553216B2 (en) | Systems and methods of facilitating live streaming of content on multiple social media platforms | |
| US20150358318A1 (en) | Biometric authentication of content for social networks | |
| US11716203B2 (en) | Secure transmission | |
| US9646355B2 (en) | Use of near field communication devices as proof of identity during electronic signature process | |
| CN111986166A (en) | Validity identification method and system for multimedia evidence content | |
| TWI612438B (en) | Password verification method for handheld mobile communication device | |
| CN113990429B (en) | Electronic medical record data protection method and device | |
| CN114826609B (en) | Electronic certificate management method, device and system based on blockchain and storage medium | |
| US20230409754A1 (en) | Method for certifying the authenticity of digital files generated by a communication device | |
| CN111279330B (en) | Method and apparatus for storing and managing audio data on a blockchain | |
| TWI673623B (en) | Video-Audio Recording Apparatus with an Integration Interface Device | |
| TW202321963A (en) | Electronic signature device and method capable of recording signature process wherein the device includes a touch screen, a communication module, an image capture module and a processor |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20211221 Address after: Room 610, floor 6, No. 618, Wai Road, Huangpu District, Shanghai 200010 Applicant after: Ant Shengxin (Shanghai) Information Technology Co.,Ltd. Address before: 310000 801-11 section B, 8th floor, 556 Xixi Road, Xihu District, Hangzhou City, Zhejiang Province Applicant before: Alipay (Hangzhou) Information Technology Co.,Ltd. |
|
| TA01 | Transfer of patent application right | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20201124 |
|
| RJ01 | Rejection of invention patent application after publication |