WO2021043144A1

WO2021043144A1 - Blockchain-based evidence collection service system

Info

Publication number: WO2021043144A1
Application number: PCT/CN2020/112897
Authority: WO
Inventors: 李伟; 邱炜伟; 匡立中; 谢杨洁; 李晨熙
Original assignee: 杭州趣链科技有限公司
Priority date: 2019-09-03
Filing date: 2020-09-01
Publication date: 2021-03-11
Also published as: CN110535660B; CN110535660A

Abstract

The present application relates to a blockchain-based evidence collection service system, comprising: an account module for creating a unique account of a user and managing identity information of the user; an evidence collection module for collecting an evidence collection instruction of the user, executing a corresponding evidence collection task and carrying out hash calculation and blockchain storage on evidence collection data; an evidence presenting module for carrying out corresponding management and presentation on the evidence collection data of the user; a certificate issuing module for calling stored evidence collection data stored in a blockchain and generating an evidence document; an evidence verification module for calling the evidence collection data stored in the blockchain and comparing same with the evidence collection data submitted by the user, and outputting and presenting a verification result; and an evidence database for storing evidence data collected by means of a system executing different evidence collection instructions. The problem of a low degree of credibility of electronic data is solved.

Description

Blockchain-based forensic service system

Related application

This application claims the priority of the Chinese patent application filed on September 3, 2019 with the application number 201910827935.X and the invention title "a blockchain-based evidence collection service system", the entire content of which is incorporated herein by reference Applying.

Technical field

This application relates to the field of blockchain technology, in particular to a forensic service system based on blockchain.

Background technique

Blockchain technology is an emerging distributed technology that has emerged in recent years. The core technology points include consensus algorithms, point-to-point transmission, and distributed databases. The entire blockchain is composed of a large number of nodes, and each node has a complete ledger or database. Writing data to a blockchain node requires a consensus algorithm to confirm that the entire blockchain has reached a consensus before it can be written. The data of the blockchain is stored in a chain structure, that is, the previous block and the next block are related to each other. Therefore, due to the difficulty of controlling a large number of nodes, the blockchain has the characteristics of non-tampering and traceability, which is suitable for the safe storage and anti-tampering of data.

Electronic data has the characteristics of wide distribution, strong duplication, and easy tampering. Traditional electronic data forensics tools can only collect and store electronic data, but cannot further improve the credibility of data. As a result, electronic data is used as a type of evidence. The application in the judicial field is very difficult.

In order to solve the problem of low credibility of electronic data, blockchain is introduced to solidify the collected electronic data, so as to achieve data credibility and anti-tampering.

Summary of the invention

Based on this, in view of the shortcomings of the prior art, this application provides a blockchain-based forensics service system, which can realize the acquisition and fixation of electronic evidence in web pages, clients, mobile terminals and other scenarios to solve the existence of electronic data The problem of low credibility, to achieve data credibility and anti-tampering.

According to various embodiments of the present application, a blockchain-based forensic service system is provided. The system includes: an account module, a forensic module, an evidence display module, a certificate issuance module, a verification module, and an evidence database, in which:

The account module is used to collect user identity related information, confirm the user's real identity through identity authentication technology, and generate a blockchain account for the user;

The evidence database is used to store the collected evidence files and evidence certificates;

The forensic module is used to collect user's forensic instructions, perform corresponding forensic tasks, and perform hash calculation and blockchain storage of forensic data. The forensic module includes a web page forensic unit, a process forensic unit, a mobile terminal forensic unit, Hash calculation unit, evidence on-chain unit and identity verification unit, including:

The web page forensics unit is used to collect the URL address submitted by the user, collect the resources under the URL address after initiating access to the target URL address, generate an evidence package including pictures, resource files and the forensic process, and record the time and URL of the forensic collection Address and forensic name;

The process forensic unit is used to provide a virtual machine desktop to the user and record the screen of the virtual machine desktop; record all remote operations of the user, generate a screen recording document evidence package, and record the time and name of the forensic collection;

The mobile terminal forensics unit is used to collect pictures, videos, and audio files obtained by users through mobile terminal devices, record user mobile terminal device information and network information, generate evidence packages and record the forensic time, the forensic name and the forensic device code;

The Hash calculation unit is used to perform a hash calculation on the evidence package collected and generated by the web page forensic unit, the process forensic unit, and the mobile terminal forensic unit to generate a Hash associated with the evidence package;

The evidence chaining unit is used to send the Hash generated by the Hash calculation unit to the blockchain, write it into the blockchain evidence database after passing the blockchain consensus, and record the time of writing to the blockchain;

The identity verification unit is used to verify the real identity of the user when the user submits a request for web page forensics, process forensics, and mobile terminal forensics;

The evidence display module is used to manage and display the user's forensic data. The evidence display module includes an evidence query unit and an evidence display unit, wherein:

The evidence query unit is configured to search the evidence database according to the keyword field input by the user, find the evidence data that matches the field under the user account, and display the evidence through the evidence display unit;

The evidence display unit is used to retrieve the evidence database according to the user account, display the user's forensic data in the form of a list or detail page, and generate an extraction code for the user, provide evidence files and evidence certificate downloads;

The certificate issuance module is used to retrieve forensic data stored on the blockchain and generate evidence documents. The certificate issuance module includes a certificate issuance unit, a certificate hash calculation unit, and a certificate chain unit, wherein:

The certificate issuance unit is used to summarize the Hash, the name of the evidence, the type of evidence, the collection time, and the blockchain where the evidence is located for each piece of evidence record, and generate a certificate for the piece of evidence;

The certificate Hash calculation unit is used to calculate the certificate Hash by using the Hash algorithm for the certificate generated by the certificate issuing unit;

The certificate chaining unit is used to send the certificate Hash to the blockchain, write it into the blockchain evidence database after passing the blockchain consensus, and record the time of writing to the blockchain;

The verification module is used to retrieve the forensic data stored on the blockchain and compare it with the forensic data submitted by the user, and output and display the verification result. The verification module includes an evidence verification unit and a result display unit ,among them:

The evidence verification unit is used to verify the evidence according to the verification request submitted by the user, and includes 3 verification methods:

(1) Hash verification: The user submits the Hash from the evidence display unit, and the system uses the Hash to query and match the evidence database. If the match is successful, the hash verification passes; if the match fails, the hash verification fails;

(2) File verification: After the user submits the evidence file downloaded from the evidence display unit, the system performs Hash calculation on the file, and uses the calculated Hash to query and match the evidence database. If the matching is successful, the file verification passes, and the matching fails. File verification failed;

(3) Original text query: Collect the Hash and extraction code submitted by the user from the evidence display unit, and retrieve the corresponding evidence content in the evidence database;

The result display unit is used to display the verification result. In the mode of hash check and file verification, the verification result is displayed in the form of an information box; in the mode of original text query, the query result is displayed in the form of a table and a picture. Form for display.

The above-mentioned blockchain-based forensic service system has the following advantages: The blockchain-based forensic service system provides evidence collection tools covering various forensic demand scenarios, including web pages, client applications, audio, video, and mobile terminals. App evidence acquisition; and after the collection of electronic evidence, it is stored and fixed through the blockchain in real time, which realizes the anti-tampering of evidence and solves the problem of low credibility of electronic data.

In one of the embodiments, the identity authentication methods in the account module include personal authentication and enterprise authentication; when the account module is personally authenticated, the user identity related information collected includes the user's real name, user ID number, and user identity When the account module authenticates the enterprise, the user identity-related information collected includes the business license of the enterprise, the real name of the legal representative, the ID number of the legal representative, and the image information of the ID card of the legal representative.

In one of the embodiments, the verification module may also verify the certificate of the certificate issuance module. The certificate verification process in is: after the user submits the certificate downloaded from the evidence display unit, the system performs a hash calculation on the certificate, and queries the evidence database based on the calculated hash. If the matching is successful, the file The verification is passed; if the matching fails, the file verification fails.

The forensic module is used to collect user's forensic instructions, perform corresponding forensic tasks, and perform hash calculation and blockchain storage of forensic data;

The evidence display module is used to manage and display the user's forensic data accordingly;

The certificate issuance module is used to retrieve forensic data stored on the blockchain and generate evidence documents;

The verification module is used to retrieve the forensic data stored on the blockchain, compare the forensic data stored on the blockchain with the forensic data submitted by the user, and output and display the verification result.

In one of the embodiments, the forensic module includes a web forensic unit, a process forensic unit, a mobile-end forensic unit, a hash calculation unit, a proof on-chain unit, and an identity verification unit, wherein:

The web page forensics unit is used to collect the URL address submitted by the user, collect the resources under the URL address after initiating an access to the URL address, and generate an evidence package containing pictures, resource files and the forensic process according to the collected resources, And record the forensic time, URL address and the forensic name;

The process forensic unit is used to provide a virtual machine desktop to the user and perform screen recording processing on the virtual machine desktop to record all remote operations of the user, generate a screen recording document evidence package, and record the time and name of the forensic collection;

The mobile terminal forensics unit is used to collect pictures, video and audio files obtained by the user through the mobile terminal device, record user mobile terminal device information and network information, generate evidence package and record the forensic time, the forensic name and the forensic device code;

The Hash calculation unit is configured to perform a hash calculation on the evidence package collected and generated by the web page forensic unit, the process forensic unit, and the mobile terminal forensic unit to generate a Hash associated with the evidence package;

The identity verification unit is used to verify the real identity of the user when the user submits a request for web page forensics, process forensics, and mobile terminal forensics.

In one of the embodiments, the evidence display module includes an evidence query unit and an evidence display unit, wherein:

The evidence query unit is configured to search for evidence data matching the field under the user account from the evidence database according to the keyword field input by the user, and transmit the evidence data to the evidence display unit for display;

The evidence display unit is used to obtain evidence data retrieved from the evidence database, display the evidence data in the form of a list or a detail page, generate extraction codes for users, and provide evidence files and evidence certificates for downloading service.

In one of the embodiments, the certificate issuance module includes a certificate issuance unit, a certificate hash calculation unit, and a certificate on-chain unit, wherein:

The certificate Hash calculation unit is configured to calculate the certificate Hash according to the certificate and the hash algorithm generated by the certificate issuance unit;

The certificate chaining unit is used to send the certificate Hash to the block chain, write it into the block chain evidence database after passing the block chain consensus, and record the time of writing to the block chain.

In one of the embodiments, the verification module includes an evidence verification unit and a result display unit, wherein:

The evidence verification unit is configured to verify the evidence according to the verification request submitted by the user, and transmit the verification result to the result display unit;

The result display unit is used to display the verification result.

In one of the embodiments, the verification mode of the evidence verification unit includes hash verification, file verification and original text query, wherein:

Hash verification: The user submits the Hash from the evidence display unit, and the system uses the Hash to query and match the evidence database. If the match is successful, the hash verification passes; if the match fails, the hash verification fails;

File verification: After the user submits the evidence file downloaded from the evidence display unit, the system performs Hash calculation on the file, and uses the calculated Hash to query and match the evidence database. If the matching is successful, the file verification passes, and the matching fails, the file verification failure;

Original query: Collect the Hash and extraction code submitted by the user from the evidence display unit, and retrieve the corresponding evidence content in the evidence database;

The result display unit is also used to display the verification result in the form of an information box in the mode of hash checksum file verification; in the mode of original text query, the query result is displayed in the form of tables and pictures Show.

In one of the embodiments, the certificate verification process in the verification module is: Hash calculation is performed on the certificate file submitted by the user, and the calculated Hash is searched and matched with the evidence database. If the matching is successful, the certificate file The verification of the certificate file is passed; if the matching fails, the verification of the certificate file fails.

Description of the drawings

In order to better describe and illustrate the embodiments and/or examples of the inventions disclosed herein, one or more drawings may be referred to. The additional details or examples used to describe the drawings should not be considered as limiting the scope of any of the disclosed inventions, the currently described embodiments and/or examples, and the best mode of these inventions currently understood.

Figure 1 is a basic architecture diagram of a blockchain-based forensics service system according to an embodiment of the application.

Fig. 2 is a schematic diagram of the process of a blockchain-based forensic service system according to an embodiment of the application.

Fig. 3 is a schematic structural diagram of a blockchain-based forensic service system according to a specific embodiment of the application.

detailed description

In order to facilitate the understanding of this application, and to make the above objectives, features and advantages of this application more comprehensible, specific implementations of this application will be described in detail below with reference to the accompanying drawings. In the following description, many specific details are set forth in order to fully understand the application, and the preferred embodiments of the application are shown in the accompanying drawings. However, this application can be implemented in many different forms and is not limited to the implementation described herein. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of this application more thorough and comprehensive. This application can be implemented in many other ways different from those described herein, and those skilled in the art can make similar improvements without violating the connotation of this application. Therefore, this application is not limited by the specific embodiments disclosed below.

In addition, the terms "first" and "second" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Therefore, the features defined with "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present application, "a plurality of" means at least two, such as two, three, etc., unless specifically defined otherwise. In the description of this application, "several" means at least one, such as one, two, etc., unless otherwise specifically defined.

Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field of this application. The terminology used herein is only for the purpose of describing specific embodiments, and is not intended to limit the application. The term "and/or" as used herein includes any and all combinations of one or more related listed items.

The following will further explain the blockchain-based over-the-counter transaction methods, systems, storage media, and electronic devices provided in this application:

Figure 1 is a basic architecture diagram of a blockchain-based forensic service system according to an embodiment of the application. As shown in Figure 1, the system includes: an account module, a forensic module, an evidence display module, a certificate issuance module, a verification module, and Evidence database, including:

The account module is used to collect user identity related information, confirm the user's real identity through identity authentication technology, and generate a blockchain account for the user.

The evidence database is used to store the collected evidence files and evidence certificates.

Further, the types of evidence collection include web page evidence, process evidence, video evidence, audio recording evidence, screen recording evidence, and photo evidence.

The evidence display unit is used to retrieve the evidence database according to the user account, display the user's forensic data in the form of a list or a detailed page, and generate an extraction code for the user, provide evidence files and download evidence certificates.

The certificate issuance module is used to retrieve forensic data stored on the blockchain and form a generated evidence document. The certificate issuance module includes a certificate issuance unit, a certificate hash calculation unit, and a certificate chain unit, wherein:

The certificate chaining unit is used to send the certificate Hash to the blockchain, write it into the blockchain evidence database after passing the blockchain consensus, and record the time of writing to the blockchain.

For the blockchain-based forensic service system provided by this application, the user needs to register the forensic service system when using it, and perform identity information authentication. After the system confirms the user’s real identity information, the private key is issued to the user and tied to the blockchain account set. The user can subsequently initiate a forensic request through the account. Forensic request types include web forensics, process forensics, and mobile forensics. Mobile forensics include audio recording, video recording, screen recording, and photographing. When a user submits a forensic request, identity information verification is required. According to the forensic request submitted by the user, the system executes the corresponding order and completes the collection of electronic evidence, then forms an evidence package, and writes the evidence package to the blockchain for storage after Hash calculation. For each forensic record, the system separately generates a unique and verifiable certificate. Users can view all the electronic evidence under their account, download the evidence package, verify the evidence, and verify the certificate.

Figure 2 is a schematic diagram of the process of the blockchain-based forensic service system according to an embodiment of the application. As shown in Figure 2, the typical use process of this system is: after the user's identity is authenticated, use the system to submit a forensic request. When requesting, the user’s identity is verified. If the verification fails, the forensics will fail. After the verification is passed, the system executes the forensic instruction entered by the user, calculates the Hash of the evidence after obtaining the evidence, and uploads the calculation result to the chain in real time. After the chain is successfully chained, a proof certificate is generated for the piece of evidence, and the proof certificate Hash is calculated, and then the certificate Hash is chained and the evidence collection is completed. After the evidence collection is successful, the user can perform evidence management, including operations such as query, view, and verification.

In one of the embodiments, the verification module may also verify the certificate of the certificate issuance module. The certificate verification process in is: after the user submits the certificate downloaded from the evidence display unit, the system performs a Hash calculation on the certificate, and searches and matches the evidence database based on the calculated Hash. If the matching is successful, the file The verification is passed; if the matching fails, the file verification fails.

Hereinafter, the blockchain-based forensic service system will be further explained through the following specific embodiments:

Fig. 3 is a schematic structural diagram of a blockchain-based forensic service system according to a specific embodiment of the application. As shown in Fig. 3, the system includes: an account module 310, a forensic module 320, an evidence display module 330, a certificate issuance module 340, The verification module 350 and the evidence database 360, in which:

The account module 310 is used to collect user identity related information, confirm the user's true identity through identity authentication technology, and generate a blockchain account for the user;

The forensic module 320 is used to collect the user's forensic instructions, perform corresponding forensic tasks, and perform hash calculation and blockchain storage on the forensic data;

The evidence display module 330 is used to manage and display the user's forensic data accordingly;

The certificate issuance module 340 is used to retrieve forensic data stored on the blockchain and generate evidence documents;

The verification module 350 is used to retrieve forensic data stored on the blockchain, compare the forensic data stored on the blockchain with the forensic data submitted by the user, and output and display the verification result;

The evidence database 360 is used to store the collected evidence files and evidence certificates.

The above-mentioned blockchain-based forensic service system has the following advantages: The blockchain-based forensic service system provides evidence collection tools covering various forensic demand scenarios, including web pages, client applications, audio, video, and mobile terminals. App evidence acquisition; and after the electronic evidence is collected, it is stored and fixed through the blockchain in real time, which realizes the anti-tampering of the evidence and solves the problem of low credibility of electronic data.

In one of the embodiments, the forensic module 320 includes a web forensic unit, a process forensic unit, a mobile-end forensic unit, a hash calculation unit, an evidence chain unit, and an identity verification unit, wherein:

The process forensic unit is used to provide a virtual machine desktop to the user, and perform screen recording processing on the virtual machine desktop to record all remote operations of the user, generate a screen recording document evidence package, and record the time and name of the forensic collection;

The evidence on-chain unit is used to send the Hash generated by the Hash calculation unit to the blockchain, write it into the blockchain evidence database 360 after passing the blockchain consensus, and record the time of writing to the blockchain;

In one of the embodiments, the evidence display module 330 includes an evidence query unit and an evidence display unit, wherein:

The evidence query unit is configured to search the evidence database 360 for evidence data matching the field under the user account according to the keyword field input by the user, and transmit the evidence data to the evidence display unit for display;

The evidence display unit is used to obtain evidence data retrieved from the evidence database 360, display the evidence data in the form of a list or a detail page, and generate extraction codes for users and provide evidence files and evidence certificates. Download service.

In one of the embodiments, the certificate issuance module 340 includes a certificate issuance unit, a certificate hash calculation unit, and a certificate on-chain unit, wherein:

The certificate chaining unit is used to send the certificate Hash to the blockchain, write it into the blockchain evidence database 360 after passing the blockchain consensus, and record the time of writing to the blockchain.

In one of the embodiments, the verification module 350 includes an evidence verification unit and a result display unit, wherein:

The result display unit is used to display the verification result.

Hash verification: The user submits the Hash from the evidence display unit, and the system uses the Hash to query and match the evidence database 360. If the match is successful, the hash verification passes; if the match fails, the hash verification fails;

File verification: After the user submits the evidence file downloaded from the evidence display unit, the system performs Hash calculation on the file, and uses the calculated Hash to query and match the evidence database 360. If the matching is successful, the file verification is passed, and the matching fails, the file is verified. Test failed

Original query: Collect the Hash and extraction code submitted by the user from the evidence display unit, and retrieve the corresponding evidence content in the evidence database 360;

In one of the embodiments, the identity authentication methods in the account module 310 include personal authentication and enterprise authentication; when the account module 310 performs personal authentication, the user identity-related information collected includes the user’s real name, user ID number, and User ID image information; the user ID related information collected by the account module 310 during enterprise authentication includes the business license, the real name of the legal representative, the ID number of the legal representative, and the image information of the ID card of the legal representative.

In one of the embodiments, the certificate verification process in the verification module 350 is: Hash calculation is performed on the certificate file submitted by the user, and the calculated Hash is searched and matched with the evidence database 360. If the matching is successful, then The verification of the certificate file is passed; if the matching fails, the verification of the certificate file fails.

A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage. In the medium, when the computer program is executed, it may include the procedures of the above-mentioned method embodiments. Wherein, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and/or volatile memory. Non-volatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not a limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain Channel (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the various technical features in the above-mentioned embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, All should be considered as the scope of this specification.

The above-mentioned embodiments only express several implementation manners of the present application, and their descriptions are relatively specific and detailed, but they should not be understood as a limitation on the scope of the patent application. It should be pointed out that for those of ordinary skill in the art, without departing from the concept of this application, several modifications and improvements can be made, and these all fall within the protection scope of this application. Therefore, the scope of protection of the patent of this application shall be subject to the appended claims.

Claims

A forensic service system based on blockchain, which is characterized in that the system includes: an account module, a forensic module, an evidence display module, a certificate issuance module, a verification module, and an evidence database, wherein:

The account module is used to collect user identity related information, confirm the user's real identity through identity authentication technology, and generate a blockchain account for the user;

The evidence database is used to store the collected evidence files and evidence certificates;

The forensic module is used to collect user's forensic instructions, perform corresponding forensic tasks, and perform hash calculation and blockchain storage of forensic data;

The evidence display module is used to manage and display the user's forensic data accordingly;

The certificate issuance module is used to retrieve forensic data stored on the blockchain and generate evidence documents;

The verification module is used to retrieve the forensic data stored on the blockchain, compare the forensic data stored on the blockchain with the forensic data submitted by the user, and output and display the verification result.
The blockchain-based forensic service system according to claim 1, wherein the forensic module includes a web forensic unit, a process forensic unit, a mobile-end forensic unit, a hash calculation unit, an evidence on-chain unit, and an identity verification unit ,among them:

The web page forensics unit is used to collect the URL address submitted by the user, collect the resources under the URL address after initiating an access to the URL address, and generate an evidence package containing pictures, resource files and the forensic process according to the collected resources, And record the forensic time, URL address and the forensic name;

The process forensic unit is used to provide a virtual machine desktop to the user and perform screen recording processing on the virtual machine desktop to record all remote operations of the user, generate a screen recording document evidence package, and record the time and name of the forensic collection;

The mobile terminal forensics unit is used to collect pictures, video and audio files obtained by the user through the mobile terminal device, record user mobile terminal device information and network information, generate evidence package and record the forensic time, the forensic name and the forensic device code;

The Hash calculation unit is configured to perform a hash calculation on the evidence package collected and generated by the web page forensic unit, the process forensic unit, and the mobile terminal forensic unit to generate a Hash associated with the evidence package;

The evidence chaining unit is used to send the Hash generated by the Hash calculation unit to the blockchain, write it into the blockchain evidence database after passing the blockchain consensus, and record the time of writing to the blockchain;

The identity verification unit is used to verify the real identity of the user when the user submits a request for web page forensics, process forensics, and mobile terminal forensics.
The blockchain-based forensic service system according to claim 1, wherein the evidence display module includes an evidence query unit and an evidence display unit, wherein:

The evidence query unit is configured to search the evidence database for the evidence data that matches the field under the user account according to the keyword field input by the user, and transmit the evidence data to the evidence display unit for display;

The evidence display unit is used to obtain evidence data retrieved from the evidence database, display the evidence data in the form of a list or a detail page, generate extraction codes for users, and provide evidence files and evidence certificates for downloading service.
The blockchain-based forensic service system according to claim 1, wherein the certificate issuance module includes a certificate issuance unit, a certificate Hash calculation unit, and a certificate on-chain unit, wherein:

The certificate issuance unit is used to summarize the Hash, the name of the evidence, the type of evidence, the collection time, and the blockchain where the evidence is located for each piece of evidence record, and generate a certificate for the piece of evidence;

The certificate Hash calculation unit is configured to calculate the certificate Hash according to the certificate and the hash algorithm generated by the certificate issuance unit;

The certificate chaining unit is used to send the certificate Hash to the block chain, write it into the block chain evidence database after passing the block chain consensus, and record the time of writing to the block chain.
The blockchain-based forensic service system according to claim 1, wherein the verification module includes an evidence verification unit and a result display unit, wherein:

The evidence verification unit is configured to verify the evidence according to the verification request submitted by the user, and transmit the verification result to the result display unit;

The result display unit is used to display the verification result.
The blockchain-based forensic service system according to claim 5, wherein the verification mode of the evidence verification unit includes hash verification, document verification and original text query, wherein:

Hash verification: The user submits the Hash from the evidence display unit, and the system uses the Hash to query and match the evidence database. If the match is successful, the hash verification passes; if the match fails, the hash verification fails;

File verification: After the user submits the evidence file downloaded from the evidence display unit, the system performs Hash calculation on the file, and uses the calculated Hash to query and match the evidence database. If the matching is successful, the file verification passes, and the matching fails, the file verification failure;

Original query: Collect the Hash and extraction code submitted by the user from the evidence display unit, and retrieve the corresponding evidence content in the evidence database;

The result display unit is also used to display the verification result in the form of an information box in the mode of hash checksum file verification; in the mode of original text query, the query result is displayed in the form of tables and pictures Show.
The blockchain-based forensic service system according to claim 1, wherein the identity authentication method in the account module includes personal authentication and enterprise authentication; when the account module is personally authenticated, the collected user identity is related The information includes the user's real name, user ID number, and user ID image information; when the account module is used for enterprise authentication, the user identity-related information collected includes the enterprise business license, the real name of the legal representative, the ID number of the legal representative, and the legal representative ID image information.
The blockchain-based forensic service system according to claim 1, wherein the certificate verification process in the verification module is: Hash calculation on the certificate file submitted by the user, and the calculated Hash and The evidence database performs query matching. If the matching is successful, the verification of the certificate file passes; if the matching fails, the verification of the certificate file fails.
A forensic service system based on blockchain, which is characterized in that the system includes: an account module, a forensic module, an evidence display module, a certificate issuance module, a verification module, and an evidence database, wherein:

The account module is used to collect user identity related information, confirm the user's real identity through identity authentication technology, and generate a blockchain account for the user;

The evidence database is used to store the collected evidence files and evidence certificates;

The forensic module is used to collect user's forensic instructions, perform corresponding forensic tasks, and perform hash calculation and blockchain storage of forensic data. The forensic module includes a web page forensic unit, a process forensic unit, a mobile terminal forensic unit, Hash calculation unit, evidence on-chain unit and identity verification unit, including:

The web page forensics unit is used to collect the URL address submitted by the user, collect the resources under the URL address after initiating access to the target URL address, generate an evidence package including pictures, resource files and the forensic process, and record the time and URL of the forensic collection Address and forensic name;

The process forensic unit is used to provide a virtual machine desktop to the user and record the screen of the virtual machine desktop; record all remote operations of the user, generate a screen recording document evidence package, and record the time and name of the forensic collection;

The mobile terminal forensics unit is used to collect pictures, videos, and audio files obtained by users through mobile terminal devices, record user mobile terminal device information and network information, generate evidence packages and record the forensic time, the forensic name and the forensic device code;

The Hash calculation unit is used to perform a hash calculation on the evidence package collected and generated by the web page forensic unit, the process forensic unit, and the mobile terminal forensic unit to generate a Hash associated with the evidence package;

The evidence chaining unit is used to send the Hash generated by the Hash calculation unit to the blockchain, write it into the blockchain evidence database after passing the blockchain consensus, and record the time of writing to the blockchain;

The identity verification unit is used to verify the real identity of the user when the user submits a request for web page forensics, process forensics, and mobile terminal forensics;

The evidence display module is used to manage and display the user's forensic data. The evidence display module includes an evidence query unit and an evidence display unit, wherein:

The evidence query unit is configured to search the evidence database according to the keyword field input by the user, find the evidence data that matches the field under the user account, and display the evidence through the evidence display unit;

The evidence display unit is used to retrieve the evidence database according to the user account, display the user's forensic data in the form of a list or detail page, and generate an extraction code for the user, provide evidence files and evidence certificate downloads;

The certificate issuance module is used to retrieve forensic data stored on the blockchain and generate evidence documents. The certificate issuance module includes a certificate issuance unit, a certificate hash calculation unit, and a certificate chain unit, wherein:

The certificate issuance unit is used to summarize the Hash, the name of the evidence, the type of evidence, the collection time, and the blockchain where the evidence is located for each piece of evidence record, and generate a certificate for the piece of evidence;

The certificate Hash calculation unit is used to calculate the certificate Hash by using the Hash algorithm for the certificate generated by the certificate issuing unit;

The certificate chaining unit is used to send the certificate Hash to the blockchain, write it into the blockchain evidence database after passing the blockchain consensus, and record the time of writing to the blockchain;

The verification module is used to retrieve the forensic data stored on the blockchain and compare it with the forensic data submitted by the user, and output and display the verification result. The verification module includes an evidence verification unit and a result display unit ,among them:

The evidence verification unit is used to verify the evidence according to the verification request submitted by the user, and includes 3 verification methods:

(1) Hash verification: The user submits the Hash from the evidence display unit, and the system uses the Hash to query and match the evidence database. If the match is successful, the hash verification passes; if the match fails, the hash verification fails;

(2) File verification: After the user submits the evidence file downloaded from the evidence display unit, the system performs Hash calculation on the file, and uses the calculated Hash to query and match the evidence database. If the matching is successful, the file verification passes, and the matching fails. File verification failed;

(3) Original text query: Collect the Hash and extraction code submitted by the user from the evidence display unit, and retrieve the corresponding evidence content in the evidence database;

The result display unit is used to display the verification result. In the mode of hash check and file verification, the verification result is displayed in the form of an information box; in the mode of original text query, the query result is displayed in the form of a table and a picture. Form for display.
The blockchain-based forensic service system according to claim 9, wherein the identity authentication method in the account module includes personal authentication and enterprise authentication; when the account module is personally authenticated, the collected user identity is related The information includes the user’s real name, user ID number, and user ID image information; when the account module authenticates the enterprise, the user identity-related information collected includes the enterprise business license, the real name of the legal representative, the ID number of the legal representative, and the legal representative ID image information.
The blockchain-based forensics service system according to claim 9, wherein the certificate verification process in the verification module is: when the user submits the certificate downloaded from the evidence display unit, the system will Perform Hash calculation, and query and match the evidence database according to the calculated Hash. If the matching is successful, the verification of the certificate file is passed; if the matching fails, the verification of the certificate file fails.