WO2021135641A1

WO2021135641A1 - Blockchain-based digital content evidence collection method, apparatus and device

Info

Publication number: WO2021135641A1
Application number: PCT/CN2020/126973
Authority: WO
Inventors: 韩喆; 王春霈
Original assignee: 支付宝(杭州)信息技术有限公司
Priority date: 2019-12-31
Filing date: 2020-11-06
Publication date: 2021-07-08
Also published as: CN111143883B; CN111143883A

Abstract

A blockchain-based digital content evidence collection method, apparatus and device. The blockchain-based digital content evidence collection method comprises: receiving an evidence collection task of digital content (202); selecting a plurality of second nodes from a plurality of nodes of the blockchain, and sending an execution instruction of the evidence collection task to each second node in the plurality of second nodes (204); receiving a plurality of evidence collection results returned by the second nodes after the second nodes execute the corresponding evidence collection tasks (206); determining whether the plurality of evidence collection results are matched or not (208); if the plurality of evidence collection results are matched, selecting any first evidence collection result from the plurality of evidence collection results as an evidence storage result (210); and storing the evidence storage result locally, and broadcasting the evidence storage result to other nodes except the first node in the plurality of nodes, so that the other nodes perform consensus verification on the evidence storage result and then store the evidence storage result (212).

Description

Digital content forensics method, device and equipment based on blockchain

Technical field

One or more embodiments of this specification relate to the field of computer technology, and in particular to a blockchain-based digital content forensics method, device, and equipment.

Background technique

In the current field of digital copyright protection, digital content such as pictures and videos are often stolen. The main reasons are the following two aspects: First, there are very few security agencies that can protect digital content, and the processing steps are cumbersome, and the method of obtaining evidence is single. It is unable to provide extensive and convenient copyright protection services for all sectors of society. Second, there are many irregular, non-standard, and insecure factors in users' self-collecting evidence, which can easily lead to the failure to obtain appeals for their legitimate rights. Therefore, how to effectively obtain evidence for digital content has become a problem to be solved.

In traditional technology, the forensics of digital content is usually realized based on the architecture of client and server. Taking digital content as a screenshot of a webpage as an example, the forensic process is: whenever a client needs to take a screenshot of a webpage, it will send a request to the server that contains the address of the webpage to be screenshotted, and then the server will take a screenshot and take the webpage The screenshot is saved on the server. However, in the above process, the request sent by the client to the server and the screenshot of the webpage saved on the server may be tampered with. Therefore, it is necessary to provide a more reliable method for obtaining evidence of digital content.

Summary of the invention

One or more embodiments of this specification describe a blockchain-based digital content forensics method, device, and equipment, which can improve the credibility of acquired digital content.

In a first aspect, a blockchain-based digital content forensics method is provided, which includes: receiving digital content forensic tasks; selecting a number of second nodes from the plurality of nodes, and sending them to one of the plurality of second nodes. Each second node sends an execution instruction for the forensic task; receives multiple forensic results returned by each second node after completing the corresponding forensic task; judges whether the multiple forensic results match; Select any first forensic result from the plurality of forensic results as the result of the forensic evidence; store the result of the forensic evidence locally, and broadcast the result of the forensic evidence to nodes other than the first node among the plurality of nodes, In this way, other nodes store the result after consensus verification of the deposit certificate.

In a second aspect, a blockchain-based digital content forensics method is provided, which includes: receiving an execution instruction of a forensic task sent by any first node among the plurality of first nodes; and in response to the execution instruction, executing all the forensics tasks. The forensic task to obtain the forensic result; return the forensic result to the first node; receive the forensic result determined by the first node at least based on the forensic result; and based on the forensic result received from other first nodes , Adopting a consensus algorithm to perform consensus verification on the deposit certificate result received from the first node; if the consensus verification is passed, store the deposit certificate result received from the first node.

In a third aspect, a digital content forensics device based on blockchain is provided, including: a receiving unit for receiving digital content forensic tasks; and a selecting unit for selecting a number of second nodes from the plurality of nodes; The sending unit is configured to send an execution instruction of the forensics task to each of the plurality of second nodes selected by the selection unit; the receiving unit is also configured to receive the corresponding execution of each second node The multiple forensic results returned after the forensic task of the forensics; the judging unit is used to determine whether the multiple forensic results received by the receiving unit match; the selection unit is also used to obtain evidence from the multiple forensics if they match Select any first forensic result as the result of the evidence; the storage unit is used to locally store the result of the evidence selected by the selection unit; the sending unit is also used to remove the evidence from the multiple nodes Nodes other than the first node broadcast the deposit result, so that other nodes store the deposit result after consensus verification.

In a fourth aspect, a digital content forensics device based on blockchain is provided, including: a receiving unit, configured to receive an execution instruction of a forensic task sent by any first node among the plurality of first nodes; an execution unit, using In response to the execution instruction received by the receiving unit, execute the forensic task to obtain a forensic result; a sending unit is configured to return the forensic result to the first node; and the receiving unit is further configured to Receive the evidence result determined by the first node at least based on the forensic result; the consensus unit is used for adopting a consensus algorithm based on the evidence result received by the receiving unit from other first nodes to compare the evidence from the first node Consensus verification is performed on the received deposit certificate result; a storage unit is used to store the deposit certificate result received from the first node if the consensus unit verification is passed by the consensus unit.

In a fifth aspect, a blockchain-based digital content forensics device is provided, including: a memory; one or more processors; and one or more programs, wherein the one or more programs are stored in the memory And is configured to be executed by the one or more processors, and when the program is executed by the processor, the following steps are implemented:

Receive the forensic task of digital content; select a number of second nodes from a plurality of nodes in the blockchain, and send an execution instruction of the forensic task to each of the plurality of second nodes; receive each of the second nodes Multiple forensic results returned after the execution of the corresponding forensic task; determine whether the multiple forensic results match; if they match, select any first forensic result from the multiple forensic results as the evidence; Store the attestation result locally, and broadcast the attestation result to other nodes of the plurality of nodes except the first node, so that other nodes store the attestation result after consensus verification of the attestation result.

In a sixth aspect, a blockchain-based digital content forensics device is provided, including: a memory; one or more processors; and one or more programs, wherein the one or more programs are stored in the memory , And is configured to be executed by the one or more processors, and when the program is executed by the processor, the following steps are implemented: receiving the forensic task sent by any one of the several first nodes of the blockchain Execution instruction; in response to the execution instruction, execute the forensic task to obtain the forensic result; return the forensic result to the first node; receive the forensic result determined by the first node at least based on the forensic result ; Based on the deposit certificate results received from other first nodes, the consensus algorithm is adopted to perform consensus verification on the deposit certificate results received from the first node; if the consensus verification is passed, the deposit certificate received from the first node The results are stored.

In the blockchain-based digital content forensics method, device, and equipment provided by one or more embodiments of this specification, the first node in the blockchain is responsible for receiving the forensic task, and after receiving the forensic task, from the block Several second nodes are selected in the chain to perform corresponding forensics tasks. After that, the first node, after receiving multiple forensic results returned by each second node, determines whether the multiple forensic results match, and in the case of a match, determines the corresponding evidence from the multiple forensic results As a result, the deposit result will be published on the blockchain. That is to say, the solution provided in this manual can obtain digital content based on the blockchain, thereby ensuring the safety and reliability of the forensic process. In addition, in this solution, setting the first node in the blockchain to be responsible for instructing the execution of the forensic task can greatly save computing resources.

Description of the drawings

In order to explain the technical solutions of the embodiments of this specification more clearly, the following will briefly introduce the drawings needed in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the specification. A person of ordinary skill in the art can obtain other drawings based on these drawings without creative work.

Figure 1 is a schematic diagram of the application scenario of the blockchain-based digital content forensics method provided in this manual.

Figure 2 is a flowchart of a blockchain-based digital content forensics method provided by an embodiment of this specification.

Fig. 3 is a flowchart of a blockchain-based digital content forensics method provided by another embodiment of this specification.

Figure 4 is a schematic diagram of a blockchain-based digital content forensics device provided by an embodiment of this specification.

Figure 5 is a schematic diagram of a blockchain-based digital content forensics device provided by another embodiment of this specification.

Figure 6 is a schematic diagram of a blockchain-based digital content forensics device provided by an embodiment of this specification.

Detailed ways

The following describes the solutions provided in this specification with reference to the accompanying drawings.

Before describing the solution provided in this specification, the following description of the inventive concept of this solution is provided.

Blockchain technology is a kind of Internet database technology, which is characterized by decentralization, openness and transparency, immutability and trustworthiness. Therefore, this solution can introduce blockchain technology.

After the introduction of blockchain technology, for the nodes in the blockchain, a part of the nodes can be selected to be responsible for the broadcast of forensic tasks and the sending of task execution instructions. This part of the nodes can also be called a group of committee nodes (or a group of first node). It should be noted that the committee nodes of this group are replaced periodically, for example, it can be replaced every hour.

For the task execution node (that is, the second node) in the blockchain, it executes the corresponding forensics task only when it receives a task execution instruction sent by a valid committee node. As a result, it is possible to avoid the problem that when each node is not distinguished, any node may send a task execution instruction, which will greatly waste computing resources. In addition, it can also be compatible with the existing blockchain architecture (that is, several core nodes of the blockchain have the right to keep accounts, and other nodes have only verification functions).

In addition, in order to further ensure the reliability of the forensic content, the committee node can select several nodes from the nodes of the blockchain to perform the corresponding forensic task. Here, each of the selected nodes may be referred to as the second node. After that, the final evidence deposit result is determined based on the forensic result returned by each of the several nodes (the determination method will be explained later).

After the committee node selects the above deposit result, it can broadcast the deposit result on the blockchain. It is understandable that, for ordinary nodes on the blockchain other than committee nodes, they can receive the evidence result sent by each committee node in a group of committee nodes. After that, it can use a consensus algorithm to determine the final deposit result from the multiple deposit results sent by each committee node and store it. It can be seen that, for the above-mentioned ordinary nodes, the final storage certificate results have been double-verified, that is, the committee node first verifies the first time, and then conducts the second verification through the consensus algorithm. Therefore, It can greatly improve the accuracy and validity of the deposit evidence.

The above is the inventive concept provided in this specification, and the solution can be obtained based on the inventive concept. The solution will be described in detail below.

Figure 1 is a schematic diagram of the application scenario of the blockchain-based digital content forensics method provided in this manual. In FIG. 1, the blockchain may include multiple nodes, and the multiple nodes may include a group of first nodes. Specifically, the user can publish the forensic task of digital content to a certain first node in the blockchain based on the corresponding client. After that, the first node may broadcast the forensic task on the blockchain, so that each first node in the group of first nodes can receive the forensic task.

Take a certain first node in the above group of first nodes as an example. After the first node receives the forensics task, it can select several second nodes from the multiple nodes of the blockchain, and send to the several second nodes. Each second node in the second node sends an execution instruction of the forensic task. After completing the corresponding forensics task, each second node may return the corresponding forensic result to the first node. The first node judges whether multiple forensic results match. If they match, any first forensic result is selected from the multiple forensic results as the result of the forensic evidence. Store the certification result locally, and broadcast the certification result to other nodes among the multiple nodes except the first node, so that other nodes store the certification result after consensus verification.

Figure 2 is a flowchart of a blockchain-based digital content forensics method provided by an embodiment of this specification. The execution subject of the method may be the first node of the blockchain in FIG. 1. As shown in FIG. 2, the method may specifically include step 202-step 212.

Step 202: Receive the forensics task of the digital content.

The forensic task of the digital content here may be directly received by the first node from the client, or it may be received by the first node when the forensic task is broadcast by other first nodes on the blockchain.

It should be noted that the client can add the corresponding digital signature/certificate when sending the above forensic task. Alternatively, other first nodes may add corresponding digital signatures/certificates when broadcasting the above forensic task. Therefore, the above-mentioned first node can verify the identity of the client or other first nodes based on the digital signature/certificate, thereby ensuring the credibility of the communication between the client and the first node and multiple first nodes.

In step 202, the digital content may include, but is not limited to, screenshots of web pages, video files, audio files, and so on. Taking a screenshot of a web page as an example, the corresponding forensic task can be a screenshot task or a grabbing task. Taking a video file or an audio file as an example, the corresponding forensic task may be a recording task.

Taking the digital content as a screenshot of a webpage as an example, the above forensic task may include the user's uid (user identity) and the URL address of the webpage to be screenshotted.

Step 204: Select a number of second nodes from a plurality of nodes in the blockchain, and send an execution instruction of the forensics task to each of the plurality of second nodes.

The above-mentioned several second nodes may be selected from all nodes of the blockchain based on predefined node selection rules, or selected from predetermined nodes of the blockchain. The scheduled node here is only responsible for the execution of forensic tasks. It can be understood that, when the above-mentioned several second nodes are selected based on the first method, the several second nodes may include the first node itself. In other words, the first node in this specification can also be responsible for the execution of forensic tasks. In addition, when the second node is selected from the predetermined nodes, the efficiency of selecting the second node can be greatly improved.

Taking the digital content as a screenshot of a webpage as an example, the execution instruction of the forensic task may include the uid of the user and the URL address of the webpage to be screenshotted. After receiving the execution instruction, any second node can start the docker container based on the pre-downloaded docker image file. And run the pre-packaged browser in the docker container. In the running browser, load the web page to be screenshot based on the URL address, and take a screenshot of the web page to be screenshot to obtain a screenshot of the web page. It is understandable that, in this example, the obtained screenshot of the webpage is the forensic result obtained by any of the above-mentioned second nodes.

It should be noted that in this specification, the first node is responsible for sending the execution instruction of the forensic task. Therefore, any second node can perform the forensic task execution instruction according to the predefined validity verification rules. The validity of the first node is verified. If the validity verification is passed, the forensics task will be executed.

It should be understood that when the first node needs to be replaced periodically, the corresponding validity verification rule may also be updated periodically. For example, suppose that at t, the validity verification rule is: node id%t=0, then at t+1, the validity verification rule can be updated to: node id%(t+1)=0.

Step 206: Receive multiple forensic results returned by each second node after completing the corresponding forensic task.

Taking the digital content as a screenshot of a webpage as an example, the first node can receive multiple screenshots of the webpage each sent by multiple second nodes selected by it.

Step 208: Determine whether the multiple forensic results match.

In an example, the judging process may specifically include: calculating the similarity between two forensic results of multiple forensic results. Based on the similarity between the two forensic results of the multiple forensic results, the multiple forensic results are divided into at least one group. Based on the number of forensic results in at least one group, it is determined whether multiple forensic results match. For example, when there is a first group with a number of forensic results greater than a first threshold in at least one group, it is determined that the multiple forensic results match.

Taking the digital content as a screenshot of a web page as an example, the similarity between the above-mentioned pair of forensic results can be calculated based on image similarity algorithms such as perceptual hash algorithm, ORB algorithm, and histogram statistical algorithm.

In addition, the above judgment process may also have other steps. Taking the digital content as a screenshot of a webpage as an example, it can also include the following steps: judging whether the corresponding attribute information (such as size or height) of multiple webpage screenshots are equal, and/or judging that multiple forensic results correspond to each other Whether the sub-screenshots match, etc. The sub-screenshots here can be taken based on predefined screenshot rules (for example, a square or rounded area with a white background color in a web page). The judgment of whether the above sub-screenshots match can also be realized based on the image similarity algorithm and attribute information. The specific judgment process is the same as that described above, and will not be repeated here.

Of course, in practical applications, the judgment of whether multiple forensic results match can also be realized directly based on whether the respective corresponding sub-screenshots match, that is, this solution does not require each forensic result to be exactly the same, but only cares about the core content (That is, the content corresponding to the sub-screenshot), which expands the scope of application or usage scenarios of this solution.

In this specification, the first node selects multiple second nodes to perform the forensic task, which can ensure the safety and reliability of the obtained evidence.

In step 210, if they match, any first forensic result is selected from a plurality of forensic results as the result of the forensic evidence.

Taking the digital content as a screenshot of a webpage as an example, if multiple webpage screenshots match, then any webpage screenshot can be selected as the final certification result.

It should be noted that if multiple forensic results do not match, then the first node can broadcast its forensic failure information on the blockchain. Of course, it is not necessary to broadcast any information, which is not limited in this specification. In addition, the first node can also select an incorrect forensic result from a plurality of forensic results, and determine the second node that sends the incorrect forensic result. Count the number of times that the determined second node sends wrong forensic results. If the number of times is greater than the predetermined threshold, the determined second node is broadcast on the blockchain. In this way, the function of supervising the second node is realized.

Step 212: Store the attestation result locally, and broadcast the attestation result to other nodes among the multiple nodes except the first node, so that other nodes store the attestation result after consensus verification.

Here, the process of the first node locally storing the attestation result may specifically be: generating a target transaction based on the attestation result and content information related to the attestation result. Store the generated target transaction locally. Among them, in one implementation, after the first node generates the above-mentioned target transaction, it may first record the target transaction in the transaction pool, and then connect to other transactions and write them into the transaction details of the corresponding block of the first node. . The foregoing content information may include any one or more of the following: Hash value corresponding to the evidence storage result, the initiator of the forensic task (for example, user id), the information of the first node, the information of the second node, and the time of obtaining the evidence.

In addition, the above-mentioned other nodes can be divided into two types, one of which is committee nodes (that is, other first nodes), and the other is nodes other than committee nodes (hereinafter referred to as ordinary nodes). For each other first node, if its forensic result is successfully obtained, that is, if the multiple forensic results obtained by corresponding several second nodes match, then after receiving the above-mentioned first node, it can Do nothing. And if the forensic result fails to obtain, that is, if the multiple forensic results obtained through the corresponding second nodes do not match, then it performs the same consensus verification operation as the ordinary node (described below).

For ordinary nodes, it performs the following consensus verification operations. Specifically, the ordinary node first receives multiple deposit results broadcast by each first node. Then, based on the deposit certificate results received from other first nodes, a consensus algorithm is adopted to perform consensus verification on the deposit certificate results received from the first node. The consensus algorithm here can include but is not limited to Practical Byzantine Fault Tolerance (PBFT) algorithm, Proof of Work (POW) algorithm, Proof of Stake (POS) algorithm, and Delegated Proof of Stake (Delegated) Proof of Stake, DPOS) algorithm, etc. If the consensus verification is passed, the deposit result received from the first node will be stored. The specific storage process is the same as the storage process of the first node, and will not be repeated here.

It should be noted that, for other nodes, when generating the corresponding target transaction, the content information related to the deposit result may be sent by the first node together with the deposit result when the above deposit result is broadcast.

It should also be noted that for the deposit result stored on the blockchain, if the user or judicial institution needs to extract or verify the deposit result, it only needs to query on the blockchain based on the hash value corresponding to the deposit result Or just get the deposit result.

In short, in the embodiments of this specification, because the blockchain has the characteristics of traceability and tamper resistance, it is inherently an excellent way to store evidence. Therefore, after the evidence is generated through a trusted processing link, it is stored in the same trusted On the blockchain, the value of evidence can be maximized. In addition, the embodiments of this specification are suitable for obtaining evidence of various types of digital content, and only need to set different matching mechanisms for different types.

The foregoing embodiment describes the solution with the first node in the blockchain as the execution subject, and the following describes the solution with the second node as the execution subject.

Fig. 3 is a flowchart of a blockchain-based digital content forensics method provided by another embodiment of this specification. The execution subject of the method may be the second node of the blockchain in FIG. 1. As shown in FIG. 3, the method may specifically include step 302 to step 312.

Step 302: Receive an execution instruction of the forensic task sent by any first node among the plurality of first nodes.

Here, the forensic task sent by the client or other first nodes on the blockchain may be first received by the above-mentioned first node. After that, the first node selects the second node and sends the execution instruction of the forensic task to the second node.

Step 304: In response to the execution instruction, perform a forensic task to obtain a forensic result.

In an example, before performing the forensics task, the second node may first verify the validity of the first node according to a predefined validity verification rule. If the validity verification is passed, the forensics task will be executed.

Taking the digital content as a screenshot of a webpage as an example, the execution instruction of the forensic task may include the uid of the user and the URL address of the webpage to be screenshotted. After receiving the execution instruction, the second node can start the docker container based on the pre-downloaded docker image file. And run the pre-packaged browser in the docker container. In the running browser, load the web page to be screenshot based on the URL address, and take a screenshot of the web page to be screenshot to obtain a screenshot of the web page. It is understandable that, in this example, the obtained screenshot of the webpage is the forensic result obtained by the second node.

Step 306: Return the forensic result to the first node.

Step 308: Receive an attestation result determined by the first node at least based on the forensic result.

Specifically, the first node may receive forensic results returned by multiple second nodes. After that, the first node can determine whether the multiple forensic results match. For example, it is possible to judge whether multiple forensic results match based on the similarity between the two forensic results of multiple forensic results. In addition, it is also possible to judge whether the multiple forensic results match based on the respective attribute information (such as size or height) of the multiple webpage screenshots, and/or the sub-screenshots corresponding to the multiple forensic results.

If they match, any first forensic result is selected from the multiple forensic results as the result of the forensic evidence.

Step 310: Based on the deposit result received from other first nodes, a consensus algorithm is used to perform consensus verification on the deposit result received from the first node.

It is understandable that, in this specification, each second node in the blockchain can receive the deposit certificate results broadcast by each first node in a group of first nodes on the blockchain. After receiving the deposit certificate results sent by each first node, consensus verification can be performed based on the consensus algorithm.

The aforementioned consensus algorithm may be a PBFT algorithm.

In step 312, if the consensus verification is passed, the storage certificate result received from the first node is stored.

As mentioned above, in addition to receiving the attestation result broadcast by the first node, the second node may also receive content information related to the attestation result. The content information here may be recorded when the first node executes the process of obtaining the evidence result. It may include, but is not limited to, the hash value corresponding to the evidence deposit result, the initiator of the forensic task (for example, user id), the information of the first node, the information of the second node, and the time of obtaining the evidence, etc.

The process for the second node to store the foregoing deposit result may specifically be: generating a target transaction based on the deposit result and content information related to the deposit result. Store the generated target transaction locally.

It should be noted that in this manual, the deposit result stored by the second node is actually double-verified, that is, the first node performs the first verification, and then the consensus algorithm performs the second verification. As a result, the correctness and validity of the deposit evidence can be greatly improved.

In a word, the embodiments of this specification protect the safety and reliability of all processing processes by using multiple times of obtaining evidence, verification and consensus, and the evidence is traceable and easy to verify. In addition, this scheme can also be applied to other scenarios. For example, when redundant data is required to be fault-tolerant and verified in an unreliable network, the redundant data is treated as the same piece of evidence through this scheme, and committee voting and consensus are used. The mechanism can also guarantee the correctness of the final result.

Based on the above two embodiments, it can be concluded that the solution provided in this specification can solve the following problems.

First, it solves the problem of risks in the forensics process. This solution ensures that the processing link forms a credible closed loop, and adds multi-node verification, so that the entire process has the ability to resist potential threats, and the obtained evidence has strong credibility.

Second, it solves the problem of the risk of evidence preservation. This solution will calculate the hash value through the result of the verification, and then upload it together with the key information in the processing process to store the evidence, which solves the risk in the preservation of evidence and makes the evidence verifiable and traceable.

Third, the problem of inconvenient evidence verification is solved. By storing the evidence on the chain, this solution enables users or judicial organs to quickly extract the hash value from the chain for verification when they need to verify the evidence. At the same time, it can also verify the source of the evidence, which greatly improves the processing efficiency.

Corresponding to the above-mentioned blockchain-based digital content forensics method, an embodiment of this specification also provides a blockchain-based digital content forensics device. The blockchain includes multiple nodes, and the multiple nodes include at least a first node. The device is implemented by the first node. As shown in FIG. 4, the device may include a receiving unit 402, a selecting unit 404, a sending unit 406, a judging unit 408, and a storage source 410.

The receiving unit 402 is used to receive forensics tasks of digital content.

The digital content here includes any of the following: webpage screenshots, audio files, video files, etc. Forensic tasks include any of the following: screenshot tasks, capture tasks, and recording tasks.

The selecting unit 404 is configured to select a number of second nodes from a plurality of nodes.

The sending unit 406 is configured to send an execution instruction of the forensic task to each of the plurality of second nodes selected by the selecting unit 404.

The receiving unit 402 is further configured to receive multiple forensic results returned by each second node after completing the corresponding forensic task.

The judging unit 408 is configured to judge whether the multiple forensic results received by the receiving unit 402 match.

The judging unit 408 may be specifically used to calculate the similarity between the pairwise forensic results of multiple forensic results.

Based on the similarity between the two forensic results of the multiple forensic results, the multiple forensic results are divided into at least one group.

Based on the number of forensic results in at least one group, it is determined whether multiple forensic results match.

The judging unit 408 may also be specifically configured to judge whether there is a first group whose number of forensic results is greater than a first threshold in the at least one group. If the first group exists, it is determined that multiple forensic results match.

Optionally, if the forensic result is a screenshot of a webpage, the determining unit 408 may be specifically configured to: determine multiple forensic results based on the attribute information corresponding to each of the multiple forensic results and/or based on the matching results of the sub-screenshots corresponding to each of the multiple forensic results. Whether the forensic results match.

The selecting unit 404 is further configured to, if the determining unit 408 determines that they match, select any first forensic result from a plurality of forensic results as the result of the forensic evidence.

The storage unit 410 is configured to locally store the storage result selected by the selection unit 404.

The storage unit 410 may be specifically used to generate a target transaction based on the deposit certificate result and content information related to the deposit certificate result.

Store the target transaction locally.

The foregoing content information includes any one or more of the following: Hash value corresponding to the evidence deposit result, the initiator of the forensic task, the information of the first node, the information of the second node, and the time of obtaining the evidence.

The sending unit 406 is also configured to broadcast the certification result to other nodes among the multiple nodes except the first node, so that other nodes store the certification result after consensus verification.

Optionally, the device may further include: a statistical unit (not shown in the figure).

The selecting unit 404 is further configured to select an erroneous forensic result from the multiple forensic results if the multiple forensic results do not match, and determine the second node that sends the erroneous forensic result.

The statistical unit is used to count the number of times that the determined second node sends wrong forensic results.

The sending unit 406 is further configured to broadcast the determined second node on the blockchain if the number of times counted by the statistical unit is greater than a predetermined threshold.

The function of each functional module of the device in the above-mentioned embodiment of this specification can be realized by the steps of the above-mentioned method embodiment. Therefore, the specific working process of the device provided in an embodiment of this specification will not be repeated here.

In the digital content forensics device based on blockchain provided in an embodiment of this specification, the receiving unit 402 receives the forensics task of the digital content. The selecting unit 404 selects a number of second nodes from a plurality of nodes. The sending unit 406 sends an execution instruction of the forensic task to each of the selected second nodes. The receiving unit 402 receives multiple forensic results returned by each second node after completing the corresponding forensic task. The judging unit 408 judges whether the multiple forensic results match. If they match, the selecting unit 404 selects any first forensic result from the multiple forensic results as the evidence storage result. The storage unit 410 locally stores the attestation result. The sending unit 406 broadcasts the certification result to nodes other than the first node among the multiple nodes, so that other nodes store the certification result after consensus verification. As a result, the credibility of the acquired digital content can be improved.

Corresponding to the above-mentioned blockchain-based digital content forensics method, an embodiment of this specification also provides a blockchain-based digital content forensics device. The blockchain includes a plurality of nodes, and the plurality of nodes includes a plurality of One node and second node. The device is implemented by the second node. As shown in FIG. 5, the device may include a receiving unit 502, an executing unit 504, a sending compound 506, a consensus unit 508, and a storage unit 510.

The receiving unit 502 is configured to receive an execution instruction of a forensic task sent by any first node among several first nodes.

The execution unit 504 is configured to execute the forensic task in response to the execution instruction received by the receiving unit 502 to obtain the forensic result.

The execution unit 504 may be specifically configured to verify the validity of the first node according to a predefined validity verification rule.

If the validity verification is passed, the forensics task will be executed.

The sending unit 506 is configured to return the forensic result to the first node.

The receiving unit 502 is further configured to receive the evidence deposit result determined by the first node at least based on the forensic result.

The consensus unit 508 is configured to use a consensus algorithm to perform consensus verification on the deposit result received from the first node based on the deposit result received by the receiving unit 502 from other first nodes.

The consensus algorithm here can be a practical Byzantine fault-tolerant PBFT algorithm.

The storage unit 510 is configured to store the certificate deposit result received from the first node if the consensus verification by the consensus unit 508 is passed.

The block chain-based digital content forensics device provided in an embodiment of this specification can improve the credibility of the acquired digital content.

Corresponding to the foregoing blockchain-based digital content forensics method, an embodiment of this specification also provides a forensics device, which may include a memory 602, one or more processors 604, and one or more programs. Wherein, the one or more programs are stored in the memory 602 and are configured to be executed by one or more processors 604. When the programs are executed by the processor 604, the following steps are implemented: receiving digital content forensic tasks; A number of second nodes are selected from the nodes, and the execution instructions of the forensics task are sent to each of the plurality of second nodes; the multiple forensics results returned by each second node after the completion of the corresponding forensics task are received; multiple forensic results are judged Whether the forensic results match; if they match, select any first forensic result from the multiple forensic results as the attestation result; store the attestation result locally and send it to the nodes other than the first node among the multiple forensic results Broadcast the deposit result so that other nodes will store the deposit result after consensus verification.

The forensic device provided in an embodiment of this specification can improve the credibility of acquired digital content.

Corresponding to the foregoing blockchain-based digital content forensics method, another forensic device provided in another embodiment of this specification may also be as shown in FIG. One or more programs. Wherein, the one or more programs are stored in the memory 602, and are configured to be executed by one or more processors 604. The difference is that when the program is executed by the processor 604, the following steps are implemented: receiving the execution instruction of the forensic task sent by any first node among the first nodes; in response to the execution instruction, execute the forensic task to obtain the forensic result ; Return the forensic result to the first node. The receiving first node at least determines the evidence deposit result based on the forensic result; based on the evidence result received from other first nodes, the consensus algorithm is adopted to perform consensus verification on the evidence result received from the first node; if the consensus verification is passed, Then the deposit result received from the first node is stored.

The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the difference from other embodiments. In particular, as for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for related parts, please refer to the part of the description of the method embodiment.

The steps of the method or algorithm described in conjunction with the disclosure of this specification can be implemented in a hardware manner, or can be implemented in a manner in which a processor executes software instructions. Software instructions can be composed of corresponding software modules, which can be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, mobile hard disk, CD-ROM or any other form of storage known in the art Medium. An exemplary storage medium is coupled to the processor, so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium may also be an integral part of the processor. The processor and the storage medium may be located in the ASIC. In addition, the ASIC may be located in the server. Of course, the processor and the storage medium may also exist as discrete components in the server.

Those skilled in the art should be aware that, in one or more of the foregoing examples, the functions described in the present invention can be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on the computer-readable medium. The computer-readable medium includes a computer storage medium and a communication medium, where the communication medium includes any medium that facilitates the transfer of a computer program from one place to another. The storage medium may be any available medium that can be accessed by a general-purpose or special-purpose computer.

The foregoing describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in a different order than in the embodiments and still achieve desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or sequential order shown in order to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

The specific implementations described above further describe the purpose, technical solutions and beneficial effects of this specification. It should be understood that the above are only specific implementations of this specification and are not intended to limit the description of this specification. The scope of protection, any modification, equivalent replacement, improvement, etc. made on the basis of the technical solution of this specification shall be included in the scope of protection of this specification.

Claims

A digital content forensics method based on a blockchain, the blockchain including a plurality of nodes, the plurality of nodes includes at least a first node, and the method is executed by the first node and includes:

Forensic tasks for receiving digital content;

Selecting a number of second nodes from the plurality of nodes, and sending an execution instruction of the forensic task to each of the plurality of second nodes;

Receiving multiple forensic results returned by each of the second nodes after completing the corresponding forensic task;

Judge whether the multiple forensic results match; if they match, select any first forensic result from the multiple forensic results as the evidence storage result;

Store the attestation result locally, and broadcast the attestation result to other nodes among the multiple nodes except the first node, so that other nodes store the attestation result after consensus verification of the attestation result.
The method according to claim 1, determining whether the multiple forensic results match, comprising:

Calculating the similarity between the two forensic results of the multiple forensic results;

Dividing the multiple forensic results into at least one group based on the similarity between the pair of forensic results of the multiple forensic results;

Based on the number of forensic results in the at least one group, it is determined whether the multiple forensic results match.
The method according to claim 2, based on the number of forensic results in the at least one group, judging whether the multiple forensic results match, comprising:

It is determined whether there is a first group with a number of forensic results greater than a first threshold in the at least one group; if the first group exists, it is determined that the multiple forensic results match.
The method according to claim 2, wherein the forensic result is a screenshot of a webpage; and the judging whether a plurality of forensic results match, further comprises:

Based on the attribute information corresponding to each of the multiple forensic results and/or based on the matching results of the sub-screenshots corresponding to the multiple forensic results, it is determined whether the multiple forensic results match.
The method according to claim 1, wherein the storing the evidence result locally includes:

Generating a target transaction based on the deposit result and content information related to the deposit result;

Store the target transaction locally;

The content information includes any one or more of the following: the Hash value corresponding to the evidence deposit result, the initiator of the forensic task, the information of the first node, the information of the second node, and the time of obtaining the evidence.
The method according to claim 1, further comprising:

If the multiple forensic results do not match, select an erroneous forensic result from the multiple forensic results, and determine the second node that sends the erroneous forensic result;

Count the number of times that the determined second node sends wrong forensic results;

If the number of times is greater than a predetermined threshold, broadcast the determined second node on the blockchain.
The method according to any one of claims 1 to 6, wherein the digital content includes any one of the following: a screenshot of a webpage, an audio file, and a video file; the forensic task includes any one of the following: a screenshot task, a capture task And recording tasks.
A digital content forensics method based on a blockchain, the blockchain including a plurality of nodes, the plurality of nodes including a plurality of first nodes and a second node, the method being executed by the second node, including:

Receiving an execution instruction of a forensic task sent by any first node among the plurality of first nodes;

In response to the execution instruction, execute the forensic task to obtain a forensic result;

Return the forensic result to the first node;

Receiving the evidence deposit result determined by the first node at least based on the forensic result;

Based on the deposit certificate results received from other first nodes, adopting a consensus algorithm to perform consensus verification on the deposit certificate results received from the first node;

If the consensus verification is passed, the storage certificate result received from the first node is stored.
The method according to claim 8, wherein said performing said forensic task comprises:

Verify the validity of the first node according to a predefined validity verification rule;

If the validity verification is passed, the forensic task is executed.
According to the method of claim 8 or 9, the consensus algorithm is a practical Byzantine fault-tolerant PBFT algorithm.
A digital content forensics device based on a blockchain, the blockchain including a plurality of nodes, the plurality of nodes includes at least a first node, and the device is implemented by the first node and includes:

The receiving unit is used to receive the forensic task of digital content;

The selection unit is used to select a number of second nodes from the plurality of nodes;

A sending unit, configured to send an execution instruction of a forensic task to each of the plurality of second nodes selected by the selection unit;

The receiving unit is further configured to receive multiple forensic results returned by each of the second nodes after completing the corresponding forensic task;

A judging unit, configured to judge whether the multiple forensic results received by the receiving unit match;

The selecting unit is further configured to select any first forensic result from the plurality of forensic results as the result of the evidence if the judgment unit judges that they match;

A storage unit, configured to locally store the evidence storage result selected by the selection unit;

The sending unit is further configured to broadcast the certification result to other nodes among the multiple nodes except the first node, so that other nodes store the certification result after consensus verification.
According to the device according to claim 11, the judgment unit is specifically configured to:

Calculating the similarity between the two forensic results of the multiple forensic results;

Dividing the multiple forensic results into at least one group based on the similarity between the pair of forensic results of the multiple forensic results;

Based on the number of forensic results in the at least one group, it is determined whether the multiple forensic results match.
According to the device according to claim 12, the judging unit is further configured to:

It is determined whether there is a first group with a number of forensic results greater than a first threshold in the at least one group; if the first group exists, it is determined that the multiple forensic results match.
The apparatus according to claim 12, wherein the forensic result is a screenshot of a webpage; the judgment unit is further specifically configured to:

Based on the attribute information corresponding to each of the multiple forensic results and/or based on the matching results of the sub-screenshots corresponding to the multiple forensic results, it is determined whether the multiple forensic results match.
The device according to claim 11, the storage unit is configured to:

Generating a target transaction based on the deposit result and content information related to the deposit result;

Store the target transaction locally;

The content information includes any one or more of the following: the Hash value corresponding to the evidence deposit result, the initiator of the forensic task, the information of the first node, the information of the second node, and the time of obtaining the evidence.
The device according to claim 11, further comprising: a statistical unit;

The selecting unit is further configured to select an erroneous forensic result from the multiple forensic results if the multiple forensic results do not match, and determine the second node that sends the erroneous forensic result;

The statistical unit is configured to count the number of times that the determined second node sends wrong forensic results;

The sending unit is further configured to broadcast the determined second node on the blockchain if the number of times counted by the statistics unit is greater than a predetermined threshold.
The device according to any one of claims 11-16, wherein

The digital content includes any one of the following: webpage screenshots, audio files, and video files;

The forensic task includes any one of the following: a screenshot task, a capture task, and a recording task.
A digital content forensics device based on a blockchain. The blockchain includes multiple nodes. The multiple nodes include a number of first nodes and second nodes. The device is implemented by the second node and includes:

A receiving unit, configured to receive an execution instruction of a forensic task sent by any first node among the plurality of first nodes;

An execution unit, configured to execute the forensic task in response to the execution instruction received by the receiving unit to obtain a forensic result;

A sending unit, configured to return the forensic result to the first node;

The receiving unit is further configured to receive the evidence deposit result determined by the first node at least based on the forensic result;

The consensus unit is configured to use a consensus algorithm to perform consensus verification on the deposit result received from the first node based on the deposit result received by the receiving unit from the other first node;

The storage unit is configured to store the certification result received from the first node if the consensus verification of the consensus unit is passed.
According to the device of claim 18, the execution unit is specifically configured to:

Verify the validity of the first node according to a predefined validity verification rule;

If the validity verification is passed, the forensic task is executed.
The device according to claim 18 or 19, wherein the consensus algorithm is a practical Byzantine fault-tolerant PBFT algorithm.
A forensic device, including:

Memory

One or more processors; and

One or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the following steps are implemented when the programs are executed by the processor:

Forensic tasks for receiving digital content;

Selecting a number of second nodes from a plurality of nodes in the blockchain, and sending an execution instruction of the forensic task to each of the plurality of second nodes;

Receiving multiple forensic results returned by each of the second nodes after completing the corresponding forensic task;

Judge whether the multiple forensic results match; if they match, select any first forensic result from the multiple forensic results as the evidence storage result;

Store the attestation result locally, and broadcast the attestation result to other nodes among the multiple nodes except the first node, so that other nodes store the attestation result after consensus verification.
A forensic device, including:

Memory

One or more processors; and

One or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and when the programs are executed by the processor, the following steps are implemented:

Receiving the execution instruction of the forensic task sent by any first node among the several first nodes of the blockchain;

In response to the execution instruction, execute the forensic task to obtain a forensic result;

Return the forensic result to the first node;

Receiving the evidence deposit result determined by the first node at least based on the forensic result;

Based on the deposit certificate results received from other first nodes, adopting a consensus algorithm to perform consensus verification on the deposit certificate results received from the first node;

If the consensus verification is passed, the storage certificate result received from the first node is stored.