Method and device for encrypting and decrypting disk and storage medium

Abstract

The invention belongs to the technical field of disk encryption and decryption, and provides a disk encryption and decryption method and device and a storage medium. The method comprises the following steps: extracting internal data of a main body device provided with a to-be-accessed disk in a pre-tracking preset time period based on an access request; wherein the preset time period is a time region between the timestamp of the current access request and the timestamp of the last shutdown operation; traversing the internal data to confirm that communication exists between the main body equipment and the external equipment, and extracting equipment information of the external equipment and communication duration of the external equipment and the main body equipment; when it is judged that the external device communicates with the main device for the first time and the communication duration is larger than a preset duration threshold value, a first instruction is sent to a display front end; wherein the first instruction is used for requesting the user sending the access request to input a standby key. The security of the disk data of the user is further ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of disk encryption and decryption, and in particular to a method, device and storage medium for disk encryption and decryption. Background Art

[0002] As a storage component in computer devices, disks store a large amount of important data related to users, even privacy-sensitive data. Therefore, how to ensure the security of data in disks is of great value to protect the rights and interests of users.

[0003] Based on this, the existing technology requires key verification before accessing the data in the disk. However, in actual applications, the key is often obtained through various illegal means. For example, in some cases, when using BitLocker for encryption based on the TPM module, the key can be obtained through an external data grabber, and the disk plaintext data can be obtained using the key. Then, all the plaintext data can be compared and captured using an analyzer to obtain the plaintext data corresponding to the key, and the key can be cracked, thereby illegally invading the user's disk.

[0004] It can be seen that the security of user disk data cannot be ensured by simply setting the key. Summary of the invention

[0005] The present invention aims to provide a method, device and storage medium for disk encryption and decryption, so as to improve the technical problem in the prior art that the security of user disk data cannot be ensured by setting a key.

[0006] To achieve the above object, the present invention proposes the following technical solutions:

[0007] In the first aspect, the technical solution provides a method for disk encryption and decryption. It includes:

[0008] Extracting internal data of a main device equipped with a disk to be accessed within a preset period of time based on an access request; wherein the access request is used to request to obtain data in the disk to be accessed, and carries a disk key; the preset period of time is the time zone between the timestamp of the current access request and the timestamp of the last shutdown operation;

[0009] When the internal data is traversed to confirm that the main device and the external device are communicating, the device information of the external device and the communication duration between the external device and the main device are extracted; wherein the device information includes: device IP address and device type;

[0010] When it is determined that the external device and the main device are communicating for the first time and the communication duration is greater than a preset duration threshold, a first instruction is sent to the display front end; wherein the first instruction is used to require the user who sends the access request to enter a backup key.

[0011] Furthermore, the method of extracting the internal data of the main device equipped with the disk to be accessed within a preset period of time based on the access request includes:

[0012] Obtaining the timestamp of the access request to determine when a preset update cycle has been reached, sending a first feedback to the display front end of the main device; wherein the first feedback is used to remind that the disk key carried in the access request has expired;

[0013] A second instruction is sent to a mobile device associated with the main device to perform a custom key reset; wherein the second instruction carries a random key generated in real time, which is used to input into the display front end of the main device to trigger the custom key reset.

[0014] Further, when it is determined that the external device and the main device are communicating for the first time and the communication duration is greater than a preset duration threshold, after sending a first instruction to the display front end; it includes:

[0015] When it is determined that the backup key is entered incorrectly and the number of incorrect entries is greater than a preset number threshold, the disk to be accessed is locked to prohibit access, and a warning message is sent to a mobile device associated with the main device;

[0016] Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

[0017] Furthermore, when it is determined that the external device and the main device are communicating for the first time and the communication duration is greater than a preset duration threshold, sending a first instruction to the display front end includes:

[0018] Sending a third instruction to the display front end; wherein the third instruction is used to obtain a shard key corresponding to the backup key;

[0019] If it is determined that a correct sharding key is received within a preset time interval, the third instruction is sent in a loop until all sharding keys are obtained;

[0020] The shard keys are concatenated to obtain the backup key, and the disk to be accessed is allowed to be decrypted.

[0021] Further, the determining that a correct sharding key is received within a preset time interval, then executing the sending of the third instruction in a loop until all sharding keys are obtained; includes:

[0022] If it is determined that the correct sharding key is not received within the preset time interval, the third instruction is stopped from being sent, the disk to be accessed is locked to prohibit access, and a warning message is sent to a mobile device associated with the main device;

[0023] Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

[0024] In the second aspect, the technical solution provides a device for disk encryption and decryption. It includes:

[0025] A data retrieval module is used to extract internal data of a main device equipped with a disk to be accessed within a preset period of time based on an access request; wherein the access request is used to request the acquisition of data in the disk to be accessed, and carries a disk key; the preset period of time is the time zone between the timestamp of the current access request and the timestamp of the last shutdown operation;

[0026] A data traversal module is used to traverse the internal data to confirm that the main device and the external device are communicating, and then extract the device information of the external device and the communication duration between the external device and the main device; wherein the device information includes: device IP address and device type;

[0027] The abnormal verification module is used to determine that the external device and the main device are communicating for the first time, and when the communication duration is greater than a preset duration threshold, send a first instruction to the display front end; wherein the first instruction is used to require the user who sends the access request to enter a backup key.

[0028] Further, including:

[0029] A feedback sending module, used for obtaining the timestamp of the access request to determine when a preset update period has been reached, and sending a first feedback to the display front end of the main device; wherein the first feedback is used to remind that the disk key carried in the access request has expired;

[0030] An update reset module is used to send a second instruction to a mobile device associated with the main device to reset the custom key; wherein the second instruction carries a random key generated in real time, which is used to input the display front end of the main device to trigger the custom key reset.

[0031] Further, including:

[0032] The abnormal warning module is used to determine that the backup key is input incorrectly, and when the number of incorrect inputs exceeds a preset number threshold, lock the disk to be accessed to prohibit access, and send a warning message to a mobile device associated with the main device;

[0033] Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

[0034] In a third aspect, the technical solution provides an electronic device, comprising at least one processor, the processor being coupled to a memory, the memory storing a computer program, and the computer program being configured to execute the method when executed by the processor.

[0035] In a fourth aspect, the technical solution provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a computer, the method described above is implemented.

[0036] Beneficial effects:

[0037] It can be seen from the above technical solutions that the technical solution of the present invention provides a method for disk encryption and decryption to solve the technical defect of low security level in the prior art when only key setting is used to protect user disk data.

[0038] The method includes: first, based on the access request, extract the internal data of the main device equipped with the disk to be accessed within the preset time period; wherein, the access request is used to request the acquisition of the data in the disk to be accessed, which carries the disk key; the preset time period is the time zone between the timestamp of this access request and the timestamp of the last shutdown operation. Then, when the internal data is traversed to confirm that there is communication between the main device and the external device, the device information of the external device and the communication duration between the external device and the main device are extracted; wherein, the device information includes: device IP address and device type. Finally, when it is determined that the external device and the main device are communicating for the first time and the communication duration is greater than the preset duration threshold, a first instruction is sent to the display front end; wherein, the first instruction is used to require the user who sent the access request to enter a backup key.

[0039] From the above, it can be seen that in the process of processing the access request, this technical solution not only verifies whether the key carried in it is correct to confirm the legitimacy of the request. Instead, it screens and analyzes the internal data within the preset time to determine whether there is a risk that the key has been illegally obtained. And continue to verify with the backup key. On the one hand, it avoids the risk of illegal intrusion and thus affects the normal acquisition of disk data. On the other hand, it also avoids the risk of disk data leakage when the key is illegally obtained.

[0040] It should be appreciated that all combinations of the foregoing concepts, as well as additional concepts described in greater detail below, may be considered to be part of the inventive subject matter of the present disclosure, provided such concepts are not mutually inconsistent.

[0041] The foregoing and other aspects, embodiments and features of the present invention can be more fully understood from the following description in conjunction with the accompanying drawings. Other additional aspects of the present invention, such as the features and / or beneficial effects of the exemplary embodiments, will be apparent from the following description or learned from the practice of the specific embodiments according to the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The drawings are not intended to be drawn to scale. In the drawings, each identical or nearly identical component shown in various figures may be represented by the same reference numeral. For clarity, not every component is labeled in every figure. Embodiments of various aspects of the present invention will now be described by way of example and with reference to the accompanying drawings, in which:

[0043] Figure 1 This is a flow chart of the method for disk encryption and decryption described in this embodiment;

[0044] Figure 2 This is a flow chart of periodically resetting the key in this embodiment;

[0045] Figure 3 Another flowchart for obtaining a backup key is provided;

[0046] Figure 4 Flowchart for handling errors in alternate key input;

[0047] Figure 5 This is a structural block diagram of the device for disk encryption and decryption described in this embodiment;

[0048] Figure 6 is a structural block diagram of the electronic device described in this embodiment. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiment of the present invention clearer, the technical solution of the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings of the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all of the embodiments. Based on the described embodiment of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meaning understood by people with general skills in the field to which the present invention belongs.

[0050] The words "first", "second" and similar words used in the specification and claims of this application do not indicate any order, quantity or importance, but are only used to distinguish different components. Similarly, unless the context clearly indicates otherwise, the singular form of "a", "an" or "the" and other similar words do not indicate a quantitative limitation, but rather indicate the presence of at least one. Words such as "include" or "comprise" and the like mean that the elements or objects appearing before "include" or "comprise" cover the features, wholes, steps, operations, elements and / or components listed after "include" or "comprise", and do not exclude the existence or addition of one or more other features, wholes, steps, operations, elements, components and / or their collections. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0051] As a storage component in a computer device, a disk stores a large amount of important data related to the user, even privacy-sensitive data. Therefore, how to ensure the security of the data in the disk is of great value to protect the rights and interests of users. Based on this, in the prior art, key verification is required before access to the data in the disk. However, in actual application, there are often situations where the key is obtained through various illegal means, so that the security of the user's disk data cannot be effectively ensured. Therefore, this embodiment aims to provide a method for disk encryption and decryption to improve this technical defect.

[0052] The method for disk encryption and decryption described in this embodiment is described in detail below with reference to the accompanying drawings.

[0053] like Figure 1 As shown, the method comprises the following steps:

[0054] Step S102: extracting internal data of a main device equipped with a disk to be accessed within a preset period of time based on the access request.

[0055] In a specific implementation, the access request is used to request to obtain data in the disk to be accessed, which carries the disk key. The preset time period is the time zone between the timestamp of this access request and the timestamp of the last shutdown operation. In order to reduce the risk of illegal acquisition of the key, the minimum number of digits and the minimum character combination type of the key are specified.

[0056] As a specific implementation method, in order to improve data security, Figure 2 As shown, before step S102, the following steps are also included:

[0057] Step S100.2: Obtain the timestamp of the access request to determine when a preset update cycle has been reached, and send a first feedback to the display front end of the main device.

[0058] In this embodiment, the first feedback is used to remind that the disk key carried in the access request has expired.

[0059] Step S100.4: Send a second instruction to a mobile device associated with the main device to reset the custom key.

[0060] Specifically, the second instruction carries a random key generated in real time, which is used to input into the display front end of the main device to trigger the reset of the custom key.

[0061] At this time, based on steps S100.2 to S100.4, even if the key carried in the access request is obtained illegally, the risk of illegal disk intrusion can be reduced by setting the validity period of such key and automatically invalidating it upon expiration.

[0062] Step S104: When the internal data is traversed to confirm that there is communication between the main device and the external device, device information of the external device and the communication duration between the external device and the main device are extracted.

[0063] Specifically, the device information includes the device IP address and the device type.

[0064] Step S106: When it is determined that the external device and the main device are communicating for the first time and the communication duration is greater than a preset duration threshold, a first instruction is sent to the display front end.

[0065] The first instruction is used to require the user who sends the access request to input a backup key.

[0066] Considering that when the backup key needs to be sent, there is a risk that the disk to be accessed will be illegally accessed. Figure 3 As shown, step S106 specifically includes:

[0067] Step S106.2: Send a third instruction to the display front end.

[0068] The third instruction is used to obtain a shard key corresponding to the backup key.

[0069] Step S106.4: if it is determined that a correct sharding key is received within a preset time interval, the third instruction is sent in a loop until all sharding keys are obtained.

[0070] In a specific implementation, if it is determined that the correct sharding key is not received within a preset time interval, the sending of the third instruction is stopped, the disk to be accessed is locked to prohibit access, and a warning message is sent to a mobile device associated with the main device.

[0071] Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

[0072] Step S106.6: Concatenate the shard keys to obtain the backup key, and allow the disk to be accessed to be decrypted.

[0073] At this time, the input difficulty can be increased during the process of obtaining the backup key to reduce the risk of the backup key also being illegally obtained.

[0074] As a specific implementation method, Figure 4 As shown, the following processing is performed when the backup key is entered incorrectly:

[0075] Step S106.2': when it is determined that the backup key is input incorrectly and the number of incorrect inputs is greater than a preset number threshold, the disk to be accessed is locked to prohibit access, and a warning message is sent to a mobile device associated with the main device.

[0076] Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

[0077] At this time, step S106.2' can determine that the risk of the key being illegally obtained is high, and take corresponding measures to prevent disk data leakage, while providing corresponding means to ensure that legitimate users continue to access the disk.

[0078] The above program can be run in the processor, or it can be stored in the memory (or computer-readable storage medium), which includes permanent and non-permanent, removable and non-removable media. Information storage can be achieved by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer-readable media does not include temporary computer-readable media, such as modulated data signals and carrier waves.

[0079] These computer programs can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functions specified in one or more blocks can be implemented by different modules corresponding to different steps.

[0080] Based on this, this embodiment also provides a device for disk encryption and decryption. Figure 5 As shown, the device comprises:

[0081] A data retrieval module is used to extract internal data of a main device equipped with a disk to be accessed within a preset period of time based on an access request; wherein the access request is used to request the acquisition of data in the disk to be accessed, which carries a disk key; the preset period of time is the time zone between the timestamp of this access request and the timestamp of the last shutdown operation.

[0082] The data traversal module is used to traverse the internal data to confirm that there is communication between the main device and the external device, extract the device information of the external device, and the communication duration between the external device and the main device; wherein the device information includes: device IP address and device type.

[0083] The abnormal verification module is used to determine that the external device and the main device are communicating for the first time, and when the communication duration is greater than a preset duration threshold, send a first instruction to the display front end; wherein the first instruction is used to require the user who sends the access request to enter a backup key.

[0084] The device is used to implement the steps of the above method, so what has been described has not been repeated here.

[0085] For example, the device further comprises:

[0086] A feedback sending module is used to obtain the timestamp of the access request to determine when a preset update cycle has been reached, and send a first feedback to the display front end of the main device; wherein the first feedback is used to remind that the disk key carried in the access request has expired.

[0087] An update reset module is used to send a second instruction to a mobile device associated with the main device to reset the custom key; wherein the second instruction carries a random key generated in real time, which is used to input the display front end of the main device to trigger the custom key reset.

[0088] For another example, the device further includes:

[0089] The abnormal warning module is used to determine that the backup key is input incorrectly, and when the number of incorrect inputs exceeds a preset threshold, the disk to be accessed is locked to prohibit access, and a warning message is sent to a mobile device associated with the main device.

[0090] Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

[0091] Combination Figure 6 As shown, this embodiment further provides an electronic device, comprising at least one processor, the processor being coupled to a memory, the memory storing a computer program, and the computer program being configured to execute the method when being executed by the processor.

[0092] Meanwhile, this embodiment also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a computer, the method described above is implemented.

[0093] Since the device, electronic device and storage medium are constructed based on the method, they also have the technical advantage of further ensuring the security of user disk data during actual use.

[0094] Although the present invention has been disclosed as above with preferred embodiments, it is not intended to limit the present invention. A person with ordinary knowledge in the technical field to which the present invention belongs may make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be determined by the definition of the claims.

Claims

1. A method for disk encryption and decryption, It is characterized in that include: Extracting internal data of a main device equipped with a disk to be accessed within a preset period of time based on an access request; wherein the access request is used to request to obtain data in the disk to be accessed, and carries a disk key; the preset period of time is the time zone between the timestamp of the current access request and the timestamp of the last shutdown operation; When the internal data is traversed to confirm that the main device and the external device are communicating, the device information of the external device and the communication duration between the external device and the main device are extracted; wherein the device information includes: device IP address and device type; When it is determined that the external device and the main device are communicating for the first time and the communication duration is greater than a preset duration threshold, a first instruction is sent to the display front end; wherein the first instruction is used to require the user who sends the access request to enter a backup key.

2. The method for disk encryption and decryption according to claim 1, It is characterized in that The method of extracting the internal data of the main device equipped with the disk to be accessed within a preset period of time based on the access request includes: Obtaining the timestamp of the access request to determine when a preset update cycle has been reached, sending a first feedback to the display front end of the main device; wherein the first feedback is used to remind that the disk key carried in the access request has expired; A second instruction is sent to a mobile device associated with the main device to perform a custom key reset; wherein the second instruction carries a random key generated in real time, which is used to input into the display front end of the main device to trigger the custom key reset.

3. The method for disk encryption and decryption according to claim 1, It is characterized in that The method of determining that the external device and the main device are communicating for the first time and the communication duration is greater than a preset duration threshold, and sending a first instruction to the display front end includes: When it is determined that the backup key is entered incorrectly and the number of incorrect entries is greater than a preset number threshold, the disk to be accessed is locked to prohibit access, and an early warning message is sent to a mobile device associated with the main device; Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

4. The method for disk encryption and decryption according to claim 1, It is characterized in that The method of determining that the external device and the main device are communicating for the first time and the communication duration is greater than a preset duration threshold, sending a first instruction to the display front end includes: Sending a third instruction to the display front end; wherein the third instruction is used to obtain a shard key corresponding to the backup key; If it is determined that a correct sharding key is received within a preset time interval, the third instruction is sent in a loop until all sharding keys are obtained; The shard keys are concatenated to obtain the backup key, and the disk to be accessed is allowed to be decrypted.

5. The method for disk encryption and decryption according to claim 1, It is characterized in that The determining that a correct sharding key is received within a preset time interval, and then executing the sending of the third instruction in a loop until all sharding keys are obtained; comprises: If it is determined that the correct sharding key is not received within the preset time interval, the third instruction is stopped from being sent, the disk to be accessed is locked to prohibit access, and a warning message is sent to a mobile device associated with the main device; Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

6. A device for disk encryption and decryption, It is characterized in that include: A data retrieval module is used to extract internal data of a main device equipped with a disk to be accessed within a preset period of time based on an access request; wherein the access request is used to request the acquisition of data in the disk to be accessed, and carries a disk key; the preset period of time is the time zone between the timestamp of the current access request and the timestamp of the last shutdown operation; A data traversal module is used to traverse the internal data to confirm that the main device and the external device are communicating, and then extract the device information of the external device and the communication duration between the external device and the main device; wherein the device information includes: device IP address and device type; The abnormal verification module is used to determine that the external device and the main device are communicating for the first time, and when the communication duration is greater than a preset duration threshold, send a first instruction to the display front end; wherein the first instruction is used to require the user who sends the access request to enter a backup key.

7. The device for disk encryption and decryption according to claim 6, It is characterized in that include: A feedback sending module, used for obtaining the timestamp of the access request to determine when a preset update period has been reached, and sending a first feedback to the display front end of the main device; wherein the first feedback is used to remind that the disk key carried in the access request has expired; An update reset module is used to send a second instruction to a mobile device associated with the main device to reset the custom key; wherein the second instruction carries a random key generated in real time, which is used to input the display front end of the main device to trigger the custom key reset.

8. The device for disk encryption and decryption according to claim 6, It is characterized in that include: The abnormal warning module is used to determine that the backup key is input incorrectly, and when the number of incorrect inputs exceeds a preset number threshold, lock the disk to be accessed to prohibit access, and send a warning message to a mobile device associated with the main device; Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

9. An electronic device, It is characterized in that The method comprises at least one processor, wherein the processor is coupled to a memory, wherein a computer program is stored in the memory, and wherein the computer program is configured to execute the method according to any one of claims 1 to 5 when executed by the processor.

10. A computer-readable storage medium, It is characterized in that A computer program is stored thereon, and when the computer program is executed by a computer, the method according to any one of claims 1 to 5 is implemented.

Images