Hard disk encrypted data protection method and system

Abstract

The invention provides a hard disk encrypted data protection method and system. The method comprises the steps of generating a hard disk encryption key; receiving a hard disk encryption request, and determining a to-be-encrypted target storage device and a to-be-encrypted target hard disk; configuring a hard disk encryption key corresponding to the target hard disk; partitioning the target hard disk into an encrypted region and a non-encrypted region; the target storage device encrypts the data with the encryption identifier according to the hard disk encryption key and then transmits the data to the encryption area in the corresponding target hard disk; the target storage device encrypts the data with the encryption identifier according to the hard disk encryption key and then performs monitoring when transmitting the data to the encryption area in the corresponding target hard disk to generate monitoring information; judging whether encryption abnormity occurs or not according to the monitoring information, and if yes, sending an encryption abnormity alarm; therefore, the target storage device and the target hard disk are matched with each other to encrypt the data with the encryption identifier and perform exception monitoring on the encryption process, and the data security is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of hard disk encryption, and in particular relates to a hard disk encryption data protection method and system. Background Art

[0002] With the rapid development of information technology, security issues such as data leakage and hard disk theft are becoming increasingly serious. Especially in personal computers and corporate servers, if the sensitive information stored on the hard disk is not encrypted, it is very easy to be illegally accessed, which brings huge data security risks to individuals and enterprises. Although the existing hard disk encryption technology can provide a certain degree of protection, in actual applications, there are often problems such as low encryption efficiency, complex password management, and failure to adapt to the security needs of multiple scenarios. Therefore, how to improve encryption efficiency while ensuring data security and make user management more convenient has become a technical problem that needs to be solved urgently. Summary of the invention

[0003] In view of the above-mentioned deficiencies in the prior art, the purpose of the present invention is to provide a hard disk encryption data protection method and system, which can effectively improve data encryption efficiency, simplify the password management process, enhance the reliability of data protection, and can adapt to a variety of different usage scenarios.

[0004] In one aspect, the present invention provides a hard disk encryption data protection method, the method comprising the following steps:

[0005] Initialize one or more target hard disks;

[0006] Generate a hard disk encryption key; the hard disk encryption key is a symmetric encryption key or an asymmetric encryption key;

[0007] Receive a hard disk encryption request, determine a target storage device to be encrypted and a target hard disk to be encrypted; the target storage device carries one or more target hard disks, and the target storage device is one or more;

[0008] Configuring a hard disk encryption key corresponding to the target hard disk;

[0009] Partitioning the target hard disk into an encryption area and a non-encryption area;

[0010] The target storage device encrypts the data with the encryption identifier according to the hard disk encryption key and transmits the data to the encryption area in the corresponding target hard disk;

[0011] The target storage device encrypts the data with the encryption identifier according to the hard disk encryption key, and monitors the data when the data is transmitted to the encryption area in the corresponding target hard disk to generate monitoring information;

[0012] Determine whether an encryption anomaly occurs based on the monitoring information, and if so, issue an encryption anomaly alarm.

[0013] The method of the present invention, wherein the hard disk encryption key is stored in and bound to any one of the target storage device, the BIOS chip of the computer motherboard, the TPM chip of the computer motherboard, and the external USB flash drive.

[0014] The method of the present invention further comprises:

[0015] The hard disk encryption key is protected by using biometric technology or a key.

[0016] The method of the present invention further comprises:

[0017] After the biometric identification technology or the key verification is passed, the hard disk encryption key is allowed to be used, and the data in the encryption area of ​​the target hard disk is decrypted according to the hard disk encryption key.

[0018] The method of the present invention further comprises:

[0019] The hard disk encryption key is randomly updated.

[0020] The method of the present invention, wherein the hard disk encryption key is allowed to be used after the biometric identification technology or the key verification is passed, and before decrypting the data in the encryption area of ​​the target hard disk according to the hard disk encryption key, the method further includes:

[0021] Verify whether the target storage device, the BIOS chip of the computer motherboard, the TPM chip of the computer motherboard, and the hard disk encryption key stored in the external U disk are bound to the target storage device, the BIOS chip of the computer motherboard, the TPM chip of the computer motherboard, and the external U disk. If not, refuse to perform the biometric technology or the key verification.

[0022] The method of the present invention further comprises:

[0023] Automatically adjust the partition size according to the used space size of the encryption area and the non-encryption area or the size of the data with encryption identification;

[0024] Both the encryption area and the non-encryption area have redundant space;

[0025] The automatic adjustment of the partition size is to automatically adjust the size of the redundant space of the encryption area and the non-encryption area.

[0026] In the method of the present invention, the target hard disk is generated by a disk array consisting of one hard disk or multiple hard disks.

[0027] In another aspect, the present invention provides a hard disk encryption data protection system, the system comprising:

[0028] An initialization unit, initializing one or more target hard disks;

[0029] A key generation unit, generating a hard disk encryption key;

[0030] An encryption request receiving unit receives a hard disk encryption request and determines a target storage device to be encrypted and a target hard disk to be encrypted;

[0031] A key configuration unit, configured with a hard disk encryption key corresponding to the target hard disk;

[0032] A partitioning unit, partitioning the target hard disk into an encryption area and a non-encryption area;

[0033] An encryption unit, wherein the target storage device encrypts the data with the encryption identifier according to the hard disk encryption key and transmits the encrypted data to the encryption area in the corresponding target hard disk;

[0034] An encryption monitoring unit, wherein the target storage device encrypts the data with the encryption identifier according to the hard disk encryption key, and monitors the data when the data is transmitted to the encryption area in the corresponding target hard disk, thereby generating monitoring information;

[0035] The encryption anomaly detection unit determines whether an encryption anomaly occurs based on the monitoring information, and if so, issues an encryption anomaly alarm.

[0036] On the other hand, the present invention also provides a non-volatile computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by one or more processors, the one or more processors can execute the above-mentioned hard disk encryption data protection method.

[0037] The beneficial effects of the present invention are: initializing one or more target hard disks; generating a hard disk encryption key; receiving a hard disk encryption request, determining a target storage device to be encrypted and a target hard disk to be encrypted; configuring a hard disk encryption key corresponding to the target hard disk; partitioning the target hard disk into an encryption area and a non-encryption area; the target storage device encrypts data with an encryption identifier according to the hard disk encryption key, and transmits the data to the encryption area in the corresponding target hard disk; the target storage device encrypts data with an encryption identifier according to the hard disk encryption key, and monitors the data when the data is transmitted to the encryption area in the corresponding target hard disk, and generates monitoring information; judging whether an encryption anomaly occurs according to the monitoring information, and if so, issuing an encryption anomaly alarm; thereby achieving the target storage device and the target hard disk cooperating with each other to encrypt the data with the encryption identifier, and performing anomaly monitoring on the encryption process, which greatly improves data security and intelligence, and thus improves user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a flow chart of the implementation of the hard disk encryption data protection method provided by the first embodiment of the present invention;

[0039] Figure 2 It is a structural diagram of a hard disk encryption data protection system provided in Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0041] The specific implementation of the present invention is described in detail below in conjunction with specific embodiments:

[0042] Embodiment 1:

[0043] Figure 1 The implementation process of the hard disk encryption data protection method provided by the first embodiment of the present invention is shown. For the convenience of description, only the part related to the embodiment of the present invention is shown, which is described in detail as follows:

[0044] In step S101, one or more target hard disks are initialized;

[0045] In an embodiment of the present invention, the target hard disk is generated by a disk array consisting of one hard disk or multiple hard disks; the use of the disk array further improves data security, wherein the disk array preferably uses one of RAID0, RAID5 and RAID10.

[0046] In step S102, a hard disk encryption key is generated;

[0047] In an embodiment of the present invention, the hard disk encryption key is a symmetric encryption key or an asymmetric encryption key; preferably, the hard disk encryption key is issued by a CA certificate issuing authority or can also be customized, randomly generated, etc.;

[0048] Furthermore, the hard disk encryption key is stored in any one of the target storage device, the BIOS chip of the computer motherboard, the TPM chip of the computer motherboard, and the external USB flash drive and bound to meet different usage requirements;

[0049] The method also includes: randomly updating the hard disk encryption key to further improve security.

[0050] In step S103, a hard disk encryption request is received, and a target storage device to be encrypted and a target hard disk to be encrypted are determined;

[0051] In an embodiment of the present invention, the target storage device is equipped with one or more target hard disks, and the target storage device is one or more; wherein, the target storage device to be encrypted and the target hard disk to be encrypted are determined according to a hard disk encryption request; the target storage device may be an array card or a storage server, etc.

[0052] In step S104, a hard disk encryption key corresponding to the target hard disk is configured;

[0053] In the embodiment of the present invention, one hard disk encryption key is paired with one target hard disk, which further enhances the security of data.

[0054] In step S105, the target hard disk is partitioned into an encryption area and a non-encryption area;

[0055] In an embodiment of the present invention, the partition size is automatically adjusted according to the size of the used space in the encryption area and the non-encryption area or the size of the data with encryption identification;

[0056] Redundant space is reserved in both the encrypted and non-encrypted areas;

[0057] Automatically adjust the partition size to automatically adjust the size of the redundant space in the encryption area and the non-encryption area; improve the intelligence level;

[0058] Among them, the non-encrypted area is used to store non-encrypted data to meet different usage requirements and achieve multiple uses of one disk.

[0059] In step S106, the target storage device encrypts the data with the encryption identifier according to the hard disk encryption key and transmits the encrypted data to the encryption area in the corresponding target hard disk;

[0060] In an embodiment of the present invention, the method further comprises: using biometric technology or a key to protect the hard disk encryption key;

[0061] Furthermore, the method also includes: allowing the hard disk encryption key to be used after the biometric technology or key verification is passed, and decrypting the data in the encryption area of ​​the target hard disk according to the hard disk encryption key.

[0062] Furthermore, after the biometric technology or key verification is passed, the hard disk encryption key is allowed to be used, and before decrypting the data in the encryption area of ​​the target hard disk according to the hard disk encryption key, the method further includes:

[0063] Verify whether the target storage device, the BIOS chip of the computer motherboard, the TPM chip of the computer motherboard, and the hard disk encryption key stored in the external U disk are bound to the target storage device, the BIOS chip of the computer motherboard, the TPM chip of the computer motherboard, and the external U disk. If not, refuse to perform biometric technology or key verification; perform user identity authentication to enhance security.

[0064] In step S107, the target storage device encrypts the data with the encryption identifier according to the hard disk encryption key, and monitors the data when it is transmitted to the encryption area in the corresponding target hard disk to generate monitoring information;

[0065] In the embodiment of the present invention, the monitoring contents include: access records, reading frequency of encrypted data and other abnormal behaviors.

[0066] In step S108, it is determined whether an encryption anomaly occurs based on the monitoring information, and if so, an encryption anomaly alarm is issued.

[0067] In the embodiment of the present invention, by analyzing the access records in the hard disk, the reading frequency of encrypted data and other abnormal behaviors, it is automatically detected whether there is a risk of illegal access or data leakage, and an encryption abnormality alarm is issued in time, thereby improving the degree of intelligence.

[0068] In an embodiment of the present invention, one or more target hard disks are initialized; a hard disk encryption key is generated; a hard disk encryption request is received, and a target storage device to be encrypted and a target hard disk to be encrypted are determined; a hard disk encryption key corresponding to the target hard disk is configured; the target hard disk is partitioned into an encryption area and a non-encryption area; the target storage device encrypts data with an encryption identifier according to the hard disk encryption key and transmits the data to the encryption area in the corresponding target hard disk; the target storage device encrypts data with an encryption identifier according to the hard disk encryption key and transmits the data to the encryption area in the corresponding target hard disk for monitoring and generating monitoring information; it is determined according to the monitoring information whether an encryption anomaly occurs, and if so, an encryption anomaly alarm is issued; thereby achieving the target storage device and the target hard disk to cooperate with each other to encrypt the data with the encryption identifier, and to monitor the encryption process for anomalies, which greatly improves data security and intelligence, and thus improves user experience.

[0069] Embodiment 2:

[0070] Figure 2 The structure of the hard disk encryption data protection system provided by the second embodiment of the present invention is shown. For the convenience of description, only the parts related to the embodiment of the present invention are shown, including:

[0071] Initialization unit 201, initializing one or more target hard disks;

[0072] The key generation unit 202 generates a hard disk encryption key;

[0073] The encryption request receiving unit 203 receives a hard disk encryption request and determines a target storage device to be encrypted and a target hard disk to be encrypted;

[0074] A key configuration unit 204 configures a hard disk encryption key corresponding to a target hard disk;

[0075] Partitioning unit 205 partitions the target hard disk into an encryption area and a non-encryption area;

[0076] The encryption unit 206, after the target storage device encrypts the data with the encryption identifier according to the hard disk encryption key, transmits it to the encryption area in the corresponding target hard disk;

[0077] The encryption monitoring unit 207 encrypts the data with the encryption identifier according to the hard disk encryption key, and monitors the data when it is transmitted to the encryption area in the corresponding target hard disk, thereby generating monitoring information;

[0078] The encryption anomaly detection unit 208 determines whether an encryption anomaly occurs based on the monitoring information, and if so, issues an encryption anomaly alarm.

[0079] In the embodiment of the present invention, each unit of the hard disk encryption data protection system can be implemented by a corresponding hardware or software unit. Each unit can be an independent software or hardware unit or integrated into one software or hardware unit, which is not intended to limit the present invention.

[0080] Embodiment three:

[0081] Embodiment 3 of the present invention provides a non-volatile computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by one or more processors, for example, to execute the above-described Figure 1 The method comprises steps S101 to S108.

[0082] As an example, the non-volatile storage medium can include a read-only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable ROM (EEPROM), or a flash memory. Volatile memory can include a random access memory (RAM) as an external cache memory. By way of illustration and not limitation, RAM can be obtained in many forms such as synchronous RAM (SRAM), dynamic RAM, (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and direct Rambus RAM (DRRAM). The disclosed memory components or memories of the operating environment described herein are intended to include one or more of these and / or any other suitable types of memory.

[0083] Embodiment 4:

[0084] Embodiment 4 of the present invention provides a computer program product, which includes a computer program stored on a non-volatile computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a processor, the processor executes the hard disk encryption data protection method of the above method embodiment. For example, the above described Figure 1 The method comprises steps S101 to S108.

[0085] The embodiments described above are merely illustrative, in which the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0086] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a general hardware platform, and of course can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can exist in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer electronic device (which can be a personal computer, a server, or a network electronic device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0087] Conditional language such as "can," "can," "might," or "may," among other things, unless specifically stated otherwise or otherwise understood within the context as used, is generally intended to convey that particular embodiments can include (while other embodiments do not) particular features, elements, and / or operations. Thus, such conditional language is generally not intended to imply that features, elements, and / or operations are in any way required for one or more embodiments or that one or more embodiments must include logic for determining whether such features, elements, and / or operations are included or will be performed in any particular embodiment, with or without student input or prompting.

[0088] What has been described herein in this specification and the accompanying drawings includes examples that can provide hard disk encryption data protection methods and systems. Of course, it is not possible to describe every conceivable combination of elements and / or methods for the purpose of describing the various features of the present disclosure, but it can be recognized that many other combinations and permutations of the disclosed features are possible. Therefore, it is obvious that various modifications can be made to the present disclosure without departing from the scope or spirit of the present disclosure. In addition, or in an alternative, other embodiments of the present disclosure may be apparent from consideration of the present specification and the accompanying drawings and from the practice of the present disclosure as presented herein. It is intended that the examples set forth in this specification and the accompanying drawings are considered to be illustrative and not restrictive in all respects. Although specific terms are employed herein, they are used in a general and descriptive sense and are not used for limiting purposes.

Claims

1. A hard disk encryption data protection method, characterized in that: The method comprises the following steps: Initialize one or more target hard disks; Generate a hard disk encryption key; the hard disk encryption key is a symmetric encryption key or an asymmetric encryption key; Receive a hard disk encryption request, determine a target storage device to be encrypted and a target hard disk to be encrypted; the target storage device carries one or more target hard disks, and the target storage device is one or more; Configuring a hard disk encryption key corresponding to the target hard disk; Partitioning the target hard disk into an encryption area and a non-encryption area; The target storage device encrypts the data with the encryption identifier according to the hard disk encryption key and transmits the data to the encryption area in the corresponding target hard disk; The target storage device encrypts the data with the encryption identifier according to the hard disk encryption key, and monitors the data when the data is transmitted to the encryption area in the corresponding target hard disk to generate monitoring information; Determine whether an encryption anomaly occurs based on the monitoring information, and if so, issue an encryption anomaly alarm.

2. The method according to claim 1, characterized in that The hard disk encryption key is stored in and bound to any one of the target storage device, the BIOS chip of the computer motherboard, the TPM chip of the computer motherboard, and the external USB flash drive.

3. The method according to claim 2, characterized in that The method further comprises: The hard disk encryption key is protected by using biometric technology or a key.

4. The method according to claim 1, characterized in that The method further comprises: After the biometric identification technology or the key verification is passed, the hard disk encryption key is allowed to be used, and the data in the encryption area of ​​the target hard disk is decrypted according to the hard disk encryption key.

5. The method according to claim 1, characterized in that The method further comprises: The hard disk encryption key is randomly updated.

6. The method according to claim 4, characterized in that After the biometric identification technology or the key verification is passed, the hard disk encryption key is allowed to be used, and before decrypting the data in the encryption area of ​​the target hard disk according to the hard disk encryption key, the method further includes: Verify whether the target storage device, the BIOS chip of the computer motherboard, the TPM chip of the computer motherboard, and the hard disk encryption key stored in the external U disk are bound to the target storage device, the BIOS chip of the computer motherboard, the TPM chip of the computer motherboard, and the external U disk. If not, refuse to perform the biometric technology or the key verification.

7. The method according to claim 1, characterized in that The method further comprises: Automatically adjust the partition size according to the used space size of the encryption area and the non-encryption area or the size of the data with encryption identification; Both the encryption area and the non-encryption area have redundant space; The automatic adjustment of the partition size is to automatically adjust the size of the redundant space of the encryption area and the non-encryption area.

8. The method according to claim 1, characterized in that The target hard disk is generated by a disk array consisting of one hard disk or a plurality of hard disks.

9. A hard disk encryption data protection system, characterized in that: The system comprises: An initialization unit, initializing one or more target hard disks; A key generation unit, generating a hard disk encryption key; An encryption request receiving unit receives a hard disk encryption request and determines a target storage device to be encrypted and a target hard disk to be encrypted; A key configuration unit, configured with a hard disk encryption key corresponding to the target hard disk; A partitioning unit, partitioning the target hard disk into an encryption area and a non-encryption area; An encryption unit, wherein the target storage device encrypts the data with the encryption identifier according to the hard disk encryption key and transmits the encrypted data to the encryption area in the corresponding target hard disk; An encryption monitoring unit, wherein the target storage device encrypts the data with the encryption identifier according to the hard disk encryption key, and monitors the data when the data is transmitted to the encryption area in the corresponding target hard disk, thereby generating monitoring information; The encryption anomaly detection unit determines whether an encryption anomaly occurs based on the monitoring information, and if so, issues an encryption anomaly alarm.

10. A non-volatile computer-readable storage medium, characterized in that: The non-volatile computer-readable storage medium stores computer-executable instructions, which, when executed by one or more processors, enable the one or more processors to execute the hard disk encryption data protection method according to any one of claims 1 to 8.

Images