A secure access method for storage device, electronic device and storage medium

Abstract

The present invention discloses a method for secure access to a storage device, an electronic device, and a storage medium, and relates to the technical field of secure access to storage devices. The method comprises the following steps: verifying user identity through a strong authentication mechanism to ensure that only legitimate users can access the storage device; determining whether the user's operating authority is the highest operating authority or applying for access authority based on the attributes of the stored data; generating an encryption key based on an encryption password set by the user, and encrypting, storing, and transmitting the stored data through the encryption key; the present invention is used to solve the problem that the existing storage device secure access technology still has insufficient security protection for stored data and unreasonable setting of encryption keys, which makes stored data prone to leakage.

Description

Technical Field

[0001] The present invention relates to the technical field of secure access to storage devices, and in particular to a secure access method for storage devices, electronic equipment, and storage medium. Background Art

[0002] Storage device secure access technology refers to a series of technologies and measures used to ensure that data on storage devices such as hard drives, flash drives, and network storage remains secure and protected when accessed. These technologies generally involve data encryption, access control, authentication, auditing, and monitoring to prevent unauthorized access, data leakage, or tampering. Storage device secure access technology aims to improve the confidentiality, integrity, and availability of data, and protect data from malicious attacks and accidental damage.

[0003] Existing storage device security access technology usually adds authentication to the user's login device. The user can access the storage device by logging in on his or her own authentication device. However, authentication devices are not omnipotent. There are many times in real life where one's own account has enabled device authentication, but sometimes one suddenly finds that his or her account is logged in on an unfamiliar device, that is, the thief has bypassed the device authentication. At the same time, when encrypting data, existing storage device security access technology usually only uses the password set by the user for direct encryption. If the thief bypasses the detection step during login and directly calls the decryption program after stealing the user's password, it will cause the data in the storage device to be leaked. Therefore, the password set by the user cannot be directly used as the encryption key for encrypted storage. For example, in the patent application with publication number CN109543470A, a storage device security access method and system are disclosed. This solution uses device authentication to determine whether the host end used by the user belongs to the category of secure access to the storage device, so as to protect the data in the storage device. However, the stored data is not encrypted, resulting in the stored data being easily leaked. The existing storage device security access technology also has the problem of insufficient security protection for stored data and unreasonable setting of encryption keys, resulting in the problem of easy leakage of stored data. Summary of the Invention

[0004] The present invention aims to solve one of the technical problems in the prior art to at least a certain extent, by verifying the user identity through a strong authentication mechanism to ensure that only legitimate users can access the storage device, and then determining whether the user's operating authority is the highest operating authority or applying for access authority based on the attributes of the stored data. When the user uploads stored data to the storage device, the encryption password is analyzed, a key generation scheme is assigned, and an encryption key is generated based on the key generation scheme, and then the stored data is encrypted using the encryption key. Finally, when the owner shares the stored data with the user through sharing rights, the stored data is transmitted to the user through encrypted transmission, so as to solve the problem that the existing storage device security access technology still has insufficient security protection for stored data and the setting of encryption keys is not reasonable, which makes the stored data easy to leak.

[0005] To achieve the above objectives, in a first aspect, the present application provides a method for securely accessing a storage device, comprising the following steps:

[0006] Verify user identity through a strong authentication mechanism to ensure that only legitimate users can access storage devices;

[0007] Determine whether the user's operation authority is the highest operation authority or the application access authority based on the attributes of the stored data;

[0008] An encryption key is generated based on the encryption password set by the user, and the stored data is encrypted and transmitted using the encryption key.

[0009] Furthermore, verifying user identities through a strong authentication mechanism to ensure that only legitimate users can access the storage device includes the following sub-steps:

[0010] Perform basic authentication on users through password login;

[0011] When the username and password entered by the user match the legitimate user stored in the storage device, the camera access permission is obtained and the user's face is verified;

[0012] After the user passes basic authentication and face verification, the user is allowed to access the storage device.

[0013] Furthermore, determining whether the user's operation authority is the highest operation authority or applying for access authority based on the attributes of the stored data includes the following sub-steps:

[0014] Marking data in the storage device as stored data;

[0015] The stored data has ownership, that is, the user who enters the stored data has ownership of the stored data;

[0016] Users only have the highest operating permissions for the stored data they own, which include the right to read, edit, delete, and share.

[0017] Users only have the right to apply for access to stored data that they do not own. When a user is about to read stored data that does not belong to him, the storage device will send an inquiry message to the owner of the stored data. The owner can share the data with the user through sharing rights, and the user can access the corresponding stored data after obtaining the sharing rights.

[0018] Furthermore, generating an encryption key based on the encryption password set by the user, and encrypting the stored data using the encryption key for storage and encrypted transmission includes the following sub-steps:

[0019] When users upload data to a storage device, the encryption password is analyzed and a key generation scheme is assigned;

[0020] generating an encryption key based on a key generation scheme;

[0021] Encrypting stored data using an encryption key;

[0022] When the owner shares stored data with a user through sharing rights, the stored data is transmitted to the user via encrypted transmission.

[0023] Furthermore, when a user uploads stored data to a storage device, the encryption password is analyzed and the distribution key generation scheme includes the following sub-steps:

[0024] Each user has a first number of first-level directories in the storage device, and each first-level directory can be set with a different second-level password;

[0025] When a user stores data in a primary directory, the corresponding primary directory is marked as a storage path, the secondary password corresponding to the storage path is marked as an encryption password, and the data to be stored is marked as data to be stored;

[0026] Obtaining an encrypted password in a string format, and obtaining character attributes of each character in the encrypted password, wherein the character attributes include a numeric format and an alphabetic format;

[0027] Count the number of characters in the encrypted password that are in digital format, and name them as the number of numbers; count the number of characters in the encrypted password that are in alphabetical format, and name them as the number of letters;

[0028] Comparing the number of digits with a first number threshold, if the number of digits is less than the first number threshold, outputting a number-insufficient signal, otherwise outputting a number-sufficient signal;

[0029] If a digital sufficient signal is output, the number of letters is compared with a first number threshold, and if the number of letters is less than the first number threshold, an insufficient letter signal is output, otherwise a sufficient letter signal is output;

[0030] If a digital deficiency signal or a letter deficiency signal is output, a first encrypted signal is output; otherwise, a second encrypted signal is output;

[0031] If the first encrypted signal is output, the first generation scheme is executed to process the encrypted password to generate an encryption key; if the second encrypted signal is output, the second generation scheme is executed to process the encrypted password to generate an encryption key.

[0032] Furthermore, generating an encryption key based on the key generation scheme includes the following sub-steps:

[0033] If the first encrypted signal is output, the number of bits of the encrypted password is obtained, which is named the number of bits of the password, and the number of bits of the password is calculated and divided by two, and the integer is retained to obtain the number of bits of the key;

[0034] Extract the characters that rank first in the encrypted password in order from left to right to obtain the first key, and mark the remaining characters in the encrypted password as the second key;

[0035] A preset encoding rule is used to treat the numbers 0 to 9 as G, H, I, J, K, L, M, N, O, and P, respectively. The numbers in the first key are converted into letters according to the encoding rule to obtain an alphabetic key;

[0036] Convert all letters in the second key to uppercase, mark the letters in order according to their order in the 26-digit alphabet, represent them with the symbol N, calculate N%10, and convert the letters to the remainder of the calculation result. After converting all letters in the second key, a string of pure numbers is obtained, which is marked as the digital key;

[0037] If the second encrypted signal is output, letters in the encrypted password are extracted to obtain a letter key, and numbers in the encrypted password are extracted to obtain a digital key. The letter key and the digital key are collectively referred to as an encryption key.

[0038] Furthermore, encrypting the stored data using the encryption key includes the following sub-steps:

[0039] Obtain the data to be stored, convert the data to be stored into hexadecimal code based on ASCII code, and name it the first code;

[0040] Convert the numbers in the first code into letters based on the coding rules to obtain a second code;

[0041] Number the characters in the second code from left to right, using the symbol S nIndicates, where n is a non-zero natural number and n is the serial number of S; the characters in the letter key are numbered from left to right, and the symbol P1 m Indicates, where m is a non-zero natural number and m is the serial number of P1; the numbers in the digital key are numbered from left to right, and the symbol P2 i Represents, where i is a non-zero natural number and i is the sequence number of P2;

[0042] Starting with n=1, calculate , mark the result as T n , where max(m) is the maximum value of m, and T n Is it a non-negative number? If so, calculate R n =T n %26, if not, calculate R n =T n %(-26), get R n , the calculation of letters is actually the calculation of letter numbers;

[0043] Analyze all the values ​​of n and get the R n Based on the ASCII code, convert it into a three-digit decimal code to get H n ;

[0044] Starting with n=1, calculate , mark the result as G n , in order of n from small to large, G n Combine into a string to get the encrypted code;

[0045] The encrypted code is stored in a storage device.

[0046] Furthermore, when the owner shares the stored data with the user through sharing rights, transmitting the stored data to the user through encrypted transmission includes the following sub-steps:

[0047] When the owner shares stored data with a user through sharing rights, the shared stored data is marked as shared data;

[0048] Decrypt the shared data using the owner's encryption password, and then encrypt it using the user's login password to obtain the shared code;

[0049] The shared code is transmitted to the user, and the user decrypts it using the login password to obtain the shared data.

[0050] In a second aspect, the present application provides an electronic device comprising a processor and a memory, wherein the memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the steps in the above method are performed.

[0051] In a third aspect, the present application provides a storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps in the above method are performed.

[0052] The beneficial effects of the present invention are as follows: the present invention verifies the user identity through a strong authentication mechanism, ensuring that only legitimate users can access the storage device, and then determines whether the user's operating authority is the highest operating authority or an application for access authority based on the attributes of the stored data. The advantage is that the strong authentication mechanism serves as the first layer of protection for the storage device, and the protection strength is relatively high. At the same time, the user's operating authority for the stored data is determined based on the ownership of the stored data, thereby improving the security and effectiveness of secure access to the storage device.

[0053] The present invention analyzes the encryption password when the user uploads the stored data to the storage device, allocates a key generation scheme, generates an encryption key based on the key generation scheme, and then encrypts the stored data with the encryption key. Finally, when the owner shares the stored data with the user through sharing rights, the stored data is transmitted to the user through encrypted transmission. The advantage is that a unique encryption key is generated based on the encryption password set by the user, and the user's stored data is encrypted and stored with the encryption key, preventing others from stealing the encryption password and directly calling the decryption program. At the same time, each person's stored data is encrypted with a dedicated encryption key, which ensures the independence of the stored data. When the stored data is shared, the encryption key of the shared data is replaced by the user's encryption password to prevent users from cracking the owner's encryption key, thereby improving the security and rationality of the storage data security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 is a flow chart of the steps of the method of the present invention;

[0055] Figure 2 A flowchart of the steps for verifying user identity through a strong authentication mechanism of the present invention;

[0056] Figure 3 A flowchart of the steps of analyzing the encryption code and assigning the key generation scheme according to the present invention;

[0057] Figure 4 Schematic diagram of the structure of the electronic device of the present invention. DETAILED DESCRIPTION

[0058] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0059] Example 1, please refer to Figure 1 As shown, the present application provides a method for securely accessing a storage device, comprising the following steps:

[0060] See also Figure 2 As shown, step S1 verifies the user identity through a strong authentication mechanism to ensure that only legitimate users can access the storage device; step S1 includes the following sub-steps:

[0061] Step S101, basic authentication of the user is performed by password login;

[0062] Step S102: When the username and password entered by the user match the valid user stored in the storage device, the access rights to the camera are obtained and the user's face is verified;

[0063] Step S103: After the user passes basic authentication and face verification, the user is allowed to access the storage device;

[0064] In specific implementation, the strong authentication mechanism uses the existing password login verification and face verification methods to perform dual identity authentication. Only after the user passes the dual verification can they access the storage device and can only access the storage data stored by themselves.

[0065] Step S2, based on the attributes of the stored data, determines whether the user's operating authority is the highest operating authority or an application for access authority; Step S2 includes the following sub-steps:

[0066] Step S201, marking the data in the storage device as stored data;

[0067] Step S202: The stored data has ownership, that is, the user who enters the stored data has ownership of the stored data;

[0068] In step S203, the user only has the highest operation authority for the stored data that he owns, which includes the read right, edit right, delete right, and share right;

[0069] In step S204, the user only has the right to apply for access to stored data that he does not own. When the user intends to read stored data that he does not own, the storage device will send a query message to the owner of the stored data. The owner can share the data with the user through sharing rights. After the user obtains the sharing rights, he can access the corresponding stored data.

[0070] In the specific implementation, users also set a secondary password for the stored data that they own. When the user needs to read a certain stored data, he needs to enter the correct secondary password to read the corresponding stored data; when the owner shares the stored data with the user, the transmission of the stored data is encrypted.

[0071] Step S3, generating an encryption key based on the encryption password set by the user, and encrypting the stored data using the encryption key for storage and transmission; Step S3 includes the following sub-steps:

[0072] See also Figure 3 As shown, in step S301, when a user uploads storage data to a storage device, the encryption password is analyzed and a key generation scheme is assigned;

[0073] Step S301 includes the following sub-steps:

[0074] Step S3011: Each user has a first number of first-level directories in the storage device, and each first-level directory can be set with a different second-level password;

[0075] In a specific implementation, the first number varies based on different users. The first-level directory can be regarded as a folder. The user can create different numbers of folders to classify and store stored data. The number of folders created is the first number. Each folder has a separate second-level password to encrypt different stored data of the user differently, to prevent the leakage of all stored data after the user's password is leaked. The second-level password consists only of numbers and uppercase and lowercase letters, and does not contain symbols.

[0076] Step S3012: When the user stores storage data in the first-level directory, the corresponding first-level directory is marked as a storage path, the second-level password corresponding to the storage path is marked as an encryption password, and the storage data to be stored is marked as data to be stored;

[0077] Step S3013: Obtain the encrypted password, which is in a string format, and obtain the character attributes of each character in the encrypted password, which include numeric and alphabetic formats.

[0078] Step S3014, counting the number of characters in the encrypted password in digital format, named as the number of numbers; counting the number of characters in the encrypted password in letter format, named as the number of letters;

[0079] In a specific implementation, this embodiment uses only one segment of data as the data to be stored to demonstrate the encrypted storage process. In actual application, the data to be stored is large, which is not convenient for demonstration. The encrypted password obtained is "p12345w". The encrypted password is a string in quotation marks, which is not part of the encrypted password. The data to be stored is "demonstration data". In the encrypted password "p12345w", there are 7 characters, namely p, 1, 2, 3, 4, 5, and w. Among them, the character attributes of p and w are in letter format, and the character attributes of 1, 2, 3, 4, and 5 are numbers. Therefore, the number of numbers is 5 and the number of letters is 2.

[0080] Step S3015, comparing the number of digits with a first number threshold, and outputting a digital shortage signal if the number of digits is less than the first number threshold, otherwise outputting a digital shortage signal;

[0081] Step S3016: If a digital sufficient signal is output, the number of letters is compared with a first number threshold. If the number of letters is less than the first number threshold, a letter insufficient signal is output; otherwise, a letter sufficient signal is output.

[0082] Step S3017: If a digital deficiency signal or a letter deficiency signal is output, the first encrypted signal is output; otherwise, the second encrypted signal is output;

[0083] Step S3018: If the first encrypted signal is output, the first generation scheme is executed to process the encrypted password to generate an encryption key; if the second encrypted signal is output, the second generation scheme is executed to process the encrypted password to generate an encryption key;

[0084] In a specific implementation, the first quantity threshold is set to ensure that the subsequently divided digital keys and letter keys have sufficient character length for encryption calculation. Since the secondary password is at least 6 digits, they are equally divided into the digital key and the letter key, and the minimum length of the digital key and the letter key is 3, that is, the first quantity threshold is set to 3. If the number of digits obtained by comparison is greater than the first quantity threshold, a digital sufficient signal is output. If the number of letters obtained by comparison is less than the first quantity threshold, an letter insufficient signal is output. Since the letter insufficient signal is output, the first encryption signal is output, and the encrypted password is processed by the first generation scheme to generate an encryption key.

[0085] Step S302, generating an encryption key based on a key generation scheme;

[0086] Step S302 includes the following sub-steps:

[0087] Step S3021: If the first encrypted signal is output, the number of bits of the encrypted password is obtained, which is named the password bit number, and the number of bits of the password is calculated and divided by two, and the integer is retained to obtain the number of bits of the key;

[0088] Step S3022: extract the characters with the first key digits in the encrypted password in order from left to right to obtain a first key, and mark the remaining characters in the encrypted password as a second key;

[0089] Step S3023: Preset encoding rules, treat the numbers 0 to 9 as G, H, I, J, K, L, M, N, O, and P in sequence, and convert the numbers in the first key into letters according to the encoding rules to obtain an alphabetic key;

[0090] Step S3024: Convert all letters in the second key to uppercase, mark the letters in order according to their order in the 26-digit alphabet, represent them with the symbol N, calculate N%10, and convert the letters into the remainder of the calculation result. After converting all letters in the second key, a string of pure numbers is obtained, which is marked as the digital key;

[0091] In a specific implementation, the present embodiment outputs a first encrypted signal, obtains a password digit of 7, calculates a key digit of 4, and retains an integer as the result. The encrypted password is "p12345w", and the first four characters are p, 1, 2, and 3, respectively. The first key is p123, and the second key is 45w. Based on the encoding rule, the first key is converted to a letter key of pHIJ. All letters in the second key are converted to uppercase to obtain 45W. W ranks 23rd in the 26-digit alphabet, that is, the letter number N of W is 23. The calculation of N%10 is to convert the letter into a single-digit number. The remainder of N%10 is 6, that is, W is converted to 6, and the digital key is 456.

[0092] Step S3025: If the second encrypted signal is output, extract the letters in the encrypted password to obtain the letter key, and extract the numbers in the encrypted password to obtain the numeric key. The letter key and the numeric key are collectively referred to as the encryption key.

[0093] In the specific implementation, since the second generation scheme is to directly extract the numbers and letters in the encrypted password, the process is relatively simple and will not be described in detail in this embodiment;

[0094] Step S303, encrypting the stored data using an encryption key;

[0095] Step S303 includes the following sub-steps:

[0096] Step S3031: Obtain the data to be stored, and convert the data to be stored into a hexadecimal code based on the ASCII code, which is named the first code;

[0097] Step S3032: Convert the numbers in the first code into letters based on the coding rules to obtain a second code;

[0098] Step S3033: number the characters in the second code from left to right, using the symbol S n Indicates, where n is a non-zero natural number and n is the serial number of S; the characters in the letter key are numbered from left to right, and the symbol P1 m Indicates, where m is a non-zero natural number and m is the serial number of P1; the numbers in the digital key are numbered from left to right, and the symbol P2 i Represents, where i is a non-zero natural number and i is the sequence number of P2;

[0099] In the specific implementation, the first code obtained by conversion is 6F14793A6570636E, each 4-bit character represents a character in the data to be stored, and the numbers in the first code are converted into letters based on the encoding rules to obtain the second code MFHKNPJAMLN0MJME, and the numbers S1 to S 16 , 1≤n≤16, the letter key is pHIJ, and the numbering of P11 to P14 is p, H, I, and J, respectively. The numeric key is 456, and the numbering of P21 to P23 is 4, 5, and 6, respectively.

[0100] Step S3034, starting with n=1, calculate , mark the result as T n , where max(m) is the maximum value of m, and T n Is it a non-negative number? If so, calculate R n =T n %26, if not, calculate R n =T n %(-26), get R n , the calculation of letters is actually the calculation of letter numbers;

[0101] Step S3035: Analyze all the values ​​of n and get the R n Based on the ASCII code, convert it into a three-digit decimal code to get H n ;

[0102] Step S3036, starting with n=1, calculate , mark the result as G n , in order of n from small to large, G n Combine into a string to get the encrypted code;

[0103] Step S3037, storing the encrypted code in a storage device;

[0104] In the specific implementation, take n=1 as an example. When n=1, S n =S1 is M, The result of the calculation is p+H+I+J, which is converted into an alphabetical number for calculation. Among them, p ranks 16th in the 26-digit alphabet. Similarly, the alphabetical numbers of H, I and J are 8, 9 and 10 respectively. The calculation results are is 43, and the letter number of M is 13, so we get T1=13-43=-30, T1 is a negative number, so we calculate R n =T n %(-26), we get R1=-30%(-26)=22, % is the modulo operator, the letter number 22 corresponds to the letter V, that is, the final R1 is V, convert R1 according to the ASCII code to a three-digit decimal code, and get H1=086, The calculation result is 4+5+6=15, and further calculation results in G1=086+15=101. Similarly, for all S n Analyze and get G1 to G 16 , change G1 to G 16 The encrypted code is obtained by combining and storing the encrypted code in a storage device;

[0105] Step S304 , when the owner shares the stored data with the user through sharing rights, the stored data is transmitted to the user via encrypted transmission;

[0106] Step S304 includes the following sub-steps:

[0107] Step S3041: When the owner shares stored data with the user through sharing rights, the shared stored data is marked as shared data;

[0108] Step S3042: Decrypt the shared data using the owner's encryption password, and then encrypt it using the user's login password to obtain a shared code.

[0109] Step S3043: The sharing code is transmitted to the user, and the user decrypts it using the login password to obtain the shared data;

[0110] In a specific implementation, after the processing of step S304, the stored data read by the user in the storage platform is only related to himself from the encoding to the key level, isolating the possibility of the user cracking other people's keys and ciphertexts.

[0111] Example 3, please refer to Figure 4 As shown, Figure 4A schematic diagram of the structure of an electronic device is provided, which may include: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus. The memory stores computer-readable instructions, and the processor can call instructions from the memory. When the computer-readable instructions are executed by the processor, the processor performs the steps of a method for secure access to a storage device to achieve the following functions: verifying user identity through a strong authentication mechanism to ensure that only legitimate users can access the storage device; determining whether the user's operating authority is the highest operating authority or whether to request access rights based on the attributes of the stored data; generating an encryption key based on an encryption password set by the user, and encrypting the stored data using the encryption key for storage and transmission.

[0112] In addition, the logical instructions in the above-mentioned memory can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the existing technology, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0113] Example 4. The present application also provides a computer-readable storage medium. The present application provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method for secure access to a storage device are executed to achieve the following functions: verify the user identity through a strong authentication mechanism to ensure that only legitimate users can access the storage device; determine whether the user's operating authority is the highest operating authority or to apply for access authority based on the attributes of the stored data; generate an encryption key based on the encryption password set by the user, and encrypt the stored data and encrypt the data for storage and transmission through the encryption key.

[0114] Through the description of the above embodiments, the embodiments of the present invention can be provided as methods, systems, or computer program products. Based on this understanding, the essence of the above technical solutions or the portion that contributes to the prior art can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for enabling a computer device (such as a personal computer, server, or network device) to execute the methods described in various embodiments or certain portions of the embodiments.

[0115] In the embodiments provided in this application, it should be understood that the disclosed system or method can be implemented in other ways. The embodiments described above are merely illustrative. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or units can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of systems, modules and units can be electrical, mechanical or other forms.

[0116] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for securely accessing a storage device, characterized in that: The steps include: Verify user identity through a strong authentication mechanism; determine whether the user's operation authority is the highest operation authority or request access authority based on the attributes of the stored data; Each user has a first number of first-level directories in the storage device, and each first-level directory can be set with a different encryption password; obtain the number of characters in the digital format and the number of characters in the alphabetic format of each character in the encryption password, and name them as the number of numbers and the number of letters respectively; compare the number of numbers with a first number threshold, and if the number of numbers is less than the first number threshold, output a number shortage signal; if the number sufficient signal is output, compare the number of letters with the first number threshold, and if the number of letters is less than the first number threshold, output a letter shortage signal; if the number shortage signal or the letter shortage signal is output, output a first encryption signal, execute the first generation scheme to process the encryption password, and generate an encryption key; otherwise, output a second encryption signal, execute the second generation scheme to process the encryption password, and generate an encryption key; If the first encryption signal is output, the number of digits of the encryption password is obtained, which is named the password number of digits. The number of digits of the password is calculated and divided by two, and the integer is retained to obtain the key number of digits; the characters ranked first in the key number of digits in the encryption password are extracted in order from left to right to obtain the first key, and the remaining characters in the encryption password are marked as the second key; a preset encoding rule is set, and the numbers 0 to 9 are regarded as G, H, I, J, K, L, M, N, O and P in sequence, and the numbers in the first key are converted into letters according to the encoding rule to obtain an alphabetic key; all letters in the second key are converted to uppercase, and the letter serial numbers are marked according to the order of the letters in the twenty-six-bit alphabet, represented by the symbol N, and N%10 is calculated. The letters are converted into the remainder in the calculation result. After all the letters in the second key are converted, a string of pure digits is obtained, which is marked as a digital key; if the second encryption signal is output, the letter key and the digital key in the encryption password are extracted, and the letter key and the digital key are collectively referred to as the encryption key; The stored data is encrypted using an encryption key; when the owner shares the stored data with the user through sharing rights, the stored data is transmitted to the user through encrypted transmission.

2. A method for securely accessing a storage device according to claim 1, characterized in that: Verifying user identities through a strong authentication mechanism ensures that only authorized users can access storage devices. This involves the following sub-steps: Perform basic authentication on users through password login; When the username and password entered by the user match the legitimate user stored in the storage device, the camera access permission is obtained and the user's face is verified; After the user passes basic authentication and face verification, the user is allowed to access the storage device.

3. A method for securely accessing a storage device according to claim 2, characterized in that: Determining whether a user's operation permission is the highest permission or applying for access permission based on the attributes of the stored data includes the following sub-steps: Marking data in the storage device as stored data; The stored data has ownership, that is, the user who enters the stored data has ownership of the stored data; Users only have the highest operating permissions for the stored data they own, which include the right to read, edit, delete, and share. Users only have the right to apply for access to stored data that they do not own. When a user is about to read stored data that does not belong to him, the storage device will send an inquiry message to the owner of the stored data. The owner can share the data with the user through sharing rights, and the user can access the corresponding stored data after obtaining the sharing rights.

4. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps in the method according to any one of claims 1 to 3 are executed.

5. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 3 are executed.

Images