Access protection method for solid state disk

Abstract

The invention relates to the technical field of data storage security, in particular to an access protection method for a solid state disk, which comprises a dynamic authentication module and a hierarchical encryption module, the dynamic authentication module generates a temporary access token through multi-dimensional identity authentication, and a behavior analysis component dynamically adjusts the strict degree of a security policy according to the operation habit of a user; the hierarchical encryption module adopts a partition storage structure, performs hierarchical encryption according to data sensitivity and allocates access authority, and a built-in data erasure trigger can quickly clear sensitive data under abnormal access. According to the access protection method for the solid state disk, the reliability and flexibility of data protection of the solid state disk can be improved, the problems that a traditional method is insufficient in safety and complex in operation are solved, meanwhile, user experience and the service life of equipment are considered, and remarkable technical advantages and application value are achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of data storage and information security, and in particular to an access protection method for a solid state hard disk. Background Art

[0002] In today's rapidly developing information technology landscape, computer solid-state drives (SSDs) have become the mainstream choice for data storage, thanks to their significant advantages, including high read / write speeds, low power consumption, and excellent durability. From everyday personal computers to servers supporting large-scale data processing, SSDs are ubiquitous. They not only significantly increase device data read / write speeds and significantly improve user experience, but also, to a certain extent, drive the development and transformation of the information technology industry.

[0003] However, with the continuous increase in the value of data, data security issues are becoming increasingly severe, and the importance of data access protection technology for solid-state drives has become increasingly prominent. At present, the existing solid-state drive access protection technologies on the market still have the following problems: 1. Some technologies use a single authentication method and a password-based secure boot method. In this method, the password is extremely vulnerable to theft by malicious means such as keyboard monitoring and memory Trojan attacks. Once the password is leaked, data security will face serious threats. Moreover, this type of protection technology is often rigid in terms of password trial and error restrictions, and it is difficult to effectively resist brute force cracking attempts by malicious attackers, greatly reducing data security; 2. Some protection solutions based on secure USB flash drives or trusted modules are extremely complicated in the key update and data erasure links, which not only requires a lot of time and effort, but also easily leads to the risk of data loss if not careful during operation. In addition, frequent read and write operations will also have a negative impact on the life of the storage medium, further reducing the efficiency and reliability of data protection;

[0004] Therefore, in view of the above problems existing in the prior art, it is urgent to propose a more secure, efficient and easy-to-operate solid-state hard disk access protection method to comprehensively improve the security and reliability of data storage. Summary of the Invention

[0005] The main purpose of the present invention is to provide an access protection method for a solid state hard disk, which can effectively solve the problems in the background technology.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] A method for protecting access to a solid-state drive includes a dynamic authentication module and a hierarchical encryption module. The dynamic authentication module generates a temporary access token through multi-dimensional identity authentication, and the hierarchical encryption module performs hierarchical encryption processing on data based on the access token.

[0008] The dynamic authentication module includes a trigger unit and a verification unit;

[0009] The layered encryption module includes encryption levels and a permission mapping table.

[0010] As a further improvement to the above solution, the triggering unit collects user behavior characteristics and generates a unique identifier, and the verification unit matches the identifier with a preset security policy and activates the temporary access permission.

[0011] As a further improvement of the above solution, the dynamic authentication module further includes a behavior analysis component, which adjusts the strictness of the security policy by collecting user operation habits and device environment information.

[0012] As a further improvement of the above solution, the encryption level is divided into multiple levels according to data sensitivity, and the permission mapping table is used to allocate access rights to data of different levels.

[0013] As a further improvement of the above solution, the layered encryption module adopts a partitioned storage structure to store data of different encryption levels in independent physical areas.

[0014] As a further improvement of the above solution, the layered encryption module has a built-in data erasure trigger, which clears data in a designated area when abnormal access behavior is detected.

[0015] As a further improvement of the above solution, the unique identifier generated by the trigger unit is calculated based on behavioral characteristics of the user's login time, operation frequency, mouse movement trajectory, and keyboard tapping interval.

[0016] As a further improvement of the above solution, the behavior analysis component calculates a risk score through a formula to evaluate the current risk level, and the formula is that the risk score is equal to the cumulative value of the deviation multiplied by the risk coefficient.

[0017] As a further improvement of the above solution, the encryption levels include three encryption levels L1, L2 and L3 corresponding to ordinary data, sensitive data and confidential data, and the permission mapping table allocates user permissions in a matrix form.

[0018] As a further improvement to the above solution, the independent physical area is provided with an access control mechanism, which only allows users holding corresponding access tokens to enter the corresponding storage area.

[0019] Compared with the prior art, the present invention has the following beneficial effects:

[0020] In the present invention, the dynamic authentication module realizes a flexible and reliable identity authentication mechanism through multi-dimensional identity authentication and behavior analysis components, while the layered encryption module ensures the security and isolation of data through hierarchical encryption and partitioned storage structure. In addition, the introduction of data erasure triggers further enhances the emergency response capability of the system, and can quickly clear sensitive data in abnormal situations to avoid information leakage. Through these technical means, not only the reliability of solid-state drive data protection is significantly improved, but also the user experience and equipment life are taken into account. It has important technical advantages and wide application value. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A structural diagram of a dynamic authentication module of a solid-state hard disk access protection method according to the present invention;

[0023] Figure 2 A schematic diagram of the structure of a layered encryption module of a solid-state hard disk access protection method of the present invention;

[0024] Figure 3 A schematic diagram of the workflow of a behavior analysis component of a solid-state hard disk access protection method according to the present invention;

[0025] Figure 4 This is a schematic diagram of the logical structure of a data erase trigger in a method for protecting access to a solid-state hard disk according to the present invention. DETAILED DESCRIPTION

[0026] The present invention provides a method for protecting access to a solid state hard disk, which realizes the security protection of the solid state hard disk data through the cooperation of a dynamic authentication module and a layered encryption module. Figure 1 To the attached Figure 4 , describe in detail the specific implementation of this method.

[0027] The dynamic authentication module 1 includes a trigger unit 101 and a verification unit 102. Its core function is to generate a temporary access token through multi-dimensional identity authentication. The trigger unit 101 is responsible for collecting user behavior characteristics and generating a unique identifier. This process involves the collection of information from multiple dimensions, including the user's login time, operation frequency, mouse movement trajectory, and keyboard tapping interval. This information is recorded in real time and processed through formula F1, where F1 is defined as: identifier = H (∑ (eigenvalue i × weight i)), where H represents a hash function, eigenvalue i represents the quantitative value of a specific behavioral feature, and weight i is set according to the importance of the feature in the overall security strategy. The identifier generated in this way is highly unique and difficult to forge, thereby effectively avoiding the problem of a single authentication method being vulnerable to attacks.

[0028] The verification unit 102 matches the identifier generated by the trigger unit 101 with the preset security policy to activate the temporary access right. The preset security policy is stored in the security database of the verification unit 102 and is dynamically adjusted according to the user's historical behavior. When the user switches from a commonly used device to an unfamiliar environment, the system will automatically increase the authentication strength and require additional identity verification steps such as SMS verification code or biometric information. This dynamic adjustment mechanism is implemented by the behavior analysis component 103. Its workflow is shown in the attached figure. Figure 3 As shown, the behavior analysis component 103 collects the user's operating habits and device environment information and uses a machine learning algorithm to evaluate the current risk level. Specifically, the behavior analysis component 103 uses formula F2 to calculate the risk score: risk score = ∑ (deviation j × risk coefficient j), where the deviation j represents the degree of difference between the user's current behavior and historical behavior patterns, and the risk coefficient j is set according to the security threats that may be brought about by the behavior characteristics. When the risk score exceeds the preset threshold, the system will automatically trigger a high-intensity authentication process.

[0029] The layered encryption module 2 is another core component of the present invention, and its structure is shown in the attached figure. Figure 2As shown, the hierarchical encryption module includes an encryption level 201 and a permission mapping table 202. Its main function is to perform hierarchical encryption processing on data. The encryption level 201 is divided into multiple levels according to the sensitivity of the data. Ordinary data, sensitive data and confidential data correspond to the three encryption levels L1, L2 and L3 respectively. Different encryption levels use different encryption algorithms and key lengths to ensure a balance between data security and performance. The L1 level uses AES-128 encryption, the L2 level uses AES-192 encryption, and the L3 level uses AES-256 encryption. The permission mapping table 202 is used to assign access rights to data of different levels. Its design principle is based on the principle of least privilege, that is, each user can only access data that matches his or her privileges. The specific implementation method of the permission mapping table 202 is: permission matrix M[i][j], where i represents the user ID, j represents the data ID, and the matrix element value is 0 or 1, representing no privilege and privilege respectively. In this way, the system can quickly determine whether a user is qualified to access specific data.

[0030] The layered encryption module 2 also adopts a partition storage structure, as shown in the attached Figure 2 The independent physical area 203 shown in the figure stores data of different encryption levels in independent physical areas, thereby effectively preventing low-privilege visitors from obtaining highly sensitive data through lateral detection. L1-level data is stored in area A, L2-level data is stored in area B, and L3-level data is stored in area C. Each area is equipped with a strict access control mechanism. Only users holding the corresponding access token can enter the corresponding storage area. In addition, the layered encryption module has a built-in data erasure trigger 204, and its logical structure is shown in the attached figure. Figure 4 As shown, the data erasure trigger 204 can quickly clear the data in the specified area when abnormal access behavior is detected. Its working principle is to monitor the access logs and behavior patterns in real time. Once abnormal activities are detected (such as multiple failed access attempts in a short period of time or access from unknown IP addresses), the system will immediately start the data erasure process. The data erasure process adopts a secure deletion algorithm to ensure that the deleted data cannot be recovered by any technical means.

[0031] In order to further illustrate the operating principle and application scenarios of the present invention, a detailed description is given below in conjunction with a specific embodiment.

[0032] An enterprise uses the solid-state hard drive access protection method of the present invention to protect its internal sensitive data. The enterprise's employees are divided into three categories of users: ordinary employees, department managers, and technical supervisors, and their permissions are P1, P2, and P3 respectively. Ordinary employees can only access ordinary data required for daily office work, department managers can access some sensitive data, and technical supervisors have the right to access all data, including confidential data. When an ordinary employee attempts to access the solid-state hard drive, the trigger unit 101 first collects its behavioral characteristics and generates an identifier. The verification unit 102 verifies the identifier and generates a temporary access token. Since the ordinary employee's permission is P1, the permission mapping table 202 only allows it to access data at the L1 level. Therefore, the system will guide it to enter area A for data reading operations. If the ordinary employee attempts to access data in area B or area C, the system will immediately reject the access request and record the abnormal behavior.

[0033] In another scenario, a technical supervisor needs to access confidential data due to an urgent task. At this time, the trigger unit 101 collects the technical supervisor's behavioral characteristics and generates an identifier. However, due to the abnormality of his operating environment (the login location is an unfamiliar network), the risk score calculated by the behavior analysis component 103 is high risk. The verification unit 102 then requires the technical supervisor to provide additional identity authentication information, such as fingerprint scanning or facial recognition. After completing the high-intensity authentication, the verification unit 102 generates a temporary access token and grants him permission to access L3-level data. After the technical supervisor enters area C, the system monitors his operating behavior in real time. If it is found that the technical supervisor frequently accesses a large amount of data in a short period of time or attempts to copy data, the data erasure trigger 204 will be activated immediately to clear all data in area C to prevent information leakage.

[0034] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiment. All technical solutions based on the concept of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A method for protecting access to a solid state drive, characterized in that: It comprises a dynamic authentication module (1) and a hierarchical encryption module (2), wherein the dynamic authentication module (1) generates a temporary access token through multi-dimensional identity authentication, and the hierarchical encryption module (2) performs hierarchical encryption processing on data according to the access token; The dynamic authentication module (1) comprises a trigger unit (101) and a verification unit (102); The layered encryption module (2) includes an encryption layer (201) and a permission mapping table (202).

2. The method for protecting access to a solid state drive according to claim 1, wherein: The trigger unit (101) collects user behavior characteristics and generates a unique identifier, and the verification unit (102) matches the identifier with a preset security policy and activates the temporary access right.

3. The method for protecting access to a solid state drive according to claim 1, wherein: The dynamic authentication module (1) further includes a behavior analysis component (103), which adjusts the strictness of the security policy by collecting the user's operating habits and device environment information.

4. The method for protecting access to a solid state drive according to claim 1, wherein: The encryption level (201) is divided into multiple levels according to data sensitivity, and the permission mapping table (202) is used to allocate access rights to data of different levels.

5. The method for protecting access to a solid state drive according to claim 1, wherein: The layered encryption module (2) adopts a partition storage structure to store data of different encryption levels in independent physical areas (203).

6. The method for protecting access to a solid state drive according to claim 1, wherein: The layered encryption module (2) has a built-in data erasure trigger (204), and the data erasure trigger (204) clears data in a designated area when abnormal access behavior is detected.

7. The method for protecting access to a solid state drive according to claim 2, wherein: The unique identifier generated by the trigger unit (101) is calculated based on the behavioral characteristics of the user's login time, operation frequency, mouse movement trajectory, and keyboard tapping interval.

8. The method for protecting access to a solid state drive according to claim 3, wherein: The behavior analysis component (103) calculates a risk score by a formula to evaluate the current risk level, wherein the risk score is equal to the cumulative value of the deviation multiplied by the risk coefficient.

9. The method for protecting access to a solid state drive according to claim 4, wherein: The encryption levels (201) include three encryption levels, L1, L2 and L3, corresponding to common data, sensitive data and confidential data. The permission mapping table (202) allocates user permissions in a matrix form.

10. The method for protecting access to a solid state drive according to claim 5, wherein: The independent physical area (203) is provided with an access control mechanism, which only allows users holding corresponding access tokens to enter the corresponding storage area.

Images