Data security protection method, device and system, security control framework and storage medium

Abstract

The application relates to the technical field of information security, and provides a data security protection method, device and system, a security control framework and a storage medium. The method comprises: setting a protection module in a target device to control read and write permissions of a computer device on the storage device, so as to ensure communication security between storage devices, prevent the computer security risk caused by a malicious storage device accessing the computer device, and prevent data leakage of the storage device caused by malicious access of the data on the storage device by the computer device. Meanwhile, in the present application, according to a current protection mode of the target device, permission control is carried out on a data interaction instruction sent by the computer device, and if the data interaction instruction meets the permission requirement corresponding to the current protection mode, the data interaction instruction is responded, so that the computer device is ensured to access the storage device in the current protection mode of the target device, data damage and data leakage of the storage device are avoided, and data security of the storage device is improved.

Description

Step S702, determining that the read / write operation is abnormal if the read / write operation does not comply with the preset read and write rules. Based on the preset rules, the data interaction instructions sent by the computer (such as reading or writing sector addresses) are automatically verified. If they do not meet the rules, they will not be executed, or enter the manual confirmation mode for judgment. The specific implementation method mainly establishes rules, which mainly include but are not limited to: 1. Rules of reading and writing the file system based on the normal enumeration of the computer. For example, the rules for computer reading and writing are: first read the address of sector 0 (analyze the boot sector data, read the address of the file system boot sector) -> read the address of the file system boot sector (analyze the file allocation table and first directory sector address of the file system) -> read data corresponding to sector address of file allocation table -> read data corresponding to first directory sector address. The above rules are regular and jumping, which are starting from sector 0 address, non-continuous, and generally jumping. If it is maliciously read, when analyzing the read, it will be read continuously from the address of the sector to the address of the specific sector, and there is no rule for the computer to read and write the file system normally, it is considered abnormal. 2. Contextual rules based on the normal reading and writing files of the computer. For example, when a computer reads file content data, it will first read the record of the folder data where the file is located (obtain the start sector address of the file (or called first cluster, first block, etc.)); when writing file data, it will write the record of the folder data where the file is located (recording the address of the starting sector of the file (or called the first cluster, first block, etc.)). It is considered abnormal if there is no context operation. 3. Rules based on the file system data management. For example, a file system generally divides multiple sector addresses into a sector range for management ("cluster" in the FAT file system, or "block" in other file systems). When the computer normally operates the file system, the read or write operation should be performed from the address of the first sector of the cluster or block. If the read or write operation does not start from the first sector address of the cluster or block, and the sector address of the operation is other positions in the cluster, it is considered to be abnormal. 4. Rules based on business habits. For example, if the computer reads multiple files (more than the preset number) from the storage device within a preset time (or within one access), it is considered to be abnormal. Corresponding handling based on abnormalities may include but not limited to: When the operation is prohibited, the protection module can return an error status response or a successful execution response, or respond to blank data, or respond to other non-real data, so that the computer thinks that the execution is successful, but in fact the protection module does not actually operate the data of the storage device, so as to prevent the computer from thinking that the operation failed and continuously trying to operate. The second is to switch to the process of the manual confirmation mode. In this embodiment, the preset read-write rules include, but are not limited to, general read / write rules for sector addresses, read / write numbers of file, and the like. For example, for the general read and write rules of the sector address, usually start reading and writing from the first sector address, if the current read / write operation does not start reading and writing from the first sector address of the file, but starts reading and writing from other sectors, for example, the 100th sector to the 9999th sector of the data area are continuously read and written, it is considered that the read / write operation is abnormal. For the read / write number of file, since crawler-style read scans and reads all files in the storage device in batches, by setting the read number of file to, for example, 10, if more than 10, the read / write operation is considered to be abnormal. Further, the step "responding to the data interaction instruction" in the method provided by this embodiment may include: Step 41, sending the data interaction instruction to the storage device, so that the storage device reads data and / or writes data based on the data interaction instruction; Step 42, obtaining the procedure information of the storage device reading data and / or writing data based on the data interaction instruction; Step 43, determining whether there is an abnormality based on the procedure information; Step 44, sending a stop instruction to the storage device if there is an abnormality. Based on the corresponding content in the above-mentioned rules about the normal reading of files by computer device, the above step 43 of "determining whether there is an abnormality based on the procedure information" may include at least one of the following: determining that there is an abnormality if the process of the storage device reading data based on the data interaction instruction does not conform to the set process rule; determining that there is an abnormality if a context operation is not specified in the process of the storage device reading data and / or writing data based on the data interaction instruction; wherein, when reading data, the specified context operation is the operation of reading the folder where the data is located; when writing data, the specified context operation is the operation of obtaining the folder where the data is located; determining that there is an abnormality If the process of the storage device reading data and / or writing data based on the data interaction instruction does not start the read or write operation from the first sector address of the cluster or block where the data is located; determining that there is an abnormality if the storage device reads more than a set number of files within a preset time period based on the data interaction instruction. Optionally, when the read / write operation is abnormal, manual confirmation can be performed in combination with the manual confirmation mode, or information can be fed back to the computer device. For example, the method provided in this embodiment also includes the following steps: Step 51, sending feedback information to the computer device if there is an abnormality; wherein, the feedback information includes: false information that simulates successful writing, or takes preset data as data successfully read from the storage device; and / or Step 52, outputting manual confirmation prompt information if there is an abnormality, so that the user can determine whether to continue execution based on the manual confirmation prompt information. In some embodiments, based on the embodiment shown in FIG. 1, FIG. 13 is a flow chart of the data security protection method of the fifth embodiment of the present application. The same steps as in FIG. 1 will not be repeated, as shown in FIG. 13, the method also includes: Step S801, connecting a target sector range to the computer device as a storage data source, wherein the target sector range is obtained by dividing the storage space of the storage device, and the storage data source includes the target file. In this embodiment, when the protection mode is the logical split disk mode, the storage device is logically split. The logical splitting is a process of dividing the storage space of the storage device based on the sector address of the storage device, which is different from the current system disk partition that only displays multiple partitions on a computer device but actually stores files in the same sector range. For example, the sector address range of hard disk 1 is 0 to 999, and the system disk partition is performed on hard disk 1 to display hard drive 1 and hard drive 2 on the computer device, but the data of hard drive 1 and hard drive 2 are actually stored in the 0 to 999 sector address range of the hard disk 1, and the data of hard drive 1 or hard drive 2 can also be accessed at the same time. However, the logic division mode of the present embodiment is to divide the sector address range of the hard disk 1 into two sector address ranges of 0 to 499 and 500 to 999, which correspond to disk A and disk B respectively, and the data of disk A is stored in the sector address range of 0 to 499, the data of disk B is stored in the sector address range of 500 to 999, so that the data of disk A and the data of disk B do not affect each other in the underlying logic, for example, they can be formatted into different file system. Optionally, the multiple sector ranges after dividing can be accessed to the computer device in the form of independent split disks, or can be accessed to the computer device in the form of files. That is, when the current protection mode is the logical split disk mode, correspondingly, the method provided in this embodiment further includes the following steps: Step 61, splitting the specific storage space of the storage device to obtain at least one split disk if the current protection mode selected by the user is a logical split disk mode; Step 62, selecting one split disk from the at least one split disk as the target split disk, and connecting it to the computer device. Further, the method provided in this embodiment also includes at least one of the following steps: Step a, determining the specific storage space in response to user settings; wherein the specific storage space may be all or part of the storage device; Step b, determining the specific storage space based on the selection rules of the specific storage space in the logical split disk mode. Wherein, in the above-mentioned step 61, "splitting the storage device to obtain at least one split disk" may include: reading sector information of the specific storage space in response to a user's split instruction, and splitting the specific storage space based on the sector information; or reading sector information of the specific storage space, and splitting the specific storage space based on the sector information and using a preset division strategy; or generating at least one image file in the file system of the storage device, and splitting the specific storage space of the storage device according to the address ranges respectively corresponding to the at least one image file. Specifically, the "preset disk splitting strategy” can be obtained locally; or obtain the preset disk splitting strategy from the network side server-side. It should be noted that the server-side in this application is a terminal that uses a network connection (such as using a TCP / IP connection, etc.) or a non-network connection (such as a point-to-point connection using Bluetooth, LoRA, etc.). For example, if two terminals establish a data interaction relationship, and the first terminal provides a data source for read / write operation to the second terminal, then the first terminal can be understood as a server-side. Of course, the serverside can also be understood as servers deployed on the network side, virtual servers, clouds, server clusters, and so on. In addition, the sector in this application should be understood as the storage space address in a broad sense, that is, the area that divides the storage space of the storage device. The sector information includes but is not limited to the total number of sectors (sector address range) and each sector bytes etc. The logical split disk mode is compatible with all protection modes, that is, other protection modes are aimed at the target split disk connected to the computer device after the logical splitting, and the computer device cannot recognize other split disks that are not connected to the computer device. Therefore, the data interaction instructions sent by the computer device can only be oriented to the target split disk. Through the logical split disk mode, the effect is similar to the "dual hard disk and dual system for computer" of the computer. The hard disk is switched to the internal network system or the external network system through the physical isolation card of the two hard disks, and the storage area and the system are independent of each other. The splitting here is to divide a storage device with only one physical storage area or logically one physical storage area, and logically divide it into two or more storage areas of any number and capacity. The specific implementation method: 1. Pre-dividing the split disks and select the split disks. Dividing multiple sector ranges in the storage device in advance, and selecting the corresponding sector ranges. For example, the total available sectors of the storage device are 2000, which are divided into 2 split disks equally, and the total number of available sectors of each split disk is 1000. In addition, each split disk can be assigned automatically or manually: vendor ID (Vendor ID), device ID (Product ID), character string information and other hardware characteristic parameters. 2. Responding to computer requesting hardware characteristic parameters. Th first is to respond to the split disk capacity parameter. Responding with the relative total number of the capacity of the selected split disk when the computer device sends an instruction requesting a capacity parameter. For example, when the computer sends the SCSI or UFI instruction code 0x25 (READ CAPACITY), the protection module responds with the last logical block address of the logical split disk. When the computer sends the SCSI or UFI command code 0x23 (SCSI READ FORMAT CAPACITIES), the protection module responds with the number of available sectors (or available blocks) and the number of bytes of a single sector (or block). So that the computer thinks that the capacity value of the storage device is the capacity value of the logical split disk. The second is to respond with hardware characteristic parameters such as the vendor ID (Vendor ID) and the device ID (Product ID) of the split disk. Responding with hardware characteristic parameters corresponding to the split disk when the computer sends an instruction requesting hardware characteristic parameters. For example, when the computer sends a device descriptor (0x80 0x06 0x00 0x01 0x00 0x00 0x12 0x00) request in the USB protocol, the protection module responds with the corresponding vendor ID (Vendor ID) and product ID parameters in the device descriptor. The third is to respond with the character string information parameters of the split disk. Responding with the character string information corresponding to the split disk when the computer sends an instruction requesting a character string descriptor. For example, when the computer sends a request for the string descriptor (0x8006010309040200, 0x8006020309041200, 0x8006030309042800) in the USB protocol, the protection module responds with the corresponding string information in the string descriptor. 3. Read and write mapping. When the computer sends a data interaction instruction, the protection module maps it to the corresponding sector range by offset. When disk 1 is selected, if the computer reads sector 0, it reads sector 0 of the removable storage device and returns; if the computer reads sector 1, it reads sector 1 of the storage device and returns, and so on, and the maximum readable sector is sector 999; when disk 2 is selected, the computer reads sector 0, then it offsets 1000 sectors, reads 1000 sectors of the removable storage device and returns; when the computer reads sector 1, then it reads sector 1001 of the storage device and return, and so on, and the maximum readable sector is sector 1999, and the data of sectors 0 to 999 of the storage device cannot be read. The address of sector 0 and sector 1 written by the computer is also consistent with the above sector position read by offset mapping, and so on. When the sector address read or written by the computer beyond the range of the split disk, it returns the read or write error status. If the capacity of the storage device is 2000k bytes, it is assumed that the storage device has two split disks after splitting, which are disk 1 and disk 2 respectively. The capacities of split disk 1 and split disk 2 are the same, for example, both are 1000k bytes. When disk 2 is selected, the total capacity displayed by the computer is 1000k bytes. Formatting disk 2 and copying data to it will not affect all the data in split disk 1. What needs to be added here is that the above sector range and total capacity data are examples for easy understanding, and the number will be much larger in actual scenarios. The difference between logical split disk and a specific-folder read and write. The idea of realizing logical split disk is roughly the same as that of specific file read-write and blank folder. It mainly maps the sector addresses for read / write interaction instruction of a computer to the relevant sector addresses of a storage device. Specific folder read / write and blank folder are mainly to map the sector address of one file to the sector address of another file, wherein the file system, total storage capacity and remaining space are consistent with the original disk, and the file system cannot be formatted. The split disk mode does not consider specific files, but directly maps a sector address range, wherein the total storage capacity and remaining space are independent, and the file systems can be formatted separately. Specific scenarios for splitting storage devices: The first is to automatically divide the external storage into logical split disks (storage media splitting). In the form of an intermediate device or a card reader, any connected storage device is split. The protection module reads the basic information of the storage device (connected USB flash disk, SD card, TF card) in advance: the total number of sectors, the number of bytes in each sector, vendor and device ID, string information, etc. For example, when the capacity of the storage device (such as USB flash disk, etc.) is 16G, if the storage device is divided into 2 split disks by default, it will be automatically divided into 2 split disks of 8G; if the storage device is divided into 3 split disks by default, it will be divided into one 8G split disk and two 4G split disks; 16G and 2*8G for 32G, and2*16Gfor 64G, etc. The second is to automatically divide the internal storage space (storage media splitting). As a form integrated in the removable storage device, one or more physical storage areas can be stored in the internal storage (FLASH) for logical splitting. Since the storage medium is fixed inside the device, and the storage physical capacity is known and fixed at the time of production, the above step of pre-reading the basic information of the storage device is omitted. Preset the basic information of the storage media device: the total number of sectors, the number of bytes in each sector, vendor ID and device ID, string descriptor, etc. The third is to split in the form of file mirroring. An image file is generated in the file system of the storage medium, and the content data of the image file is used as sector ranges for splitting the split disk. Map all sectors of the split disk directly to the content data of a specific file. The size of the split disk can be pre-set by means of file occupation. For example, a blank "split disk l.dd" file of 16GB is generated, and at this time, the size of the split disk is 16G. It can also be written by appending file data when there is a need to read / write, and the size of the split disk is the size of the existing data on the split disk plus the total remaining space of the USB flash disk (or called blank data area), which can make full use of the data space of the storage device. To be more specific, for example, the path of the split disk image file is "My USB flash disk\My folder\split disk 1 .dd". And the basic information corresponding to the split disk (the total number of sectors, the number of bytes in each sector, vendor ID and device ID, character string information, etc.) is preset. When using the split disk 1, when the computer enumerates, the protection module returns the basic information of the split disk, and when the computer reads and writes data, the protection module actually reads and writes the file content data of "split disk l.dd" for mapping. For example, when the computer reads sector 0, it will return the address of the first sector of the content data of the "split disk l.dd" file; when the computer reads the data corresponding to the sector address 100, it will return the data corresponding to the sector 100 of the file "split disk 1 .dd"; when the computer writes data into the sector 200 to 300, then write the data into the data corresponding to the sector 200 to 300 of the "split disk l.dd" file. The fourth is to split the disk through the network service (actually, it is connected to the network data source). As the principle of splitting in the form of file mirroring, the basic information corresponding to splitting is preset locally on the storage device or on the server-side: the total number of sectors, the number of bytes in each sector, vendor ID and device ID, string information, etc. The difference is that the image files generated and used are stored on the server-side. The networked protection module (networked USB flash disk) itself may not store data, or store a small amount of data (for optimizing the startup method, or the network configuration of the connected network server-side), and the networked USB flash disk is connected to the network server through wired or wireless methods, and sends the identification information of the networked USB disk. The background server associates the corresponding image file (such as "split disk l.dd") according to the identification information of the networked USB disk. When the computer sends interactive instructions to the USB flash disk (such as reading sectors), forward the read / write requirements of the interactive instructions to the server (the main information of the command is: read or write operation, starting sector address, continuous read or write sector length). After receiving the request sent by the USB flash disk, the server returns the data corresponding to the sector address corresponding to the related image file (such as "split disk l.dd" corresponding to disk A) file. In addition, the identification symbol can be bound to three files: "split disk l.dd" corresponding to Drive A, "split disk 2.dd" corresponding to Drive B, and "split disk 3.dd"corresponding to Drive C, which can be switched according to the data source. In addition, for the above-mentioned logical split disk mode (division of connected storage devices (such as USB flash disk), division of internal storage media, division of image files stored in files, division of network image files), parameters that can customize descriptors are required, so that the computer can distinguish them into different storage devices (such as different USB flash disks), and the realization method is "configuration information" + "data source". Configuration information includes: descriptor set and basic information. The descriptor set includes: device descriptors, configuration descriptors, interface descriptors, endpoint descriptors, etc. Basic information includes: capacity information such as the total number of sectors, the number of bytes in each sector, and parameters of the mass storage device such as read-only or read-write status. In addition, "configuration information" can be stored in a hidden location of the data source, for example, the last sector and cannot be accessed by the computer as USB flash disk data; it can also be stored in the database of the server-side; it can also be stored in a certain sector or file stored in the built-in protection module. The advantages of doing this are: It can give full play to the storage space of the storage device, and effectively reduces the hardware cost compared to using multiple storage devices or memory chips for switching to achieve isolation, so that one storage device or memory chip can meet a variety of different needs, for example, it can be formatted into different file systems in the split disk mode to realize the use in different scenarios. In addition, more secure protection can be achieved. Each split disk is directly independent of each other (the data source is independent, and the hardware characteristics can also be different), and the control is performed at the data communication layer. The computer only considers the connected storage device as the capacity of the split disk, and will not read the sector beyond the range. If it is forced to read sectors beyond the range of the split disk, the protection module will not execute the instruction. In addition, the solution provided by the embodiment of the present application may not depend on the type and kind of the storage device and the formatted file system, as long as a communication connection and read-write control can be established with the protection module, logical splitting can be realized. Data is stored in the server-side, and the protection module can switch data sources at any time according to different scenarios. Data reading and writing are all stored in the server-side, and the protection module is essentially just a front-end device. When the protection module is lost, the data is still stored in the server-side. In addition, the computer device cannot know the data source, and the protection module can use the built-in mobile cellular network, or the WiFi of the protection module user, etc., instead of connecting to the network via the computer, and the network traffic does not pass through the computer. Also, for the computer, it is impossible to intuitively control whether the data of the storage device is stored in the server-side or in the local storage medium of the protection module. In addition, the protection module of the embodiment of the present application is different from the existing network USB flash disk. In the prior art, the files of the server-side are first downloaded to the network USB flash disk storage device, and then the files in the file system of the storage device are read and downloaded by the computer; Or the computer first writes the file into the file system of the storage device of the USB flash disk, and then uploads the file to the server-side by the network USB flash disk. In this case, it needs to occupy the capacity of the network USB flash disk's own storage space. For example, a 16G network USB flash disk cannot transfer 32G files, or a network USB flash disk with less than 4G remaining space cannot transfer files larger than 4G. The present invention does not have the problem of file limitation by means of data forwarding. On the other hand, the data of the entire storage split disk cannot be switched. And in the present invention, based on sector address reading and writing, Drive A can be formatted as FAT32 file system correspondingly, and there are files A.txt, B.txt; Drive B can be formatted as ExFAT file system, and there are files C.txt, D .txt, and can be directly connected to the computer for display. However, existing network USB flash drives can only select specific files to copy. In addition, image files such as "split disk l.dd" mapped on the server-side can be database data, or the combination, splicing, and mapping of multiple files based on distributed storage technology, optimized storage, and CDN network acceleration, etc. How to choose a data source: 1. Selecting by physical button. By switching the physical button of the protection module (such as the physical switch buttons corresponding to the selection of the data sources of the split disk in FIGS. 2b and 2c), select the corresponding split disk data source (such as storage medium split disk, image file split disk, networked image files split disk, etc.). 2. Selecting by NFC. Through the communication module such as Bluetooth, WiFi, and serial port interface of the protection module, an instruction for selecting a split disk data source is sent to it. After receiving the instruction, the protection module selects the corresponding split disk data source. 3. Selecting by remote communication. Through the networking of the protection module, the instruction of the split disk data source is obtained from the server-side, and the corresponding split disk data source is selected. The instruction of the server-side is set by the user connecting to the server-side through APP, applet, webpage and other programs. 4. Selecting by the key (or characteristic value) sent by the computer. When split disk is created, its basic information contains corresponding key information. After the protection module is connected to the computer, the computer sends an interactive instruction with key (or characteristic value) information, and the protection module matches the basic information set of the split disk according to the key. When the match hits, select the corresponding split disk data source. For example, split disk 1 corresponds to key A, split disk 2 corresponds to key B, and the key to access all split disks at the same time is C. When it is verified that the instruction carries key A, it is confirmed that the split disk 1 is connected to the computer device; When it is verified that the instruction carries key B, it is confirmed that the split disk 2 is connected to the computer device; When it is verified that the instruction carries key C, it is confirmed that the split disk 1 and split disk 2 are connected to the computer device at the same time. When being connected to the computer device, it is verified by the key sent by the computer to determine that the selected target storage data source is connected, so as to improve the security of the storage data source. Based on the above method of selecting a data source, it can be known that the step "selecting a split disk from the at least one split disk as a target split disk" in the method provided by the embodiment of the present application may include: taking a split disk selected by the user as the target split disk in response to the user's selection operation of the at least one split disk through an interaction device; or taking the split disk indicated by the split disk selection instruction as the target split disk when receiving the split disk selection instruction sent by the specifying device, wherein the specifying device communicates with the protection module through near-field communication or remote communication; wherein the specifying device and the computer device are different devices; or receiving the information carrying the disk key sent by the computer device, verifying the disk key, and after the verification is passed, taking the split disk with the disk key in the at least one split disk as the target split disk. Optionally, the access mode of the target split disk can be set by toggling a switch, remote control, and computer configuration. As an example, in one possible implementation, the target device is provided with a physical switch to select the split disk, and the target split disk can be selected by toggling the physical switch. In another possible implementation, the target device is provided with a communication unit such as WiFi, Bluetooth, infrared, or ultra-wideband to be used to connect with the remote-control device, through which the target split disk is selected. In another possible implementation, the communication connection is performed through a computer device to select a target split disk through that computer device. Optionally, when the computer device reads the total number of sectors of the storage device, it returns the total number of sectors of the selected split disk to the computer device; When a computer device sends a data interaction instruction to read / write sector, it maps the real sector position of the split disk sector. What needs to be added here is: the "dividing" in the "target sector range by dividing the storage space of the storage device" mentioned above, and the "splitting" in the "splitting the specific storage space of the storage device" mentioned above can be understood as a mapping strategy in essence in actual technology. The mapping strategy can be pre-configured. For the storage medium (or storage device), there is actually no change, and its disk capacity information, sector address read / write have not changed; It is only based on this mapping strategy in the protection module that the user sees the effect of splitting on the computer device side. In other words, the splitting of the specific storage space of the storage medium by the protection module is a virtual and conceptual splitting, and what is presented to the user on the computer device side is the splitting effect without any change on the storage medium. In some embodiments, based on the embodiment shown in FIG. 13, it also comprises before step SI02: reading sector information of the storage device; based on the sector information, dividing the storage space of the storage device to obtain a plurality of sector ranges corresponding to the storage device, wherein the target sector range is at least one of the plurality of sector ranges. In this embodiment, based on the preset number of split disks, the sector address range of the storage device is divided to obtain the sector address range of each storage space. The preset number of split disks can be a preset value, or a quantity selected by the user in real time before logical splitting. The range splitting manner may be a manner of dividing the sector address of the storage device based on a preset range size, or a manner of dividing the sector address of the storage device based on a range size selected by the user in real time. Optionally, if the preset allocation quantity is a preset value, when the computer device and the storage device are connected in communication, when the target device is in the logical split disk mode, the sector information of the storage device is divided into ranges according to the default value, so as to realize plug and play. Exemplarily, if the preset allocation quantity is the quantity selected in real time, when the computer device and the storage device are connected in communication, when the target device is in the logical split disk mode, the options to provide the user with the split disk quantity and sizes of each split disk are displayed on the computer device, and the storage device is logically split based on the quantity and sizes of the split disks selected by the user in real time. For example, the sector address range of the storage device is 0 to 1999, and the number and the sizes of split disks are displayed on the computer device. If the user selects the number of split disks as 2 and the sizes of each split disk are the same, the split disk corresponding to the sector address range 0 to 999 and the split disk corresponding to the sector address range 1000 to 1999 are obtained. It can be understood that when the target device is an intermediate device, and the intermediate device is connected with multiple storage devices at the same time, it can perform logical splitting on multiple storage devices, or perform physical splitting based on each storage device to obtain the same number of split disks as the number of storage devices. FIGS. 14a, 14c, 14e, and 14g are example diagrams showing the logical split disk mode. FIG. 14a shows that the display value of the available space of the storage medium (such as a USB flash disk with a protection module or a USB flash disk connected with an intermediate device) is 14.9 GB (the theoretical available space is about 16 GB). FIG. 14b is a schematic diagram showing the storage space before logical splitting of the available space from a physical perspective, for example, from the 0x00 sector position to the end sector position (that is, the number of sectors corresponding to the available space or the last logical block address of the available space + 1). Assume that it needs to be divided into one 8GB (theoretical value) split disk and two 4GB (theoretical value) split disks, for a total of 3 logical split disks. Refer to FIG. 14c, which shows the information related to the first logical split disk, such as capacity, file system, split disk unit size, remarks, etc., the quick format in the format option can also be checked, and the action of restoring to defaults can also be controlled to trigger through the "Restore Device Defaults", and so on. The example shown in FIG. 14c shows that the capacity of the first logical split disk is 7.47GB (theoretically it can be 8GB), the file system is FAT32 (default), and the allocated unit size is 4096 bytes. The window shown in FIG. 14c is a formatting page displayed after the first logical split disk is selected. The formatting page shows that the capacity of the first logical split disk is 7.47GB (theoretical value is 8G). After the user clicks the "Start" control, the first logical split disk can be reformatted. FIG. 14d is a schematic diagram showing an 8GB storage space corresponding to the first split disk from a physical perspective. Referring to FIGS. 14e and 14g, it shows the attribute information of the other two logical split disks, that is, two 4GB logical split disks, disk_02 and disk 03. FIG. 14f is a schematic diagram showing a 4GB storage space corresponding to the second split disk from a physical perspective. FIG. 14h is a schematic diagram showing a 4GB storage space corresponding to the third split disk from a physical perspective. After splitting, the sector ranges corresponding to each disk are independent of each other, do not interfere with each other, and the data is isolated from each other. For example, the file directories of the above three logical split disks are completely different, and cannot access each other. FIG. 14i is a schematic diagram showing responding to the computer reading and writing to the storage space in a specific folder mode when the protection module does not perform logical splitting. As shown in FIG. 14i, the dotted line indicates that the computer device wants to read / write the sector data of the root directory. In fact, after the protection module receives the data interaction instruction for reading / writing the sector data of the root directory sent by the computer, the protection module reads / writes specific folder directory sector data and return it. FIG. 14j is a schematic diagram showing that the current protection mode of the protection module is a combination mode of a logical split disk mode and a blank folder mode, and responds to the computer reading / writing the storage device in the case that the storage space is divided into three logical split disks under the combination mode of logical split disk mode and blank folder mode. As shown in FIG. 14j, the dotted line indicates that the computer device wants to read / write the sector data of the root directory, and the sector position of the root directory can be offset to the sector position corresponding to the second logical split disk. After the computer device sends the data interaction instruction for reading / writing the sector data of the root directory, the protection module selects the split disk 2, and the protection module reads / writes the sector data of the specific folder directory on the split disk 2 and returns it. In some embodiments, based on the embodiment shown in FIG. 1, FIG. 15 is a flow chart of the data security protection method of the sixth embodiment of the present application. The same steps as in Fig. 1 will not be repeated, as shown in Fig. 15, the method also includes: Step S901, connecting an image file to the computer device as the storage data source, and the image file is generated based on a preset mirroring policy. In this embodiment, the preset mirroring policy can be obtained by creating a blank image file; it can also be obtained by copying an existing image file, and it can also be obtained by mirroring the data area of the storage device. Exemplarily, for the method of creating a blank image file: generating a preset storage image file (which may be a blank file "split disk l.dd" with a size of 16G) on the storage device to obtain the image file. For the method of copying the existing image file: saving the data of all sectors of the hard disk A of another storage device as the storage file of "hard disk A image file.dd", then "hard diskAimage file.dd" is called hard diskAimage file, then copy the "hard disk Aimage file.dd" to a storage device with storage capacity. Through the protection module, the above "split disk l.dd" or "hard disk A image file.dd" can be connected to the computer device as a data source. Optionally, for the method of mirroring the data range of the storage device, the size of the data range can be preset by means of file occupancy, for example, to generate a blank "split disk l.dd" file with a size of 16G, then the data size of the range is 16G; it can also be written by appending file data when there is a need for read / write, then the size of the data range is the size of the existing data in the data range plus the total remaining space of the storage device (or called blank data region), so that the data space of the storage device can be fully utilized. Exemplarily, the computer device reads / writes the storage data source in the form of a file: the file path corresponding to the data range is "E:\My folder\split disk l.dd" in the USB flash disk, when reading / writing the split disk 1, the target device actually reads / writes the file data of "split disk l.dd" for mapping. When the computer device reads the Oth data block, it will return the data from 0 to the following 512 bytes (the size of a single sector is 512 bytes) of the first address of the data of the file "split disk l.dd”, that is, return data of the file data block 0, and the file data is read / written in the fashion of (sector address x 512) operated by the computer device as the offset. If the computer can directly read / write the sector data corresponding to the file, then directly read / write the corresponding sector of the file. It should be noted that, for the file split disk in this embodiment and the network split disk in the following embodiments, the sector address should be extended and interpreted as "file data block", that is, one file data block corresponds to one sector. For example: in the case of a single sector size of 512 bytes, reading sector 0 corresponds to reading file data block 0, that is, reading a total of 512 bytes of data from the first address of the file to the following 511 bytes; writing sector 1 corresponds to writing file data block 1, which is equivalent to writing a total of 512 bytes of data from the 512 bytes of the file offset to the next 511 bytes. The subsequent steps will not be described in detail. In some embodiments, based on the embodiment shown in FIG. 1, FIG. 16 is a flow chart of the data security protection method of the seventh embodiment of the present application. The same steps as in FIG. 1 will not be repeated. The storage device is a networked storage device which is connected to a server-side, and the server-side contains a plurality of networked image files, as shown in FIG. 16, the method further includes: Step S1001, connecting the target networked image file as a storage data source to the computer device, wherein the target networked image file is at least one of a plurality of the networked image files, and the storage data source contains the target file. In this embodiment, the storage device is a networked storage device. The networked storage device may not store data or may store data, and it communicates with the server-side through a wired or wireless method, wherein the server-side includes multiple networked images files. Optionally, in the case of distributed storage technology, optimized storage and CDN network acceleration, the networked image file can be the data of the database, or the combination, patchwork and mapping of multiple files. Optionally, the networked storage device is connected to the server-side, and sends identification information to the server-side. The server-side associates the corresponding networked image file according to the identification information of the networked storage device, and forwards the read / write requirements of the data interaction instruction (such as read or write operation, the sector address at which the operation starts, and the length of sector continuously read) to the server-side when the computer device sends a data interaction instruction. After the serverside receives the read / write requirements sent by the networked storage device, it returns the address of the sector file data block corresponding to the networked image file to realize the expansion of the data space of the networked storage device. Optionally, according to the identification information of the networked storage device, the target networked image file corresponding to the networked storage device is switched and controlled at the server-side, so as to access the target networked image file to the computer device. For example, according to the identification number of the networked storage device (or the user's identification information (bound through account login)), three networked image files "split disk l.dd", "split disk 2.dd" and "split disk 3.dd" are bound, so as to switch the data source connected to the computer device among the 3 networked image files. Exemplarily, the target device is connected to the server-side, and the networked image file "split disk l.dd" stored on the server-side is connected to the computer device, and the computer device sends data interaction instructions in a single sector size of 512 bytes. If the data interaction instruction is used to read the data of the Oth sector address and write data to the 1st sector address, then the protection module sends a request to the server-side, and the server-side converts the Oth sector to the first address of "split disk l.dd", and convert the 1st sector to the 512th byte offset address of "split disk 1 .dd". According to the converted address, the server-side returns the data from Oth to 511th bytes of the first address of the image file "split disk 1 .dd". Write data to the 512th byte of "split disk 1 .dd" for the data with the offset address to the next 511 bytes, and the networked storage device returns the result returned by the server-side to the computer device. The networked storage device of this embodiment can freely switch between different storage data sources without installing software tools on the computer device. The real address of the data source is invisible to the computer, and the data source is stored in the cloud. When the networked storage device is lost, the data source can be canceled remotely, thereby improving the data security of the data storage device. At the same time, in this embodiment, the data corresponding to the specific offset address (or the data corresponding to the sector address corresponding to the file) of the file associated with the server-side is directly read / written, and the data is forwarded directly to the server-side or computer device in a forwarding manner, so that it is not limited by the storage space of the storage device itself, improving efficiency and increasing applicable scenarios. In some embodiments, the descriptor set (and related configuration files) are used to distinguish data sources in different forms such as independent split disks, files and networked forms, so that computer devices can distinguish different storage devices. The "descriptor set" can be stored in a hidden location of the data source, for example, the last sector, and cannot be accessed by the computer as storage device data. It can also be stored on the server-side, or it can be stored in a sector or file stored in the built-in storage of the protection module. If the protection module is arranged at the intermediate device, the intermediate device has a networking function to connect to the cloud or the storage module on the server-side. Correspondingly, the step "responding to the data interaction instruction" in the solution provided by the embodiment of the present application includes: sending the data interaction instruction to the storage module on the network side, so that the storage module reads and / or writes corresponding data based on the data interaction instruction. In some embodiments, on the basis of any one of the embodiments in FIGS. 13,15 and 16, the method further includes: in response to a verification instruction input by the user, connecting a target storage data source corresponding to the instruction type of the verification instruction to the computer device, wherein the target storage data source is at least one of a sector range, an image file, and a networked image file. In this embodiment, the verification instruction is an instruction for determining that the selected target storage data source is connected to the computer device, and it may carry password information corresponding to the target storage data source. For example, if the target storage data source is connected to a computer device in the form of split disks, split disk 1 corresponds to password A, split disk 2 corresponds to password B, and the password to access all split disks at the same time is C. When it is verified that the instruction carries password A, it is confirmed that the split disk 1 is connected to the computer device; When it is verified that the instruction carries password B, it is confirmed that the split disk 2 is connected to the computer device; When it is verified that the instruction carries password C, it is confirmed that the split disk 1 and split disk 2 are connected to the computer device at the same time. In this embodiment, the user identity can be verified by a password when accessing the target sector range to determine that the selected target storage data source is accessed, thereby improving the security of the storage data source. In some embodiments, based on the embodiment shown in FIG. 1, FIG. 17 is a flow chart of the data security protection method of the eighth embodiment of the present application. The same steps as in Fig. 1 will not be repeated, as shown in Fig. 17, the method also includes: Step S1101, reading the power demand information of the storage device; Step SI 102, configuring a circuit current limiting protection strategy of the storage device according to the power demand information, wherein the circuit protection strategy is used to control the power consumption status of the storage device. In this embodiment, the power demand information includes, but is not limited to, power current, power voltage, and circuit status, and circuit protection strategy includes protection strategy for storage device and protection strategy for computer device. Optionally, in order to prevent the storage device from burning out due to the input of high current from the computer device, the protection strategy is configured according to the power consumption current of the storage device. For example, the path current between the second interface of the intermediate device connected to the computer device and the first interface of the intermediate device connected to the storage device does not exceed the power consumption current, or does not exceed the preset allowable upper limit (such as 10%) of power demand, or does not exceed a preset fixed value (such as 500 mA). In order to prevent the computer device from being burned due to the short circuit in the storage device, the protection strategy is configured according to the circuit status of the storage device. For example, if the circuit status of the storage device is short-circuited or there is an instantaneous high current, the intermediate device disconnects the connection path to the first interface connected to the storage device, or increases the resistance to the first interface. In some embodiments, the method further includes: generating an interaction log which is used to record processing records of the data interaction instruction sent by the computer. In this embodiment, the processing records of the data interaction instruction sent by the computer device (for example, data related to recording forwarding and execution) are stored in the interaction log, so as to facilitate subsequent auditing. Optionally, when the interaction log is read out, it can be configured as a read-only mode, so that it cannot be tampered with and ensures the reliability of the interaction log storage records. In some embodiments, if the current protection mode is the backup mode, correspondingly, the step "responding to the data interaction instruction" may include: synchronously writing the data written by the computer device into the specified backup storage area when the data interaction instruction is a write instruction; and / or the protection module reading the data corresponding to the sector address written by the computer device and writes it into the specified backup storage area before executing the write instruction when the data interaction instruction is a write instruction. The advantage of the above-mentioned "synchronously writing the data written by the computer device into the specified backup storage area" is: when important data is copied on the computer device and the important data is found to have been maliciously written by another computer device, the data recovery can be performed through backup recovery. The above-mentioned "the protection module reading the data corresponding to the sector address written by the computer device and writes it into the specified backup storage area before executing the write instruction" has the advantage that it is equivalent to retaining the original data before writing, after being maliciously deleted or modified by a computer, it can be restored from the backup storage area. For example, data such as the boot sector, FAT table, and file item information are backed up in advance before the computer writes the data. When it is found that it has been corrupted by malicious writing by the computer, when the storage device cannot be accessed normally (for example, it prompts that it needs to be reformatted) or the file cannot be displayed or read / written, the data can be restored through the backup. Further, when the current protection mode is the backup mode, the data protection method provided in the embodiment of the present application may further include the following steps: storing the data backup of the important data sectors connected to the storage device in the specified backup storage area; reading out the data in the specified backup storage area and writing into the original data sector of the storage device when the restoration is triggered. Wherein, the important data sector can be set manually, for example, specified by the user through the interactive device, and the data sector specified by the user can be marked as an important sector. Or, the important data sector is set by the protection module itself; or, the important data sector is selected based on a preset importance judging strategy, etc., which is not specifically limited in this embodiment. Refer to an example of the structure of the intermediate device shown in FIG. 18a. Or FIG. 18b shows a storage device integrated with a protection module having functions corresponding to the protection methods provided by various embodiments of the present application. The intermediate device shown in FIGS. 18a and 18b can display information that requires manual confirmation, such as file name, file type, file size, operation, etc., when it is in the manual confirmation mode. The user can confirm the operation through the "Confirm" control, and can also cancel the operation through the "Cancel" control. According to different usage scenarios, the user can manually operate on the panel of the intermediate device or storage device as shown in FIG. 18a or 18b: 1. Selecting the protection mode. Selecting the protection switches corresponding to the protection modes such as whole-disk read-only, specific-folder write-only (blank folder), specificfolder read-only, and specific-folder read-write to complete the setting of the current protection mode of the intermediate device. 2. Selecting the physical data source. Selecting the data source as USB storage device, SD card, built-in memory chip or external network storage device, etc. 3. Selecting the logical split disk data source. Further dividing the sector address of the physical data source to form multiple data sources for selection, and select one of the split disks as the data source. For example, a 16G USB flash disk can be divided into 3 data sources of 8G, 4G, and 4G. 4. Connecting the intermediate device to the computer device. Inserting the USB male interface of the storage device into the USB female interface of the intermediate device, inserting the USB male interface of the intermediate device into the USB female interface of the computer device, and using the USB interface of the computer device to supply power for the intermediate device and the storage device. FIG. 19 shows several scenarios: Scenario 1: The computer device and the storage device are connected through an intermediate device, and the intermediate device isolates the computer device and the storage device. The product form of the intermediate device corresponding to the scenario 1 may be a hardware device similar to an interface converter as shown in FIGS. 2a, 2b or 18a. Scenario 2: The product form of the intermediate device is a card reader, which is used to connect card and chip storage devices (such as SD card). The card reader has a control function and a protection function. The control function and the protection function can be integrated in one chip in the form of pure software, or they can be two independent chips in the card reader. Scenario 3: The storage device has a protection module and built-in at least one or more storage chips (or memory chip), as well as an interface for connecting at least one or more external storage devices (such as a TF Card interface for accessing SD cards, TF cards, the USB interface is used to access the USB flash disk, etc.). Wherein, the protection module can be in the form of an independent chip (such as scenario 4), or it can be configured on the control chip of the storage device in the form of pure software similar to scenario 5, or it can be configured on the storage chip, etc., in the form of pure software in scenario 6, which are not limited in this embodiment. If a storage device is connected to the external storage interface, the protection module can switch the physical data source as required, such as selecting an external storage device or a storage chip (or memory chip). Scenario 4: The protection module is part of the hardware of the removable storage device, but exists independently in the form of a protection chip inside the hardware. For example, an ordinary removable storage device can be transformed into the device of the present application through hardware upgrade. Scenario 5: The protection function of the data security protection method is integrated in the control chip in the form of software, that is, the protection module is in the form of software. For example, an ordinary removable storage device can be transformed into the device of the present invention by upgrading the software (firmware) of the control chip and installing external button switches. Scenario 6: The protection module is directly used as a part of the storage chip, and in terms of thinking, it can be protected according to the software and hardware methods of Scenario 4 and Scenario 5. At present, there are storage chips with protection functions, such as SD cards that can be set to be read-only. Scenario 7: The protection function of the data security protection method is integrated in the control chip in the form of software, that is, the protection module is in the form of software. The difference from Scenario 5 is that the data storage device does not have a control chip, and all read / write operations are directly completed by the control chip. What needs to be added here is: one of the protection modes mentioned above is the logical split disk mode. In the logical split disk mode, the protection module will determine the logical split disk connected to the computer device based on the current protection mode (that is, logical data source). For the above scenario 3, the protection module is arranged at the first storage device, and the first storage device is provided with at least one or more storage chips and interfaces for connecting at least one or more external second storage devices, and at least part of the interfaces on the first storage device are connected with the external second storage device; correspondingly, at least one data source specified by the current protection mode of the protection module may include but not limited to: at least one physical data source in the at least one or more storage chips, the external second storage device connected to at least part of interfaces on the first storage device; and / or at least one logical split disk of the at least one or more storage chips; and / or at least one logical split disk in the external second storage device connected to the first storage device. It is mentioned above that the interaction process between the computer device and the protection module in the technical solutions provided by the various embodiments of the application may include but not limited to: preparation phase, enumeration phase and data interaction phase. Referring to FIGS. 20a and 20b, the basic operating logic of the protection module can be briefly summarized as follows: The first phase, the physical storage data source (storage device) connection phase. According to selecting the physical data source, and establishing the physical connection. If the protection module is an intermediate device, establishing a communication connection with the storage device. If the storage device is an SD card, TF card, built-in memory chip, etc., establishing a communication connection according to its interface (such as SDIO, SPI, HSPI, etc.). If the storage device is a USB flash disk, the protection module establishes a communication connection according to its USB interface. If the storage device is a hard disk, etc., the protection module performs connection according to its SATA, M.2 and other interfaces. The second phase, a phase that the protection module reads the physical storage data source (storage device), which is the preparation phase mentioned above. During the preparation phase, storage devices can be pre-analyzed. One situation is: the intermediate device has a protection module, and the computer device and the storage device are connected through the intermediate device; in this case, the protection module reads and analyzes the data of the storage device. Another situation is: the storage device is integrated with a protection module, and at this time, there is no need to read, and it is sufficient to directly analyze the data of the storage device. As in the corresponding embodiment above, the data information of the storage device is analyzed. More specifically, the first is to read the descriptor. For example, when the protection module is an intermediate device and the physical data source is a storage device with a USB interface, read the device descriptor, configuration descriptor, interface descriptor, port descriptor and string descriptor of the storage device, and judge whether it is a legal device type, for example, mass storage device hardware type. The second is to read the storage information related parameters of the storage device. For example, when the physical data source is a USB device, SD card, TF card, built-in memory chip, etc., read the storage space capacity (or available sector size), read-write permissions, etc. The third is, if the protection mode is the logical split disk mode, the sector offset relationship is established according to the storage space. The fourth is, when the protection mode involves the file system, further read the relevant storage space data, such as when being the specific-folder readwrite, obtain the address of the first sector of the root directory and the address of the first sector of the specific folder. For example, when the protection mode is a specific file mode, according to the rules of the file system, search for relevant data for mapping, such as the address of the first sector of the specific folder of the storage device (or create a new blank folder), the address of the root directory (first directory), and so on. When the first phase and the second phase are completed, and the device type of the device connected to the protection module is a device type that is allowed to be accessed, the preparation step is successful, and the interface sends an enumeration signal to the computer device to enter the enumeration phase. As shown in FIG. 20a, the device type of the storage device is determined based on the data information of the storage device. This step is unique to the connection between a computer device and a storage device through an intermediate device with a protection module. That is, in a specific embodiment of the present application, when the target device is an intermediate device, the protection method provided in the present application may further include: in the preparation phase, the target device reads and analyzes the data information of the storage device. If the target device is a storage device, the method may further include: in the preparation phase, the protection module analyzes data information of the storage device. Referring to FIG. 20a, when the computer device provides a power supply signal to the protection module or the protection module starts, the preparation phase can be entered. If the target device is an intermediate device, "the target device reads the data information of the storage device" in the corresponding above steps may include: in the preparation phase, the protection module simulating the computer device to send a control instruction to the storage device; receiving the data information of the storage device fed back by the storage device. In a specific implementable technical solution, "analyzing data information" may include: based on the data information, determining whether the storage device is a device type specified by the current protection mode; if so, sending a signal that enumeration is possible to the computer device to enter the enumeration phase. The third phase, the enumeration phase. 3.1. In the enumeration phase, based on the current protection mode, processing the data information of the storage device to obtain the processed information; 3.2. Sending the processed information to the computer device so as to establish the communication connection between the computer device and storage device. Wherein, 3.1 "based on the current protection mode, processing the data information of the storage device to obtain the processed information" may specifically include: 3.1.1. According to the current protection mode, processing the data information to generate a second characteristic parameter simulating the storage device; and / or 3.1.2. According to the current protection mode, processing the data information to generate second storage information related parameters simulating the storage device; 3.1.3. Sending the second characteristic parameter and / or the second storage information related parameters to the computer device, so as to establish the communication connection between the computer device and the storage device. During implementation, the above-mentioned 3.1.1 may specifically include: obtaining a preset parameter template corresponding to the current protection mode; according to the device type of the storage device reflected by the first characteristic parameter in the data information, obtaining at least one parameter item that can characterize the device type device from the preset parameter template to obtain the second characteristic parameter; or using the screening strategy corresponding to the current protection mode to screen the parameter items of the first characteristic parameters, and obtaining the second characteristic parameter based on at least one screened out parameter item. Wherein, the first characteristic parameter may include but not limited to: descriptor data; wherein, the descriptor data includes at least one of the following: hardware descriptor, interface descriptor, port descriptor, endpoint descriptor, string description character, etc. Further, the data information includes the first storage information related parameters, and the first storage information related parameters include but not limited to: the read-write status of a storage device, the total number of formattable blocks, the last logical block address, the number of bytes per sector, the maximum number of logical units, and device information. The above 3.1.2 may specifically include during implementation: 3.1.2a. According to the operation type specified by the current protection mode, modifying the read-write status parameter in the first storage information related parameters. In the example shown in FIG. 21, @ is the data packet returned by the protection module to the computer device, and @ is the status packet returned by the protection module to the computer device. Wherein, in the data packet, the protection module modifies the read-write status parameter of the storage device, such as changing the read-write status 0x00 parameter to: 0x80 (representing read-only). Alternatively, the protection module directly returns a read-only (i.e., write-protected) status to the computer device. What needs to be added here is that the protection module modifies the read-write status parameter during the data interaction process. This modification is located in the memory of the protection module, and does not modify the original read-write status parameters of the storage device, and the storage device does not need to have the modify permission to the read-write status parameters (for example, it is difficult to change the read-write status of an ordinary USB flash disk through modification). After the read-write status parameter is changed to the read-only (write-protected) status, the computer device "thinks" the storage device (such as a USB flash disk) as the read-only (write-protected) status, so that writing operations are prohibited in the man-machine interface. 3.1.2b. If the current protection mode is a logical split disk mode, modifying the total number of formattable blocks and / or the last logical block address in the first storage information related parameters according to the parameters of the target split disk that can be connected to the computer device specified in the current protection mode. In the example shown in FIG. 22, @ is the data packet returned by the protection module to the computer device, and @ is the status packet returned by the protection module to the computer device. Wherein in the data packet, the protection module modifies the total number of formattable blocks of the storage device, such as modifying 0x01 DE 20 00 to 0x00 EF 10 00. The example shown in FIG. 22 is the modification of the disk capacity parameters of the storage device by the protection module in the logical split disk mode. Similarly, without modification, the protection module executes and feeds back the data packet containing 0x00 EF 10 00 to the computer device. Wherein the total number of formattable blocks can be used to calculate the maximum formattable capacity. For example, the maximum formattable capacity = the total number of formattable blocks * the byte length of each block. What needs to be added here is: the example shown in FIG. 22 can be seen correspondingly to FIG. 14d. FIG. 22 is from the perspective of the data processing process, and FIG. 14d is from the physical perspective to explain the situation of the split disk 1. It can be seen that in the case of split disk 1, the total number of formattable blocks of the original 16G storage space is modified and returned to the computer, so that the computer "thinks" that the storage device is only 8G. Similarly, the protection module modifies during the data interaction process, and the modified data is only located in the memory of the protection module, and does not modify the original data of the storage device, and the storage device does not need to have the modify permission to the capacity information (for example, it is difficult to change the capacity information of an ordinary USB flash disk through modification). In addition, FIG. 23 shows an example of modifying the last logical block address. In the example shown in FIG. 23, @ is the data packet returned by the protection module to the computer device, and @ is the status packet returned by the protection module to the computer device. Wherein in the data packet, the protection module modifies the last logical block address of the storage device, such as modifying 0x01 DE IF FF to 0x00 EF OF FF. The example shown in FIG. 22 is the modification of the disk capacity parameters of the storage device by the protection module in the logical split disk mode. Similarly, without modification, the protection module feeds back the data packet containing 0x00 EF OF FF to the computer device. 3.1.2c. According to the current protection mode, modifying the device information in the first storage information related parameters to protect the private information of the storage device. FIG. 24 shows an example modifying the privacy information of the device. In the example shown in FIG. 24, @ is the data packet returned by the protection module to the computer device, and @ is the status packet returned by the protection module to the computer device. Wherein in the device privacy protection mode, the relevant vendor information strings, product information strings, product version information strings, etc. in the data packet can be changed to 00...00. Similarly, without modification, the protection module feeds back data packets of vendor information strings, product information strings, product version information strings, etc., that are 00...00 to the computer device. Referring to the enumeration steps shown in FIGS. 20a and 20b, the computer device sends a data interaction instruction to request the protection module to acquire the hardware characteristic parameter (i.e., corresponding to the first characteristic parameter of the storage device mentioned above). Specifically, the hardware characteristic parameter may include but not limited to: hardware descriptor, interface descriptor, port descriptor, endpoint descriptor, character string descriptor, and the like. Based on the data information obtained in the preparation phase, the protection module performs data processing on the first characteristic parameter in the data information in combination with the current protection mode, to obtain the second characteristic parameter and return the second characteristic parameter to the computer device. Further, the computer device continues to send data interaction instruction to request the protection module to acquire storage information related parameters of the storage device. Wherein the storage information related parameters may include but not limited to: read-write status of the device, the maximum formattable capacity and / or the total number of formattable blocks (not shown in the figure), the last logical block address, the number of bytes per sector, the maximum number of logical units, and the device information, and so on. Based on the data information obtained in the preparation phase, the protection module performs data processing on the first storage information related parameters in the data information in combination with the current protection mode, to obtain the second storage information related parameters and return the second storage information related parameters to the computer device. Referring to FIG. 20b, the enumeration phase can be further subdivided into: a sub-phase of establishing an interface connection and a sub-phase of reading storage device information. In the sub-phase of establishing an interface connection: 1. Access control, according to the preset access control rules, reading the descriptor data of the storage device (that is, the first characteristic parameter mentioned above), and judging whether the preset requirements are met. If the preset requirements are met, allowing the computer device to establish a connection with the storage device; otherwise, prohibiting the computer device from establishing a connection with the storage device. 2. Content modification, according to the content modification rules (such as 3.1.1 mentioned above), returning the modified or replaced descriptor data to the computer device. In the sub-phase of reading storage device information: 1. Access control, according to the preset access control rules, reading the storage information data of the storage device (i.e., the storage information related parameters mentioned above), and judging whether the preset requirements are met. If the preset requirements are met, allowing the computer device to establish a connection with the storage device; otherwise, prohibiting the computer device from establishing a connection with the storage device. 2. Content modification, according to the content modification rules (such as 3.1.2a to 3.1.2c mentioned above), returning the modified or replaced storage information data to the computer device. The fourth phase: the data interaction phase. Referring to FIG. 20a, the computer device sends a data interaction instruction (such as a read instruction) to the protection module, and the data interaction instruction may include: a read instruction and a sector address. If the sector address is prohibited from reading, the protection module does not send the data interaction instruction to the storage device. If the sector address complies with the rules (that is, readable), the sector address is modified to the sector address preset by the rules (such as logical split disk, specific folder read, etc.). The storage device returns data corresponding to the modified sector address (read data + read status). The protection module sends the data returned by the storage device to the computer device. Continuing to refer to FIG. 20a, the computer device sends a data interaction instruction (such as a write instruction) to the protection module, and the data interaction instruction may include: a write instruction, a sector address, and data to be written. If the sector address is prohibited from writing, the protection module does not send a data interaction instruction to the storage device. If the sector address complies with the rules (that is, writable), the sector address is modified to the sector address preset by the rules (such as logical split disk, specific folder read / write, etc.). If the current protection module is in the encryption write mode, it is necessary to encrypt the data to be written before writing to the position corresponding to the modified sector address. The storage device returns the write status. The protection module sends the write status returned by the storage device to the computer device. FIG. 20b is an illustration of the data interaction phase from three aspects. Referring to the embodiment shown in FIG. 2b, in the data interaction phase: judging whether the read / write sector address of the computer meets the preset requirements (as mentioned above, whether write is prohibited, read is prohibited, etc.) to perform access control. If the access control rules are met, the computer device is allowed to perform read / write operations on the sector address; otherwise, the computer device is prohibited from performing read / write operations on the sector address. Subsequently, address mapping is carried out, and according to the address mapping rule, that is, the sector address modification rule mentioned above, the data of the corresponding mapped sector address of the storage device is read / written, and the read data or write status is directly returned to the computer device. Alternatively, content modification can also be performed, that is, according to the content modification rules, the data of the corresponding sector address of the storage device is read / written and modified, and the read data or write status is returned to the computer device. Here is a specific example. After the computer device is allowed to establish a connection with the storage device, the process of enumerating and reading the storage device by the computer may include but not limited to the following: 1. The computer device reads sector 0 of the storage device, analyzes the data of the MBR or GPT sector or the boot sector of the file system, and obtains the sector address of the file system partition information; 2. Read the sector address of the file system partition information, and analyze the address of the first sector of the root directory (or called the first directory) according to the protocol of the file system; 3. According to the file system protocol, read the data corresponding to the sector address of the root directory; 4. Analyze the file and folder information corresponding to the root directory sector address; 5. Display the list of files and folders in the root directory in the computer device. FIGS. 28a to 28d illustrate examples of procedures of access control, respectively. FIG. 28a is a schematic diagram showing the control of "read instruction (single-sector read)", sector addresses, data packets, or statuses from the perspective of the data processing process. FIG. 28b shows a schematic diagram of the control of "read instruction (multi-sector sequential read)", sector addresses, data packets, or statuses from the perspective of the data processing process. FIG. 28c shows the control of "write instructions (single-sector write)", sector addresses, data packets, or statuses from a data processing perspective. FIG. 28d shows the control of "write instruction (multisector sequential writes)", sector addresses, data packets, or statuses from a data processing perspective. Specifically, as shown in FIG. 28a, the instruction (or instruction packet, CBW packet) sent by the computer device, taking the SCSI protocol as an example, 0x28 represents: READ (10) instruction, requesting to read the data corresponding to the sector address. The instruction also includes the operation sector address 00 00 00 00 and the number of operation sectors 00 01. The protection module combines the operation sector address 00 00 00 00 and the number of operation sectors 00 01. If it is judged that the read permission corresponding to the sector address is forbidden to read in the current protection mode, the actual read operation will not be performed, such as sector limit mode, logical split disk mode, etc. If the current protection mode of the protection module is logical split disk mode, specific file mode, blank file mode, etc., then adjust the actual operation sector address (such as the mapping method mentioned above). If the current protection mode of the protection module is combined with other modes or judgments, other modes, such as decryption read mode, abnormal judgment, etc., are triggered. As shown in FIG. 28a, when the protection module responds to the instruction sent by the computer device, it judges whether the data of the sector to be read by the instruction meets the requirements of the current protection mode, such as the file type defined in the file type restriction mode. The protection module can modify the entire block or word by word based on the current protection mode. The modification may not modify the original data of the sector, such as decryption read mode, file type restriction mode, etc. Furthermore, the protection module can also perform auxiliary modification on the data (or data packet, DATA packet) to be returned to the computer device based on other modes, such as modifying the root directory address in a specific file mode. In addition to returning data to the computer device, the protection module also returns status packets (or CSW packets). Specifically, it is possible to treat the byte a non-OxOO byte instead of the real packet, and directly return the status packet if without the operation permission to the operation sector address; or the non-real data packet shall be returned, and the status packet of the byte 0x00 shall be returned directly to cause the computer device to think that the read is successful. Referring to FIG. 28b, as shown in FIG. 28b, the instruction (or instruction packet, CBW packet) sent by the computer device, taking the SCSI protocol as an example, 0x28 represents: READ (10) instruction, requesting to read the data corresponding to the sector address. The instruction also includes the operation sector address 00 00 00 00 and the number of operation sectors 00 02. That is, FIG. 28b shows the control corresponding to the multi-sector continuous read instruction. The control process of the protection module is the same as that in FIG. 28a above, the only difference is that in FIG. 28b, in the process of continuous reading of multiple sectors, sector-by-sector operations can be performed. Referring to FIG. 28c, the instruction (or instruction packet, CBW packet) sent by the computer device, taking the SCSI protocol as an example, 0x2A represents: WRITE (10) instruction, requesting to write data into the sector address. In the whole-disk read-only mode, the instruction is not executed (that is, the instruction is prohibited). The instruction includes the operation sector address 00 00 08 D8 and the number of operation sectors 00 01. The protection module combines the operation sector address 00 00 08 D8 and the number of operation sectors 00 01. If it is judged that the write permission corresponding to the sector address is forbidden to write in the current protection mode, the actual write operation will not be performed, such as sector limit mode, logical split disk mode, etc. If the current protection mode of the protection module is logical split disk mode, specific file mode, blank file mode, etc., then adjust the actual operation sector address (such as the mapping method mentioned above). If the current protection mode of the protection module is combined with other modes or judgments, other modes, such as decryption read mode, abnormal judgment, etc., are triggered. As shown in FIG. 28c, when the protection module responds to the data packet (or DATA packet) sent by the computer device, it judges whether the sector to which the data is to be written the data meets the requirements of the current protection mode, such as the file type defined in the file type restriction mode, etc. The protection module can modify the entire block or word by word based on the current protection mode, such as encryption write mode, file type restriction mode, etc. The protection module also returns a status packet (or CSW packet) to the computer device. Specifically, it is possible to treat the byte a non-OxOO byte instead of the real packet, and directly return the status packet if without the write operation permission to the operation sector address; or the status packet of the byte 0x00 shall be returned directly to cause the computer device to think that the write is successful. Referring to FIG. 28d, the instruction (or instruction packet, CBW packet) sent by the computer device, taking the SCSI protocol as an example, 0x2A represents: WRITE (10) instruction, requesting to write data into the sector address. The instruction also includes the operation sector address 00 00 08 D8 and the number of operation sectors 00 02. That is, FIG. 28d shows the control corresponding to the multi-sector continuous write instruction. The control process of the protection module is the same as that in FIG. 28c above, the only difference is that in FIG. 28c, in the process of continuous writing of multiple sectors, sector-by-sector operations can be performed. To sum up, the advantages of the technical solutions provided by the various embodiments of the present application are: Advantage 1, in term of application scenarios Strong versatility, and it can protect common removable storage devices on the market, such as USB flash disk, USB CD-ROM, SD adapter, SD card, etc., and the protected devices have high compatibility. High feasibility, and the computer device can be protected without installing specific software, and the protection feasibility is high for the use of the storage device. Wide range of applications and can be widely used in devices in many scenarios such as intranet environments, industrial control devices, printer devices, and Internet of Things devices. It does not need to upgrade existing systems or software, and the drivers that come with the existing embedded devices or operating systems can be used to protect many computer device scenarios. Advantage 2, in term of security The protection module adopts the hardware parameter characteristics of the connected device according to the settings, and the malicious program of the computer device cannot discover the existence of the protection module and cannot restrict the access of the protection module. The software of the protection module is in the form of no operating system or firmware, and the protection module is privileged and cannot be tampered with or deleted. The protection method is at the bottom of the communication between devices, and malicious programs cannot bypass the protection measures. The protection process can be audited by logs, and all operation commands and data packets of computer device and storage device can be saved in the built-in storage of the protection module, and post-event auditing can be performed. The protection is durable and stable. The protection is controlled based on the underlying communication protocol. The protection function can be completed after the protection module leaves the factory, and there is no need for virus database upgrades and post-maintenance work. Advantage three, in term of protection mode The coverage of protection is wide, and the protection can be provided from the physical layer, communication layer, and file system layer; There are many protection methods, which can be divided into read-only, write-only or custom modes; The granularity of protection is fine, and protection can be carried out down to specific files, folders, or sector address ranges. The implementation of the specific protection mode: Specific implementation methods: basic protection, connected device type judgment. After the storage device is connected to the protection module and the protection module is connected to the computer device and powered on, the protection module simulates the control transmission instruction of the computer device through the USBO interface, and reads the device descriptor, configuration descriptor, interface descriptor, and endpoint description of the storage device. If the above-mentioned descriptor is obtained successfully, judgment is made according to the characteristics of normal mass storage devices (standard device types of storage devices such as USB flash disks and removable optical drives), such as the following judgment (judgment can have a single condition or a combination of conditions): 1.1. Determining whether the interface type of the device is "Mass Storage Class" (USB standard protocol, mass storage device type), specifically determining whether the 6th byte of the interface descriptor is 0x08 (mass storage device) 1.2. Determining whether the interface subclass of the device is "SCSI transparent command set" (SCSI transport protocol, which varies depending on the storage device), specifically determining whether the 7th byte of the interface descriptor is 0x06 (SCSI communication subclass) 1.3. Determining whether the interface protocol of the device is "Bulk Only Transport" (USB standard protocol, bulk transport protocol), specifically determining whether the 8th byte of the interface descriptor is 0x05 (bulk transport) 1.4. Determining whether all endpoints of the device are "Bulk" (bulk transport protocol in the USB standard protocol), specifically determining whether the 4th byte of the interface descriptor is 0x02 (bulk transfer). If it does not conform to the device descriptor characteristics of a mass storage device, the connected "storage device" may actually be a single-function input device such as a mouse and keyboard, or a device with a mouse and keyboard function and a mass storage function. In this case, the intermediate device terminates further communication with the storage device. At the same time, in the subsequent link, by generating a "virtual removable disk" device, the string drive name of the "abnormal device” is displayed in the operating system, and the text file of the original hardware parameter data of the "storage device" read is saved in the root file of the virtual mobile disk for analysis. In the case of conforming to the device descriptor of a normal mass storage device, by simulating the hardware parameters and characteristics of the removable storage device, the data read by the computer device from the protection module is completely consistent with the original removable storage device, and the computer device will not recognize the existence of intermediate devices, preventing malicious programs from intercepting intermediate devices. For example, as shown in FIG. 25, when a device is connected to USBO of the intermediate device, it is judged whether it conforms to the characteristics of a normal mass storage device, and if so, the hardware characteristics are obtained directly corresponding to the above-mentioned scenarios 3 to 6 in FIG. 19 parameters, and acquire the hardware characteristic parameters of the mass storage device corresponding to scenarios 1 to 2 in FIG. 19 above. Then, replace and fill the built-in device descriptor and configuration descriptor template with the vendor ID, device ID, string, etc. of the USBO device (that is, the storage medium); finally, connect the computer device to the USB1 end according to the hardware characteristic parameters to simulate that the USBO interface is connected with the device (that is, the storage medium). If not, terminate the communication with the storage device or storage medium; and display the drive letter to the computer device on the USB 1 port through the disk name of the "virtual disk", prompting that it is an abnormal device. Save the read text file of the original hardware parameter data of the "removable storage device" in the root directory of the "virtual disk"; the hardware initialization failed. FIG. 26a is a collated diagram showing the related technical points of the technical solutions provided by each embodiment of the present application. FIG. 26b is a collated diagram showing some effects brought about by adopting the technical solutions provided by each embodiment of the present application. FIG. 27 shows another specific example in which the Scenario 1 corresponds to the scenario of split disk of storage media. The computer device sends data interaction instructions to the intermediate device, such as sending an instruction to read data at address 0 with a read length of 512 bytes; an instruction to write data to address 1 with a data of 0x1212... (512 bytes) and the length of the write data is 512 bytes. After the intermediate device receives it, it converts the data interaction instruction operation sector address, for example, converts address 0 to 1000, address 1 to 1001, and operates on the sector corresponding to the converted address, such as returning the data in address 1000 and writing data to address 1001 ... (512 bytes). If the storage device with a protection module is connected to the computer device in Scenario 1, then the middle block may correspond to the protection module in the storage device, and the rightmost block in FIG. 27 is a storage device (such as a USB flash disk, a TF card, SD card, etc.) or storage media (such as a memory chip, memory chips, etc.). Scenario 2 corresponds to the scenario of split disk of storage media files. The computer device sends data interaction instructions to the intermediate device, such as sending an instruction to read data at address 0 with a read length of 512 bytes; an instruction to write data to address 1 with a data of... (512 bytes) and the length of the write data is 512 bytes. After the intermediate device receives it, it combines the address, the number of bytes per sector (for example, 512 bytes), and the calculation of the data length, and converts the operation sector address of the data interaction instruction into the address corresponding to the file data, such as converting to read / write operation on data of file U.dd. For example, address 0 is converted to the address of sector 0 of the file data U.dd, address 1 is converted to the address of sector 1 of the file data U.dd, and after conversion, the file data U.dd is operated, such as returning data of sector 0 address of the file U.dd, write data 0x1212... (512 bytes) to sector address 1 of file data U.dd. Similarly, if a storage device with a protection module is connected to the computer device in Scenario 2, then the middle block may correspond to the protection module in the storage device, and the rightmost block in FIG. 27 is a storage device (such as a USB flash disk, TF card, SD card, etc.) or storage media (such as storage chips, memory chips, etc.). Scenario 3 corresponds to the scenario of storage medium file splitting (networking). The computer device sends read / write interaction instructions to the intermediate device, such as sending an instruction to read data at address 0 with a read length of 512 bytes; an instruction to write data to address 1 with a data of 0x1212... (512 bytes) and the length of the write data is 512 bytes. After the intermediate device receives it, it combines the address, the number of bytes per sector (for example, 512 bytes), and the data length to calculate, and converts the address of the data interaction instruction operation sector into the address corresponding to the data of the server-side (or the server-side converts it according to the forwarded data interaction instruction is converted according to the preset rules), for example, it is converted into a read and write operation on the file data U.dd on the server side-side. For example, address 0 is converted to the address of sector 0 of the file data U.dd of the server-side, address 1 is converted to the address of sector 1 of the file data U.dd of the server-side, and after conversion, the file data U.dd of the server-side is operated, such as returning data of sector 0 address of the U.dd file of the server-side, write data 0x1212... (512 bytes) to sector address 1 of file data U.dd of the server-side. Similarly, if the storage device with a protection module is connected to the computer device in Scenario 3, then the middle block may correspond to a storage device with networking capability. Furthermore, the embodiment of the present application also provides a security control framework. According to read / write control of FIGS. 20a, 20b, 21 to 24 and FIG. 28a to FIG. 28d, according to the business scenario, allowed / prohibited control, edition / modification, etc., are performed on the data interaction instructions, data and status in the preparation phase, enumeration phase, and data interaction phase for the purpose of control. The security control framework is a protection module located between computer device and storage device. Different protection methods can be configured and switched according to actual conditions according to the needs of protection scenes (or business scenarios). In the preparation phase, enumeration phase, and data interaction phase, the information security protection of computer device, storage device or computer device and storage device is realized. At the same time, the protection scenes of the security control framework can be used alone or in combination based on the protection modes of the present invention, and new protection scenes (protection modes) can also be created according to actual needs; Multiple protection scenes can be combined at the same time, or another protection scene can be triggered by the protection scene. It should be noted that the protection method, protection mode and related embodiments of the present application can be configured and created based on the security control framework, or can exist independently according to the protection method. In a specific embodiment, the security control framework includes: a configuration module for configuring protection scene; a generation module for generating configuration information of the protection scene or software with the protection scene; wherein one protection scene corresponds to at least one protection mode; the configuration information or the software with the protection scene is deployed on a hardware device, so that the hardware device has function corresponding to the steps of the data security protection method herein. Further, during configuring protection scene, the configuration module is specifically configured for: configuring identification information of protection scene; configuring protection operation strategy corresponding to the protection scene. The above "configuring the protection operation strategy corresponding to the protection scene" may include but not limited to at least one or more of: configuring the protection operation strategy in the preparation phase under the protection scene; configuring the protection operation strategy in the enumeration phase under the protection scene; configuring the protection operation strategy in the data interaction phase in the protection scene. Still further, the security control framework provided in this embodiment may further include: a compiler module, configured to execute a corresponding software compiling strategy according to the configuration information to obtain security control software; wherein, the hardware device runs the security control software, so that the hardware device has functions corresponding to the steps in the data security protection method of any one of claims 1 -44. Of course, the security control framework may not have a compiler module. The configuration information of the protection scene can be imported to the hardware device (such as a new type of USB flash drive or the intermediate device shown in FIG. 2a, etc.), the hardware device has the ability to compile, and executes the corresponding software compilation strategy according to the configuration information to generate security control software (or can become a security control program) so as to implement the functions corresponding to the protection modules mentioned in the above embodiments. Specifically: 1. Configuring a protection scene The configuration of a protection scene includes: (1) Protection scene information, such as name, number, binary value, etc., used as the unique identification for selecting protection scene; still such as remark information, string information, etc., used for the management of scene data, etc. (2) Strategies for configuring protection operation, including at least one or more of the following combinations: 1. Strategies in the preparation phase. The protection module reads the storage device, and obtains the data required for the protection scene through extraction, analysis, modification and other methods. Configure data interaction instructions to the connected storage device in the preparation phase (equivalent to which data interaction instructions the protection module sends to the storage device) used to request data from or write data to the storage device. Configure the judging, modifying, or responding scheme that matches the data returned by the storage device (equivalent to what to do further with the data returned by the matched storage device). Strategies in the preparation phase may include, but are not limited to: a data interaction instruction sending strategy, a data interaction instruction execution result strategy, and the like. (1) Configure the data interaction instruction sending strategy. Set at least one or more data interaction instructions for simulating computer-controlled storage devices. Data interaction instructions include but are not limited to: USB standard requests (such as obtaining device descriptors, configuration descriptors, interface descriptors, port descriptors, string descriptor requests, etc.), class special requests (such as Bulk-Only Mass Storage Reset, Get Max LUN request, etc.), SCSI command set and UFI command set request (such as INQUIRY request, READ FORMAT CAPACITIES request, READ CAPACITY request, READ(10) command, WRITE(IO) command, etc.), and custom requests or commands, etc. (2) Configure the matched data interaction instruction execution result strategy. Set the byte value used to identify at least one or more data-specific positions of the data returned by the execution result of the data interaction instruction, and bind the matched treatment strategy. Data interaction instruction execution result data includes but is not limited to: USB standard request return data (such as device descriptor, configuration descriptor, interface descriptor, port descriptor, string descriptor, etc.), class special request return result (such as the maximum number of LUNs etc.), SCSI command set and UFI command set request (such as the total number of formattable blocks, the last logical block address, the number of bytes per sector, the data and status read from the sector position, the status of the written data in the sector position, etc.), and custom requests or commands, and so on. Treatment strategies include: (T) Judgment of Data Yes / No. Preset data interaction instruction rules and send them, and judge the data of at least one or more specific positions (such as byte values at specific positions) of the preset returned data, and perform operation A if the preset is met, and perform operation B if the preset is not met. For example, in the hardware type access protection mode (protection scene), it is possible to judge whether the access requirements are met by reading data such as descriptors, and disconnect the communication with the storage device when it is not met; when met, a signal indicating that enumeration can be performed is sent to the computer device. @Data modification\save. Preset data interaction instruction rules, and realize modification and saving of at least one or more specific positions (such as byte values at specific positions) of the preset returned data. For example, in the data information protection mode of the storage device or the device privacy protection mode (protection scene), data such as descriptors can be read and modified and saved in the protection module. @Data extraction\analysis. Preset data interaction instruction rules and send them, and realize context analysis on the data returned by at least one or more data interaction instructions, and extract or calculate the final value. For example, in specific file mode, file type restriction mode, manual confirmation mode and other modes (protection scenes), the sector address range of the root directory or related files can be analyzed by reading the data of the file system. @Data writing. Preset the rules of data interaction instructions and send them, and realize writing preset data to specific sector addresses in combination with data extraction\analysis results. For example, in the blank file mode, the data related to the file item is written in the address space of a specific sector to realize the purpose of automatically creating a folder. 2. Strategies in the access phase. The computer device establishes a communication connection with the protection module (enumeration of the computer host) to prepare for data interaction. Configure the data interaction instructions for the matching access phase (equivalent to which interaction instructions need to be responded to), and configure the judgment, modification or response plan when the matching result is met (equivalent to what to do further when the data interaction instruction is matched). (1) Configure the data interaction instruction matching strategy sent by the computer device: set at least one or more bytes values of data specific positions for identifying the data interaction instruction, and bind the matched processing strategy. Data interaction instructions include instruction data and data packet data, such as instruction request packets and reply data packets. When reading the data of the data interaction instruction, judge the byte value of at least one or more data positions, and execute the bound processing strategy when the data interaction instruction matches the matching item. The judged data interaction instruction is: configuring a request for establishing a connection sent by the computer device. For example, USB standard requests, and data interaction instructions for obtaining device descriptors, configuration descriptors, interface descriptors, port descriptors, string descriptors, or other custom descriptors. Specifically, for example, the USB standard request data has 8 bytes in total and is divided into 5 parts. Standard request data Oth Byte 1 st Byte 2nd - 3rd Byte 4th - 5th Byte 6th -75th Byte Data item name RequestType Request Value Index Length Example Data 0x80 0x60 0x00 0x01 0x00 0x00 0x12 0x00 According to the rule of the USB standard request, when the Request (1st byte position) is 0x06, it is to obtain the device descriptor. For this reason, it can be judged whether the first byte position is 0x06, and when it matches, execute the processing strategy bound to the request for device descriptor. USB standard requests (such as obtaining device descriptors, configuration descriptors, interface descriptors, port descriptors, string descriptors, etc.) or non-standard requests (obtaining custom descriptors, etc.) and so on. (2) Configure the matched data interaction instruction execution result strategy. (T) Judgment of whether or not the instruction is executed. Preset data interaction instruction rules and realize selection of performing operation A or selection of performing operation B. For 104 example, when the data interaction instruction is a request for a device descriptor, the device descriptor data is returned; when the data interaction instruction does not meet, no data is returned. @ Reply of data being not modified\modified\replaced. Preset data interaction instruction rules, and realize the return of the original data of the storage device, or the data modified by the preset rules, or the preset fixed replacement data. For example, in the data information protection mode (protection scene) of the storage device, return data information protection mode or device privacy protection mode (protection scene) and other modes, the data such as the modified or replaced descriptor; in the read-only mode (protection scene)) and other modes, modify the readwrite status information (as shown in FIG. 21); in the logical split disk mode (protection scene) and other modes, modify capacity-related information (as shown in FIG. 22 and FIG. 23). (4) Perform data read / write operations on storage devices and storage media. Preset data interaction instruction rules, and realize preset read / write operations on storage devices. For example, when receiving a preset data interaction instruction (a data interaction instruction that may be dangerous), the read / write operation to the sector data of the storage device is prioritized to protect the data in advance. @ Perform the trigger to start the protection mode. Preset data interaction instruction rules and realize operation of starting the protection mode. For example, when receiving a preset data interaction instruction (a data interaction instruction that may be dangerous), the backup mode is started to prevent data from being destroyed; log recording is started to save the log information of the data interaction instruction. @ Perform the operation of disconnecting the computer device. Preset data interaction instruction rules and realize operation of disconnecting computer device. For example, when receiving a preset data interaction instruction (a potentially dangerous data interaction instruction), the computer device is disconnected. @Perform virtual storage media operations. Preset data interaction instruction rules and realize connection to virtual storage media in the data exchange phase. For example, when receiving a preset data interaction instruction (a data interaction instruction that may be dangerous, or a device type that is prohibited from being connected), in the subsequent data exchange phase, the data operation is connected to the virtual storage medium (not storage medium for real data) to respond, wherein the virtual storage medium can be a "virtual disk" with relevant reminder information, or a "virtual disk" in the form of a common storage medium. @Perform the trigger of selecting the data source. Preset data interaction instruction rules and realize selection of storage devices, storage media or logical disk partitions. For example, when receiving a preset data interaction instruction, a preset storage device, storage medium or logical split disk is selected as an access data source. 3. Strategies in the data interaction phase. The data exchange between the computer device and the protection module is mainly that the computer device sends data exchange instructions related to read / write sector addresses to the protection equipment. Configure the data interaction instructions used to match the data exchange phase (equivalent to the response to the read / write data interaction instructions or other data interaction instructions used in the data exchange phase), and configure the judgment, modification or response plan when the matching results are met (equivalent to what to do further for the matched data exchange instructions (read / write, etc.). (1) Configure the data interaction instruction matching strategy sent by the computer device: set at least one or more byte values of data specific positions (or parameters) for identifying the data interaction instruction, and bind the matched processing strategy. Data interaction instructions include instruction data, data packet data and status packet data, such as read instruction and replied data packet, replied status packet; write instruction, written data packet and replied data packet. The judged data interaction instruction mainly corresponds to byte values of at least one or more specific data positions (or parameters). As all the data of @@(3) or @@@@ in FIGS. 28a-28d. For the instruction (T) (instruction (instruction package) (CBW package) sent by computer device), according to different scenarios, mainly judge the total number of bytes transmitted, the direction of transmission, the LUN operated, the length of the instruction block, the operation instruction code, and the operating LUN, operation sector address, operation sector number. For one or more data packets, judge the byte value of a specific position, or multiple byte values or hash values of a specific data range according to different scenarios. For the status packet, it mainly judges the number of remaining bytes and the error code executed. Referring to FIGS. 28a-28d. FIG. 28a shows a schematic diagram of controlling the sector address, data packet or status of the "read instruction (single sector read)" from the perspective of data processing. FIG. 28b shows a schematic diagram of the control of "read instruction (multisector sequential read)", sector addresses, data packets, or statuses from the perspective of the data processing process. FIG. 28c shows the control of "write instructions (single-sector write)", sector addresses, data packets, or statuses from a data processing perspective. FIG. 28d shows the control of "write instruction (multi-sector sequential writes)", sector addresses, data packets, or statuses from a data processing perspective. The CBW, DATA, CSW, and operation instruction codes involved in the data processing process shown in FIGS. 28a-28d above all belong to the SCSI protocol. FIG. 29 is a schematic diagram showing the connection of a computer device, a protection module, and a storage device (such as a USB flash disk, a memory card, or a memory chip). As for the connection between the protection module and the storage device, the only difference is the interface and protocol, which are essentially the principle of "intermediate device or card reader". Including our existing USB flash disk, removable hard disk, etc., they are actually just card readers with built-in storage chips. The technical logic is that the control chip converts the received SCSI instructions into SDIO or SPI instructions that can read / write storage media, and operate the data of the storage medium. However, if the control and storage are separated, such as USB flash disk and card reader, the intermediate device needs to obtain the storage information in advance in the preparation phase. For the USB flash disk of USB interface, further judgment on the descriptor is needed to determine the device type (simple mass storage device type) of USB flash disk and ensure that there are no functions such as HID. If control and storage are integrated together, for example, for the new USB flash disk according to the present invention, the storage information is fixed in advance, and there is no need to obtain it during the preparation phase. However, if it is in the logical split disk mode, the capacity information needs to be modified, and if it is in the specific folder read / write mode, the file address also needs to be read. (2) Configure the matched data interaction instruction execution result strategy. (T) Judgment of whether or not the instruction data is executed. Preset data interaction instruction rules and realize judgment such as selecting to perform operation A or selecting to perform operation B. For example, in the read-only mode (protection scene) and other modes, when the computer device sends a data interaction instruction to write data (for example, the operation instruction code is 0x2A (write data)), the protection module does not perform the write operation. For example, in modes such as sector limit mode (protection scene), when the computer device sends data interaction instructions to operate sector address in restriction of the preset read / write only, the protection module does not perform corresponding operations. @ Instruction data modification / replacement. Preset data interaction instruction rules and realize modification or replacement of instruction data, and then send the instruction data to the storage device. For example, in the logical split disk mode, the specific file mode, and the blank file mode, modify the operation sector address and read / write the corresponding storage device sector address according to the preset. @ Judgment of whether or not the data packet is forwarded. Preset data packet rules and realize judgment such as selecting to perform operation A or selecting to perform operation B. For example, in file-limited read-write mode, keyword comparison rules can be preset, the contents of the packet hit the rules are forwarded or not forwarded to a computer device or storage device. @Packet data modification / replacement. Preset data packet rules and realize modification or replacement of data packet data, and then send the data packet to the computer device\or storage device. For example, in the encryption write or decryption read mode, the data packet data is modified according to preset rules, and then forwarded to the computer device\or storage device. For example, in the sector limited read / write mode, according to the preset rules, when the sector address read by the computer device does not meet the preset rules, directly return the preset data packets for replacement (such as blank data packets). @ Judgment of whether or not the status packet is forwarded. Preset data packet rules and realize judgment such as selecting to perform operation A or selecting to perform operation B. For example, when it is judged that when the status error code is not 0x00, whether to forward the status packet to the computer device. @ Modification / replacement of status packet data. Preset data packet rules and realize modification or replacement of status packet data, and then send the status packet to the computer device\or storage device. For example, in the sector limited read / write mode, according to the preset rules, when the sector address read by the computer device does not meet the preset rules, directly return the preset status packets for replacement (such as a packet that is not 0x00 error status). @ Perform data read / write operations on storage devices and storage media. Preset data interaction instruction judgment rules, and realize preset read / write operations on storage devices. For example, when receiving a preset data interaction instruction (e.g., a data interaction instruction and a data packet or a status packet that may be dangerous), the read / write operation to the sector data of the storage device is prioritized to protect the data in advance. @ Perform the trigger to start the protection mode. Preset data interaction instruction judgment rules and realize operation of starting the protection mode. For example, when receiving a preset data interaction instruction (e.g., a data interaction instruction and a data packet or a status packet that may be dangerous), the backup mode is started to prevent data from being destroyed; log recording is started to save the log information of the data interaction instruction. @ Perform the operation of disconnecting the computer device. Preset data interaction instruction judgment rules and realize operation of disconnecting computer device. For example, when receiving a preset data interaction instruction (e.g., a data interaction instruction and a data packet or a status packet that may be dangerous), the computer device is disconnected. @Perform the trigger of selecting the data source. Preset data interaction instruction judgment rules and realize reselection of storage devices, storage media or logical disk partitions. For example, when receiving a preset data interaction instruction (e.g., a data interaction instruction and a data packet or a status packet that may be dangerous), reselect a preset storage device, storage medium or logical split disk, or a virtual storage medium (non-real data storage medium), and disconnect the device to re-enumerate as the access data source. 2. Generating configuration information of the protection scene or software with the protection scene Protection scenario information and protection operation strategies for the above configurations: On the one hand, configuration information can be generated. Generate export configuration information and share it through data transmission (e.g., network transmission, point-to-point transmission, copy and paste), etc. The configuration information can be further modified according to different usage scenarios. The configuration information can be imported into the security control framework software or the security control framework hardware device, and the security control framework executes the corresponding security control strategies. On the other hand, software (or firmware) can be generated. In the software or hardware device of the security control framework, the corresponding software compilation strategy is executed according to the configuration information written by itself or imported from the outside, and generate security control software (or firmware) for the protection scenarios in the configuration information. By running the security control software (or firmware) on the operating system or hardware device, the corresponding security control strategy is executed. 3. Execute protection scene security control Security control software (or firmware) or security control framework software (or firmware) becomes a protection module, which runs on operating systems, hardware devices, control chips, memory chips and other devices. In the preparation phase, according to the configuration of the protection scenario, data interaction instructions are sent to the storage device. In the enumeration phase and the data interaction phase, according to the current protection scene (protection mode) of the protection module, the permission control is performed on the data interaction instruction sent by the computer device, and the data interaction instruction is used for the computer device to perform data interaction with the storage device; Respond to the data interaction instruction if the data interaction instruction satisfies the permission requirement corresponding to the current protection mode. In addition, another embodiment of the present application provides an intermediate device. The intermediate device comprises: a first port for connecting a computer device; a second port for connecting a storage device; an interaction module comprising at least one of the following: a touch screen, a voice interaction device, a plurality of buttons, a slide switch (or an interaction control with at least two selections); and a protection module which is connected between the first port and the second port and is used for implementing the steps of the data security protection method provided in the above embodiment. Another embodiment of the present application provides a device system, which comprises: a computer device, a storage device and an intermediate device provided by the above embodiment. Another embodiment of the present application provides a storage device, which comprises: a first port for connecting a computer device; a protection chip for implementing the steps of the data security protection method provided in the embodiment; a control chip connected with the first port through the protection chip; a storage chip connected with the control chip, which is used for performing storage management on data in storage space under the control of the control chip. Another embodiment of the present application provides a storage device, which comprises: a first port for connecting a computer device; a control chip on which a protection module is deployed for implementing the steps of the data security protection method provided in the above embodiment; a storage chip connected with the first port through the control chip, which is used for performing storage management on data in storage space under the control of the control chip. Still another embodiment of the present application provides a storage device. The storage device comprises: a first port for connecting a computer device; a control chip connected with a first port, which is used for generating corresponding control instructions based on the data interaction instructions sent by the computer device; a storage chip connected with the control chip; wherein, a protection module is deployed on the storage chip for processing control instructions sent by the control chip by adopting the steps of the data security protection method of the above embodiment. In order to implement the data security protection method corresponding to the above method embodiment, to achieve corresponding functions and technical effects. Referring to FIG. 30, which is a structure diagram of the data security protection module shown in an embodiment of the present application. For ease of illustration, only the parts related to this embodiment are shown. The data security protection module provided by application can be applied to a target device, the target device is provided with a protection module comprising at least one protection mode for controlling read / write permission of a computer device on a storage device, wherein the device comprises: a control unit 1301 configured for controlling the permission of the data interaction instruction sent by the computer device according to the current protection mode of the target device, wherein the data interaction instruction is used for data interaction between the computer device and the storage device; a response unit 1302 configured for responding to the data interaction instruction if the data interaction instruction meets permission requirement corresponding to the current protection mode. In some embodiments, the device further includes: an identification unit configured or identifying a device type of the first interface if a communication connection request between the computer device and the storage device is detected; an establishing unit configured for establishing a communication connection between the computer device and the storage device if the device type is a preset permissible communication type In some embodiments, if the target device is an intermediate device with a protection module, the intermediate device is provided with a first interface for connecting a storage device and a second interface for connecting a computer device; The device further comprised: a first detection unit configured for detecting the communication connection request between the computer device and the storage device when the first interface is connected to the storage device, and the second interface is connected to the computer device. In some embodiments, the device further comprises: an interrupt unit configured for interrupting the communication connection request if the device type is a preset prohibited communication type. In some embodiments, the establishing unit comprises: a sending subunit configured for sending target hardware characteristic parameters of the storage device to the computer device, wherein the target hardware characteristic parameters are used to establish a communication connection between the computer device and the storage device. In some embodiments, the sending subunit is specifically configured for: obtaining a target hardware characteristic parameter corresponding to the device type from a preset parameter template according to the device type of the storage device; sending the target hardware characteristic parameter to the computer device. In some embodiments, the sending subunit is further configured for: obtaining hardware characteristic parameters of the storage device; screening the hardware characteristic parameter according to the preset parameter type, so as to determine the target hardware characteristic parameter corresponding to the parameter type; sending the target hardware characteristic parameter to the computer. In some embodiments, the control unit 1301 comprises: an identification subunit configured for identifying the instruction type of the data interaction instruction; a determining subunit configured for determining that the data interaction instruction meets the permission requirements corresponding to the current protection mode if the instruction type is a preset instruction type corresponding to the permission requirement. In some embodiments, the protection mode is the read-only mode, the device further comprises: a return unit configured for returning a read-only parameter to the computer device in response to the parameter read request sent by the computer device, wherein the read-only parameter is used to cause the computer device to identify the storage device as a read-only device. In some embodiments, the response unit 1302 comprises: a response subunit configured for performing read / write operation on the target file in the storage device in response to the data interaction instruction, wherein the read / write operation include at least one of a read operation and a write operation. In some embodiments, if the protection mode is the whole-disk read-only mode, the response subunit is specifically configured for: feeding back the third target data to the computer device in response to the data interaction instruction, wherein the data interaction instruction is a read instruction, and the third target data is data returned by the storage device in response to the read instruction. In some embodiments, if the protection mode is a specific file read-write mode, the response subunit is specifically configured for: mapping the sector address of the target file to the target address in response to the data interaction instruction, wherein the target file is a file displayed on the computer device; performing read / write operation on the target file based on the target address. In some embodiments, the target file includes an existing specific file or preset file of the storage device, or a file automatically generated before the computer device establishes a communication connection with the storage device. In some embodiments, if the protection mode is an address-limited read-write mode, the response subunit is specifically configured for: verifying the target sector address corresponding to the data interaction instruction in response to the data interaction instruction and based on a preset sector address range, the target sector address is a sector address that the storage device executing the read / write operation based on the data interaction instruction; performing read / write operation at the target sector address of the storage device if the target sector address is within the preset sector address range. In some embodiments, when the protection mode is a file-restricted read-write mode, the response subunit is specifically configured for: in response to the data interaction instruction, based on the preset file characteristics, verifying the target file characteristics corresponding to the data interaction instruction, and the target file characteristics are corresponding to when the storage device performs read / write operation based on the data interaction instruction, file characteristics; if the characteristic of the target file conforms to the characteristic of the preset file, read / write operation is performed on the target file in the storage device. In some embodiments, the response subunit is specifically configured for: if the characteristic of the target file does not conform to the characteristic of the preset file, hiding operation is performed on the target file. In some embodiments, the preset file characteristic includes a first hash value corresponding to preset sector data in the file; the response subunit is specifically configured for: calculating a second hash value of the preset sector data in the target file; determining that the target file characteristic conforms to the preset file characteristic if the second hash value is consistent with the first hash value; determining that the target file characteristic does not conform to the preset file characteristic if the second hash value is inconsistent with the first hash value. In some embodiments, if the protection mode is the encryption write mode, the response subunit is specifically configured for: encrypting the data to be written carried by the data interaction instruction to obtain the first target data in response to the data interaction instruction; writing the first target data to the target file in the storage device. In some embodiments, if the protection mode is the encryption write mode, the response subunit is specifically configured for: feeding back second target data to the computer device in response to the data interaction instruction, where the second target data is data obtained by decrypting the data returned by the storage device in response to the data interaction instruction. In some embodiments, if the protection mode is a manual confirmation mode, the response subunit is specifically configured for: prompting the user whether to confirm execution of the data interaction instruction in response to the data interaction instruction; performing read / write operation on the target file in the storage device if a confirmation execution instruction of the data interaction instruction is received. In some embodiments, the response subunit is specifically configured for: performing abnormal verification on the read / write operation based on preset read and write rules; determining that the read / write operation is abnormal if the read / write operation does not comply with the preset read and write rules. In some embodiments, the device further includes: a first connecting unit configured for connecting a target sector range to the computer device as a storage data source, the target sector range is obtained by dividing the storage space of the storage device, and the storage data source includes the target file. In some embodiments, the device further includes: a first read unit configured for reading sector information of the storage device; a dividing unit configured for dividing the storage space of the storage device based on the sector information to obtain a plurality of sector ranges corresponding to the storage device, wherein the target sector range is at least one of the plurality of sector ranges. In some embodiments, the device further includes: a second connecting unit configured for connecting an image file to the computer device as the storage data source, and the image file is generated based on a preset mirroring policy. In some embodiments, the storage device is a networked storage device which is connected to a server-side, and the server-side contains a plurality of networked image files, and the device further comprises: a third connecting unit configured for connecting the target networked image file as a storage data source to the computer device, wherein the target networked image file is at least one of a plurality of the networked image files, and the storage data source contains the target file. The device further comprises: a verification unit configured for connecting a target storage data source corresponding to the instruction type of the verification instruction to the computer device in response to a verification instruction input by the user, wherein the target storage data source is at least one of a sector range, an image file, and a networked image file. In some embodiments, the device further comprises: a second read unit configured for reading the power demand information of the storage device; a configuration unit configured for configuring a circuit protection strategy of the storage device according to the power demand information, wherein the circuit protection strategy is used to control the power consumption status of the storage device. In some embodiments, the device further comprises: a generation unit configured for generating an interaction log which is used to record processing records of the data interaction instruction sent by the computer. The above-mentioned data security protection module can implement the steps of the data security protection method provided in the embodiments. The options in the above method embodiments are also applicable to the present embodiment, and are not described in detail here. The contents of the above-mentioned method embodiments may be referred to for the rest of the embodiments of the present application, and in the present embodiments, they will not be repeated. FIG. 31 is a structure diagram of the target device provided by an embodiment of the present application. As shown in FIG. 31, the target device 14 of this embodiment includes: at least one processor 140 (only one is shown in FIG. 14), a memory 141, and a computer program 142 stored in the memory 141 and can run on the at least one processor 140, wherein when the processor 140 executes the computer program 142, the steps in any of the above method embodiments are implemented. The target device 14 may be an intermediate device or a storage device with a protection module. The target device may include, but not limited to, a processor 140 and a memory 141. Those skilled in the art can understand that FIG. 31 is only an example of the target device 14, and does not constitute a limitation on the target device 14. It may include more or less components than those shown in the FIG., or may combine certain components, or different components, for example, may also include input and output devices, network access devices, and so on. The processor 140 may be a Central Processing Unit (CPU), and the processor 140 may also be other general-purpose processors, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A generalpurpose processor may be a microprocessor, or the processor may be any conventional processor, or the like. The storage 141 may be an internal storage unit of the target device 14 in some embodiments, such as a hard disk or memory of the target device 14. The memory 141 may also be an external storage device of the target device 14 in other embodiments, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a Flash Card, etc., equipped on the target device 14. Further, the storage 141 may also include both an internal storage unit of the target device 14 and an external storage device. The memory 141 is used to store operating systems, application programs, bootloader programs (BootLoader), data and other programs, such as program codes of the computer programs. The memory 141 can also be used to temporarily store data that has been output or will be output. In addition, an embodiment of the present application further provides a computer-readable storage medium on which computer programs are stored, wherein when the computer programs are executed by a processor, the steps in any of the above method embodiments are implemented. An embodiment of the present application provides a computer program product, and the steps of the above method embodiments are implemented by a target device when the computer program product is running on the target device. In the several embodiments provided by the present application, it can be understood that each block in the flowchart or block diagram may represent a module, a program segment or a part of codes, and the module, program segment or part of codes comprises one or more executable instructions for implementing specified logical functions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the FIGS. For example, two blocks in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved. If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application may be embodied in the form of a software product in essence, or the part that contributes to the prior art, or part of the technical solution, which is stored in a storage medium and includes instructions to enable a target device to perform all or part of the steps of the method described above in each embodiment of the present application. The aforementioned storage medium comprises: USB flash drive, removable hard disk, Read-Only Memory (ROM), Random Access Memory (RAM), (hard disk, SD card, TF card,) disk or CD and other media that can store program codes. In the above-mentioned specific embodiments, the purpose, technical solution and beneficial effects of the present application have been further described in detail, and it should be understood that the above is only specific embodiments of the present application and is not used to limit the scope of protection of the present application. In particular, for those skilled in the art, any amendment, equivalent replacement, improvement, etc., made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A data security protection method, wherein the method is applied to a protection module having at least one protection mode, and the protection mode is used for controlling interaction between a computer device and a storage device to perform security protection on the computer device and the storage device, wherein the method comprises:performing permission control on a data interaction instruction sent by the computer device according to a current protection mode of the protection module, wherein the data interaction instruction is used for data interaction between the computer device and the storage device;responding to the data interaction instruction if the data interaction instruction satisfies permission requirement corresponding to the current protection;wherein the protection module is arranged at an interface of the computer device for connecting the storage device, or arranged at the storage device, or arranged at the intermediate device; the intermediate device connects the computer device with the storage device.

2. The method of claim 1, wherein responding to the data interaction instruction if the data interaction instruction satisfies permission requirement corresponding to the current protection mode comprises:responding to the data interaction instruction when an operation type of the data interaction instruction on data in data source conforms to an operation type specified by the current protection mode, wherein the data source directed by the data interaction instruction is one of at least one data source specified by the current protection mode.

3. The method of claim 2, wherein the protection module is arranged at the first storage device, and the first storage device is provided with at least one or more storage chips and interfaces for connecting at least one or more external second storage devices, and at least part of the interfaces on the first storage device are connected with the external second storage device;at least one data source specified by the current protection mode comprises:at least one physical data source in the at least one or more storage chips, the external second storage device connected to at least part of interfaces on the first storage device; and / orat least one logical split disk of the at least one or more storage chips; and / orat least one logical split disk in the external second storage device connected to the first storagedevice.

3. The method of claim 1, wherein interaction process between the computer device and the protection module comprises: a preparation phase, an enumeration phase, and a data interaction phase;performing permission control on a data interaction instruction sent by the computer device according to a current protection mode of the target device, wherein the data interaction instruction is used for data interaction between the computer device and the storage device, and if the data interaction instruction meets the permission requirements corresponding to the current protection mode, responding to the data interaction instruction is a step in the data interaction phase.

5. The method of claim 4, wherein,in case that the protection module is an arranged at the intermediate device, the method further comprises: in the preparation phase, the intermediate device reads and analyzes data information of the storage device;in case that the protection module is arranged at the storage device, the method further comprises: in the preparation phase, the protection module analyzes data information of the storage device;wherein, the data information comprises at least one of the following: a first characteristic parameter of the storage device, a first storage information related parameter of the storage device, and address information.

6. The method of claim 5, wherein in case that the current protection mode is a specific file mode, the address information comprises: a first sector address of a root directory and a first sector address of at least one specific file or folder.

7. The method of claim 5, further comprises:entering the preparation phase in response to power supply signal of the computer device;in the preparation phase, the intermediate device reads the data information of the storage device, comprising:in the preparation phase, the protection module simulating the computer device to send a control instruction to the storage device;receiving the data information of the storage device fed back by the storage device.

8. The method of claim 5, wherein analyzing data information comprises:based on the data information, determining whether the storage device is a device type specified by the current protection mode;if so, sending a signal that enumeration is possible to the computer device to enter the enumeration phase.

9. The method of claim 4, further comprising:in the enumeration phase, based on the current protection mode, processing the data information of the storage device to obtain the processed information;sending the processed information to the computer device, so as to establish a communication connection between the computer device and the storage device.

10. The method of claim 9, wherein based on the current protection mode, processing the data information of the storage device to obtain the processed information, comprises:according to the current protection mode, processing the data information to generate a second characteristic parameter simulating the storage device; and / oraccording to the current protection mode, processing the data information to generate second storage information related parameters simulating the storage device;sending the second characteristic parameter and / or the second storage information related parameters to the computer device, so as to establish the communication connection between the computer device and the storage device.

11. The method of claim 10, wherein according to the current protection mode, processing the data information to generate a second characteristic parameter simulating the storage device, comprises:obtaining a preset parameter template corresponding to the current protection mode; obtaining at least one parameter item that can characterize the device of the device type from the preset parameter template according to the device type of the storage device reflected by the first characteristic parameter in the data information, to obtain the second characteristic parameter; orscreening parameter items in the first characteristic parameter by use of the screening strategy corresponding to the current protection mode, and obtaining the second characteristic parameter based on at least one screened parameter item.

12. The method of claim 11, wherein the first characteristic parameter comprises descriptor data; wherein, the descriptor data comprises at least one of the following: hardware descriptor, interface descriptor, port descriptor, endpoint descriptor, string description character.

13. The method of claim 10, wherein the data information comprises the first storage information related parameters, and the first storage information related parameters comprises at least one of the following: the read-write status of a storage device, the total number of formattable blocks, the last logical block address, the number of bytes per sector, the maximum number of logical units, and device information.

14. The method of claim 13, wherein according to the current protection mode, processing the data information to generate second storage information related parameters simulating the storage device, comprises:according to the operation type specified by the current protection mode, modifying the readwrite status parameter in the first storage information related parameters;If the current protection mode is a logical split disk mode, modifying the total number of formattable blocks and / or the last logical block address in the first storage information related parameters according to the parameters of the target split disk that can be connected to the computer device specified in the current protection mode;according to the current protection mode, modifying the device information in the first storage information related parameters to protect the private information of the storage device.

15. The method of claim 8, further comprising:terminating the communication with the storage device when determining that the storage device is not the device type specified by the current protection mode based on the first characteristic parameter;sending a first information to the computer device, so that the computer device displays a virtual disk identifier and / or abnormal device prompt information based on the first information;wherein, if a virtual disk identifier is displayed, the first information also comprises text corresponding to the first characteristic parameter, and the text is saved in the root folder corresponding to the virtual disk identifier.

16. The method of any one of claims 1 to 15, wherein responding to the data interactioninstruction comprises:determining a target address according to the data interaction instruction and according to address mapping rules;obtaining data of the target address;performing data modification on data of the target address according to preset content modification rules;feeding the modified data back to the computer device.

17. The method of any one of claims 1 to 15, further comprises:obtaining a target protection mode selected by the user in at least one protection mode in response to the user's operation on the interaction device of the first device;taking the target protection mode as the current protection mode of the protection module;wherein the interaction device comprises at least one of the following: a touch screen, a voice interaction device, a plurality of buttons, a slide switch, and an interaction control with at least two selections.

18. The method of claim 17, wherein the at least one protection mode comprises at least one of the following:read-only mode, the data source specified in the read-only mode is the overall data of the storage device, and the specified operation type is read-only type;specific file mode: the specified data source in the specific file mode is at least one specific file in the storage device, and the specified operation type is a read, write, or read-write type;blank file mode: the data source specified in the blank file mode is at least one blank file automatically created and / or manually created in the storage device, and the specified operation type is write type or read-write type;sector limited mode: the data source specified in the sector limited mode is at least one specific sector range in the storage device, and the specified operation type is a read type, a write type, or a read-write type;file type restriction mode: The data source specified in the file type restriction mode is at least one specific type of file in the storage device, and the specified operation type is read, write, or readwrite;encryption write mode: the data source specified in the encryption write mode is data in at least one first sector range, at least one first file and / or at least one type of file in the storage device, and the specified operation type is a write type;decryption readout mode: the data source specified in the decryption readout mode is the data in at least one second sector range in the storage device, at least one second file, and / or at least one type of file, and the specified operation type is a read type;manual confirmation mode: the data source specified in the manual confirmation mode is the data in at least one third sector range in the storage device, at least one third file and / or at least one type of file, and the specified operation type is a read-write type;logical split disk mode: the data source specified in the logical split disk mode is at least one split disk in the storage device, and the specified operation type is a read type, or a write type, or a read-write type;hardware type access protection mode: the hardware type access protection mode does not have a specified data source, and in the hardware type access protection mode, determines whether the storage device is a specified device type.data information protection mode for the storage device: the data information protection mode for storage device does not have a specified data source, in the data information protection mode for the storage device, the data information of the storage device sent to the computer device is protectively processed, and the data information of the storage device after protective processing is sent to the computer device in the enumeration phase;device privacy protection mode, in which the device privacy protection mode does not specify a data source, and in the device privacy protection mode, the device privacy information sent to the computer device is protectively processed;backup mode: the backup mode does not have a specified data source, in the backup mode, the data written to the computer device is synchronously written to the specified backup storage area, and / or the protection module reads the data corresponding to sector addresses written by the computer device and writes them to the specified backup storage area before executing the write instruction, and / or the data of the important data sector of the connected storage device is backed up and stored in the specified backup storage area; If the restore is triggered, the data in the specifiedbackup storage area is read out and written to the original data sectors of the storage device.

19. The method of claim 18, further comprises:creating at least one blank file or folder when the current protection mode is the blank file mode.

20. The method of any one of claims 1 to 15, further comprising:outputting prompt information indicating whether to set a blank file or folder when the current protection mode is a specific file mode;creating a file or folder in the storage device as the specific file or folder corresponding to the specific file mode in response to the confirmation instruction of the user for the prompt information of setting a blank file or folder;obtaining at least one file or folder specified by the user in response to the user's negative instruction for the prompt information of setting blank files or folders, and using the at least one file or folder specified by the user as the corresponding specific file mode specific file or folder.

21. The method of any one of claims 1 to 15, further comprises:determining at least one specific file or folder in the storage device when the current protection mode is the specific file mode;obtaining address information of the at least one specific file or folder;establishing a mapping relationship between the address information of the at least one specific file or folder and the address of the root directory.

22. The method of claim 21, further comprises:after the computer device establishes communication with the storage device and receiving a request from the computer device to read the root directory address of the storage device, determining address information of at least one specific file or file that has a mapping relationship with the root directory address based on the mapping relationship to read data corresponding to the address information or write data in an area corresponding to the address information.

23. The method of claim 21, wherein the address information of the at least one specific file or folder comprises:a first sector address or collection of sector addresses for a specific file or folder; orcluster or block information in which at least one specific file or folder is recorded in a fileallocation table.

24. The method of any one of claims 1 to 15, wherein when the current protection mode is manual confirmation mode,responding to the data interaction instruction comprises:display the relevant information of the data interaction instruction pre-written or read out data;writing the data to or reading the data from the storage device based on the data interaction instruction in response to the user triggering a confirmation operation on the related information.

25. The method of any one of claims 1 to 15, wherein when the current protection mode is backup mode,responding to the data interaction instruction comprises:synchronously writing the data written by the computer device into the specified backup storage area when the data interaction instruction is a write instruction; and / orthe protection module reading the data corresponding to the sector address written by the computer device and writes it into the specified backup storage area before executing the write instruction when the data interaction instruction is a write instruction.

26. The method of claim 25, wherein when the current protection mode is backup mode, the method further comprises:storing the data backup of the important data sectors connected to the storage device in the specified backup storage area;reading out the data in the specified backup storage area and writing into the original data sector of the storage device when the restoration is triggered.

27. The method of any one of claims 1 to 15, wherein responding to the data interaction instruction comprises:obtaining the procedure information of the storage device reading data and / or writing data based on the data interaction instruction;determining whether there is an abnormality based on the procedure information;sending a stop instruction to the storage device if there is an abnormality.

28. The method of claim 27, wherein determining whether there is an abnormality based on the procedure information comprises at least one of the following:determining that there is an abnormality if the process of the storage device reading data based on the data interaction instruction does not conform to the set process rule;determining that there is an abnormality if a context operation is not specified in the process of the storage device reading data and / or writing data based on the data interaction instruction; wherein, when reading data, the specified context operation is the operation of reading the folder where the data is located; when writing data, the specified context operation is the operation of obtaining the folder where the data is located;determining that there is an abnormality If the process of the storage device reading data and / or writing data based on the data interaction instruction does not start the read or write operation from the first address of the cluster or block where the data is located;determining that there is an abnormality if the storage device reads more than a set number of files within a preset time period based on the data interaction instruction.

29. The method of claim 27, further comprises:sending feedback information to the computer device if there is an abnormality; wherein, the feedback information comprises: false information that simulates successful writing, or takes preset data as data successfully read from the storage device; and / oroutputting manual confirmation prompt information if there is an abnormality, so that the user can determine whether to continue execution based on the manual confirmation prompt information.

30. The method of any one of claims 1 to 15, further comprises:splitting the specific storage space of the storage device to obtain at least one split disk if the current protection mode selected by the user is the logical split disk mode;selecting one split disk from the at least one split disk as the target split disk, and connecting it to the computer device.

31. The method of claim 30, further comprises at least one of the following steps:determining the specific storage space in response to user settings; wherein the specific storage space is all or part of the storage device;determining the specific storage space based on the selection rules of the specific storage space in the logical split disk mode.

32. The method of claim 30, wherein splitting the specific storage space of the storage deviceto obtain at least one split disk comprises:reading sector information of the specific storage space in response to a user's split instruction, and splitting the specific storage space based on the sector information; orreading sector information of the specific storage space, and splitting the specific storage space based on the sector information and using a preset division strategy; orGenerating at least one image file in the file system of the storage device, and splitting the specific storage space of the storage device according to the address ranges respectively corresponding to the at least one image file.

33. The method of claim 32, further comprises:obtaining the preset disk splitting strategy locally; orobtaining the preset disk splitting strategy from a server-side of network side.

34. The method of claim 30, wherein selecting one split disk from the at least one split disk as the target split disk comprises:taking a split disk selected by the user as the target split disk in response to the user's selection operation of the at least one split disk through an interaction device; ortaking the split disk indicated by the split disk selection instruction as the target split disk when receiving the split disk selection instruction sent by the specifying device, wherein the specifying device communicates with the protection module through near-field communication or remote communication, wherein the specifying device is different from the computer device; orreceiving the information carrying the disk key sent by the computer device, verifying the disk key, and after the verification is passed, taking the split disk with the disk key in the at least one split disk as the target split disk.

35. The method of any one of claims 1 to 15, wherein the protection module is arranged at the intermediate device, the intermediate device has a networking function to connect to the cloud or the storage module on the server-side; andresponding to the data interaction instruction comprises:sending the data interaction instruction to the storage module on the network side, so that the storage module reads and / or writes corresponding data based on the data interaction instruction.

36. The data security protection method of any one of claims 1 to 15, wherein when theprotection mode is the file type restriction mode, responding to the data interaction instruction comprises:in response to the data interaction instruction, based on the preset file characteristics, verifying the target file characteristics corresponding to the data interaction instruction, and the target file characteristics are corresponding to when the storage device performs read and / or write operation based on the data interaction instruction, file characteristics;If the characteristic of the target file conforms to the characteristic of the preset file, read and / or write operation is performed on the target file in the storage device.

37. The data security protection method of claim 36, after verifying the target file characteristics corresponding to the data interaction instruction, further comprises:if the characteristic of the target file does not conform to the characteristic of the preset file, hiding operation is performed on the target file.

38. The data security protection method of any one of claims 1 to 15, wherein when the protection mode is the encryption write mode, responding to the data interaction instruction comprises:encrypting the data to be written carried by the data interaction instruction to obtain the first target data in response to the data interaction instruction;writing the first target data to a target file in the storage device.

39. The data security protection method of any one of claims 1 to 15, wherein when the protection mode is the decryption read mode, responding to the data interaction instruction comprises:feeding back second target data to the computer device in response to the data interaction instruction, where the second target data is data obtained by decrypting the data returned by the storage device in response to the data interaction instruction.

40. The data security protection method of any one of claims 1 to 15, before responding to the data interaction instruction if the data interaction instruction satisfies permission requirement corresponding to the current protection mode, further comprises:connecting an image file to the computer device as the storage data source, and the image file is generated based on a preset mirroring policy.

41. The data security protection method of any one of claims 1 to 15, wherein the storage device is a networked storage device which is connected to a server-side, and the server-side contains a plurality of networked image files, and before responding to the data interaction instruction if the data interaction instruction satisfies permission requirement corresponding to the current protection, further comprises:connecting the target networked image file as a storage data source to the computer device, wherein the target networked image file is at least one of a plurality of the networked image files.

42. The data security protection method of any one of claims 1 to 15, wherein the method further comprises:in response to a verification instruction input by the user, connecting a target storage data source corresponding to the instruction type of the verification instruction to the computer device, wherein the target storage data source is at least one of a sector range, an image file, and a networked image file.

43. The data security protection method of any one of claims 1 to 15, before responding to the data interaction instruction if the data interaction instruction meets permission requirement corresponding to the current protection mode, further comprises:The data interaction instruction satisfies the permission requirements corresponding to the current protection mode, and the data interaction instruction is to determine the sector address when reading or modifying file content data, read or write the data of the corresponding sector of the storage device and return;the method further comprises: when the data interaction instruction does not meet the permission requirements corresponding to the current protection mode, an error status response is returned, or an execution success response is returned, or blank data is responded, or preset data is used as feedback data for response.

44. The data security protection method of any one of claims 1 to 15, before responding to the data interaction instruction if the data interaction instruction meets permission requirement corresponding to the current protection mode, further comprises:when the data interaction instruction satisfies the permission requirements corresponding to the current protection mode, and the data interaction instruction is to create a new file, delete a fileor modify a file,determining the sector address;if the data interaction instruction comprises information of multiple files, and the sector address corresponding to the storage device contains a part of files of the multiple files, determining that the computer device needs to create at least one file at the sector address, and based on the current protection mode, determining whether creating the at least one file or triggering other protection modes combined with the current protection mode is allowed; wherein, at least one file created is the remaining files of the multiple files except the part of files;if the data interaction instruction comprises information of multiple files, and at least part of the multiple files have deletion marks, finding at least one pre-deleted file in the sector address corresponding to the storage device that is associated with the part of files with deletion marks of the multiple files; determining that the computer device is to delete the at least one pre-delete file, and based on the current protection mode, determining whether creating deleting the at least one pre-delete file or triggering other protection modes combined with the current protection mode is allowed;if the data interaction instruction comprises a first file set, and the sector address corresponding to the storage device contains a second file set, and the first file set is a subset of the second file set, determining the computer device is to delete at least one file in the second file set that does not belong to the first file set and based on the current protection mode, determining whether deleting or triggering other protection modes combined with the current protection mode is allowed;if the attribute information except the file name of the first file comprised in the data interaction instruction is the same as the attribute information except the file name of the second file in the sector address corresponding to the storage device, determining that the computer device is to modify the file name of the second file in the sector address to the file name of the first file; based on the current protection mode, determining whether modifying the file name or triggering other protection modes combined with the current protection mode is allowed;if the file name of the first file contained in the data interaction instruction is the same as the file name of the second file in the corresponding sector address of the storage device, and the attribute information of the first file except the file name is different from that of the attributeinformation except the file name of the second file is different, determining that the computer device is to modify the attribute information except the file name of the second file to the attribute information except the file name of the first file; based on the current protection mode, determining whether modifying the attribute information or triggering other protection modes combined with the current protection mode is allowed.

45. A intermediate device, comprising:a first port for connecting a computer device;a second port for connecting a storage device;an interaction module comprising at least one of the following: a touch screen, a voice interaction device, a plurality of buttons, a slide switch, and an interaction control with at least two selections; anda protection module which is connected between the first port and the second port and is used for implementing the steps of the data security protection method of any one of the above claims 1 to 44.

46. The intermediate device of claim 45, further comprises:a communication component, which is connected with the protection module, and is used for networking so as to connect the protection module with the storage module on the cloud or serverside, and when responding to the data interaction instruction, sending the data interaction instruction to the storage module on the network side, so that the storage module reads and / or writes corresponding data based on the data interaction instruction.

47. A device system, comprising:a computer device;a storage device; andan intermediate device of claim 46 or 45.

48. A storage device, comprising:a first port for connecting a computer device;a protection chip for implementing the steps of the data security protection method of the data security protection method of any one of the above claims 1 to 44;a control chip connected with the first port through the protection chip;a storage chip connected with the control chip, which is used for performing storage management on data in storage space under the control of the control chip.

49. A storage device, comprising:a first port for connecting a computer device;a control chip on which a protection module is deployed for implementing the steps of the data security protection method of any one of the above claims 1 to 44;a storage chip connected with the first port through the control chip, which is used for performing storage management on data in storage space under the control of the control chip.

50. A storage device, comprising:a first port for connecting a computer device;a control chip connected with a first port, which is used for generating corresponding control instructions based on the data interaction instructions sent by the computer device;a storage chip connected with the control chip;wherein, a protection module is deployed on the storage chip for processing control instructions sent by the control chip by adopting the steps of the data security protection method of any one of the above claims 1 to 44.

51. A security control framework, wherein the security control framework comprises:a configuration module for configuring protection scene;a generation module for generating configuration information of the protection scene or software with the protection scene;wherein one protection scene corresponds to at least one protection mode; the configuration information or the software with the protection scene is deployed on a hardware device, so that the hardware device has function corresponding to the steps of the data security protection method of any one of the above claims 1 to 44.

52. The security control framework of claim 51, wherein during configuring protection scene, the configuration module is specifically configured for:configuring identification information of protection scene;configuring protection operation strategy corresponding to the protection scene.

53. The security control framework of claim 52, wherein configuring protection operationstrategy corresponding to the protection scene comprises at least one or more of:configuring the protection operation strategy in the preparation phase under the protection scene;configuring the protection operation strategy in the enumeration phase under the protection 5 scene;configuring the protection operation strategy in the data interaction phase in the protection scene.

54. The security control framework of any one of claims 51 to 53, further comprises:a compiler module, configured to execute a corresponding software compiling strategy 10 according to the configuration information to obtain security control software;wherein, the hardware device runs the security control software, so that the hardware device has functions corresponding to the steps in the data security protection method of any one of claims 1 to 44.

55. A computer-readable storage medium, on which a computer program is stored, and the steps 15 in the data security protection method of any one of claims 1 to 44 are implemented when the computer program is executed by a processor.

Images