Information processing method and device

Abstract

The embodiment of the present application discloses an information processing method, which includes: obtaining target feature information of a disk to be analyzed; wherein the target feature information is used to represent the disk characteristics of the disk to be analyzed; determining the security category of the disk to be analyzed based on the target feature information; and determining a target operation for security management of the disk to be analyzed based on the security category of the disk to be analyzed. The embodiment of the present application also discloses an information processing device.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to an information processing method and device. Background Art

[0002] Redundant Array of Independent Disks (RAID) technology has the advantages of large capacity, high performance, availability and reliability, and has been widely used in the production systems of enterprise users. It uses data redundancy technologies such as mirroring and data verification to ensure the high reliability of disk data on servers and edge nodes. In this way, when a disk in a certain disk position of a server or edge node fails, the failed disk can be unplugged and a new disk can be directly inserted into the corresponding disk position to reconstruct and synchronize data, so that the server can achieve data redundancy again and ensure high availability. However, at the same time, attackers also use this data redundancy technology to copy and steal disk data on enterprise servers or edge servers, that is, attackers can arbitrarily insert their own disks into the attacked server or edge node for data synchronization and replication, causing great security risks and economic losses to the enterprise. At present, disk encryption solutions or user identity authentication technology solutions are usually used to encrypt disk data to solve the above technical problems.

[0003] However, the current process of encrypting and decrypting disk data requires high CPU resources of the server or edge node, which can easily have a great impact on the business provided by the enterprise. Therefore, many enterprises give up on disk data encryption operations. In this way, since the protection method for disk data security is relatively single, the risk of disk data leakage is greater and the security of disk data leakage is lower.

[0004] Application Contents

[0005] In order to solve the above technical problems, the embodiments of the present application hope to provide an information processing method and device.

[0006] The technical solution of this application is implemented as follows:

[0007] In a first aspect, an information processing method is provided, the method being applied to an information processing device, the method comprising:

[0008] Acquire target feature information of the disk to be analyzed; wherein the target feature information is used to represent the disk characteristics of the disk to be analyzed;

[0009] Based on the target feature information, determining the security category of the disk to be analyzed;

[0010] Based on the security category of the disk to be analyzed, a target operation for performing security management on the disk to be analyzed is determined.

[0011] Optionally, before obtaining the target feature information of the disk to be analyzed, the method further includes:

[0012] If it is determined that the disk to be analyzed is a disk currently inserted into a reference device, determining the identity information of the reference device; wherein the reference device is the information processing device or an edge node device managed by the information processing device;

[0013] Correspondingly, determining the security category of the disk to be analyzed based on the target feature information includes:

[0014] The security category of the disk to be analyzed is determined based on the target feature information and the identity identification information.

[0015] Optionally, determining the security category of the disk to be analyzed based on the target feature information and the identity identification information includes:

[0016] Based on the target feature information and the identity identification information, performing identity authentication on the disk to be analyzed;

[0017] If the disk to be analyzed fails the identity authentication, determining that the security category of the disk to be analyzed is an illegally invaded disk category;

[0018] Correspondingly, the method further comprises: determining a target operation for performing security management on the disk to be analyzed based on the security category of the disk to be analyzed;

[0019] If the security category is the illegal intrusion disk category, the target operation is determined to be prohibiting the operation of synchronizing data to the disk to be analyzed and eliminating the operation of the disk to be analyzed.

[0020] Optionally, after determining a target operation for performing security management on the disk to be analyzed based on the security category of the disk to be analyzed, the method further includes:

[0021] If a synchronization instruction to synchronize data to the disk to be analyzed is detected, the operation of prohibiting synchronization of data to the disk to be analyzed is executed;

[0022] Determine the target disk slot information where the disk to be analyzed is inserted;

[0023] Based on the target disk slot information, the disk to be analyzed is eliminated.

[0024] Optionally, after determining a target operation for performing security management on the disk to be analyzed based on the security category of the disk to be analyzed, the method further includes:

[0025] Based on the target operation, generating a first control message;

[0026] The first control message is sent to the reference device; wherein the first control message is used to instruct the reference device to perform the target operation.

[0027] Optionally, before obtaining the target feature information of the disk to be analyzed, the method further includes:

[0028] If it is detected that the target disk is inserted into the information processing device, obtaining disk verification information from the target disk;

[0029] Determine at least one disk other than the target disk in the information processing device to obtain the disk to be analyzed;

[0030] Correspondingly, determining the security category of the disk to be analyzed based on the target feature information includes:

[0031] Based on the target feature information and the disk verification information, performing identity authentication on the disk to be analyzed;

[0032] If the disk to be analyzed fails the identity authentication, it is determined that the disk to be analyzed belongs to a non-secure operating environment category; wherein the security type includes the non-secure operating environment category.

[0033] Optionally, the determining, based on the security category of the disk to be analyzed, a target operation for performing security management on the disk to be analyzed includes:

[0034] If the security category of the disk to be analyzed is the non-secure operating environment category, determining that the target operation is an access interception operation;

[0035] Based on the access interception operation, generating a second control message;

[0036] The second control message is sent to the target disk; wherein the second control message is used to instruct the target disk to perform the access interception operation and not respond to the data read / write request when receiving the data read / write request.

[0037] Optionally, the target characteristic information includes at least one of the following information: disk array level, model, serial number, capacity and inserted disk slot information.

[0038] In a second aspect, an information processing device includes: a first processor, a memory, and a communication bus; wherein:

[0039] The memory is used to store executable instructions;

[0040] The communication bus is used to realize the communication connection between the first processor and the memory;

[0041] The first processor is used to execute the information processing program stored in the memory to implement the steps of any of the above-mentioned information processing methods.

[0042] In a third aspect, an information processing device comprises: a second processor, a disk to be analyzed, and a second communication bus; wherein:

[0043] The disk to be analyzed is used to store data information in the information processing device;

[0044] The second communication bus is used to realize the communication connection between the second processor and the disk to be analyzed;

[0045] The second processor is used to execute the information processing program stored in the target storage area of ​​the target disk if it is detected that the target disk is inserted into the information processing device, so as to implement the steps of any one of the above-mentioned information processing methods.

[0046] The embodiment of the present application provides an information processing method and device, which obtains target feature information of the disk to be analyzed, determines the security category of the disk to be analyzed based on the target feature information, and determines the target operation for security management of the disk to be analyzed based on the security category of the disk to be analyzed. In this way, after determining the security category of the disk to be analyzed based on the target feature information of the disk to be analyzed, the disk to be analyzed is securely managed, which solves the problem of a relatively single protection method for disk data security, enriches the protection method for disk data security, reduces the risk of disk data leakage, and improves the security of disk data. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A flowchart of an information processing method provided in an embodiment of the present application;

[0048] Figure 2 A flowchart of another information processing method provided in an embodiment of the present application;

[0049] Figure 3 A flowchart of another information processing method provided in an embodiment of the present application;

[0050] Figure 4 A schematic diagram of the structure of an information processing device provided in an embodiment of the present application;

[0051] Figure 5 A flowchart of another information processing method provided in an embodiment of the present application;

[0052] Figure 6 A flowchart of an information processing method provided by another embodiment of the present application;

[0053] Figure 7 A flowchart of another information processing method provided by another embodiment of the present application;

[0054] Figure 8 A schematic diagram of the structure of a target disk provided in an embodiment of the present application;

[0055] Fig. 9 A schematic diagram of an application scenario of a target disk provided in an embodiment of the present application;

[0056] Fig.10 A schematic diagram of the structure of another information processing device provided in an embodiment of the present application;

[0057] Fig.11 A schematic diagram of the structure of another information processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0059] The embodiment of the present application provides an information processing method, referring to Figure 1 As shown, the method is applied to an information processing device, and the method comprises the following steps:

[0060] Step 101: Obtain target feature information of the disk to be analyzed.

[0061] The target feature information is used to represent the disk characteristics of the disk to be analyzed.

[0062] In the embodiment of the present application, the information processing device can be a central server with centralized management and control functions, or an edge node device in a service cluster that provides edge services, or a general server or other electronic device with a disk and pluggable disk. In different application scenarios, the disk to be analyzed can be a disk inserted into the information processing device, or a disk installed in the information processing device. The target feature information is the disk characteristics of the disk to be analyzed, which can be used to identify and process the disk to be analyzed.

[0063] Step 102: Determine the security category of the disk to be analyzed based on the target feature information.

[0064] In the embodiment of the present application, security analysis is performed on the target feature information of the disk to be analyzed to determine the security category of the disk to be analyzed. The security category of the disk to be analyzed includes a compliant disk category and an illegally invaded disk category, or a safe operating environment category and an unsafe operating environment category. Among them, the compliant disk category and the safe operating environment category belong to a safe situation, and the illegally invaded disk category and the unsafe operating environment category belong to an unsafe situation.

[0065] Step 103: Based on the security category of the disk to be analyzed, determine a target operation for performing security management on the disk to be analyzed.

[0066] In an embodiment of the present application, a target operation for managing the disk to be analyzed is determined based on the determined security category of the disk to be analyzed. In a safe situation, the target operation at least includes allowing access to the disk to be analyzed. In an unsafe situation, the target operation is operations such as not allowing the disk to be analyzed to synchronize data.

[0067] The embodiment of the present application provides an information processing method, which determines the security category of the disk to be analyzed based on the target feature information after obtaining the target feature information of the disk to be analyzed, and determines the target operation for security management of the disk to be analyzed based on the security category of the disk to be analyzed. In this way, after determining the security category of the disk to be analyzed based on the target feature information of the disk to be analyzed, the disk to be analyzed is securely managed, which solves the problem of a relatively single protection method for disk data security, enriches the protection method for disk data security, reduces the risk of disk data leakage, and improves the security of disk data.

[0068] Based on the above embodiments, the embodiments of the present application provide an information processing method, referring to Figure 2 As shown, when the reference device is an information processing device, the method is applied to the information processing device, and the method includes the following steps:

[0069] Step 201: If it is determined that the disk to be analyzed is a disk currently inserted into a reference device, determine the identity information of the reference device.

[0070] In an embodiment of the present application, the identification information of the reference device may be identification information for uniquely identifying the reference device, such as the serial number of the reference device, or identification information such as a number set for the reference device in the cluster. If the information processing device detects that a disk is currently inserted into its own disk, it determines that the currently inserted disk is the disk to be analyzed, and determines the identification information of the information processing device itself. The information processing device may be any electronic device that has a disk and can plug and unplug the disk.

[0071] Step 202: Obtain target feature information of the disk to be analyzed.

[0072] The target characteristic information is used to indicate the disk characteristics of the disk to be analyzed. The target characteristic information includes at least one of the following information: disk array level, model, serial number, capacity, and inserted disk slot information.

[0073] In the embodiment of the present application, the information processing device obtains the disk array level of the currently inserted disk, i.e., the disk to be analyzed, the model of the disk to be analyzed, the serial number of the disk to be analyzed, the capacity of the disk to be analyzed, and the disk position information where the disk to be analyzed is inserted, and obtains the target feature information. The disk position information where the disk to be analyzed is inserted refers to the insertion position of the disk to be analyzed in the information processing device.

[0074] Step 203: Determine the security category of the disk to be analyzed based on the target feature information and the identity identification information.

[0075] In an embodiment of the present application, the information processing device obtains at least one preset disk feature information corresponding to the identity information from the reference storage area, compares and analyzes the target feature information with the obtained at least one preset disk feature information, and determines whether the target feature information is in the at least one preset disk feature information, so as to determine the security category of the disk to be analyzed. The reference storage area can be a local storage area of ​​the information processing device, or a cloud storage space accessible to the information processing device.

[0076] If the target feature information is the same as one of the preset disk feature information in at least one preset disk feature information, at this time, the disk to be analyzed passes the identity authentication, so it can be determined that the security category of the disk to be analyzed is the compliant disk category; if the target feature information is different from any of the preset disk feature information in at least one preset disk feature information, at this time, the disk to be analyzed does not pass the identity authentication, so it can be determined that the security category of the disk to be analyzed is the illegally intruded disk category.

[0077] Step 204: Based on the security category of the disk to be analyzed, determine a target operation for performing security management on the disk to be analyzed.

[0078] In the embodiment of the present application, when the security category of the disk to be analyzed is a compliant disk category, the target operation is to allow the read data and write data operations for the disk to be analyzed; when the security category of the disk to be analyzed is an illegal intrusion disk category, the target operation is to prohibit the read data and write data operations for the disk to be analyzed. In this way, after determining the security category of the currently inserted disk, it is determined whether to synchronize data to the currently inserted disk according to the security category of the currently inserted disk, which effectively ensures the data security in the information processing device.

[0079] Based on the above embodiments, in other embodiments of the present application, step 203 can be implemented by steps 203a to 203b:

[0080] Step 203a: Based on the target feature information and the identity identification information, the disk to be analyzed is authenticated.

[0081] In an embodiment of the present application, the target characteristic information and the identity identification information are hashed to obtain a target hash value. If the target hash value does not match the preset hash value, the preset disk characteristic information corresponding to the identity identification information is obtained; wherein the preset hash value corresponds to a preset disk that has been pre-verified; if the target characteristic information does not match the preset characteristic information, it is determined that the disk to be analyzed has not passed the identity authentication; if the target characteristic information matches the preset characteristic information, it is determined that the disk to be analyzed has passed the identity authentication.

[0082] Step 203b: If the disk to be analyzed fails the identity authentication, the security category of the disk to be analyzed is determined to be an illegally invaded disk category.

[0083] In the embodiment of the present application, when it is determined that the disk to be analyzed has not passed the identity authentication, the security category of the disk to be analyzed is determined to be an illegally invaded disk category, that is, the disk to be analyzed may be a disk inserted into the information processing device by an illegal person to steal data in the information processing device. If the disk to be analyzed passes the identity authentication, the security category of the disk to be analyzed is determined to be a compliant disk category.

[0084] Correspondingly, step 204 can be implemented by step 204a:

[0085] Step 204a: If the security category is the illegal intrusion disk category, determine the target operation as prohibiting the operation of synchronizing data to the disk to be analyzed and eliminating the operation of the disk to be analyzed.

[0086] In the embodiment of the present application, the synchronization data operation includes a read data operation and a write data operation. In some application scenarios, after determining the target operation, the information processing device can directly execute the target operation, prohibit other installed disks in the information processing device from synchronizing data with the disk to be analyzed, and remove the disk to be analyzed.

[0087] Based on the above embodiments, in other embodiments of the present application, refer to Figure 3 As shown, after the information processing device executes step 204a, it is also used to execute steps 205 to 207:

[0088] Step 205: If a synchronization instruction for synchronizing data with the disk to be analyzed is detected, an operation of prohibiting synchronization of data with the disk to be analyzed is executed.

[0089] In the embodiment of the present application, the synchronization instruction may be a data synchronization request instruction issued by the disk to be analyzed.

[0090] Step 206: Determine the target disk slot information where the disk to be analyzed is inserted.

[0091] Step 207: based on the target disk slot information, remove the disk to be analyzed.

[0092] In this way, the embodiment of the present application makes improvements on the information processing device side, so that when the information processing device detects an inserted disk, it performs a security judgment on the inserted disk to prevent the inserted disk from being a disk for criminals to steal data information, thereby reducing the risk of data leakage on the information processing device side.

[0093] Based on the above embodiments, refer to Figure 4 The figure shows a schematic diagram of the structure of an information processing device provided by an embodiment of the present application, wherein the information processing device comprises: an edge security alarm module a1, a disk security access authentication and analysis module a2, a compliant disk database a3, a disk security information analysis and reporting module a4, a disk security information cache module a5, a disk security information construction module a6, a disk information identification module a7, a disk data control module a8, a RAID controller a9 and a disk a10, wherein the disk a9 comprises: a compliant disk 1a91, a compliant disk 2a92 and a currently inserted disk a93; wherein:

[0094] The disk information identification module a7 is used to identify the currently inserted intrusion disk through the RAID controller, obtain the reference feature information of the intrusion disk: disk array level, model, serial number, capacity and inserted disk slot information, and then send the reference feature information to the disk security information construction module.

[0095] The disk security information construction module a6 is used to construct and process the received reference feature information according to a certain disk data format to obtain target feature information, and send the target feature information to the disk security information analysis and reporting module. At the same time, the disk security information construction module can also use a hash algorithm to hash the target feature information to obtain a target hash value.

[0096] Exemplarily, the disk data format may be as shown in the following code:

[0097]

[0098]

[0099] The disk security information cache module a5 is used to cache the preset hash value corresponding to the preset disk feature information of the predetermined compliant disk.

[0100] The disk security information analysis and reporting module a4 is used to compare the received target hash value with the preset hash value in the disk security information cache module. If the target hash value does not match the preset hash value, the target feature information is sent to the disk security access authentication and analysis module.

[0101] The compliant disk database a3 is used to store preset disk characteristic information of compliant disks that have passed identity authentication in advance.

[0102] The disk security access authentication and analysis module a2 is used to compare the target feature information with the preset disk feature information stored in the compliant disk database. If any preset disk feature information in the compliant disk database matches the target feature information, the edge security alarm module is called to issue an alarm; at the same time, a data synchronization blocking instruction is sent to the disk data control module. If the compliant disk database contains preset disk feature information that matches the target feature information, a data synchronization instruction is sent to the disk control module. At this time, it may be a normal replacement scenario for the faulty disk.

[0103] The disk data control module a8 is used to control the RAID controller to stop the data synchronization operation for the currently inserted disk if it receives the data synchronization blocking instruction sent by the disk security access authentication and analysis module. This step can be implemented in a variety of ways to block the data of the intruding disk. The method used in this article is not limited to using this method to block the data of the intruding disk. Furthermore, the disk slot corresponding to the currently inserted disk can be manually removed through the RAID controller management software. The specific removal operation can be implemented through the following instructions:

[0104] / opt / MegaRAID / MegaCli / MegaCli64-PDOffline-PhysDrv[1:4]-a0 / / Delete physical disk number 1:4

[0105] The disk data control module a8 is further used to call the RAID controller to synchronize the data in the compliant disk 1 and the compliant disk 2 to the currently inserted disk if a data synchronization instruction is received from the disk security access authentication and analysis module.

[0106] It should be noted that, for the description of the same steps and the same contents in this embodiment as those in other embodiments, reference can be made to the description in other embodiments and will not be repeated here.

[0107] The embodiment of the present application provides an information processing method, which determines the security category of the disk to be analyzed based on the target feature information after obtaining the target feature information of the disk to be analyzed, and determines the target operation for security management of the disk to be analyzed based on the security category of the disk to be analyzed. In this way, after determining the security category of the disk to be analyzed based on the target feature information of the disk to be analyzed, the disk to be analyzed is securely managed, which solves the problem of a relatively single protection method for disk data security, enriches the protection method for disk data security, reduces the risk of disk data leakage, and improves the security of disk data.

[0108] Based on the above embodiments, the embodiments of the present application provide an information processing method, referring to Figure 5 As shown, when the reference device is an edge node device managed by an information processing device, the method includes the following steps:

[0109] Step 301: If it is determined that the disk to be analyzed is a disk currently inserted into a reference device, the information processing device determines the identity information of the reference device.

[0110] In an embodiment of the present application, when the reference device detects that a disk is currently inserted into the reference device, it sends a message including the identity information of the reference device to the information processing device.

[0111] Step 302: The information processing device receives target feature information of the disk to be analyzed sent by the reference device.

[0112] The target characteristic information is used to indicate the disk characteristics of the disk to be analyzed. The target characteristic information includes at least one of the following information: disk array level, model, serial number, capacity, and inserted disk slot information.

[0113] In the embodiment of the present application, the information processing device receives the target feature information of the disk to be analyzed sent by the reference device, so that the information processing device obtains the target feature information of the disk to be analyzed of the reference device. In some application scenarios, the target feature information of the disk to be analyzed can also be actively obtained by the information processing device from the reference device.

[0114] Step 303: The information processing device determines the security category of the disk to be analyzed based on the target feature information and the identity information.

[0115] Step 304: The information processing device determines a target operation for security management of the disk to be analyzed based on the security category of the disk to be analyzed.

[0116] Based on the above embodiment, in other embodiments of the present application, step 303 can be implemented by steps 303a to 303b:

[0117] Step 303a: The information processing device performs identity authentication on the disk to be analyzed based on the target feature information and the identity identification information.

[0118] Step 303b: If the disk to be analyzed fails the identity authentication, the information processing device determines that the security category of the disk to be analyzed is an illegally invaded disk category.

[0119] Correspondingly, step 304 can be implemented by step 304a:

[0120] Step 304a: If the security category is the illegal intrusion disk category, the information processing device determines the target operation to be prohibiting the operation of synchronizing data to the disk to be analyzed and eliminating the operation of the disk to be analyzed.

[0121] In other embodiments of the present application, refer to Figure 6 As shown, after the information processing device executes step 304a, it is also used to execute steps:

[0122] Step 305: The information processing device generates a first control message based on the target operation.

[0123] Step 306: The information processing device sends a first control message to the reference device.

[0124] The first control message is used to instruct the reference device to perform a target operation.

[0125] In an embodiment of the present application, after the reference device receives the first control message, the reference device responds to the first control message. If a synchronization instruction to synchronize data to the disk to be analyzed is detected, the reference device executes an operation to prohibit synchronizing data to the disk to be analyzed, determines the target disk position information of the disk to be analyzed, and eliminates the disk to be analyzed based on the target disk position information.

[0126] It should be noted that, for the description of the same steps and the same contents in this embodiment as those in other embodiments, reference can be made to the description in other embodiments and will not be repeated here.

[0127] The embodiment of the present application provides an information processing method, which determines the security category of the disk to be analyzed based on the target feature information after obtaining the target feature information of the disk to be analyzed, and determines the target operation for security management of the disk to be analyzed based on the security category of the disk to be analyzed. In this way, after determining the security category of the disk to be analyzed based on the target feature information of the disk to be analyzed, the disk to be analyzed is securely managed, which solves the problem of a relatively single protection method for disk data security, enriches the protection method for disk data security, reduces the risk of disk data leakage, and improves the security of disk data.

[0128] Based on the above embodiments, the present application provides an information processing method, referring to Figure 7As shown, the method is applied to an information processing device, and the target disk stores an information processing program for implementing the information processing method. When the target disk is inserted into the information processing device, the information processing program stored in the target disk is run by the information processing device to implement the information processing method. The method includes the following steps:

[0129] Step 401: If it is detected that a target disk is inserted into an information processing device, disk verification information is obtained from the target disk.

[0130] In the embodiment of the present application, after the information processing device detects that the target disk is inserted, it executes the information processing program stored in the target disk, and the disk verification information can be the preset disk feature information of at least one preset disk that has passed the identity verification. In some application scenarios, the disk verification information can be the disk serial number of at least one preset disk that has passed the identity verification. The information processing device can be any electronic device that has a disk and can plug and unplug the disk, such as a server or an edge node device.

[0131] Step 402: determine at least one disk other than the target disk in the information processing device to obtain a disk to be analyzed.

[0132] In the embodiment of the present application, at least one disk in the information processing device other than the target disk is a disk that has been inserted into the information processing device before the target disk is inserted.

[0133] Step 403: Obtain target feature information of the disk to be analyzed.

[0134] The target characteristic information is used to indicate the disk characteristics of the disk to be analyzed. The target characteristic information includes at least one of the following information: disk array level, model, serial number, capacity, and inserted disk slot information.

[0135] Step 404: Based on the target feature information and the disk verification information, the disk to be analyzed is authenticated.

[0136] In the embodiment of the present application, the identity of the disk to be analyzed is authenticated by determining whether the target feature information matches the disk verification information.

[0137] Step 405: If the disk to be analyzed fails the identity authentication, it is determined that the disk to be analyzed belongs to the category of an insecure operating environment.

[0138] Among them, the security type includes the non-secure operating environment category.

[0139] In an embodiment of the present application, if the target feature information of the disk to be analyzed does not match any information in the disk verification information, it is determined that the disk to be analyzed has not passed the identity authentication. At this time, it can be determined that the disk to be analyzed belongs to the non-secure operating environment category.

[0140] Step 406: Based on the security category of the disk to be analyzed, determine a target operation for performing security management on the disk to be analyzed.

[0141] In the embodiment of the present application, if the security category of the disk to be analyzed is a secure operating environment category, the target operation is determined to be an operation that allows synchronization of data in the target disk.

[0142] Based on the above embodiment, in other embodiments of the present application, step 406 can be implemented by steps 406a to 406c:

[0143] Step 406a: If the security category of the disk to be analyzed is a non-secure operating environment category, determine that the target operation is an access interception operation.

[0144] In an embodiment of the present application, since the target feature information of the disk to be analyzed does not match the disk verification information in the target disk, it can be determined that the disk to be analyzed is not the pre-set disk in the target disk. In this way, it can be determined that the operating environment provided by the information processing device is unsafe. Therefore, the security category of the disk to be analyzed can be determined as a non-safe operating environment category, and the target operation can be determined as an access interception operation.

[0145] Step 406b: Generate a second control message based on the access interception operation.

[0146] In the embodiment of the present application, the second control message is used to instruct the target disk not to respond to the data synchronization request instruction when receiving the data synchronization request instruction sent by the disk to be analyzed.

[0147] Step 406c: Send a second control message to the target disk.

[0148] The second control message is used to instruct the target disk to perform an access interception operation and not respond to the data read / write request when receiving the data read / write request.

[0149] Based on the above embodiments, refer to Figure 8 As shown, the present embodiment provides a schematic diagram of the structure of a target disk, the target disk includes: a disk space application and locking module b1, an operating environment security monitoring module b2, a disk input and output (I / O) abnormal access interception module b3 and a disk data format (DDF) area module b4. Among them:

[0150] The DDF area module b4 is used to store disk verification information, which may specifically be RAID information of disks that have passed verification. The RAID information of each disk includes information such as disk array level, model, serial number, capacity, and inserted disk slot information.

[0151] The disk space application and locking module b1 is used to apply for a fixed address space and lock the address space at the same time. The disk space application and locking module stores an information processing program for implementing the information processing method corresponding to steps 401 to 406 and steps 406a to 406c. The address space can only be used to implement the information processing program, and no other process can access the address space.

[0152] The operating environment security monitoring module b2 automatically starts after the target disk is inserted into the information processing device and powered on. It is used to perform security detection on the current operating environment of the target disk. The security monitoring process can be as follows: all RAID information stored in the DDF area module is parsed to obtain the disk serial numbers of all disks included in the DDF area module; then the disk serial numbers on the information processing device are compared with the disk serial numbers of all disks included in the DDF area module; if the disk serial numbers on the information processing device do not match the disk serial numbers of all disks included in the DDF area module, it is determined that the current operating environment of the target disk is abnormal, and an I / O request interception instruction is sent to the disk I / O abnormal access interception module; the I / O request interception instruction is the aforementioned second control message.

[0153] The disk I / O abnormal access interception module b3 is automatically started after the target disk is powered on, and is used to receive the I / O request interception instruction sent by the operating environment security monitoring module b2, and actively intercept the user data read and write requests sent from the virtual file system layer. Fig. 9 As shown, after the disk I / O abnormal access interception module b3 receives the I / O request interception instruction, the specific process of the disk I / O abnormal access interception module b3 actively intercepting the user data read and write request issued from the virtual file system layer is: c1, the virtual file system layer on the user side sends the I / O request instruction to the disk I / O abnormal access interception module, and the monitoring and identification unit in the disk I / O abnormal access interception module receives the I / O request instruction, c2, the monitoring and identification unit sends the received I / O request instruction to the data response unit in the disk I / O abnormal access interception module, c3, the data response unit responds to the I / O request instruction and returns empty data for the I / O request instruction to the user.

[0154] In this way, in the embodiment of the present application, corresponding improvements are made to the disk to prevent the risk of information leakage caused by the disk being easily read by criminals after being stolen, thereby effectively ensuring the security of the data in the stolen disk.

[0155] It should be noted that, for the description of the same steps and the same contents in this embodiment as those in other embodiments, reference can be made to the description in other embodiments and will not be repeated here.

[0156] The embodiment of the present application provides an information processing method, which determines the security category of the disk to be analyzed based on the target feature information after obtaining the target feature information of the disk to be analyzed, and determines the target operation for security management of the disk to be analyzed based on the security category of the disk to be analyzed. In this way, after determining the security category of the disk to be analyzed based on the target feature information of the disk to be analyzed, the disk to be analyzed is securely managed, which solves the problem of a relatively single protection method for disk data security, enriches the protection method for disk data security, reduces the risk of disk data leakage, and improves the security of disk data.

[0157] Based on the above embodiments, the embodiments of the present application provide an information processing device, which can be applied to Figures 1 to 3 and Figures 5-6 In the information processing method provided in the corresponding embodiment, refer to Fig.10 As shown, the information processing device 5 may include: a first processor 51, a memory 52 and a communication bus 53, wherein:

[0158] A communication bus 53, used to realize the communication connection between the processor 51 and the memory 52;

[0159] The processor 51 is used to execute the information processing program stored in the memory 52 to implement the following steps:

[0160] Obtaining target feature information of the disk to be analyzed; wherein the target feature information is used to represent the disk characteristics of the disk to be analyzed;

[0161] Based on the target feature information, determine the security category of the disk to be analyzed;

[0162] Based on the security category of the disk to be analyzed, a target operation for security management of the disk to be analyzed is determined.

[0163] In other embodiments of the present application, before the first processor executes the step of acquiring target feature information of the disk to be analyzed, it is further configured to execute the following steps:

[0164] If it is determined that the disk to be analyzed is a disk currently inserted into a reference device, determine the identity information of the reference device; wherein the reference device is an information processing device or an edge node device managed by the information processing device;

[0165] Correspondingly, when the first processor executes the step of determining the security category of the disk to be analyzed based on the target feature information, it can be implemented by the following steps:

[0166] Based on the target feature information and identity information, the security category of the disk to be analyzed is determined.

[0167] In other embodiments of the present application, the first processor executes a step of determining the security category of the disk to be analyzed based on the target feature information and the identity information, including:

[0168] Based on the target feature information and identity information, the disk to be analyzed is authenticated;

[0169] If the disk to be analyzed fails to pass the identity authentication, the security category of the disk to be analyzed is determined to be an illegally invaded disk category;

[0170] Correspondingly, when the first processor executes the step of determining the target operation for security management of the disk to be analyzed based on the security category of the disk to be analyzed, it can be implemented by the following steps:

[0171] If the security category is the illegal intrusion disk category, the target operation is determined to be prohibiting the operation of synchronizing data to the disk to be analyzed and eliminating the operation of the disk to be analyzed.

[0172] In other embodiments of the present application, after the first processor executes the step of determining the target operation for security management of the disk to be analyzed based on the security category of the disk to be analyzed, it is further configured to execute the following steps:

[0173] If a synchronization instruction to synchronize data to the disk to be analyzed is detected, an operation of prohibiting synchronization of data to the disk to be analyzed is executed;

[0174] Determine the target disk slot information where the disk to be analyzed is inserted;

[0175] Based on the target disk slot information, remove the disk to be analyzed.

[0176] In other embodiments of the present application, after the first processor executes the step of determining the target operation for security management of the disk to be analyzed based on the security category of the disk to be analyzed, it is further configured to execute the following steps:

[0177] Based on the target operation, generating a first control message;

[0178] A first control message is sent to an edge node device, wherein the first control message is used to instruct the edge node device to perform a target operation.

[0179] In other embodiments of the present application, the target characteristic information includes at least one of the following information: disk array level, model, serial number, capacity and inserted disk slot information.

[0180] It should be noted that the specific implementation process of the steps executed by the processor in this embodiment can refer to Figures 1 to 3 and Figures 5-6 The implementation process of the information processing method provided in the corresponding embodiment will not be repeated here.

[0181] The embodiment of the present application provides an information processing device, which determines the security category of the disk to be analyzed based on the target feature information after obtaining the target feature information of the disk to be analyzed, and determines the target operation for security management of the disk to be analyzed based on the security category of the disk to be analyzed. In this way, after determining the security category of the disk to be analyzed based on the target feature information of the disk to be analyzed, the disk to be analyzed is securely managed, which solves the problem of a relatively single protection method for disk data security, enriches the protection method for disk data security, reduces the risk of disk data leakage, and improves the security of disk data.

[0182] Based on the above embodiments, the embodiments of the present application provide an information processing device, which can be applied to Figure 1 and Figure 7 In the information processing method provided in the corresponding embodiment, refer to Fig.11 As shown, the information processing device 5 may include: a second processor 54, a disk to be analyzed 55, and a second communication bus 56, wherein:

[0183] The disk to be analyzed 55 is used to store data information in the information processing device;

[0184] A second communication bus 56, used to realize the communication connection between the second processor and the disk to be analyzed;

[0185] The second processor 54 is used to execute the information processing program stored in the target storage area of ​​the target disk to implement the following steps if it is detected that the target disk is inserted into the information processing device:

[0186] Obtaining target feature information of the disk to be analyzed; wherein the target feature information is used to represent the disk characteristics of the disk to be analyzed;

[0187] Based on the target feature information, determine the security category of the disk to be analyzed;

[0188] Based on the security category of the disk to be analyzed, a target operation for security management of the disk to be analyzed is determined.

[0189] In other embodiments of the present application, before the second processor executes the step of acquiring target feature information of the disk to be analyzed, it is further configured to execute the following steps:

[0190] If it is detected that the target disk is inserted into the information processing device, obtaining disk verification information from the target disk;

[0191] Determine at least one disk other than the target disk in the information processing device to obtain a disk to be analyzed;

[0192] Correspondingly, when the second processor executes the step of determining the security category of the disk to be analyzed based on the target feature information, it can be implemented by the following steps:

[0193] Based on the target feature information and disk verification information, the disk to be analyzed is authenticated;

[0194] If the disk to be analyzed fails the identity authentication, it is determined that the disk to be analyzed belongs to the non-secure operating environment category; wherein the security type includes the non-secure operating environment category.

[0195] In other embodiments of the present application, when the second processor executes the step of determining the target operation for security management of the disk to be analyzed based on the security category of the disk to be analyzed, it can be implemented by the following steps:

[0196] If the security category of the disk to be analyzed is a non-secure operating environment category, determining the target operation is an access interception operation;

[0197] Based on the access interception operation, generating a second control message;

[0198] A second control message is sent to the target disk; wherein the second control message is used to instruct the target disk to perform an access interception operation and not respond to the data read / write request when receiving the data read / write request.

[0199] In other embodiments of the present application, the target characteristic information includes at least one of the following information: disk array level, model, serial number, capacity and inserted disk slot information.

[0200] It should be noted that the specific implementation process of the steps executed by the processor in this embodiment can refer to Figure 1 and Figure 7 The implementation process of the information processing method provided in the corresponding embodiment will not be repeated here.

[0201] The embodiment of the present application provides an information processing device, which determines the security category of the disk to be analyzed based on the target feature information after obtaining the target feature information of the disk to be analyzed, and determines the target operation for security management of the disk to be analyzed based on the security category of the disk to be analyzed. In this way, after determining the security category of the disk to be analyzed based on the target feature information of the disk to be analyzed, the disk to be analyzed is securely managed, which solves the problem of a relatively single protection method for disk data security, enriches the protection method for disk data security, reduces the risk of disk data leakage, and improves the security of disk data.

[0202] Based on the foregoing embodiments, the embodiments of the present application provide a computer-readable storage medium, which may be referred to as a storage medium for short. The computer-readable storage medium stores one or more programs, and the one or more programs may be executed by one or more processors to implement Figures 1 to 3 and Figures 5-6 ,or Figure 1 and Figure 7 The implementation process of the information processing method provided in the corresponding embodiment will not be repeated here.

[0203] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of hardware embodiments, software embodiments, or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0204] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0205] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0206] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0207] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. An information processing method, the method being applied to an information processing device, the method comprising: Obtain target feature information of the disk to be analyzed; wherein the target feature information is used to represent the disk characteristics of the disk to be analyzed; the target feature information includes at least one of the following information: disk array level, model, serial number, capacity and inserted disk slot information; Based on the target feature information and the identity information of the reference device, the security category of the disk to be analyzed is determined; the security category of the disk to be analyzed includes a compliant disk category and an illegally invaded disk category, or a secure operating environment category and an unsecure operating environment category; the identity information of the reference device is the serial number of the reference device, or a number set for the reference device in the cluster; the reference device is the information processing device or an edge node device managed by the information processing device; Based on the security category of the disk to be analyzed, a target operation for performing security management on the disk to be analyzed is determined.

2. According to the method of claim 1, before obtaining the target feature information of the disk to be analyzed, the method further comprises: If it is determined that the disk to be analyzed is a disk currently inserted into a reference device, the identity information of the reference device is determined.

3. The method according to claim 2, wherein determining the security category of the disk to be analyzed based on the target feature information and the identity information comprises: Based on the target feature information and the identity identification information, performing identity authentication on the disk to be analyzed; If the disk to be analyzed fails the identity authentication, determining that the security category of the disk to be analyzed is an illegally invaded disk category; Correspondingly, the method further comprises: determining a target operation for performing security management on the disk to be analyzed based on the security category of the disk to be analyzed; If the security category is the illegal intrusion disk category, the target operation is determined to be prohibiting the operation of synchronizing data to the disk to be analyzed and eliminating the operation of the disk to be analyzed.

4. The method according to claim 3, after determining the target operation for performing security management on the disk to be analyzed based on the security category of the disk to be analyzed, the method further comprises: If a synchronization instruction to synchronize data to the disk to be analyzed is detected, the operation of prohibiting synchronization of data to the disk to be analyzed is executed; Determine the target disk slot information where the disk to be analyzed is inserted; Based on the target disk slot information, the disk to be analyzed is eliminated.

5. The method according to claim 3, after determining the target operation for performing security management on the disk to be analyzed based on the security category of the disk to be analyzed, the method further comprises: Based on the target operation, generating a first control message; The first control message is sent to the reference device; wherein the first control message is used to instruct the reference device to perform the target operation.

6. The method according to claim 1, before obtaining the target characteristic information of the disk to be analyzed, the method further comprises: If it is detected that the target disk is inserted into the information processing device, obtaining disk verification information from the target disk; Determine at least one disk other than the target disk in the information processing device to obtain the disk to be analyzed; Correspondingly, determining the security category of the disk to be analyzed based on the target feature information includes: Based on the target feature information and the disk verification information, performing identity authentication on the disk to be analyzed; If the disk to be analyzed fails the identity authentication, it is determined that the disk to be analyzed belongs to a non-secure operating environment category; wherein the security category includes the non-secure operating environment category.

7. The method according to claim 6, wherein determining a target operation for performing security management on the disk to be analyzed based on the security category of the disk to be analyzed comprises: If the security category of the disk to be analyzed is the non-secure operating environment category, determining that the target operation is an access interception operation; Based on the access interception operation, generating a second control message; The second control message is sent to the target disk; wherein the second control message is used to instruct the target disk to perform the access interception operation and not respond to the data read / write request when receiving the data read / write request.

8. An information processing device, comprising: A first processor, a memory, and a communication bus; wherein: The memory is used to store executable instructions; The communication bus is used to realize the communication connection between the first processor and the memory; The first processor is used to execute the information processing program stored in the memory to implement the steps of the information processing method according to any one of claims 1 to 5.

9. An information processing device, comprising: A second processor, a disk to be analyzed, and a second communication bus; wherein: The disk to be analyzed is used to store data information in the information processing device; The second communication bus is used to realize the communication connection between the second processor and the disk to be analyzed; The second processor is used to execute the information processing program stored in the target storage area of ​​the target disk if it is detected that the target disk is inserted into the information processing device, so as to implement the steps of the information processing method according to any one of claims 1 and claims 6 to 7.

Images