Data protection method, device, equipment and storage medium

Abstract

The present invention discloses a data protection method, device, equipment and storage medium, and belongs to the field of data security technology. The present invention performs jigsaw segmentation on original data, and lowers data protection to the data block level, realizes refined data protection, generates a jigsaw log corresponding to the segmented original data, associates the original data with the information after jigsaw segmentation through the jigsaw log, and feeds back the data status, without the need to add additional data authority management, and reduces the authority management risk. After obtaining the written data, the data is modified based on the written data and the original data after the jigsaw segmentation to obtain the modified data block, and the jigsaw log is updated according to the modified data block, and the updated jigsaw log is determined to save the data modification record, so that when it is monitored that the updated jigsaw log does not match the preset channel information, the rollback of the modified data block is triggered to prevent illegal tampering, enhance the data security protection capability and data recovery capability, and ensure data security.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data protection method, device, equipment and storage medium. Background Art

[0002] Data is the life of an enterprise, and enterprises have regarded key data as the basis for normal operations. Once a data disaster occurs, the overall work will be paralyzed, causing immeasurable losses. There are many ways to protect key business data. The two most commonly used methods are to establish permissions and encrypt sensitive data. Among them, by establishing permissions, the operating system can provide protection against data loss caused by employees' misoperation, but establishing permission policies is to establish access rights from the user / system access level. Once malicious permissions are obtained, the risk is greater. By encrypting sensitive data, data leakage is prevented and data protection is played, but data encryption and decryption are required during data use, which reduces the convenience of data use. How to balance reducing the risk of data access rights and improving access convenience, and realizing the multi-faceted nature of data protection, has become a problem that needs to be solved urgently. Summary of the invention

[0003] The main purpose of the present invention is to provide a data protection method, device, equipment and storage medium, aiming to solve the technical problem of how to achieve multi-faceted data protection.

[0004] To achieve the above object, the present invention provides a data protection method, comprising the following steps:

[0005] Perform jigsaw segmentation on the original data, and generate jigsaw logs corresponding to the original data after the jigsaw segmentation;

[0006] Acquire write data, modify data based on the write data and original data after puzzle segmentation to obtain modified data blocks, and update the puzzle log according to the modified data blocks to determine the updated puzzle log;

[0007] If the updated puzzle log does not match the preset channel information, the modified data block is rolled back.

[0008] Optionally, the step of generating a puzzle log corresponding to the original data after puzzle segmentation includes:

[0009] Obtaining original data blocks after jigsaw segmentation of the original data;

[0010] Calculating a check value of the original data block, obtaining current channel information of the original data block, and calculating a cryptographic check value based on the current channel information and the check value;

[0011] Storing the original data block in a data storage area, and obtaining the serial number of the data storage area;

[0012] A puzzle log is generated according to the current channel information, the check value, the password check value and the number.

[0013] Optionally, the step of performing data modification based on the written data and the original data after the puzzle segmentation to obtain a modified data block, and updating the puzzle log according to the modified data block, and determining to update the puzzle log includes:

[0014] Obtaining the write number carried by the write data, traversing the numbers of the data storage area storing the original data block, and determining whether there is a modification number matching the write number among the numbers;

[0015] If yes, modifying the original data block corresponding to the modification number based on the written data to obtain a modified data block;

[0016] Calculating an update check value of the modified data block, obtaining update channel information of the modified data block, and calculating an update password check value based on the update channel information and the update check value;

[0017] The puzzle log is updated according to the update channel information, the update check value, the update password check value and the modification number to generate an update puzzle log.

[0018] Optionally, if the updated puzzle log does not match the preset channel information, the step of rolling back the modified data block includes:

[0019] Calculating a channel password check value based on preset channel information and the update check value, and monitoring the update password check value in the update puzzle log;

[0020] Determining whether the update password check value matches the channel password check value;

[0021] If not, it is determined that the updated puzzle log does not match the preset channel information, and the modified data block is rolled back.

[0022] Optionally, before the step of rolling back the modified data block if the updated puzzle log does not match the preset channel information, the step further includes:

[0023] Determine a first puzzle corresponding to the original data, and determine a modification number corresponding to the update puzzle log;

[0024] Based on the written data, the data block in the data storage area corresponding to the modification number in the first puzzle is updated to a modified data block to obtain a second puzzle.

[0025] Optionally, the step of rolling back the modified data block includes:

[0026] Determine the original data block corresponding to the modification number;

[0027] The modified data block is rolled back according to the original data block and the second puzzle.

[0028] Optionally, the data protection method further includes:

[0029] Monitor in real time whether the updated puzzle log matches the preset channel information and record the monitoring results;

[0030] If the monitoring result does not conform to the preset behavior rule, the data writing channel is locked and a puzzle report is output.

[0031] In addition, to achieve the above object, the present invention also provides a data protection device, the device comprising:

[0032] A data segmentation module is used to segment the original data into puzzle pieces and generate puzzle logs corresponding to the original data after the puzzle segmentation;

[0033] A data modification module, used for acquiring written data, performing data modification based on the written data and the original data after puzzle segmentation to obtain a modified data block, and updating the puzzle log according to the modified data block to determine the updated puzzle log;

[0034] A data rollback module is used to roll back the modified data block if the updated puzzle log does not match the preset channel information.

[0035] In addition, to achieve the above-mentioned purpose, the present invention also provides a data protection device, which includes a memory, a processor, and a data protection program stored in the memory and executable on the processor, wherein: when the data protection program is executed by the processor, the steps of the data protection method described above are implemented.

[0036] In addition, to achieve the above-mentioned purpose, the present invention further provides a storage medium, on which a data protection program is stored, and when the data protection program is executed by a processor, the steps of the data protection method described above are implemented.

[0037] The present invention proposes a data protection method, device, equipment and storage medium, which performs puzzle segmentation on original data, protects data down to the data block level, retains the convenience of data access, realizes refined data protection, obtains the puzzle log corresponding to the original data after puzzle segmentation, and records the puzzle log. The information after puzzle segmentation of the original data is associated with the puzzle log, and the data status is fed back without additional data permission management, thereby reducing the permission management risk. After obtaining the written data, the data is modified based on the written data and the original data after puzzle segmentation, and the updated puzzle log is determined to save the data modification record, so that when it is monitored that the updated puzzle log does not match the preset channel information, the written data is triggered to be rolled back to prevent illegal tampering, enhance data security protection capabilities and data recovery capabilities, and ensure data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a structural diagram of a data protection device of a hardware operating environment involved in an embodiment of the present invention;

[0039] Figure 2 This is a flow chart of a first embodiment of a data protection method of the present invention;

[0040] Figure 3 A schematic diagram of generating a jigsaw log according to an embodiment of the present invention;

[0041] Figure 4 A schematic diagram of updating puzzle log generation according to an embodiment of the present invention;

[0042] Figure 5 A schematic diagram of writing a data puzzle generation according to an embodiment of the present invention;

[0043] Figure 6 This is a schematic diagram of data block rollback according to an embodiment of the present invention;

[0044] Figure 7 This is a schematic diagram of channel locking according to an embodiment of the present invention;

[0045] Figure 8 The figure is a schematic diagram of the structure of a data protection device according to an embodiment of the present invention.

[0046] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0047] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0048] Reference Figure 1 , Figure 1 It is a schematic diagram of the structure of a data protection device in a hardware operating environment involved in an embodiment of the present invention.

[0049] like Figure 1 As shown, the data protection device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0050] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the data protection device, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0051] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a data storage module, a network communication module, a user interface module and a data protection program.

[0052] exist Figure 1 In the data protection device shown, the network interface 1004 is mainly used for data communication with other devices; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the data protection device of the present invention can be set in the data protection device, and the data protection device calls the data protection program stored in the memory 1005 through the processor 1001, and executes the data protection method provided by the embodiment of the present invention.

[0053] The embodiment of the present invention provides a data protection method, referring to Figure 2 , Figure 2 It is a flowchart of a first embodiment of a data protection method of the present invention.

[0054] In this embodiment, the data protection method includes:

[0055] Step S100, performing jigsaw segmentation on the original data to generate a jigsaw log corresponding to the original data after the jigsaw segmentation;

[0056] In this embodiment, it should be noted that data protection is protection down to the data block level. For the channel open data write permission that the user has applied for, a jigsaw data copy is performed on the changed data when the data is written. If an abnormal write or abnormal attack is found in the channel, the channel for data writing can be closed, and the data tampered with by the channel can be rolled back through the jigsaw as needed. Specifically, the original data is stored in the jigsaw storage area, which includes a data jigsaw log area, a data storage area, a data block HASH (hash) verification area, and a channel information table. The original data is jigsaw segmented, which is the process of performing jigsaw cutting operations on the block data in the existing original storage and storing them in the jigsaw storage area. The jigsaw segmentation cuts the original data into multiple data blocks. The original data can be cut according to the preset data block size, such as 64K, 128K, 256K or 512K. The puzzle log is used to record the information of each data block corresponding to the original data after cutting. The puzzle log includes one or more of the data storage area number corresponding to each data block, the HASH value (the value calculated based on the data block), the channel information, the timestamp information, and the HASH2 value (the value calculated based on the channel information and the HASH value). The puzzle log may also include other information associated with each data block, which is not limited here.

[0057] Specifically, after the original data is segmented into puzzle pieces, a puzzle log corresponding to the original data after segmentation is generated, and the puzzle log is stored in the data puzzle log area.

[0058] Step S200, obtaining written data, performing data modification based on the written data and the original data after puzzle segmentation to obtain modified data blocks, and updating the puzzle log according to the modified data blocks to determine the updated puzzle log;

[0059] In this embodiment, it should be noted that the written data refers to the data when the user writes data through the channel that has been applied for. Data writing is to modify the original data, which may include operations such as replacing, adding, and deleting the original data. The original data is segmented into a jigsaw puzzle, and the original data is cut into multiple original data blocks, which are stored in different data storage areas in sequence. When the channel data is detected to be written, based on the data storage area information corresponding to the written data, the original data block that needs to be modified is found, the written data is written into the corresponding data storage area, and the original data block in the data storage area is modified to obtain a modified data block. That is, the modified data block refers to the new data block obtained after the original data block is modified. Since the jigsaw puzzle log records the information of each data block after the original data is cut, the original data block is modified to obtain a modified data block, that is, a modified data block, and the jigsaw puzzle log corresponding to the modified data block will have information changes compared to the jigsaw puzzle log corresponding to the original data block. Updating the jigsaw puzzle log refers to the jigsaw puzzle log corresponding to the modified data block generated after a data block of the original data is modified, that is, the jigsaw puzzle log corresponding to the data storage area of ​​the modified data block is updated. In addition, if the written data is to append the original data rather than to modify the original data block in the data storage area, the additional written data is written into the puzzle storage area to obtain the modified data block, and the data storage area storing the modified data block is numbered, and a corresponding update puzzle log is generated.

[0060] Specifically, the write data written by the channel is obtained, and according to the data storage area number information carried by the write data, the original data in the data storage area with the corresponding number is modified. After modifying the original data block, a modified data block is obtained, and based on the information corresponding to the modified data block, an update puzzle log is generated, and the update puzzle log is stored in the data puzzle log area.

[0061] Step S300: If the updated puzzle log does not match the preset channel information, the modified data block is rolled back.

[0062] In this embodiment, it should be noted that not all modifications to the data blocks in the data storage area are legal modifications. When encountering malicious tampering, data security issues will be faced. In this embodiment, whether the writing of data is legal is determined by verifying whether the updated puzzle log matches the preset channel information. The updated puzzle log contains relevant information about the data blocks in the data storage area, such as the data storage area number, HASH value, channel information, timestamp information, and HASH2 value corresponding to each data block. The preset channel information is the channel information obtained by the user through application, including relevant information of the channel for data writing, such as the channel unique code, channel password, and channel authority. When verifying whether the updated puzzle log matches the preset channel information, it can be done by judging whether the channel information in the updated puzzle log is consistent with the preset channel information; it can also be done by obtaining specific channel information in the updated puzzle log, such as a channel password, and then comparing the specific channel information in the updated puzzle log with the corresponding specific channel information in the preset channel information to judge whether the updated puzzle log matches the preset channel information; it can also be done by obtaining a HASH2 value calculated based on a HASH value and a channel password in the updated puzzle log, and comparing it with a HASH2 value calculated based on the channel password in the preset channel information and the HASH value in the updated puzzle log, and then comparing it with the channel password after packaging to judge whether the updated puzzle log matches the preset channel information. Rolling back written data refers to the process of recovering data and rolling back to the data before the data was written when the current data is considered to be illegally written.

[0063] Specifically, after determining to update the puzzle log, it is determined whether the updated puzzle log matches the preset channel information. When the updated puzzle log does not match the preset channel information, the modified data block is rolled back and the recovery data is written into the previous data block.

[0064] In an embodiment of the present invention, the original data is segmented into puzzle pieces, and data protection is extended to the data block level, thereby retaining the convenience of data access and realizing refined data protection. A puzzle log corresponding to the original data after puzzle segmentation is generated, and the information after puzzle segmentation of the original data is associated with the puzzle log to feedback the data status, without the need for additional data authority management, thereby reducing the authority management risk. After obtaining the write data, the data is modified based on the write data and the original data after puzzle segmentation to obtain a modified data block, and the puzzle log is updated according to the modified data block, the update puzzle log is determined, and the data modification record is saved, so that when it is monitored that the updated puzzle log does not match the preset channel information, the rollback of the modified data block is triggered to prevent illegal tampering, enhance the data security protection capability and data recovery capability, and ensure data security.

[0065] Furthermore, based on the first embodiment of the data protection method of the present invention, a second embodiment of the data protection method of the present invention is proposed, wherein the step of generating a puzzle log corresponding to the original data after puzzle segmentation includes:

[0066] Step a, obtaining the original data blocks after jigsaw segmentation of the original data;

[0067] In this embodiment, it should be noted that the original data block refers to a data block obtained after segmenting the original data, and there are multiple data blocks. The original data can be segmented according to a pre-set data block size to divide the original data into data blocks of equal size. It can also be other segmentation methods to evenly segment the original data.

[0068] Step b, calculating the check value of the original data block, obtaining the current channel information of the original data block, and calculating the password check value based on the current channel information and the check value;

[0069] In the present embodiment, it should be noted that the check value of the original data block is calculated by calculating the original data block. In the present embodiment, the HASH value of the calculated data is used as the check value, that is, the HASH value of the data block stored in the data storage area is calculated as the check value. For example, the HASH value of the data block is obtained by the hash algorithm MD5 message digest algorithm (MD5 Message-DigestAlgorithm, message digest algorithm), and the HASH value of the data block is obtained by the hash algorithm SHA-1 (Secure HashAlgorithm 1, secure hash algorithm 1). In one embodiment, the check value can also be a value obtained by other calculation methods for data verification. The check value is used to verify the data block and is stored in the data block HASH check area of ​​the puzzle storage area. For example, the corresponding HASH values ​​are calculated for the data blocks written in the data storage area, and the HASH value of the data block calculated is HASH1, then HASH1 is stored in the HASH validation area corresponding to the data block.

[0070] In this embodiment, it should be noted that the channel information refers to the channel information obtained by the user through the application, and the user writes data through the applied channel. The current channel information is the relevant information of the channel corresponding to the current data writing. The channel information includes the channel code CNXX, the channel password CPW and the channel permission CPRW. The channel number CNXX, the channel password CPW and the channel permission CPRW need to be recorded in the channel information table. Among them, the channel code is the only code that the legal user writes legally through VPN information, bastion host information, user account and password and other information. Channel permissions are combined with the advantages of file permission protection to grant permissions to the channel. Channel permissions are divided into three types: RO, RW, and --. RO means Read Open, read-only permission; RW means Read Write, read and write permission; -- means no permission. The password check value refers to the check value associated with the channel password. For example, when the check value is HASH1, the formula for calculating the password check value HASH2 is: HASH2 value = HASH (channel password + HASH1). Calculating the HASH2 value can avoid channel password leakage. The channel password is encrypted with HASH, and the HASH value (HASH1) corresponding to the channel password and the data block is combined to make the HASH value of the channel password variable.

[0071] Specifically, a check value corresponding to an original data block in a data storage area is obtained through an algorithm, and after obtaining current channel information corresponding to the original data block, a password check value is calculated based on the current channel information and the check value.

[0072] Step c, storing the original data block into a data storage area, and obtaining the serial number of the data storage area;

[0073] In this embodiment, it should be noted that the jigsaw puzzle storage area for storing data includes a plurality of data storage areas, and the data storage areas store the segmented data blocks. The data storage areas and the segmented data blocks are not limited to a one-to-one corresponding quantity relationship, and the data storage areas can have more numbers than the data blocks, and can be used to store the additional data blocks when the original data is appended and modified. Each data storage area has a unique number, and the number can be the numbering of each data storage area before the original data is segmented, or the numbering of each data storage area while the data is segmented, or the data segmentation is performed first, and after the segmented data blocks are stored in the data storage area, each data storage area is numbered. For example, each data block {25 3D 97 94 0C 445A A1 9F} after the original data is segmented is copied and sequentially stored in a data storage area numbered {A1 A2 A3 B1 B2 B3 C1 C2 C3}. The data storage area numbers after copying and the corresponding original data blocks are as follows: A1:25, A2:3D, A3:97, B1:94, B2:0C, B3:44, C1:5A, C2:A1, C3:9F.

[0074] Specifically, the original data is segmented to obtain a plurality of original data blocks, the plurality of original data blocks are copied sequentially to data storage areas with numbers, and the number corresponding to the data storage area where each original data block is stored is determined.

[0075] Step d: generating a puzzle log according to the current channel information, the check value, the password check value and the number.

[0076] The puzzle log is used to record the information of each data block corresponding to the original data after cutting. The puzzle log includes the data storage area number corresponding to the data block, check value, channel code, channel authority, password check value, and the timestamp T of the data block update time. After determining the current channel information, the puzzle log is generated in combination with the check value corresponding to the data block. For example, the puzzle log corresponding to the data storage area numbered C2: C2: HASH1: CNO1: CPRW: HASH2: T is stored in the puzzle log table, where C2 is the data storage area number corresponding to the data block, HASH1 is the check value calculated for the data block in the C2 data storage area, CNO1 is the channel code corresponding to the channel when the data block is written, CPRW is the corresponding channel authority, HASH2 is the password check value, calculated using the channel password and HASH1, and T is the puzzle modification time.

[0077] Specifically, the write channel corresponding to the data block in the data storage area is determined, the current channel information corresponding to the write channel is obtained, and based on the current channel information, the check value corresponding to the data block and the password check value are combined to generate a puzzle log.

[0078] refer to Figure 3 , Figure 3 In the example, the original data {25 3D 97 94 0C 44 5A A1 9F} is segmented and stored in the data storage areas numbered {A1 A2 A3 B1 B2 B3 C1 C2 C3}. The data storage area numbers correspond to the original data blocks as follows: A1:25, A2:3D, A3:97, B1:94, B2:0C, B3:44, C1:5A, C2:A1, C3:9F. The sub-block data C3:9F is determined to have a check value of 32D1 obtained by HASH calculation, that is, HASH1=32D1. According to the channel information table, the current channel information is obtained: CNO1:CPW:CPRW, and combined with the check value to generate the puzzle log corresponding to each data block: C3:HASH1:CNO1:CPRW:HASH2:T, which is stored in the puzzle log area.

[0079] By segmenting the original data, data protection is extended to the data block level, and by recording puzzle logs to record the writing of puzzle data by users or programs, refined data protection is achieved to improve data security.

[0080] Further, data modification is performed based on the written data and the original data after the puzzle segmentation to obtain a modified data block, and the puzzle log is updated according to the modified data block. The step of determining to update the puzzle log includes:

[0081] Step e, obtaining the write number carried by the write data, traversing the numbers of the data storage area storing the original data block, and determining whether there is a modification number matching the write number among the numbers;

[0082] In the present embodiment, it should be noted that when the original data is modified, new data will be written, i.e., the write data. When the write data is written into the channel, it will carry the number corresponding to the data storage area to which the data is about to be written, i.e., the write number. Through the write number carried by the write data itself, the original data block that needs to be modified by the write data can be determined, and then the original data block that needs to be modified is modified to obtain the modified data block. The data storage areas that store the original data blocks are all numbered. Based on the write number, the numbers corresponding to each data storage area are traversed to determine whether there is a data storage area number that is consistent with the write number carried by the write data among all the data storage area numbers storing the original data blocks. If so, the data storage area number that matches the write number carried by the write data is used as the modification number. When there is no data storage area number matching the write number carried by the write data in the data storage area number storing the original data block, it can be determined that the write data is additional data, and the additional data is stored in a data storage area that currently does not store data blocks, and a modified data block corresponding to the additional data is obtained. Based on the relevant information of the modified data block corresponding to the additional data, channel information, and data storage area information, an update puzzle log is generated.

[0083] Specifically, the write number carried by the write data is obtained, the numbers corresponding to all data storage areas storing the original data blocks are determined, and the numbers of the data storage areas are traversed to see if there is a number matching the write number, and the number of the data storage area matching the write number is used as the modification number.

[0084] Step f: if yes, modify the original data block corresponding to the modification number based on the written data to obtain a modified data block;

[0085] In this embodiment, it should be noted that modifying a data block refers to replacing the data of an original data block. When modifying the original data, the data storage area where the write data is written is determined by obtaining the write number carried by the write data, and the write data is written into the data storage area to complete the modification of the original data block. The data in the data storage area after the modification is the modified data block.

[0086] Specifically, the write data is written into the data storage area corresponding to the modification number, the modification of the original data is completed, and the modified data block is obtained.

[0087] Step g, calculating an update check value of the modified data block, obtaining update channel information of the modified data block, and calculating an update password check value based on the update channel information and the update check value;

[0088] In this embodiment, it should be noted that the update check value, update channel information, and update password check value are updates to the check value, current channel information, and password check value in the original puzzle log, respectively. After determining the modified data block, calculate the HASH value of the modified data block as the update check value; obtain the channel information when the modified data block is written, that is, the update channel information, determine the channel code, channel password, and channel authority in the updated channel information, and the update password check value is an update check value associated with the channel password in the updated channel information. Specifically, after determining the modified data block, calculate the update check value of the modified data block, obtain the update channel information written by the modified data block, associate the updated channel information with the update check value, and obtain the update password check value.

[0089] Step h, updating the puzzle log according to the update channel information, the update check value, the update password check value and the modification number to generate an update puzzle log.

[0090] The update puzzle log refers to the updated puzzle log, which is used to record the information related to the data blocks in the data storage area after the modification. That is, the puzzle log of the modified data block corresponding to the write number. For example, when modifying the original data block in the data storage area numbered C2, the modified data block is written to the C2 data storage area, and the HASH value is calculated based on the modified data block to obtain NHASH1, that is, the update verification value. And the HASH2 value is calculated based on the HASH value to obtain NHASH2, that is, the update password verification value. And record the write time T' of the current write data, combined with the channel number CNO1 and channel authority CPRW in the channel information corresponding to the channel where the write data is written, and finally generate the update puzzle log: C2:NHASH1:CNO1:CPRW:NHASH2:T'. In addition, if the modification of the original data is to append the original data, that is, when a new data block is added based on the original data, there is no need to write data to replace the original data. The additional data is written into the data storage area of ​​the puzzle storage area, and the number of the data storage area, the channel information corresponding to the additional data, and the timestamp of the additional data are obtained. The HASH value of the additional data is calculated, and the puzzle log corresponding to the additional data is generated and recorded in the target puzzle log table. Figure 4 , Figure 4 In the process, the data block numbered C2 in the data storage area is modified through channel writing, C2:A1 is modified to C2:AF, the original data block C2:A1 is backed up, the current timestamp T' is obtained, and the puzzle log is updated in the target puzzle log table: C2:NHASH1:CNO1:CPRW:NHASH2:T', and the original data block puzzle log corresponding to the puzzle backup area is added to the historical puzzle log table: C2`:HASH1:CNO1:CPRW:HASH2:T.

[0091] By recording the relevant information corresponding to the modified data blocks in the update puzzle log, data modification traces are retained, the data recoverability is increased, and the effectiveness of data protection is improved.

[0092] Furthermore, in this embodiment, when data modification is performed, the original data is backed up. Specifically, the original data block corresponding to the modification number is copied to the puzzle backup area, and the puzzle log corresponding to the puzzle backup area is recorded in the historical puzzle log table;

[0093] In this embodiment, it should be noted that in order to protect the data from being illegally tampered with, when the data is modified, the original data block that has been modified will be backed up so that data recovery can be performed when the data writing is abnormal. The puzzle backup area refers to the area where the original data block is backed up. The puzzle backup area is similar to the data storage area, which is used to store data blocks and has a number. The number of the puzzle backup area is associated with the number of the data storage area, and the number of the puzzle backup area is associated with the number of the data storage area corresponding to the data block backed up. After the write data is obtained, before the data storage area corresponding to the modification number is about to write the write data, the original data block in the data storage area of ​​the modification number is backed up and copied to the puzzle backup area, and the puzzle log corresponding to the original data block is recorded based on the puzzle backup area, and the puzzle log is stored in the historical puzzle log table. The puzzle storage area includes a data puzzle log area for storing a puzzle log table. The puzzle log table is used to record puzzle logs, and the data puzzle log area includes a target puzzle log table and a historical puzzle log table. The puzzle log reflects the relevant information of the data blocks in each data storage area. By recording the puzzle log after the data block is modified and updated in the target puzzle log table, the modification and update operation of the data block can be fed back. By recording the puzzle log of the data block backup in the historical puzzle log table, the data block information before the data is updated and modified can be fed back. After the original data block corresponding to the write number is copied to the puzzle backup area, the number of the puzzle backup area is obtained, and the puzzle log corresponding to the puzzle backup area is generated based on the number of the puzzle backup area and the puzzle log corresponding to the original data block. For example, after the data block C2:A1 corresponding to the data storage area with the write number C2 is copied to the puzzle backup area with the number C2`, based on the number C2` of the puzzle backup area and the puzzle log corresponding to the original data block: C2:HASH1:CNO1:CPRW:HASH2:T, the puzzle log corresponding to the puzzle backup area is added to the historical puzzle log table: C2`:HASH1:CNO1:CPRW:HASH2:T. After backing up the original data blocks, the puzzle log is recorded based on the puzzle backup area to provide a basis for data recovery if the data blocks are to be restored later.

[0094] Specifically, determine the original data block in the data storage area corresponding to the write number, copy the original data block to the puzzle backup area, obtain the number corresponding to the puzzle backup area, generate the puzzle log corresponding to the puzzle backup area, and record it in the historical puzzle log table.

[0095] When modifying the original data block, the modified original data block is backed up so that data can be restored in the face of malicious tampering, thereby improving data protection capabilities; for data modifications, the puzzle log corresponding to the original data and the updated puzzle log corresponding to the written data are recorded to feedback data changes, retain data modification traces, and improve data repair defense capabilities.

[0096] Furthermore, if the updated puzzle log does not match the preset channel information, the step of rolling back the modified data block includes:

[0097] Step i, calculating a channel password check value based on preset channel information and the update check value, and monitoring the update password check value in the update puzzle log;

[0098] In this embodiment, it should be noted that there is a risk of illegal input for the modification of data. By setting a verification mechanism, real-time monitoring of data can be achieved to prevent malicious tampering of data. In this embodiment, verification is performed by updating the password check value. The preset channel information refers to the channel information corresponding to the channel where data is written when the data block is modified and updated. After determining the update check value, the password check value corresponding to the write channel is calculated in combination with the update check value and the preset channel information as the channel password check value. The channel password check value is used to compare the update password check value in the update puzzle log to determine whether the update password check value in the update puzzle log is correct. In this embodiment, the channel password in the preset channel information is combined with the update check value to calculate the channel password check value. When the update check value is HASH1 and the channel password is CPW, the channel password check value is (HASH1+CPW). Since the HASH1 corresponding to each data block is different, the channel password is packaged by HASH1, which can make the channel password have variability to achieve protection of the channel password. Real-time monitoring of the update puzzle log is performed to obtain the update password check value corresponding to the update puzzle log. In another embodiment, the update puzzle log may be monitored regularly. In this embodiment, the update password verification value corresponding to the update puzzle log is the HASH2 value in the update puzzle log. The HASH2 value is a combination of the HASH1 of the data block corresponding to the update puzzle log and the channel password corresponding to the channel when the data block is written. That is, in this embodiment, the verification mechanism for whether the data modification is legal is actually whether the channel password corresponding to the channel when the data block corresponding to the update puzzle log is written is consistent with the preset channel password of the channel.

[0099] Specifically, the channel password is determined by preset channel information, a channel password check value is calculated in combination with the channel password, and the updated password check value in the updated puzzle log is monitored in real time.

[0100] Step j, determining whether the updated password check value matches the channel password check value;

[0101] Determine the update password check value corresponding to the update puzzle log, which in this embodiment is the HASH2 value in the update puzzle log. The HASH2 value is a combination of the HASH1 of the data block corresponding to the update puzzle log and the channel password corresponding to the channel when the data block is written. The judgment of whether the update password check value in the update puzzle log matches the channel password check value is whether the password check value in the update puzzle log is consistent with the channel password check value.

[0102] Step k: if not, it is determined that the updated puzzle log does not match the preset channel information, and the modified data block is rolled back.

[0103] Verify whether the update password check value in the update puzzle log matches the channel password check value. If not, it can be determined that the channel password corresponding to the channel at the time of writing the modified data block corresponding to the update puzzle log is inconsistent with the preset channel password of the channel. At this time, it can be considered that the update puzzle log does not match the preset channel information. The update of the modified data block corresponding to the update puzzle log has the risk of illegal writing, and the modified data block needs to be rolled back and replaced with the data before the modification. If the update password check value in the update puzzle log matches the channel password check value, it can be considered that the modified data block corresponding to the update puzzle log is updated as a legal modification and the data is in a safe state.

[0104] It is understandable that when judging the legitimacy of data writing, it can also be judged based on channel permissions, and whether the updated puzzle log matches the preset channel information can be determined by judging whether the channel permissions in the updated puzzle log are consistent with the channel permissions in the preset channel information. It can also be determined whether the updated puzzle log matches the preset channel information by simultaneously using whether the channel permissions and channel passwords in the updated puzzle log are consistent with the channel permissions and channel passwords in the preset channel information.

[0105] By performing data legitimacy verification on the update password check value and the channel password check value in the update puzzle log, it is ensured that all modifications to the data block are written legally, thereby improving the effectiveness of data protection.

[0106] Furthermore, if the updated puzzle log does not match the preset channel information, before the step of rolling back the modified data block, the method further includes:

[0107] Step 1, determining the first puzzle corresponding to the original data, and determining the modification number corresponding to the updated puzzle log;

[0108] In this embodiment, it should be noted that when storing data, the original data is divided into multiple data blocks through puzzle segmentation and then copied to different data storage areas, so as to facilitate data modification and updating. After the modification of the data block is completed, the new modified data block has been stored in the data storage area. At this time, the data blocks in each data storage area are spliced ​​to determine the entire puzzle that integrates all data blocks. The first puzzle refers to the puzzle of the original data, which is the puzzle assembled after the original data is cut and copied to different data storage areas. After the original data is modified, an update puzzle log is generated. At this time, the data in the data storage area is the modified write data, and the data storage area corresponding to the write data needs to be spliced ​​with the data storage area of ​​other data blocks that have not been modified.

[0109] Specifically, the first puzzle corresponding to the original data is obtained, and the number of the data storage area modified by the data block corresponding to the update puzzle log, that is, the modification number, is determined.

[0110] Step m: based on the written data, update the data block in the data storage area corresponding to the modification number in the first puzzle to a modified data block to obtain a second puzzle.

[0111] In this embodiment, it should be noted that the second puzzle is to assemble the data puzzle by integrating the modified data storage areas based on the new data block written after modifying the original data block. When the written data is written, it will carry a write number, determine the modification number that matches the write number in the number of the data storage area where the data block is stored, and update the data block in the data storage area according to the modification number, and update the data block to a modified data block. When the data in the data storage area corresponding to the modification number is replaced with the written data, an update puzzle log corresponding to the written data is generated. When the target puzzle log table detects an update to the puzzle log, the puzzle protection operation is triggered, and the data storage area corresponding to the write number is assembled with the remaining data storage areas that have not been modified to obtain the second puzzle.

[0112] refer to Figure 5 , Figure 5 In the process, when an updated puzzle log is detected according to the target puzzle log table corresponding to the puzzle log, the puzzle is triggered, the channel is modified for the data C2:A1 in the data storage area numbered C2, the modified data block C2:AF in the C2 data storage area is obtained, the first puzzle piece T1 corresponding to the original data block is combined with the puzzle piece C2:AF corresponding to the written data to obtain the second puzzle piece T2.

[0113] The original data block is modified through the number of the data storage area, and a new puzzle is generated to obtain a new whole block of data, thereby ensuring the integrity of the data and avoiding data loss.

[0114] Furthermore, the step of rolling back the modified data block includes:

[0115] Step n, determining the original data block corresponding to the modification number;

[0116] In this embodiment, it should be noted that after the original data is modified, if the update puzzle log does not match the preset channel information, it is considered that there is an abnormality in the update puzzle log, and the current data modification has the risk of illegal writing. It is necessary to roll back the modified and written data and restore the data to the state before the modification. Before modifying the data, a backup is made for the original data block that needs to be modified. When the data block is rolled back, the time node corresponding to the abnormal update puzzle log and the data storage area number corresponding to the abnormal update puzzle log where the data block is modified, that is, the modification number, are determined, and the backed-up original data block is replaced with the modified data block that has been modified in the data storage area corresponding to the modification number.

[0117] In this embodiment, it should be noted that the second puzzle refers to a data puzzle generated after abnormal data modification. When performing data rollback, it is necessary to restore the data of the second puzzle that currently has the risk of abnormal data being written, and the update puzzle log does not match the preset channel information. The timestamp in the update puzzle log is obtained, and the second puzzle corresponding to the timestamp is determined, that is, the data puzzle that needs to be restored, and the modification number in the update puzzle log is obtained. The number of the puzzle backup area is associated with the data storage area number, and the number of the puzzle backup area corresponds to the data storage area number corresponding to the data block backed up by it. The data storage area corresponding to the data storage area number corresponding to the data block backed up is the data storage area for data writing, and the data storage area number corresponds to the modification number. The puzzle backup area number associated with the modification number is obtained from the puzzle backup area, and the original data block in the puzzle backup area corresponding to the puzzle backup area number is obtained.

[0118] Specifically, the jigsaw backup area number corresponding to the modification number is determined, and the original data block in the jigsaw backup area corresponding to the jigsaw backup area number is obtained.

[0119] Step o: rolling back the modified data block according to the original data block and the second puzzle.

[0120] After determining the original data block in the puzzle backup area, the data block in the data storage area corresponding to the modification number in the updated puzzle log with the exception in the second puzzle is rolled back to the original data block.

[0121] In one embodiment, in the rollback of the data block, the original data block can also be determined by, when it is determined that there is an abnormality in the update puzzle log, determining the timestamp of the abnormal puzzle behavior from the abnormal update puzzle log, finding the previous moment corresponding to the time of the timestamp, determining the puzzle log corresponding to the previous moment, and determining the original data block in the puzzle backup area corresponding to the puzzle backup area number according to the puzzle backup area number corresponding to the puzzle log corresponding to the previous moment. The original data block is rolled back.

[0122] refer to Figure 6 , Figure 6 In the process, the puzzle log is used to check whether an alarm is triggered. If it is detected that the updated puzzle log in the target puzzle log table does not match the information in the channel information table, an alarm is triggered and the puzzle is rolled back. When the data block C2:WT in the data storage area corresponding to C2 is illegally written data, the data in the data storage area of ​​the C2 number is determined to be C2:AF from the original data puzzle T2, and the data C2:AF is rolled back and stored again in the data storage area corresponding to the C2 number.

[0123] When it is determined that there is a risk of illegal writing of written data, the data is rolled back to prevent the data from being maliciously tampered with, and the data is restored to ensure data security and enhance the defense capability of data protection.

[0124] Furthermore, the data protection method further includes:

[0125] Step p, real-time monitoring of whether the updated puzzle log matches the preset channel information, and recording the monitoring results;

[0126] In this embodiment, it should be noted that during daily data maintenance, the updated puzzle log in the target puzzle log table is monitored in real time to see if there is any abnormality, so as to ensure data security. The updated puzzle log is monitored in real time to see if it matches the preset channel information, and the result of each monitoring is recorded for reference to data defense. When monitoring the updated puzzle log, it can be real-time monitoring or timed monitoring at preset intervals.

[0127] Step q: if the monitoring result does not conform to the preset behavior rule, the data writing channel is locked and a puzzle report is output.

[0128] In this embodiment, it is mainly explained that the preset behavior rule refers to a pre-set criterion for periodic determination of the monitoring results of the updated puzzle log, for example, limiting the number of abnormal updates of the puzzle log, or limiting the frequency of abnormal updates of the puzzle log within a certain period of time. In the process of monitoring the updated puzzle log, the monitoring results are recorded. If the monitoring results violate the preset behavior criteria, the write channel is locked. Specifically, the write channel is locked by modifying the channel permissions in the channel information table corresponding to the write channel. For example, the CNO3 channel has an abnormal write behavior to the puzzle storage area. At this time, the permissions of CNO3 are modified to CNO3:CPW:-- through the channel information table. (Channel permissions-- means no permissions). After locking the write channel, the administrator can also confirm the way to close data writing for abnormal writing when necessary, such as VPN (Virtual Private Network), bastion host, user account, etc.

[0129] In this embodiment, a puzzle report can be generated for data maintenance. The generated puzzle report is displayed visually, and the generation status of the data puzzle is output intuitively, which is provided to the administrator for review and decision-making basis. The administrator can also adjust the frequency of data puzzle triggering according to needs. The puzzle report intuitively displays the data block IO (Input / Output) status, and business management can move or migrate data blocks with frequent IO to storage areas with better performance. The puzzle report can also output the behavior analysis of the channel lock, query and analyze which users or processes have illegally written to the data, and close the channel when necessary to achieve better data protection.

[0130] refer to Figure 7 , Figure 7 In the process, check whether an alarm is triggered through the puzzle log. If it is detected that the updated puzzle log in the target puzzle log table does not match the information in the channel information table, that is, the HASH2 value in the updated puzzle log is not equal to the HASH2 value calculated by the channel information in the channel information table, an alarm is triggered, the puzzle is rolled back, the channel is locked, and the channel information table is modified to lock the channel.

[0131] In daily data maintenance, puzzle logs are monitored and updated in real time, and channels are locked when necessary to ensure data security and persistence, improve data defense capabilities, and output puzzle reports to visually display data status, providing a strong reference for data management.

[0132] In addition, reference Figure 8 The present invention also provides a data protection device, characterized in that the data protection device comprises a data segmentation module 2001, a data modification module 2002, and a data rollback module 2003, wherein:

[0133] The data segmentation module 2001 is used to segment the original data into jigsaw puzzles and generate jigsaw puzzle logs corresponding to the original data after the jigsaw puzzle segmentation;

[0134] The data modification module 2002 is used to obtain the written data, perform data modification based on the written data and the original data after the puzzle segmentation to obtain the modified data block, and update the puzzle log according to the modified data block to determine the updated puzzle log;

[0135] The data rollback module 2003 is used to roll back the modified data block if the updated puzzle log does not match the preset channel information.

[0136] Optionally, the data segmentation module 2001 is further used for:

[0137] Obtaining original data blocks after jigsaw segmentation of the original data;

[0138] Calculating a check value of the original data block, obtaining current channel information of the original data block, and calculating a cryptographic check value based on the current channel information and the check value;

[0139] Storing the original data block in a data storage area, and obtaining the serial number of the data storage area;

[0140] A puzzle log is generated according to the current channel information, the check value, the password check value and the number.

[0141] Optionally, the data modification module 2002 is further used to:

[0142] Obtaining the write number carried by the write data, traversing the numbers of the data storage area storing the original data block, and determining whether there is a modification number matching the write number among the numbers;

[0143] If yes, modifying the original data block corresponding to the modification number based on the written data to obtain a modified data block;

[0144] Calculating an update check value of the modified data block, obtaining update channel information of the modified data block, and calculating an update password check value based on the update channel information and the update check value;

[0145] The puzzle log is updated according to the update channel information, the update check value, the update password check value and the modification number to generate an update puzzle log.

[0146] Optionally, the data rollback module 2003 is further used to:

[0147] Calculating a channel password check value based on preset channel information and the update check value, and monitoring the update password check value in the update puzzle log;

[0148] Determining whether the update password check value matches the channel password check value;

[0149] If not, it is determined that the updated puzzle log does not match the preset channel information, and the modified data block is rolled back.

[0150] Optionally, the data modification module 2002 is further used to:

[0151] Determine a first puzzle corresponding to the original data, and determine a modification number corresponding to the update puzzle log;

[0152] Based on the written data, the data block in the data storage area corresponding to the modification number in the first puzzle is updated to a modified data block to obtain a second puzzle.

[0153] Optionally, the data rollback module 2003 is further used to:

[0154] Determine the original data block corresponding to the modification number;

[0155] The modified data block is rolled back according to the original data block and the second puzzle.

[0156] Optionally, the data rollback module 2003 is further used to:

[0157] Monitor in real time whether the updated puzzle log matches the preset channel information and record the monitoring results;

[0158] If the monitoring result does not conform to the preset behavior rule, the data writing channel is locked and a puzzle report is output.

[0159] The specific implementation of the data protection device of the present invention is basically the same as the various embodiments of the above-mentioned data protection method, and will not be repeated here.

[0160] In addition, the present invention also proposes a data protection device, characterized in that the data protection device includes a memory, a processor, and a data protection program stored in the memory and executable on the processor, wherein: when the data protection program is executed by the processor, the data protection method described in each embodiment of the present invention is implemented.

[0161] In addition, the present invention also provides a storage medium on which a data protection program is stored. The storage medium may be Figure 1The memory 20 in the terminal may also be at least one of a ROM (Read-Only Memory) / RAM (Random Access Memory), a magnetic disk, and an optical disk. The computer-readable storage medium includes a number of instructions for enabling a device with a processor to execute the data protection method described in each embodiment of the present invention.

[0162] It is understood that, in the description of this specification, the description with reference to the terms "one embodiment", "another embodiment", "other embodiments", or "first to Nth embodiments" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0163] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0164] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0165] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0166] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A data protection method, characterized in that: The data protection method comprises the following steps: Perform jigsaw segmentation on the original data, and generate jigsaw logs corresponding to the original data after the jigsaw segmentation; Acquire write data, modify data based on the write data and original data after puzzle segmentation to obtain modified data blocks, and update the puzzle log according to the modified data blocks to determine the updated puzzle log; If the updated puzzle log does not match the preset channel information, the modified data block is rolled back; The step of generating a puzzle log corresponding to the original data after puzzle segmentation includes: Obtaining original data blocks after jigsaw segmentation of the original data; Calculating a check value of the original data block, obtaining current channel information of the original data block, and calculating a cryptographic check value based on the current channel information and the check value; Storing the original data block in a data storage area, and obtaining the serial number of the data storage area; Generate a puzzle log according to the current channel information, the check value, the password check value and the number; The step of modifying the data based on the written data and the original data after the puzzle segmentation to obtain a modified data block, and updating the puzzle log according to the modified data block, and determining to update the puzzle log includes: Obtaining the write number carried by the write data, traversing the numbers of the data storage area storing the original data block, and determining whether there is a modification number matching the write number among the numbers; If yes, modifying the original data block corresponding to the modification number based on the written data to obtain a modified data block; Calculating an update check value of the modified data block, obtaining update channel information of the modified data block, and calculating an update password check value based on the update channel information and the update check value; The puzzle log is updated according to the update channel information, the update check value, the update password check value and the modification number to generate an update puzzle log; If the updated puzzle log does not match the preset channel information, the step of rolling back the modified data block includes: Calculating a channel password check value based on preset channel information and the update check value, and monitoring the update password check value in the update puzzle log; Determining whether the update password check value matches the channel password check value; If not, it is determined that the updated puzzle log does not match the preset channel information, and the modified data block is rolled back.

2. The data protection method according to claim 1, characterized in that: Before the step of rolling back the modified data block if the updated puzzle log does not match the preset channel information, the method further includes: Determine a first puzzle corresponding to the original data, and determine a modification number corresponding to the update puzzle log; Based on the written data, the data block in the data storage area corresponding to the modification number in the first puzzle is updated to a modified data block to obtain a second puzzle.

3. The data protection method according to claim 2, characterized in that: The step of rolling back the modified data block comprises: Determine the original data block corresponding to the modification number; The modified data block is rolled back according to the original data block and the second puzzle.

4. The data protection method according to claim 1, characterized in that: The data protection method further includes: Monitor in real time whether the updated puzzle log matches the preset channel information and record the monitoring results; If the monitoring result does not conform to the preset behavior rule, the data writing channel is locked and a puzzle report is output.

5. A data protection device, characterized in that: The device comprises: A data segmentation module is used to perform jigsaw segmentation on the original data and generate a jigsaw log corresponding to the original data after the jigsaw segmentation; the data segmentation module is also used to obtain the original data block after the jigsaw segmentation of the original data; calculate the check value of the original data block, and obtain the current channel information of the original data block, and calculate the password check value based on the current channel information and the check value; store the original data block in a data storage area and obtain the number of the data storage area; generate a jigsaw log according to the current channel information, the check value, the password check value and the number; A data modification module, used to obtain write data, perform data modification based on the write data and the original data after puzzle segmentation to obtain a modified data block, and update the puzzle log according to the modified data block to determine the updated puzzle log; the data modification module is also used to obtain the write number carried by the write data, traverse the numbers of the data storage areas where the original data blocks are stored, and determine whether there is a modification number matching the write number in each of the numbers; if so, modify the original data block corresponding to the modification number based on the write data to obtain a modified data block; calculate an update check value of the modified data block, obtain update channel information of the modified data block, and calculate an update password check value based on the update channel information and the update check value; update the puzzle log according to the update channel information, the update check value, the update password check value and the modification number to generate an updated puzzle log; A data rollback module is used to roll back the modified data block if the update puzzle log does not match the preset channel information; the data rollback module is also used to calculate the channel password check value based on the preset channel information and the update check value, and monitor the update password check value in the update puzzle log; determine whether the update password check value matches the channel password check value; if not, determine that the update puzzle log does not match the preset channel information, and roll back the modified data block.

6. A data protection device, characterized in that: The device comprises: a memory, a processor, and a data protection program stored in the memory and executable on the processor, wherein the data protection program is configured to implement the steps of the data protection method according to any one of claims 1 to 4.

7. A storage medium, characterized in that: The storage medium stores a data protection program, and when the data protection program is executed by the processor, the steps of the data protection method according to any one of claims 1 to 4 are implemented.

Images