Data secure storage method, device and storage medium

Abstract

The present invention relates to the field of data security, and discloses a data security storage method, device and storage medium. The method comprises: receiving a storage instruction of target data, caching target data, and detecting and processing the target data cached in the virtual memory according to a preset virus detection algorithm to obtain a detection result; when the detection result is qualified, extracting qualified target data from the virtual memory; encrypting and processing the qualified target data according to a preset encryption algorithm to obtain encrypted data; partitioning the system memory to obtain N sub-partition memories, where N is a positive integer; splitting the encrypted data into M encrypted sub-data, and storing the M encrypted sub-data in order in the N sub-partition memories, where M is a positive integer less than N. In the embodiment of the present invention, secure storage of data is achieved, the possibility of data loss is reduced, and the information security of users is improved.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a data security storage method, device and storage medium. Background Art

[0002] In the past decade or so, due to the rapid development of society, various Internet products have also developed rapidly. On various Internet devices, the core is the system. The system manages various software and is linked to the screen. Various software information and user information are stored in the system.

[0003] Data security in the system is very important to users. Once the data in the device system is stolen, it may lead to data leakage, and if the data is confidential, it will cause property loss. Therefore, research on data security protection is a practical and urgent need. At present, the data transmission and storage in most systems on the market have not been specially processed. Generally, the account information of various software can be directly seen in the storage system. Once the device is lost, the various account information in the device will be queried by other users, and data leakage may occur at any time. Therefore, in view of the technical problem that the current device storage data is not secure enough and can be easily stolen by others to obtain the stored data, a new technology is needed to solve the current problem. Summary of the invention

[0004] The main purpose of the present invention is to solve the technical problem that the security of device storage data is insufficient and the storage data can be easily stolen by others.

[0005] A first aspect of the present invention provides a method for securely storing data, the method comprising:

[0006] receiving a storage instruction of target data, and triggering creation of a virtual memory based on the storage instruction;

[0007] Utilizing the virtual memory to cache the target data, and performing detection processing on the target data cached in the virtual memory according to a preset virus detection algorithm to obtain a detection result;

[0008] When the detection result is qualified, the qualified target data is extracted from the virtual memory;

[0009] According to a preset encryption algorithm, the qualified target data is encrypted to obtain encrypted data;

[0010] Partition the system memory to obtain N sub-partition memories, where N is a positive integer;

[0011] The encrypted data is split into M encrypted sub-data, and the M encrypted sub-data are stored in N sub-partition memories in sequence, where M is a positive integer less than N.

[0012] Optionally, in a first implementation manner of the first aspect of the present invention, splitting the encrypted data into M encrypted sub-data includes:

[0013] Splitting the encrypted data equally into characters to obtain M ordered strings, recording the first characters of the M ordered strings, and obtaining a header token;

[0014] The tail characters of the M ordered strings are replaced with the head characters of the next ordered string, M encrypted sub-data are generated, and the head token is sent to the port corresponding to the storage instruction.

[0015] Optionally, in a second implementation of the first aspect of the present invention, storing the M encrypted sub-data in order in N sub-partition memories includes:

[0016] Extract the i-th encrypted sub-data, where i=1, 2, 3, ..., M;

[0017] Determine whether the j-th sub-partition memory contains encrypted sub-data, where j=1, 2, 3, ..., N;

[0018] If the encrypted sub-data is placed, determine whether the encrypted sub-data is placed in the j+1th sub-partition memory;

[0019] If no encrypted sub-data is placed, the i-th encrypted sub-data is stored in the j-th sub-partition memory, and the header token is bound to the N sub-partition memories.

[0020] Optionally, in a third implementation of the first aspect of the present invention, encrypting the qualified target data according to a preset encryption algorithm to obtain the encrypted data includes:

[0021] Based on Base64 encoding, the qualified target data is transcoded to obtain an encoded string;

[0022] Based on a preset number of characters, the encoded string is split to obtain K split strings, where K is a positive integer;

[0023] Exchange the even-digit characters of the x-th string and the x+1-th string in the K split strings to obtain K exchange strings, where x=1, 3, 5, ..., 2s+1, ..., K, and s is a positive integer;

[0024] Sort the characters and combine the K exchange strings to generate encrypted data.

[0025] Optionally, in a fourth implementation manner of the first aspect of the present invention, after storing the M encrypted sub-data in the N sub-partition memories in sequence, the method further includes:

[0026] The encrypted sub-data in the memory of the N sub-partitions is transferred to the preset storage database.

[0027] Optionally, in a fifth implementation manner of the first aspect of the present invention, the receiving a storage instruction of the target data, and triggering the creation of the virtual memory based on the storage instruction includes:

[0028] receiving a storage instruction of target data;

[0029] Extract the identity token storing the instruction, and determine whether the identity token is a valid token;

[0030] When the identity token is a valid token, the creation of virtual memory is triggered based on the storage instruction.

[0031] Optionally, in a sixth implementation of the first aspect of the present invention, after the target data cached in the virtual memory is detected and processed according to a preset virus detection algorithm and a detection result is obtained, the method further includes:

[0032] When the detection result is unqualified, an abnormal alarm message is sent to the preset management port.

[0033] Optionally, in a seventh implementation manner of the first aspect of the present invention, sending abnormal alarm information to a preset management port includes:

[0034] Packaging and encapsulating the target data to obtain encapsulated data;

[0035] The encapsulated data is stored in a secure storage area, and abnormal alarm information is sent to a preset management port.

[0036] A second aspect of the present invention provides a secure data storage device, comprising: a memory and at least one processor, wherein instructions are stored in the memory, and the memory and the at least one processor are interconnected via lines; the at least one processor calls the instructions in the memory so that the secure data storage device executes the above-mentioned secure data storage method.

[0037] A third aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the above-mentioned method for securely storing data.

[0038] In the embodiment of the present invention, the data transmitted to the device is first checked for Trojans, scripts, etc. to ensure that the data entering the device system is safe, and then the data is securely encrypted once by encryption. The encrypted data is transmitted to the storage module, and the storage module will first store the data in separate partitions to ensure that the data will not be confused. The partition storage setting is used to prevent external devices from directly obtaining data by force. Since the encrypted data is stored, the relevant partition data can be extracted and parsed through the token information set in the storage instruction, which solves the technical problem that the device storage data is not secure enough and can be easily stolen by others to obtain the stored data. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A schematic diagram of an embodiment of a method for securely storing data in an embodiment of the present invention;

[0040] Figure 2 A schematic diagram of an embodiment of step 104 of the method for securely storing data in an embodiment of the present invention;

[0041] Figure 3 A schematic diagram of an embodiment of step 106 of the method for securely storing data in an embodiment of the present invention;

[0042] Figure 4 Schematic diagram of another embodiment of step 106 of the method for securely storing data in an embodiment of the present invention;

[0043] Figure 5 A schematic diagram of an embodiment of a secure data storage device in an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The embodiments of the present invention provide a data secure storage method, device and storage medium.

[0045] The embodiments disclosed in the present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments disclosed in the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments disclosed in the present invention are only for exemplary purposes and are not intended to limit the scope of protection disclosed in the present invention.

[0046] In the description of the embodiments disclosed in the present invention, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0047] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 , an embodiment of a method for securely storing data in an embodiment of the present invention includes:

[0048] 101. Receive a storage instruction of target data, and trigger creation of a virtual memory based on the storage instruction, wherein the storage instruction includes: an identity token;

[0049] In this embodiment, an identity token with an account number and password is set as the basis for partitioning the hardware device that needs to store data. After the identity token is determined, the storage instruction for generating the target data is encapsulated. When the data needs to be stored, the system will first generate a virtual memory to receive the data (the source of the data can be network transmission, USB flash drive transmission, etc.). This is to prevent data and information with viruses from directly contacting the device system and causing the device to be invaded.

[0050] Specifically, step 101 includes the following specific implementation methods:

[0051] 1011. Receive a storage instruction of target data;

[0052] 1012. Extract the identity token storing the instruction, and determine whether the identity token is a valid token;

[0053] 1013. When the identity token is a valid token, the creation of virtual memory is triggered based on the storage instruction.

[0054] In steps 1011-1013, a storage instruction for storing target data is received. An identity token is encapsulated in the storage instruction. First, it is necessary to verify whether the identity token is a valid token. If the identity token is a valid token registered in the device, the creation of virtual memory is triggered based on the storage instruction. If the identity token is not a valid token registered in the device, the storage process will not be performed, and the storage will be directly rejected.

[0055] 102. Utilize the virtual memory to cache the target data, and perform detection processing on the target data cached in the virtual memory according to a preset virus detection algorithm to obtain a detection result;

[0056] In this embodiment, in the opened virtual memory, the target data is first cached and stored, and then virus detection is performed. The purpose of the detection is to ensure the security of the device system when receiving the data. Because the data may be transmitted through the network, USB flash drive, data cable, etc., it is inevitable that someone will add viruses, Trojans, scripts, etc. to the data. The security of the data is detected to prevent the device system from being invaded by viruses, Trojans, etc. As for the virus detection algorithm, some ready-made software for detecting Trojan viruses can be used.

[0057] Specifically, after step 102, the following specific implementation methods are included:

[0058] 1021. When the detection result is unqualified, an abnormal alarm message is sent to a preset management port.

[0059] In step 1021, if the detection result is unqualified, it means that there is virus data in the virtual memory, which cannot be stored and needs to send abnormal alarm information to a pre-set management port, such as the display port of the device operation interface, or there is a general management system for multiple devices, and the abnormal alarm information is sent to the port of the general management system.

[0060] Furthermore, step 1021 also includes the following specific implementation methods:

[0061] 10211. Pack and encapsulate the target data to obtain encapsulated data;

[0062] 10212. Store the encapsulated data in a secure storage area, and send abnormal alarm information to a preset management port.

[0063] In steps 10211-10212, the target data is first packaged and encapsulated to ensure that the packaged and encapsulated data is isolated, and then the encapsulated data is stored in a secure storage area. After completing the above isolation operations, an abnormal alarm message is sent to the preset management port.

[0064] 103. When the detection result is qualified, extracting qualified target data from the virtual memory;

[0065] In this embodiment, when the detection result is qualified, it is ensured that the data in the virtual memory does not contain harmful data such as viruses, and the data is extracted from the virtual memory to obtain qualified target data.

[0066] 104. Encrypt the qualified target data according to a preset encryption algorithm to obtain encrypted data;

[0067] In this embodiment, the encryption algorithm encrypts the qualified target data to obtain encrypted data. If data needs to be extracted, the encrypted data is inversely operated to obtain decrypted data. The encryption process can be an existing encryption algorithm such as RSA, DES, 3DES, etc., and the decryption process can be reverse decrypted using a related secret key.

[0068] For details, please refer to Figure 2 , Figure 2 This is an embodiment of step 104 of the method for securely storing data in an embodiment of the present invention. Step 104 includes the following specific implementation methods:

[0069] 1041. Based on Base64 encoding, the qualified target data is transcoded to obtain an encoded string;

[0070] 1042. Split the encoded string based on a preset number of characters to obtain K split strings, where K is a positive integer.

[0071] 1043. Exchange the even-digit characters of the x-th string and the x+1-th string in the K split strings to obtain K exchange strings, where x=1, 3, 5, ..., 2s+1, ..., K, and s is a positive integer;

[0072] 1044. Sort the characters and combine the K exchange strings to generate encrypted data.

[0073] In steps 1041-1044, the qualified target data such as {this is a test data storage} is transcoded based on Base64 encoding to obtain e+i / meaYr+a1i+ivleaVsOaNruWtmOWCqH0=. The preset number of characters can be 5, and e+i / meaYr+a1i+ivleaVsOaNruWt mOWCqH0= is split into the following character data in a group of 5 characters:

[0074] e+i / m

[0075] eaYr+

[0076] a1i+i

[0077] V

[0078] oeLh

[0079] wxya

[0080] Wlq

[0081] =

[0082] Then replace the double-digit characters (2, 4, 6, 8, etc.) in the two adjacent groups of characters. The last group with less than 5 digits does not need to be processed, and the last group with an odd number of groups does not need to be processed, that is:

[0083] e+i / m ​​is converted to eairm

[0084] eaYr+ to e+Y / +

[0085] a1i+i is converted to aliai

[0086] vleaV is converted to v1e+V

[0087] sOaNr to sWamr

[0088] uWtmO is converted to u0tNO

[0089] WCqH0 to WCqH0

[0090] =Convert to =

[0091] According to the character sorting, the K exchange strings are combined and processed to generate the encrypted data eairme+Y / +aliaiv1e+VsWamru0tNOWCqH0=, which cannot be decoded alone.

[0092] 105. Partition the system memory according to the identity token to obtain N sub-partition memories, where N is a positive integer;

[0093] In this embodiment, different identity tokens may have different partition settings, and the partitions opened up have different storage quantities, making reverse cracking difficult.

[0094] 106. Split the encrypted data into M encrypted sub-data, and store the M encrypted sub-data in N sub-partition memories in sequence, where M is a positive integer less than N.

[0095] In this embodiment, eairme+Y / +aliaiv1e+VsWamru0tNOWCqH0= is split into different encrypted sub-data, such as: eair, me+Y / +aliaiv1e+, VsWa, mru0tNOWC, qH0= and other encrypted sub-data, and multiple encrypted sub-data are written into multiple sub-partition memories to complete basic data storage.

[0096] For details, please refer to Figure 3 , Figure 3 This is an embodiment of step 106 of the method for securely storing data in an embodiment of the present invention. Step 106 includes the following specific implementation methods:

[0097] 1061. Split the encrypted data equally into characters to obtain M ordered character strings, record the first characters of the M ordered character strings, and obtain a header token;

[0098] 1062. Replace the tail characters of the M ordered strings with the head characters of the next ordered string, generate M encrypted sub-data, and send the head token to the port corresponding to the storage instruction.

[0099] In steps 1061-1062, if the encrypted data is: abcdefg123456hijk, the data is split into 5 segments according to the principle of equal division. If it is not evenly divided, the last segment of data can be more or less, and the data such as abc def g12 345 6hijk are obtained. The first character of the start is recorded to form the header token adg36, and then the last character of each group of characters is replaced with the first character of the next group of characters. abc def g12 345 6hijk is converted into 5 encrypted sub-data of kab cde fg1 234 56hij, and adg36 is sent to the port corresponding to the storage instruction.

[0100] Encryption principle: record the first character of each initial group of characters. After replacement, the first character will become the second character. Even if the order is disrupted, as long as you remember the first character at the beginning (the second character after replacement), you can match the corresponding character (if you encounter the same character in the second position, you need to match it in a loop, check the data through decryption, and then filter out the appropriate data).

[0101] For details, please refer to Figure 4 , Figure 4 This is another embodiment of step 106 of the method for securely storing data in an embodiment of the present invention. In step 106, "storing the M encrypted sub-data in sequence in the N sub-partition memories" also includes the following specific implementation methods:

[0102] 1063. Extract the i-th encrypted sub-data, where i=1, 2, 3, ..., M;

[0103] 1064. Determine whether the j-th sub-partition memory contains encrypted sub-data, where j=1, 2, 3, ..., N;

[0104] 1065. If the encrypted sub-data is stored, determine whether the encrypted sub-data is stored in the j+1th sub-partition memory;

[0105] 1066. If no encrypted sub-data is placed, the i-th encrypted sub-data is stored in the j-th sub-partition memory, and the header token is bound to the N sub-partition memories.

[0106] In steps 1063-1066, extract the first encrypted sub-data, determine whether the first sub-partition has encrypted sub-data, if the first sub-partition has encrypted sub-data, determine whether the second sub-partition has encrypted sub-data, if the second sub-partition has encrypted sub-data, determine whether the third sub-partition has encrypted sub-data, and so on. If the first sub-partition has no encrypted sub-data, place the first encrypted sub-data in the first sub-partition, and bind the header token to the N sub-partition memories so that the data to be extracted from the sub-partition can be limited during the next decryption process. By storing the data in a disordered order in the sub-partition, it is ensured that the data cannot be directly displayed even if it is obtained. Finally, by generating instructions, the purpose of quickly finding the specified data is achieved. At the same time, a unique instruction is required to obtain unique data, which further ensures single storage and single retrieval of data, making data storage in the system safer, thereby achieving the effect of protecting data security storage.

[0107] Furthermore, after step 106, the following specific implementations are also included:

[0108] 107. Transfer the encrypted sub-data in the memory of the N sub-partitions to a preset storage database.

[0109] In step 107, the encrypted sub-data in the memory cache of the N sub-partitions are transferred to the preset storage database to achieve long-term caching and carry the cache memory sub-partition number during the storage process to achieve longer-term data storage.

[0110] In the embodiment of the present invention, the data transmitted to the device is first checked for Trojans, scripts, etc. to ensure that the data entering the device system is safe, and then the data is securely encrypted once by encryption. The encrypted data is transmitted to the storage module, and the storage module will first store the data in separate partitions to ensure that the data will not be confused. The partition storage setting is used to prevent external devices from directly obtaining data by force. Since the encrypted data is stored, the relevant partition data can be extracted and parsed through the token information set in the storage instruction, which solves the technical problem that the device storage data is not secure enough and can be easily stolen by others to obtain the stored data.

[0111] Figure 51 is a schematic diagram of the structure of a secure data storage device provided by an embodiment of the present invention. The secure data storage device 500 may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 510 (for example, one or more processors) and a memory 520, and one or more storage media 530 (for example, one or more mass storage devices) storing application programs 533 or data 532. Among them, the memory 520 and the storage medium 530 can be short-term storage or permanent storage. The program stored in the storage medium 530 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the secure data storage device 500. Furthermore, the processor 510 may be configured to communicate with the storage medium 530 to execute a series of instruction operations in the storage medium 530 on the secure data storage device 500.

[0112] The data-based secure storage device 500 may also include one or more power supplies 540, one or more wired or wireless network interfaces 550, one or more input and output interfaces 560, and / or one or more operating systems 531, such as Windows Serve, Mac OS X, Unix, Linux, Free BSD, etc. It will be appreciated by those skilled in the art that Figure 5 The illustrated secure data storage device structure does not constitute a limitation on the secure data storage device, and may include more or fewer components than illustrated, or a combination of certain components, or a different arrangement of components.

[0113] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of the method for securely storing data.

[0114] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0115] In addition, although each operation is described in a specific order, this should be understood as requiring such operation to be performed in the specific order shown or in a sequential order, or requiring that all illustrated operations should be performed to obtain desired results. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single implementation in combination. On the contrary, the various features described in the context of a single implementation can also be implemented in multiple implementations individually or in any suitable sub-combination mode.

[0116] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A method for securely storing data, characterized in that: Includes steps: receiving a storage instruction of target data, and triggering creation of a virtual memory based on the storage instruction, wherein the storage instruction includes: an identity token; Utilizing the virtual memory to cache the target data, and performing detection processing on the target data cached in the virtual memory according to a preset virus detection algorithm to obtain a detection result; When the detection result is qualified, the qualified target data is extracted from the virtual memory; According to a preset encryption algorithm, the qualified target data is encrypted to obtain encrypted data; Partitioning the system memory according to the identity token to obtain N sub-partition memories, where N is a positive integer; Splitting the encrypted data into M encrypted sub-data, and storing the M encrypted sub-data in N sub-partition memories in sequence, where M is a positive integer less than N; The step of encrypting the qualified target data according to a preset encryption algorithm to obtain encrypted data includes: Based on Base64 encoding, the qualified target data is transcoded to obtain an encoded string; Based on a preset number of characters, the encoded string is split to obtain K split strings, where K is a positive integer; Exchange the even-digit characters of the xth string and the x+1th string in the K split strings to obtain K exchange strings, where x=1, 3, 5, ..., 2s+1, ..., K-1, and s is a positive integer; Sort the strings and combine the K exchange strings to generate encrypted data; The step of splitting the encrypted data into M encrypted sub-data includes: Splitting the encrypted data equally into characters to obtain M ordered strings, recording the first characters of the M ordered strings, and obtaining a header token; Replace the tail characters of the M ordered strings with the head characters of the next ordered string, generate M encrypted sub-data, and send the head token to the port corresponding to the storage instruction; The step of sequentially storing the M encrypted sub-data in the N sub-partition memories includes: Extract the i-th encrypted sub-data, where i=1, 2, 3, ..., M; Determine whether the j-th sub-partition memory contains encrypted sub-data, where j=1, 2, 3, ..., N; If the encrypted sub-data is placed, determine whether the encrypted sub-data is placed in the j+1th sub-partition memory; If no encrypted sub-data is placed, the i-th encrypted sub-data is stored in the j-th sub-partition memory, and the header token is bound to the N sub-partition memories.

2. The method for securely storing data according to claim 1, characterized in that: After the M encrypted sub-data are sequentially stored in the N sub-partition memories, the method further includes: The encrypted sub-data in the memory of the N sub-partitions is transferred to the preset storage database.

3. The data security storage method according to claim 1, characterized in that: The receiving a storage instruction of the target data and triggering the creation of the virtual memory based on the storage instruction comprises: receiving a storage instruction of target data; Extract the identity token storing the instruction, and determine whether the identity token is a valid token; When the identity token is a valid token, the creation of virtual memory is triggered based on the storage instruction.

4. The method for securely storing data according to claim 1, characterized in that: After the target data cached in the virtual memory is detected and processed according to the preset virus detection algorithm to obtain the detection result, the method further includes: When the detection result is unqualified, an abnormal alarm message is sent to the preset management port.

5. The method for securely storing data according to claim 4, characterized in that: The sending of abnormal alarm information to the preset management port includes: Packaging and encapsulating the target data to obtain encapsulated data; The encapsulated data is stored in a secure storage area, and abnormal alarm information is sent to a preset management port.

6. A data security storage device, characterized in that: The secure data storage device comprises: a memory and at least one processor, the memory stores instructions, and the memory and the at least one processor are interconnected via a line; The at least one processor calls the instruction in the memory to enable the secure data storage device to execute the secure data storage method according to any one of claims 1 to 5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for securely storing data according to any one of claims 1 to 5 is implemented.

Images