A security risk protection method and system for a mobile solid-state hard disk

Abstract

The present invention relates to the technical field of hard disk security protection, and in particular to a method and system for protecting the security risks of a mobile solid-state hard disk. The method comprises the following steps: obtaining newly written data of a mobile solid-state hard disk; decomposing the newly written data of the mobile solid-state hard disk into multiple segments, and performing independent data encapsulation to construct multiple data clusters; randomly arranging multiple data clusters in a disordered order, and performing random free allocation storage to generate data clusters with random storage data; generating a random initial encryption key based on the newly written data of the mobile solid-state hard disk; constructing a distributed storage architecture for the random storage data of the data clusters based on the random initial encryption key, and constructing a distributed encryption storage framework; when the mobile solid-state hard disk is identified to be accessed, obtaining the hard disk work log; performing access behavior response detection on the hard disk work log, and performing abnormal access behavior speculation, and extracting abnormal access behavior data. The present invention realizes high security and rapid hard disk risk protection.

Description

Technical Field

[0001] The present invention relates to the technical field of hard disk security protection, and in particular to a security risk protection method and system for a mobile solid-state hard disk. Background Art

[0002] As a portable data storage device, mobile solid-state drives play an important role in daily work and life. With the continuous improvement of information security awareness, users have put forward higher requirements for the security of mobile solid-state drives. Traditional mobile solid-state drive security protection methods mainly focus on passive protection measures such as data encryption and access control, which are difficult to deal with the security risks of the device itself.

[0003] Traditional mobile storage security protection solutions mainly rely on software-level encryption, backup and other means, which have many limitations. First, software encryption is easily cracked by hackers and cannot provide comprehensive and reliable data protection. Second, data backup requires additional storage space and management costs, and it is impossible to monitor the usage of the hard disk in real time. As hacker attack methods become increasingly sophisticated, the protection capabilities of these traditional solutions can no longer meet the needs of modern mobile storage security. In order to better ensure the security of mobile solid-state hard drives, it is urgent to develop an intelligent and adaptive security protection method. Summary of the invention

[0004] In order to solve the above technical problems, the present invention proposes a security risk protection method and system for a mobile solid-state hard disk to solve at least one of the above technical problems.

[0005] To achieve the above object, the present invention provides a method for protecting a mobile solid-state hard disk from security risks, comprising the following steps:

[0006] Step S1: acquiring newly written data of the mobile solid state hard disk; decomposing the newly written data of the mobile solid state hard disk into multiple segments, and performing independent data encapsulation to construct multiple data clusters;

[0007] Step S2: randomly arranging multiple data clusters in a disordered order and performing random idle allocation storage to generate data clusters for random storage of data;

[0008] Step S3: Generate a random initial encryption key based on the newly written data of the mobile solid-state hard disk; construct a distributed storage architecture for randomly storing data in the data cluster based on the random initial encryption key to build a distributed encryption storage framework;

[0009] Step S4: when the mobile solid-state hard disk is identified to be accessed, the hard disk work log is obtained; access behavior response detection is performed on the hard disk work log, and abnormal access behavior is inferred, and abnormal access behavior data is extracted;

[0010] Step S5: performing framework intrusion detection on the abnormal access behavior data based on the distributed encrypted storage framework to generate storage framework intrusion data; generating an intrusion warning signal based on the storage framework intrusion data;

[0011] Step S6: Make security protection decisions for the mobile solid-state hard disk based on the intrusion warning signal, and build a high-speed hard disk security protection strategy to perform security risk protection operations.

[0012] The present invention decomposes newly written data of a mobile solid-state hard disk into multiple segments and encapsulates the data independently to construct multiple data clusters, which helps to achieve data isolation and decentralized storage. The multi-segment data decomposition and independent data encapsulation improve the security and protection of data and reduce the risk of data leakage. The multiple data clusters are randomly arranged in disorder and randomly allocated for storage to generate data clusters to randomly store data, increase the obfuscation of data and improve data security. Random storage enables data to be dispersedly stored on the hard disk, increases the dispersion of data and reduces the risk of data being maliciously accessed. A random initial encryption key is generated based on the newly written data of the mobile solid-state hard disk, and a distributed encryption storage framework is constructed to encrypt and store data to enhance the confidentiality of data. The construction of the distributed encryption storage framework helps to improve the security and privacy protection level of data and ensure the security of data during storage and transmission. , perform access behavior response detection and abnormal access behavior inference on the hard disk work log, timely monitor the access status of the hard disk, discover potential abnormal access behavior, and extract abnormal access behavior data to help identify existing security risks and malicious operations, providing a basis for subsequent security protection. Based on the distributed encryption storage framework, framework intrusion detection is performed on abnormal access behavior data to generate storage framework intrusion data, which helps to respond to intrusion behaviors in a timely manner, generate intrusion warning signals to remind system administrators or users of existing security threats, and promote timely security protection and response measures. Based on the intrusion warning signals, security protection decisions are made for mobile solid-state hard disks, a high-speed hard disk security protection strategy is constructed, and corresponding security control measures are implemented to ensure the security of hard disk data. Security risk protection operations are performed to help prevent potential security risks and ensure the integrity and confidentiality of mobile solid-state hard disk data.

[0013] Preferably, step S1 comprises the following steps:

[0014] Step S11: acquiring newly written data of the mobile solid state hard disk; decomposing the newly written data of the mobile solid state hard disk into multiple segments to obtain multiple written data units;

[0015] Step S12: performing cyclic redundancy check on multiple written data units to extract erroneous data units;

[0016] Step S13: Encoding and correcting the erroneous data unit to generate a check-corrected data unit;

[0017] Step S14: embedding random length header information into the check and correction data unit to obtain a header information embedded data unit;

[0018] Step S15: perform independent data encapsulation on the header information embedded data unit to construct multiple data clusters.

[0019] The present invention decomposes newly written data into multiple segments to obtain multiple written data units, which helps to ensure the integrity and accuracy of the data. Decomposing the data into units can better isolate the data and improve the security of the data. It also helps to manage and maintain the data. Through cyclic redundancy code check detection, the error data unit is found and extracted to ensure the accuracy and integrity of the data during transmission and storage. Extracting the error data unit helps to improve the reliability and robustness of the data and reduce the risk of errors during data transmission. Encoding and correcting the error data unit to generate a check correction data unit helps to repair the error in the data and improve the accuracy and reliability of the data. Encoding correction helps to improve the reliability of the data and ensure that the data is not affected by errors during transmission and storage. Random length header information is embedded to increase the security of the data and make it more difficult for the data to be maliciously accessed or tampered. The embedding of header information helps to identify the data unit, improve the recognition ability of the data, and ensure that the data is correctly recognized and processed. Independent data encapsulation is performed on the header information embedded data unit to construct multiple data clusters, which helps to protect the security and integrity of the data. Constructing multiple data clusters better isolates the data and reduces the risk of data leakage and damage. It also helps to manage and maintain the data.

[0020] Preferably, step S2 comprises the following steps:

[0021] Step S21: sequentially number multiple data clusters to obtain a number for each data cluster;

[0022] Step S22: randomly arranging multiple data clusters in random order based on each data cluster number to obtain a random data cluster sequence;

[0023] Step S23: Analyze the storage physical blocks of the mobile solid state drive to generate the storage physical block data in the solid state drive;

[0024] Step S24: calculating the physical block occupancy of each physical block stored in the solid state drive to obtain physical block occupancy data;

[0025] Step S25: Randomly allocate and store the random data cluster sequence according to the physical block occupancy data to generate data cluster random storage data.

[0026] The present invention helps to effectively manage and organize data by marking multiple data clusters with sequential numbers. Each data cluster number helps to quickly identify and locate a specific data cluster, thereby improving data search efficiency and accuracy. By randomly arranging data clusters in a disordered order, the order of data is confused, the security of data is increased, and the data is more difficult to be tampered with or stolen. The random disordered order reduces the risk of unauthorized access to data and improves the protection level of data. By analyzing the storage physical blocks of a solid-state hard disk, the storage structure of the hard disk is deeply understood, and necessary information and basis are provided for subsequent operations. The generation of physical block data stored in the solid-state hard disk helps to accurately locate and manage the data storage location in the hard disk, thereby improving the accuracy of data operations. Physical block occupancy data is obtained by calculating the occupancy of each physical block, thereby helping to optimize the utilization of the hard disk storage space and improving storage efficiency and performance. The physical block occupancy data helps to manage the data distribution on the hard disk and provides a reference basis for data storage and scheduling. According to the physical block occupancy data, random idle allocation storage is performed on a random data cluster sequence, thereby increasing data security and reducing the risk of data leakage and damage. The random idle allocation storage helps to disperse data storage locations, thereby increasing data security and stability and reducing the risk caused by centralized data storage.

[0027] Preferably, step S25 specifically comprises the following steps:

[0028] Calculate the spatial position of the physical block based on the physical block occupancy data and extract the spatial storage space of each physical block;

[0029] Extract each data cluster based on the random data cluster sequence;

[0030] Performing storage space free matching on the spatial storage space of each physical block based on each data cluster, and generating unique matching data when only one spatial physical block of the data cluster is successfully matched;

[0031] When the data cluster has multiple spatial physical blocks that are successfully matched, multiple physical block matching data are obtained;

[0032] Random data cluster sequences are randomly allocated and stored according to the unique matching data and the matching data of the multiple physical blocks, so as to generate data cluster random storage data.

[0033] The present invention calculates the spatial position of the physical block, accurately determines the storage position of each physical block on the hard disk, improves the access efficiency and management accuracy of data, calculates the spatial position of the physical block to facilitate the subsequent matching process between the data cluster and the physical block, ensures that the data cluster can correctly match the appropriate physical block, extracts each data cluster to ensure that the data is processed one by one, and ensures the integrity and security of the data, extracts the data cluster to facilitate accurate identification and positioning of each data unit, ensures the correct storage and processing of the data, matches the spatial storage space of the data cluster with the physical block, ensures that the data cluster can be correctly mapped to the appropriate physical block, improves the storage efficiency and security of the data, generates unique matching data to ensure the uniqueness and consistency of the data when only one spatial physical block of the data cluster matches successfully, obtains multiple physical block matching data to provide redundant backup of the data when multiple spatial physical blocks of the data cluster match successfully, and increases the security and reliability of the data, multiple physical block matching data facilitates the recovery and repair of the data, and provides spare data when the data is damaged or lost, performs random idle allocation storage on the random data cluster sequence, disperses the storage position of the data, reduces the risk brought by the centralized storage of the data, and improves the security of the data, and the random idle allocation storage facilitates the protection of the security and integrity of the data, and prevents the data from being accessed or tampered with without authorization.

[0034] Preferably, step S3 specifically comprises the following steps:

[0035] Step S31: extracting a data timestamp based on the newly written data of the mobile solid state hard disk, and extracting a unique hard disk device code according to the mobile solid state hard disk;

[0036] Step S32: Calculate a random initial key based on the data timestamp and the unique hard disk device code to generate a random initial encryption key;

[0037] Step S33: Calculate the physical storage location of the data clusters randomly stored data to obtain storage location data of each data cluster;

[0038] Step S34: performing storage location mapping on the random initial encryption key based on the storage location data of each data cluster, thereby obtaining a key location mapping table;

[0039] Step S35: construct a distributed storage architecture for the random data cluster sequence based on the key position mapping table to build a distributed encryption storage framework.

[0040] The present invention helps to track the writing time of data by extracting data timestamps, provides key information for data management and traceability, extracts a unique hard disk device code to uniquely identify the hard disk, ensures that the data is associated with a specific device, and enhances the security and manageability of the data. By calculating the random initial key, generating a random initial encryption key helps to improve the encryption strength of the data and enhance the security of the data. The data timestamp and the hard disk device code are combined to generate a key, ensure that the key is associated with the data and the device, and enhance the security of data encryption. Calculating the physical storage location of the data cluster helps to optimize the storage distribution of the data and improve the reading efficiency and access speed of the data. Determining the storage location data of the data cluster ensures that the data is correctly stored and reduces the risk of data loss or confusion. By mapping the storage location, the key is associated with the storage location of the data cluster to ensure that each data cluster has a corresponding encryption key and enhance the security of the data. The key location mapping table is used to control the access rights to the data and ensure that only authorized users decrypt and access the data. Through the distributed storage architecture, the decentralized storage of data is realized, the fault tolerance and availability of the data are increased, and the construction of a distributed encryption storage framework helps to strengthen the encryption protection of the data and improve the security of the data during transmission and storage.

[0041] Preferably, the specific steps of step S4 are:

[0042] Step S41: when the mobile solid state hard disk is identified to be accessed, the hard disk work log is obtained;

[0043] Step S42: Calculate the current spatial position of the hard disk work log to generate the current hard disk spatial position coordinates;

[0044] Step S43: Perform historical hard disk work position statistics on the hard disk work log to generate historical spatial position data;

[0045] Step S44: performing a working position credibility calculation on the current hard disk space position coordinates based on the historical space position data to generate a current hard disk position credibility index;

[0046] Step S45: performing access behavior response detection on the hard disk work log to generate hard disk access behavior data;

[0047] Step S46: inferring abnormal access behavior of the hard disk access behavior data based on the current hard disk location credibility index, and extracting abnormal access behavior data.

[0048] The present invention helps detect potential security risk behaviors by acquiring hard disk work logs, monitoring hard disk access and operation behaviors, and helping to detect potential security risk behaviors. The work log records are used to audit and track hard disk usage records, which helps to discover abnormal behaviors and illegal operations. By calculating the current spatial position, the current spatial location of the hard disk is accurately identified, so as to identify whether the hard disk is consistent with the position used in normal situations. By comparing the current position with historical data, the credibility index of the hard disk position is calculated to help determine the authenticity of the current hard disk position. The credibility index is used to detect abnormal changes or potential threats in the hard disk position and improve the security of hard disk access. By detecting the hard disk access behavior, the hard disk access mode is monitored in real time, and abnormal access behavior is discovered in time. The access behavior data helps to quickly respond to abnormal behavior and take necessary measures to protect the security of hard disk data. The access behavior data is analyzed based on the location credibility index to infer abnormal access behavior, which helps to prevent data leakage or damage in advance. The abnormal access behavior data is extracted to strengthen the protection measures for hard disk security and ensure the integrity and confidentiality of the data.

[0049] Preferably, the specific steps of step S46 are:

[0050] Performing access address timing frequency statistics on hard disk access behavior data to obtain access address frequency;

[0051] Perform access distribution analysis on the access address frequency and identify the access distribution data of each address;

[0052] Calculate the visit duration of the address access frequency to obtain the address visit duration for each visit;

[0053] Perform internal address topology dependency analysis on the physical block data stored in the solid-state drive to obtain the IoT block topology dependency network;

[0054] Based on the IoT block topology dependency network, the access logic deviation analysis is performed on the dwell time of each address access and the access distribution data of each address to extract the access logic deviation behavior;

[0055] Based on the current hard disk location trust index, abnormal access behavior is inferred based on the access logic deviation behavior, and abnormal access behavior data is extracted.

[0056] The present invention establishes an access behavior model of users or programs by counting the access address sequence frequency, identifies common access patterns and abnormal behaviors, and frequency statistics help to discover abnormal access frequencies, indicating unauthorized access or potential malicious activities. Analyzing the distribution of access addresses reveals access hot spots and sparse areas of data, helps to understand the access pattern of data, and discovers abnormal access patterns or unusual activities by identifying the access distribution data of each address. Calculating the access residence time monitors the time users or programs stay at each address, which helps to identify abnormal long-term access or short-term access. The residence time calculation helps to evaluate the access frequency and duration of data, and provides data support for abnormal behavior detection. The topological dependency analysis of the local address helps to understand the logical relationship and dependency between the hard disk storage data, which helps to understand the organizational structure of the data. The topological dependency analysis helps to find abnormal data dependencies or unusual data connection methods. The access behavior data is analyzed through the topological dependency network to find the logical deviation between the access behavior and the data, and identify abnormal access patterns. The logical deviation analysis helps to detect access logic that does not meet the expectations, suggesting data leakage, data tampering or other security risks. Combined with the location trust index, abnormal access behavior is inferred to more accurately assess the risk level of access logic deviation behavior. Extracting abnormal access behavior data helps to respond to potential security threats in a timely manner and protect the data security in the solid-state drive.

[0057] Preferably, step S5 comprises the following steps:

[0058] Step S51: Perform hard disk intrusion analysis on the abnormal access behavior data, and when the abnormal access behavior data is detected as intrusion behavior, mark it as hard disk intrusion behavior data;

[0059] Step S52: performing framework intrusion detection on the hard disk intrusion behavior data based on the distributed encryption storage framework to generate storage framework intrusion data;

[0060] Step S53: Generate an intrusion warning signal based on the storage framework intrusion data.

[0061] The present invention identifies hard disk intrusion behaviors, including unauthorized access and malware activities, by analyzing abnormal access behavior data. Marking the hard disk intrusion behavior data helps to respond to potential intrusion activities in a timely manner and limit the degree of damage to data by intruders. A distributed encrypted storage framework is used to identify whether the hard disk intrusion behavior data is used to conduct unauthorized access or tampering with the framework. When the intrusion address of the hard disk intrusion behavior data is a distributed encrypted storage framework, the hard disk intrusion behavior data is marked as storage framework intrusion data; Framework intrusion detection helps to identify intrusion behaviors against the storage framework, including attacks or intrusion attempts against distributed storage systems, and generates intrusion warning signals to promptly notify the security team or system administrator of the existence of intrusion activities, thereby improving the response speed to security incidents. The intrusion warning signal helps to manage the security risks of solid-state hard drives and helps to take necessary measures to reduce the losses caused by intrusions.

[0062] Preferably, the specific steps of step S6 are:

[0063] Activate high-speed security protection mode of mobile solid-state hard disk based on intrusion warning signals;

[0064] The high-speed security protection mode specifically includes: identifying all storage physical blocks of the distributed encryption storage framework;

[0065] Perform multi-threaded random high-speed reading and writing on all storage physical blocks to extract the storage data of all physical blocks;

[0066] Perform XOR overwriting modification on the storage data of all physical blocks to generate multiple overwriting modification storage data;

[0067] Iteratively perform confusion sorting on all storage physical blocks to generate new confusion storage physical blocks;

[0068] Based on multiple overwriting and modification of storage data, the new obfuscated storage physical block is fully covered and stored to generate a deep coverage storage framework;

[0069] Define the depth coverage protection interval;

[0070] Repeating the full depth coverage storage operation in real time according to the depth coverage protection interval;

[0071] Make security protection decisions based on the high-speed security protection mode and build a hard disk high-speed security protection strategy to perform security risk protection operations.

[0072] The present invention uses multi-threaded disordered high-speed reading and writing to quickly extract stored data and improve data processing efficiency. It also uses XOR overwriting to modify and confuse stored data to increase data confidentiality and prevent data leakage. It also generates new storage physical blocks through obfuscated sorting to increase data security and make it more difficult for data to be maliciously accessed or tampered with. The full-volume deep overwriting storage ensures data coverage and obfuscation, further enhancing data security. By establishing a high-speed security protection strategy and making security protection decisions based on actual conditions, the prevention and handling of hard disk security risks are strengthened.

[0073] In this specification, a security risk protection system for a mobile solid-state hard disk is provided, which is used to execute the security risk protection method for the mobile solid-state hard disk as described above, including:

[0074] The data encapsulation module is used to obtain the newly written data of the mobile solid-state hard disk; decompose the newly written data of the mobile solid-state hard disk into multiple segments, and perform independent data encapsulation to construct multiple data clusters;

[0075] The idle storage module is used to randomly arrange multiple data clusters in a disordered order and perform random idle allocation storage to generate data clusters for random storage data;

[0076] The distributed encryption storage module is used to generate a random initial encryption key based on the newly written data of the mobile solid-state hard disk; based on the random initial encryption key, a distributed storage architecture is constructed for randomly storing data in the data cluster to build a distributed encryption storage framework;

[0077] The abnormal access inference module is used to obtain the hard disk work log when the mobile solid-state hard disk is accessed; perform access behavior response detection on the hard disk work log, and perform abnormal access behavior inference to extract abnormal access behavior data;

[0078] The framework intrusion detection module is used to perform framework intrusion detection on abnormal access behavior data based on the distributed encrypted storage framework to generate storage framework intrusion data; and to generate an intrusion warning signal based on the storage framework intrusion data;

[0079] The security protection decision module is used to make security protection decisions for mobile solid-state hard drives based on intrusion warning signals, build hard drive high-speed security protection strategies, and perform security risk protection operations.

[0080] The present invention constructs multiple data clusters through multi-segment data decomposition and independent data encapsulation, realizes isolation of newly written data and prevents data cross-influence, realizes random storage of data clusters through random disorder arrangement and random idle allocation storage, increases data security and obfuscation, and makes data more difficult to be maliciously acquired, realizes encrypted storage of data and improves data confidentiality and security by generating random initial encryption keys and building a distributed encryption storage framework, improves detection and response capabilities for abnormal access behaviors through analysis of hard disk work logs and inference of abnormal access behaviors, and helps to timely discover potential security threats, realizes security monitoring of storage frameworks through framework intrusion detection and generation of intrusion warning signals, timely discovers existing intrusion behaviors, ensures data security, makes security protection decisions based on intrusion warning signals, and builds high-speed security protection strategies, which helps to quickly respond to potential security threats and strengthen security protection for hard disks. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] Figure 1 A schematic diagram of the steps of a security risk protection method for a mobile solid-state hard disk according to the present invention;

[0082] Figure 2 Detailed implementation flow chart of step S1;

[0083] Figure 3 Detailed implementation flow chart of step S2;

[0084] Figure 4 Detailed implementation flow chart of step S3. DETAILED DESCRIPTION

[0085] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0086] The present application example provides a method and system for protecting the security risks of a mobile solid-state hard disk. The execution subject of the method and system for protecting the security risks of a mobile solid-state hard disk includes but is not limited to: mechanical equipment, data processing platform, cloud server node, network upload device, etc. equipped with the system can be regarded as the general computing node of the present application, and the data processing platform includes but is not limited to: at least one of an audio and image management system, an information management system, and a cloud data management system.

[0087] See also Figures 1 to 4 The present invention provides a method for protecting a mobile solid-state hard disk from security risks. The method for protecting a mobile solid-state hard disk from security risks comprises the following steps:

[0088] Step S1: acquiring newly written data of the mobile solid state hard disk; decomposing the newly written data of the mobile solid state hard disk into multiple segments, and performing independent data encapsulation to construct multiple data clusters;

[0089] Step S2: randomly arranging multiple data clusters in a disordered order and performing random idle allocation storage to generate data clusters for random storage of data;

[0090] Step S3: Generate a random initial encryption key based on the newly written data of the mobile solid-state hard disk; construct a distributed storage architecture for randomly storing data in the data cluster based on the random initial encryption key to build a distributed encryption storage framework;

[0091] Step S4: when the mobile solid-state hard disk is identified to be accessed, the hard disk work log is obtained; access behavior response detection is performed on the hard disk work log, and abnormal access behavior is inferred, and abnormal access behavior data is extracted;

[0092] Step S5: performing framework intrusion detection on the abnormal access behavior data based on the distributed encrypted storage framework to generate storage framework intrusion data; generating an intrusion warning signal based on the storage framework intrusion data;

[0093] Step S6: Make security protection decisions for the mobile solid-state hard disk based on the intrusion warning signal, and build a high-speed hard disk security protection strategy to perform security risk protection operations.

[0094] The present invention decomposes newly written data of a mobile solid-state hard disk into multiple segments and encapsulates the data independently to construct multiple data clusters, which helps to achieve data isolation and decentralized storage. The multi-segment data decomposition and independent data encapsulation improve the security and protection of data and reduce the risk of data leakage. The multiple data clusters are randomly arranged in disorder and randomly allocated for storage to generate data clusters to randomly store data, increase the obfuscation of data and improve data security. Random storage enables data to be dispersedly stored on the hard disk, increases the dispersion of data and reduces the risk of data being maliciously accessed. A random initial encryption key is generated based on the newly written data of the mobile solid-state hard disk, and a distributed encryption storage framework is constructed to encrypt and store data to enhance the confidentiality of data. The construction of the distributed encryption storage framework helps to improve the security and privacy protection level of data and ensure the security of data during storage and transmission. , perform access behavior response detection and abnormal access behavior inference on the hard disk work log, timely monitor the access status of the hard disk, discover potential abnormal access behavior, and extract abnormal access behavior data to help identify existing security risks and malicious operations, providing a basis for subsequent security protection. Based on the distributed encryption storage framework, framework intrusion detection is performed on abnormal access behavior data to generate storage framework intrusion data, which helps to respond to intrusion behaviors in a timely manner, generate intrusion warning signals to remind system administrators or users of existing security threats, and promote timely security protection and response measures. Based on the intrusion warning signals, security protection decisions are made for mobile solid-state hard disks, a high-speed hard disk security protection strategy is constructed, and corresponding security control measures are implemented to ensure the security of hard disk data. Security risk protection operations are performed to help prevent potential security risks and ensure the integrity and confidentiality of mobile solid-state hard disk data.

[0095] In the embodiment of the present invention, refer to Figure 1 , is a schematic flow chart of the steps of a security risk protection method for a mobile solid-state hard disk of the present invention. In this example, the steps of the method include:

[0096] Step S1: acquiring newly written data of the mobile solid state hard disk; decomposing the newly written data of the mobile solid state hard disk into multiple segments, and performing independent data encapsulation to construct multiple data clusters;

[0097] In this embodiment, an API provided by the operating system (such as Windows' ReadFile or Linux's read function) is used to obtain newly written data from the mobile solid-state hard disk. In order to improve efficiency, an asynchronous reading method is used to ensure that the latest data can be read while data is being written to avoid blocking. The size of the segment (such as 512 bytes or 1KB per segment) is determined according to the characteristics and requirements of the data. Dynamic segmentation is also performed according to the characteristics of the data content. The newly written data in the cache is traversed and decomposed into multiple data segments. The data is segmented according to the set size and stored in a list or array using a loop traversal method. Metadata (such as the starting position, length, checksum, etc. of the segment) is generated for each data segment for subsequent management and processing. The format of data encapsulation is determined, and a custom binary format, JSON or XML, etc. is selected. , depending on the subsequent application requirements, encapsulate each decomposed data segment independently, design a data structure (such as an object or dictionary) to contain the data segment and its metadata, store the encapsulated data in memory or write it to a temporary file for subsequent processing and persistence, perform integrity check on each encapsulated data segment (such as using CRC or hash algorithm) to ensure that the data is not damaged during the encapsulation process, design the data structure of the data cluster to ensure that it can accommodate multiple independent data segments and contains necessary meta information (such as cluster identification, size, creation time, etc.), group the encapsulated data segments logically, build multiple data clusters, each data cluster contains one or more data segments, ensure that the creation process of each data cluster is independent, process in parallel to improve efficiency, and record the relevant information of each data cluster into a list or database for subsequent retrieval and management.

[0098] Step S2: randomly arranging multiple data clusters in a disordered order and performing random idle allocation storage to generate data clusters for random storage of data;

[0099] In this embodiment, a suitable random permutation algorithm is selected, such as the Fisher-Yates shuffle algorithm. This algorithm can effectively shuffle the data to ensure that each data cluster has an equal probability of being selected. Traverse the data cluster list and use the selected random permutation algorithm to shuffle multiple data clusters. Start from the last index of the data cluster and traverse forward step by step. For each data cluster, generate a random index from the current index to the starting position of the list. Exchange the current data cluster with the data cluster at the random index. Obtain information about all free storage blocks of the mobile solid-state hard disk through the hard disk controller or file system, including the address and available space of each block. Determine the allocation strategy, using random selection or polling allocation. Ensure that each data cluster has an equal chance of being allocated to any free block when storing. Traverse the data cluster list after the disorder, and allocate storage to each data cluster in turn: select a random free storage block address for the current data cluster. Write the data of the data cluster to the selected storage block to ensure the integrity of the write. Update the status of the storage block, mark it as "used", and record the mapping relationship between the data cluster and the storage block. After all data clusters are stored, storage verification is performed to ensure that the data of each data cluster can be read correctly and is consistent with the original data. A storage report is created, including the original location, the location after the shuffle, the storage block address, and the storage status of each data cluster for subsequent analysis and auditing.

[0100] Step S3: Generate a random initial encryption key based on the newly written data of the mobile solid-state hard disk; construct a distributed storage architecture for randomly storing data in the data cluster based on the random initial encryption key to build a distributed encryption storage framework;

[0101] In this embodiment, a suitable random number generation algorithm is selected, for example, a secure hash function (such as SHA-256) or a symmetric encryption algorithm (such as AES) is used to generate an initial key, and the timestamp of the newly written data of the mobile solid-state hard disk and the unique hard disk device code are used as input to increase the uniqueness and security of the key, the timestamp and the device code are combined, and a random initial encryption key is generated using the selected key generation algorithm, the timestamp and the device code are combined into a string, the string is processed using the selected hash function or encryption algorithm, and a random initial encryption key of a fixed length is generated, and a distributed storage architecture is designed, including the selection of storage nodes, data sharding strategy and redundancy mechanism to ensure data availability and security, identify storage nodes in the network (multiple servers or hard disks), and configure the storage capacity and access rights of each node, and design a data sharding strategy based on the random storage of data clusters. Divide the data cluster into multiple parts to ensure that each part can be stored and accessed independently. When designing the architecture, consider the security of encrypted storage. Use the generated random initial encryption key to encrypt each shard to ensure the confidentiality of the data during storage. Design a unified storage interface for the distributed storage system to ensure that data read and write operations can be performed through this interface to simplify data access. Distribute and store the encrypted data shards on each node. The specific steps are as follows: traverse all data shards and write each shard to a randomly selected storage node to ensure that the storage process of each shard is encrypted, and record the storage node and its corresponding shard identifier. Create a data mapping table to record the storage location of each shard and its corresponding key for subsequent data retrieval and decryption. Implement a redundant storage strategy to ensure that each data shard is backed up on different nodes to improve data reliability and fault tolerance.

[0102] Step S4: when the mobile solid-state hard disk is identified to be accessed, the hard disk work log is obtained; access behavior response detection is performed on the hard disk work log, and abnormal access behavior is inferred, and abnormal access behavior data is extracted;

[0103] In this embodiment, an event monitoring function of the operating system (such as the device manager of Windows or udev of Linux) is used to monitor the access event of the mobile solid-state hard disk. When the hard disk access is detected, the work log of the hard disk is read through an API (such as DeviceIoControl of Windows or ioctl of Linux). The work log usually contains information such as access records, timestamps of read and write operations, operation types, and storage blocks involved. An appropriate access behavior detection model (such as rule-based detection, machine learning model) is selected to analyze the access behavior in the work log, parse the key information in the work log, extract the time, type (read or write), storage block address, access source (such as user ID or program) of each access, and perform statistics and analysis on the parsed access behavior to generate an access behavior data set, including each Access frequency, time interval and access pattern. According to the set rules or models, identify normal and abnormal access behaviors. For example, if a storage block is frequently accessed in a short period of time, it is marked as abnormal. Clarify the standards for abnormal access behavior, such as unauthorized access, abnormal frequency, abnormal data block access, etc. Select a suitable anomaly detection model (such as statistical analysis, clustering algorithm or machine learning model) to analyze the access behavior data, input the access behavior data into the selected detection model, and infer abnormal access behavior. Perform feature engineering on the access behavior data to extract relevant features (such as timestamp interval, access frequency, access data volume, etc.), use the model for training (such as based on historical data) or directly infer, identify whether there is abnormal access behavior, mark the access behavior data identified as abnormal, and record its detailed information, including time, type and storage blocks involved.

[0104] Step S5: performing framework intrusion detection on the abnormal access behavior data based on the distributed encrypted storage framework to generate storage framework intrusion data; generating an intrusion warning signal based on the storage framework intrusion data;

[0105] In this embodiment, a suitable intrusion detection algorithm (such as rule-based detection, anomaly-based detection or machine learning model) is selected to analyze abnormal access behavior data, and the extracted abnormal access behavior data is organized into a structured format to ensure that it contains necessary information (such as timestamp, access type, storage address, user ID, etc.). The detected intrusion behavior data is organized to ensure that each intrusion record contains detailed information (such as the source of the intrusion, the attacked storage block, the intrusion time, the intrusion method, etc.). The organized storage framework intrusion data is stored in a database or log system for subsequent query and analysis. A risk assessment is performed on each intrusion event, considering factors such as potential losses, scope of impact and intrusion type. If the intrusion event meets the warning conditions, an intrusion warning signal is generated, and the detailed information of the signal (such as time, type, severity level, etc.) is recorded.

[0106] Step S6: Make security protection decisions for the mobile solid-state hard disk based on the intrusion warning signal, and build a high-speed hard disk security protection strategy to perform security risk protection operations.

[0107] In this embodiment, the generated intrusion warning signal is received, the integrity and accuracy of the signal are ensured, and the signal content is analyzed, including the intrusion type, time, severity level and impact range, etc. According to the severity of the warning signal, the risk assessment standard is set to determine the response priority of different types of intrusions. According to the risk assessment results, the hard disk high-speed security protection strategy is designed, including specific protection measures and response processes, and various protection measures are gradually implemented according to the formulated security protection strategy.

[0108] In this embodiment, refer to Figure 2 , is a flowchart of detailed implementation steps of step S1. In this embodiment, the detailed implementation steps of step S1 include:

[0109] Step S11: acquiring newly written data of the mobile solid state hard disk; decomposing the newly written data of the mobile solid state hard disk into multiple segments to obtain multiple written data units;

[0110] Step S12: performing cyclic redundancy check on multiple written data units to extract erroneous data units;

[0111] Step S13: Encoding and correcting the erroneous data unit to generate a check-corrected data unit;

[0112] Step S14: embedding random length header information into the check and correction data unit to obtain a header information embedded data unit;

[0113] Step S15: perform independent data encapsulation on the header information embedded data unit to construct multiple data clusters.

[0114] In this embodiment, the latest written data is read from a mobile solid-state drive (SSD) to ensure that the data reading process does not affect the writing operation. An asynchronous reading method is used to segment the acquired newly written data according to a predetermined segment size to obtain a plurality of written data units. The size of each data unit is set according to the block size of the SSD or other design requirements. A suitable cyclic redundancy code (CRC) algorithm (such as CRC-32) is selected for data verification. A CRC value is calculated for each written data unit and compared with the stored CRC value. Error data units that fail the verification are extracted, and their positions and corresponding error codes are recorded for subsequent processing. A suitable error correction coding scheme (such as Hamming code, Reed-Solomon code) is selected for error repair. The extracted erroneous data unit applies an error correction algorithm to generate a check and correction data unit, ensures that the generated data unit can be restored to its original state, and records any changes in the correction process, determines the content of the header information that needs to be embedded, such as the metadata, timestamp, device identification, etc. of the data unit, and randomly embeds the designed header information into the check and correction data unit to form a header information embedded data unit, ensuring that the embedding of the header information does not affect the integrity and readability of the data, selects a suitable data encapsulation format (such as a custom binary format, JSON or XML) to construct a data cluster, independently encapsulates each header information embedded data unit, constructs multiple data clusters, ensures that each data cluster contains complete information, and is independently parsed and processed.

[0115] In this embodiment, refer to Figure 3 , is a flowchart of detailed implementation steps of step S2. In this embodiment, the detailed implementation steps of step S2 include:

[0116] Step S21: sequentially number multiple data clusters to obtain a number for each data cluster;

[0117] Step S22: randomly arranging multiple data clusters in random order based on each data cluster number to obtain a random data cluster sequence;

[0118] Step S23: Analyze the storage physical blocks of the mobile solid state hard disk to generate the storage physical block data in the solid state hard disk;

[0119] Step S24: calculating the physical block occupancy of each physical block stored in the solid state drive to obtain physical block occupancy data;

[0120] Step S25: Randomly allocate and store the random data cluster sequence according to the physical block occupancy data to generate data cluster random storage data.

[0121] In this embodiment, a starting value and a numbering rule of a sequential number are determined (for example, starting from 1 and increasing in sequence), multiple data clusters are traversed, each data cluster is sequentially numbered, the number of each data cluster is recorded, and the numbering information is stored in the metadata of the data cluster to ensure that it can be identified during subsequent processing, and a suitable random arrangement algorithm (such as the Fisher-Yates shuffle algorithm) is selected to ensure the randomness of the data. Based on the number of each data cluster, multiple data clusters are randomly arranged in a disorderly order to generate a random data cluster sequence to ensure that each data cluster has an equal probability of being selected in the random sequence, and the generated random data cluster sequence is recorded. The physical structure of the solid-state drive, including the size of the block, the organization of the page, etc., is understood through the management interface or driver of the solid-state drive. The method comprises the following steps: first, collecting physical block information in the solid-state drive, generating physical block data stored in the solid-state drive, including the status (such as free, used, damaged) and storage capacity of each physical block, defining a calculation method for physical block occupancy, which is usually determined by reading the status information of each block, analyzing each physical block in the solid-state drive one by one, calculating its current occupancy, generating physical block occupancy data, recording the occupancy status and available space of each physical block, selecting a suitable random free physical block for storage based on the physical block occupancy data, allocating each data cluster in the random data cluster sequence to the selected random free physical block for storage, ensuring that the storage location of each data cluster is randomly selected, and recording the mapping relationship between each data cluster and its physical storage block.

[0122] In this embodiment, the specific steps of step S25 are:

[0123] Calculate the spatial position of the physical block based on the physical block occupancy data and extract the spatial storage space of each physical block;

[0124] Extract each data cluster based on the random data cluster sequence;

[0125] Performing storage space free matching on the spatial storage space of each physical block based on each data cluster, and generating unique matching data when only one spatial physical block of the data cluster is successfully matched;

[0126] When the data cluster has multiple spatial physical blocks that are successfully matched, multiple physical block matching data are obtained;

[0127] Random data cluster sequences are randomly allocated and stored according to the unique matching data and the matching data of the multiple physical blocks, so as to generate data cluster random storage data.

[0128] In this embodiment, a spatial location data structure of a physical block is defined, including the address, status, and available storage space of the physical block. Based on the physical block occupancy data, each physical block is traversed to calculate its spatial location, extract the spatial storage information of each physical block, record the total storage capacity and remaining available space of each physical block, extract each data cluster from the random data cluster sequence, ensure that each data cluster is processed independently, traverse the random data cluster sequence, record the identification, size, and storage space to be allocated of each data cluster, select a suitable matching algorithm (such as a greedy algorithm or a backtracking algorithm) for matching data clusters with physical blocks, and for each data cluster, traverse the spatial storage space of each physical block. , perform free matching. If a physical block is found that can completely accommodate the data cluster, the match is recorded as the unique matching data. If multiple physical blocks are found that can accommodate the data cluster, all matching physical block information is recorded as multiple physical block matching data. A storage allocation strategy is designed to store data based on the unique matching data and multiple physical block matching data. For unique matching data, the data cluster is directly stored in the corresponding physical block. For multiple physical block matching data, a random selection method is used to randomly select one from the available physical blocks for storage to ensure the randomness of storage. The storage location and storage block of each data cluster are recorded for subsequent data management and retrieval.

[0129] In this embodiment, refer to Figure 4 , is a flowchart of detailed implementation steps of step S3. In this embodiment, the detailed implementation steps of step S3 include:

[0130] Step S31: extracting a data timestamp based on the newly written data of the mobile solid state hard disk, and extracting a unique hard disk device code according to the mobile solid state hard disk;

[0131] Step S32: Calculate a random initial key based on the data timestamp and the unique hard disk device code to generate a random initial encryption key;

[0132] Step S33: Calculate the physical storage location of the data clusters randomly stored data to obtain storage location data of each data cluster;

[0133] Step S34: performing storage location mapping on the random initial encryption key based on the storage location data of each data cluster, thereby obtaining a key location mapping table;

[0134] Step S35: construct a distributed storage architecture for the random data cluster sequence based on the key position mapping table to build a distributed encryption storage framework.

[0135] In this embodiment, a data timestamp is extracted from newly written data of the mobile solid-state hard disk, and the writing time of the data is recorded for subsequent encryption operations. The unique device code (such as a serial number or UUID) of the mobile solid-state hard disk is obtained through the hard disk controller or driver to ensure the uniqueness of the device. A suitable random key generation algorithm (such as HMAC, SHA-256 or other encryption functions) is selected to combine the timestamp and the device code for key calculation. The extracted data timestamp and the unique hard disk device code are used as input to perform random initial encryption key calculation to generate a random initial encryption key to ensure the randomness and security of the key to prevent attacks. The method for determining the storage location calculation is usually based on the mapping relationship between data clusters in the physical storage block. The physical storage location calculation is performed on each data cluster to obtain the specific storage location data of each data cluster. (including physical block address and page number), record the storage location of each data cluster, provide a basis for subsequent key mapping and encryption operations, design the data structure of the key location mapping table, including the storage location of the data cluster and the corresponding random initial encryption key, based on the storage location data of each data cluster, map the random initial encryption key to its physical storage location, generate a key location mapping table, ensure that the key of each data cluster can accurately correspond to its storage location, facilitate subsequent encryption and decryption operations, design a distributed storage architecture, ensure that it can support multiple storage nodes and achieve load balancing, based on the key location mapping table, build a distributed storage architecture for the random data cluster sequence, ensure that each data cluster and its corresponding key can be effectively managed in a distributed environment, realize distributed encrypted storage of data and keys, and ensure data security and reliability.

[0136] In this embodiment, step S4 includes the following steps:

[0137] Step S41: when the mobile solid state hard disk is identified to be accessed, the hard disk work log is obtained;

[0138] Step S42: Calculate the current spatial position of the hard disk work log to generate the current hard disk spatial position coordinates;

[0139] Step S43: Perform historical hard disk work position statistics on the hard disk work log to generate historical spatial position data;

[0140] Step S44: performing a working position credibility calculation on the current hard disk space position coordinates based on the historical space position data to generate a current hard disk position credibility index;

[0141] Step S45: performing access behavior response detection on the hard disk work log to generate hard disk access behavior data;

[0142] Step S46: inferring abnormal access behavior of the hard disk access behavior data based on the current hard disk location credibility index, and extracting abnormal access behavior data.

[0143] In this embodiment, when a mobile solid-state hard disk is identified to be accessed, the operating system API (such as DeviceIoControl of Windows or ioctl of Linux) is used to obtain the working log of the hard disk, parse the relevant information in the working log, extract the current working status and location data of the hard disk (such as used space, total space, etc.), calculate the physical space location coordinates of the current hard disk through the physical IP address of the computer, extract the data of the historical hard disk working location from the log, including past usage and space changes, count the historical hard disk working locations, generate historical space location data, record the space usage at each time point for subsequent analysis, select a suitable trusted computing model (such as a method based on statistical analysis), analyze the relationship between the historical space location data and the current space location coordinates, perform trusted working location calculation on the current hard disk space location coordinates based on the historical space location data, and combine the hard disk history physical location data to obtain the historical hard disk working location data. Analyze the physical space address of the device to which the hard disk is connected this time, whether the current physical space address is a commonly used address, generate a trust index for the current hard disk location (such as calculated by standard deviation or Z-score), record the value of the trust index for subsequent anomaly detection, select a suitable access behavior detection algorithm (such as a rule engine, anomaly detection algorithm) to analyze the access behavior in the work log, perform access behavior response detection on the hard disk work log, generate hard disk access behavior data, record the time, type (read / write operation), request source and other information of each access, use a suitable anomaly detection model (such as a machine learning model, threshold detection) to analyze the hard disk access behavior data, and based on the current hard disk location trust index, infer abnormal access behavior of the hard disk access behavior data, extract abnormal access behavior data (such as frequent write operations, unexpected access sources), record abnormal access behavior data, and provide detailed information for subsequent auditing and processing.

[0144] In this embodiment, the specific steps of step S46 are:

[0145] Performing access address timing frequency statistics on hard disk access behavior data to obtain access address frequency;

[0146] Perform access distribution analysis on the access address frequency and identify the access distribution data of each address;

[0147] Calculate the visit duration of the address access frequency to obtain the address visit duration for each visit;

[0148] Perform internal address topology dependency analysis on the physical block data stored in the solid-state drive to obtain the IoT block topology dependency network;

[0149] Based on the IoT block topology dependency network, the access logic deviation analysis is performed on the dwell time of each address access and the access distribution data of each address to extract the access logic deviation behavior;

[0150] Based on the current hard disk location trust index, abnormal access behavior is inferred based on the access logic deviation behavior, and abnormal access behavior data is extracted.

[0151] In this embodiment, access address information is extracted from hard disk access behavior data, the timestamp and address of each access request are recorded, and data statistics tools (such as the Pandas library in Python) are used to perform time series frequency statistics on the extracted access addresses, the number of accesses to each address is calculated, access address frequency data is generated, the number of times each address is accessed is recorded, and a suitable distribution analysis method (such as a histogram, KDE estimation) is selected to perform distribution analysis of the access addresses. According to the access address frequency data, the access distribution data of each address is identified, a distribution graph is drawn to intuitively display the access conditions of different addresses, and the characteristics of the access distribution (such as mean, variance, frequency distribution, etc.) are recorded for subsequent analysis. The access residence time is defined as the time difference within each access cycle to a specific access address (i.e., the time between the first access and the last access), the access behavior data is traversed, the residence time of each access address is calculated, and the residence time data of each address is recorded to generate a residence time data set, including the access time of each address and its corresponding residence time. Based on the physical block data of the solid-state hard disk, an internal address is established. A topological dependency model is developed to represent the dependency between different addresses. A graph theory algorithm (such as the Dijkstra algorithm or the adjacency matrix of a graph) is used to analyze the topological dependency between addresses, generate an IoT block topological dependency network, record the nodes (addresses) and their connections (dependencies) in the topological network, and facilitate subsequent logical analysis. Access logic deviation is defined as a behavior that is inconsistent with the normal access pattern, such as abnormal access frequency, abnormal residence time, etc. Based on the IoT block topological dependency network, combined with the residence time of each address access and access distribution data, a logical deviation analysis is performed on the access behavior, the access logic deviation behavior is identified and extracted, and the type and degree of deviation, such as frequent jumps, abnormal residence, etc., is recorded. A suitable anomaly detection model (such as an anomaly detection model based on machine learning) is selected to analyze the access logic deviation behavior. Based on the current hard disk location trust index, the identified access logic deviation behavior is inferred for abnormal access behavior, and abnormal access behavior data is extracted. The detailed information of each abnormal access behavior, including the access address, deviation type, and trust index score, is recorded for subsequent audit and response.

[0152] In this embodiment, step S5 includes the following steps:

[0153] Step S51: Perform hard disk intrusion analysis on the abnormal access behavior data, and when the abnormal access behavior data is detected as intrusion behavior, mark it as hard disk intrusion behavior data;

[0154] Step S52: performing framework intrusion detection on the hard disk intrusion behavior data based on the distributed encryption storage framework to generate storage framework intrusion data;

[0155] Step S53: Generate an intrusion warning signal based on the storage framework intrusion data.

[0156] In this embodiment, the standard of abnormal access behavior is defined, and which features or patterns are regarded as intrusion behavior (such as unauthorized access, frequent failed attempts, etc.) are clearly defined. The abnormal access behavior data is analyzed one by one to check whether it meets the standard of intrusion behavior. If the detected abnormal access behavior data is identified as intrusion behavior, it is marked as hard disk intrusion behavior data. The detailed information of the marked intrusion behavior is recorded, including access time, address, behavior type, etc. Based on the distributed encryption storage framework, a suitable intrusion detection mechanism (such as rule-based detection, anomaly detection model) is selected to analyze the hard disk intrusion behavior data. The data marked as hard disk intrusion behavior is input into the intrusion detection system to monitor and analyze its impact on the storage framework in real time. The storage framework intrusion data is generated, and all relevant intrusion detection results are recorded, including the time, type, and scope of impact of the intrusion detection trigger. The generation mechanism of the intrusion warning signal is designed, and the standards and content of the warning signal (such as urgency, notification method, etc.) are defined. Based on the storage framework intrusion data, the severity and potential impact of the intrusion are analyzed, and the corresponding intrusion warning signal is generated. The generated warning signal is recorded to ensure that it can be communicated to relevant personnel in a timely manner through appropriate channels (such as email, SMS or system notification) for subsequent processing.

[0157] In this embodiment, the specific steps of step S6 are:

[0158] Activate high-speed security protection mode of mobile solid-state hard disk based on intrusion warning signals;

[0159] The high-speed security protection mode specifically includes: identifying all storage physical blocks of the distributed encryption storage framework;

[0160] Perform multi-threaded random high-speed reading and writing on all storage physical blocks to extract the storage data of all physical blocks;

[0161] Perform XOR overwriting modification on the storage data of all physical blocks to generate multiple overwriting modification storage data;

[0162] Iteratively perform confusion sorting on all storage physical blocks to generate new confusion storage physical blocks;

[0163] Based on multiple overwriting and modification of storage data, the new obfuscated storage physical block is fully covered and stored to generate a deep coverage storage framework;

[0164] Define the depth coverage protection interval;

[0165] Repeating the full depth coverage storage operation in real time according to the depth coverage protection interval;

[0166] Make security protection decisions based on the high-speed security protection mode and build a hard disk high-speed security protection strategy to perform security risk protection operations.

[0167] In this embodiment, the intrusion warning signal is monitored. Once the signal is activated, the high-speed security protection mode is immediately started. The information of all storage physical blocks in the distributed encryption storage framework is obtained through the hard disk controller or the management interface, including the address, status and storage capacity of each physical block. The identified physical block information is stored in a data structure (such as a list or an array) for subsequent processing. A multi-threaded program is designed, and concurrent technology (such as Python's ThreadPoolExecutor or C++'s std::thread) is used to achieve out-of-order high-speed reading and writing of physical blocks. All storage physical blocks are read and written in parallel, and storage data of all physical blocks are extracted. The read data is recorded for subsequent overwriting and obfuscation processing. XOR operation is selected to achieve data overwriting to ensure that each byte can be effectively modified, and all extracted physical block storage data is overwritten by XOR. Modify, generate multiple overwrite modified data, record the generated overwrite modified data for deep overwrite storage, design iterative obfuscation algorithm (such as random shuffle algorithm) to disrupt the order of stored data, increase data security, iteratively confuse and sort the data of all storage physical blocks, generate new obfuscated storage physical blocks, ensure that the obfuscated data can be correctly interpreted and written into the physical blocks, based on multiple overwrite modification storage data, perform full deep overwrite storage on the new obfuscated storage physical blocks, ensure that all physical blocks are overwritten by new data, and achieve the purpose of eliminating the original data, define the time of deep overwrite protection interval (such as every 5 minutes, 10 minutes, etc.) to decide when to repeat the deep overwrite operation, store the protection interval parameters in the configuration file or memory for subsequent calls, use timers or task schedulers (such as Linux cron or Windows Task) Scheduler) regularly performs full deep coverage storage operations according to the defined deep coverage protection interval. When each deep coverage protection interval is reached, the full deep coverage storage operation is repeated to enhance data security. Based on the current high-speed security protection mode, a comprehensive security protection strategy is designed, including risk identification, emergency response and data protection measures. During the implementation process, the storage status and potential security threats are monitored in real time, and corresponding security risk protection operations are executed according to the strategy. All operations are recorded for auditing.

[0168] In this embodiment, a security risk protection system for a mobile solid-state hard disk is provided, which is used to execute the security risk protection method for a mobile solid-state hard disk as described above, including:

[0169] The data encapsulation module is used to obtain the newly written data of the mobile solid-state hard disk; decompose the newly written data of the mobile solid-state hard disk into multiple segments, and perform independent data encapsulation to construct multiple data clusters;

[0170] The idle storage module is used to randomly arrange multiple data clusters in a disordered order and perform random idle allocation storage to generate data clusters for random storage data;

[0171] The distributed encryption storage module is used to generate a random initial encryption key based on the newly written data of the mobile solid-state hard disk; based on the random initial encryption key, a distributed storage architecture is constructed for randomly storing data in the data cluster to build a distributed encryption storage framework;

[0172] The abnormal access inference module is used to obtain the hard disk work log when the mobile solid-state hard disk is accessed; perform access behavior response detection on the hard disk work log, and perform abnormal access behavior inference to extract abnormal access behavior data;

[0173] The framework intrusion detection module is used to perform framework intrusion detection on abnormal access behavior data based on the distributed encrypted storage framework to generate storage framework intrusion data; and to generate an intrusion warning signal based on the storage framework intrusion data;

[0174] The security protection decision module is used to make security protection decisions for mobile solid-state hard drives based on intrusion warning signals, build hard drive high-speed security protection strategies, and perform security risk protection operations.

[0175] The present invention constructs multiple data clusters through multi-segment data decomposition and independent data encapsulation, realizes isolation of newly written data and prevents data cross-influence, realizes random storage of data clusters through random disorder arrangement and random idle allocation storage, increases data security and obfuscation, and makes data more difficult to be maliciously acquired, realizes encrypted storage of data and improves data confidentiality and security by generating random initial encryption keys and building a distributed encryption storage framework, improves detection and response capabilities for abnormal access behaviors through analysis of hard disk work logs and inference of abnormal access behaviors, and helps to timely discover potential security threats, realizes security monitoring of storage frameworks through framework intrusion detection and generation of intrusion warning signals, timely discovers existing intrusion behaviors, ensures data security, makes security protection decisions based on intrusion warning signals, and builds high-speed security protection strategies, which helps to quickly respond to potential security threats and strengthen security protection for hard disks.

[0176] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0177] The above is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A method for protecting a mobile solid state hard disk from security risks, characterized in that: The following steps are involved: Step S1: acquiring newly written data of the mobile solid state hard disk; decomposing the newly written data of the mobile solid state hard disk into multiple segments, and performing independent data encapsulation to construct multiple data clusters; Step S2: randomly arranging multiple data clusters in a disordered order and performing random idle allocation storage to generate data clusters for random storage of data; Step S3: Generate a random initial encryption key based on the newly written data of the mobile solid-state hard disk; construct a distributed storage architecture for randomly storing data in the data cluster based on the random initial encryption key to build a distributed encryption storage framework; the specific steps of step S3 are: Step S31: extracting a data timestamp based on the newly written data of the mobile solid state hard disk, and extracting a unique hard disk device code according to the mobile solid state hard disk; Step S32: Calculate a random initial key based on the data timestamp and the unique hard disk device code to generate a random initial encryption key; Step S33: Calculate the physical storage location of the data clusters randomly stored data to obtain storage location data of each data cluster; Step S34: performing storage location mapping on the random initial encryption key based on the storage location data of each data cluster, thereby obtaining a key location mapping table; Step S35: constructing a distributed storage architecture for the random data cluster sequence based on the key position mapping table to build a distributed encryption storage framework; Step S4: when the mobile solid-state hard disk is identified to be accessed, the hard disk work log is obtained; access behavior response detection is performed on the hard disk work log, and abnormal access behavior is inferred, and abnormal access behavior data is extracted; Step S5: performing framework intrusion detection on the abnormal access behavior data based on the distributed encrypted storage framework to generate storage framework intrusion data; generating an intrusion warning signal based on the storage framework intrusion data; Step S6: Make security protection decisions for the mobile solid-state hard disk based on the intrusion warning signal, and build a high-speed hard disk security protection strategy to perform security risk protection operations; the specific steps of step S6 are: Activate high-speed security protection mode of mobile solid-state hard disk based on intrusion warning signals; The high-speed security protection mode specifically includes: identifying all storage physical blocks of the distributed encryption storage framework; Perform multi-threaded random high-speed reading and writing on all storage physical blocks to extract the storage data of all physical blocks; Perform XOR overwriting modification on the storage data of all physical blocks to generate multiple overwriting modification storage data; Iteratively perform confusion sorting on all storage physical blocks to generate new confusion storage physical blocks; Based on multiple overwriting and modification of storage data, the new obfuscated storage physical block is fully covered and stored to generate a deep coverage storage framework; Define the depth coverage protection interval; Repeating the full depth coverage storage operation in real time according to the depth coverage protection interval; Make security protection decisions based on the high-speed security protection mode and build a hard disk high-speed security protection strategy to perform security risk protection operations.

2. The method for protecting the security risk of a mobile solid state drive according to claim 1, characterized in that: The specific steps of step S1 are: Step S11: acquiring newly written data of the mobile solid state hard disk; decomposing the newly written data of the mobile solid state hard disk into multiple segments to obtain multiple written data units; Step S12: performing cyclic redundancy check on multiple written data units to extract erroneous data units; Step S13: Encoding and correcting the erroneous data unit to generate a check-corrected data unit; Step S14: embedding random length header information into the check and correction data unit to obtain a header information embedded data unit; Step S15: perform independent data encapsulation on the header information embedded data unit to construct multiple data clusters.

3. The method according to claim 1, characterized in that: The specific steps of step S2 are: Step S21: sequentially number multiple data clusters to obtain a number for each data cluster; Step S22: randomly arranging multiple data clusters in random order based on each data cluster number to obtain a random data cluster sequence; Step S23: Analyze the storage physical blocks of the mobile solid state drive to generate the storage physical block data in the solid state drive; Step S24: calculating the physical block occupancy of each physical block stored in the solid state drive to obtain physical block occupancy data; Step S25: Randomly allocate and store the random data cluster sequence according to the physical block occupancy data to generate data cluster random storage data.

4. The method for protecting the security risk of a mobile solid state drive according to claim 3, characterized in that: The specific steps of step S25 are: Calculate the spatial position of the physical block based on the physical block occupancy data and extract the spatial storage space of each physical block; Extract each data cluster based on the random data cluster sequence; Performing storage space free matching on the spatial storage space of each physical block based on each data cluster, and generating unique matching data when only one spatial physical block of the data cluster is successfully matched; When the data cluster has multiple spatial physical blocks that are successfully matched, multiple physical block matching data are obtained; Random data cluster sequences are randomly allocated and stored according to the unique matching data and the matching data of the multiple physical blocks, so as to generate data cluster random storage data.

5. The method for protecting the security risk of a mobile solid state drive according to claim 1, characterized in that: The specific steps of step S4 are: Step S41: when the mobile solid state hard disk is identified to be accessed, the hard disk work log is obtained; Step S42: Calculate the current spatial position of the hard disk work log to generate the current hard disk spatial position coordinates; Step S43: Perform historical hard disk work position statistics on the hard disk work log to generate historical spatial position data; Step S44: performing a working position credibility calculation on the current hard disk space position coordinates based on the historical space position data to generate a current hard disk position credibility index; Step S45: performing access behavior response detection on the hard disk work log to generate hard disk access behavior data; Step S46: inferring abnormal access behavior of the hard disk access behavior data based on the current hard disk location credibility index, and extracting abnormal access behavior data.

6. The method for protecting the security risk of a mobile solid state drive according to claim 5, characterized in that: The specific steps of step S46 are: Performing access address timing frequency statistics on hard disk access behavior data to obtain access address frequency; Perform access distribution analysis on the access address frequency and identify the access distribution data of each address; Calculate the visit duration of the address access frequency to obtain the address visit duration for each visit; Perform internal address topology dependency analysis on the physical block data stored in the solid-state drive to obtain the IoT block topology dependency network; Based on the IoT block topology dependency network, the access logic deviation analysis is performed on the dwell time of each address access and the access distribution data of each address to extract the access logic deviation behavior; Based on the current hard disk location trust index, abnormal access behavior is inferred based on the access logic deviation behavior, and abnormal access behavior data is extracted.

7. The method for protecting the security risk of a mobile solid state hard disk according to claim 1, characterized in that: The specific steps of step S5 are: Step S51: Perform hard disk intrusion analysis on the abnormal access behavior data, and when the abnormal access behavior data is detected as intrusion behavior, mark it as hard disk intrusion behavior data; Step S52: performing framework intrusion detection on the hard disk intrusion behavior data based on the distributed encryption storage framework to generate storage framework intrusion data; Step S53: Generate an intrusion warning signal based on the storage framework intrusion data.

8. A security risk protection system for a mobile solid state hard disk, characterized in that: The method for protecting the mobile solid state hard disk from security risks according to claim 1 comprises: The data encapsulation module is used to obtain the newly written data of the mobile solid-state hard disk; decompose the newly written data of the mobile solid-state hard disk into multiple segments, and perform independent data encapsulation to construct multiple data clusters; The idle storage module is used to randomly arrange multiple data clusters in a disordered order and perform random idle allocation storage to generate data clusters for random storage data; The distributed encryption storage module is used to generate a random initial encryption key based on the newly written data of the mobile solid-state hard disk; based on the random initial encryption key, a distributed storage architecture is constructed for randomly storing data in the data cluster to build a distributed encryption storage framework; The abnormal access inference module is used to obtain the hard disk work log when the mobile solid-state hard disk is accessed; perform access behavior response detection on the hard disk work log, and perform abnormal access behavior inference to extract abnormal access behavior data; The framework intrusion detection module is used to perform framework intrusion detection on abnormal access behavior data based on the distributed encrypted storage framework to generate storage framework intrusion data; and to generate an intrusion warning signal based on the storage framework intrusion data; The security protection decision module is used to make security protection decisions for mobile solid-state hard drives based on intrusion warning signals, build hard drive high-speed security protection strategies, and perform security risk protection operations.

Images