Data protection method and device and data burning method and device

Abstract

The invention relates to a data protection method and device and a burning method and device.The data protection method comprises the steps that first indication information is obtained according to an operation request of a requester, and the first indication information is used for indicating a target position in a hard disk corresponding to the operation request; obtaining metadata of the protection data; wherein the metadata is used for indicating the storage position of the protection data in the hard disk, the metadata, the protection data and firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burnt into a firmware storage space; and under the condition that the target position is overlapped with the storage position, determining an execution mode of the operation request. Through the method and the device, the protection data in the hard disk can be effectively prevented from being read and written randomly, so that the protection data is prevented from being lost or stolen, and the safety protection of the protection data is realized.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a data protection method, a burning method and a device. Background Art

[0002] Hard disks can be used to store data. Sometimes, some data stored in the hard disk is not intended to be used by a third party or is accidentally deleted. In this case, it is necessary to protect the specified data in the hard disk. In the prior art, the specified data is protected at the operating system level, but this method can only achieve limited protection effects. Summary of the invention

[0003] In view of this, the present disclosure proposes a data protection method, a burning method and device, a device, an electronic device and a storage medium.

[0004] According to one aspect of the present disclosure, a data protection method is provided, the method comprising:

[0005] Acquire first indication information according to the operation request of the requesting party, where the first indication information is used to indicate a target location in the hard disk corresponding to the operation request;

[0006] Obtain metadata of the protection data; wherein the metadata is used to indicate a storage location of the protection data in the hard disk, the metadata, the protection data and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space;

[0007] In a case where the target location overlaps with the storage location, a method for executing the operation request is determined.

[0008] In a possible implementation manner, the pre-burning of the same file into the firmware storage space includes: pre-burning the same file into the firmware storage space in a bit-by-bit writing manner.

[0009] In a possible implementation, the metadata is further used to indicate a type of preset operation allowed to be performed on the storage location;

[0010] The method further includes: acquiring second indication information according to the operation request of the requesting party, where the second indication information is used to indicate an operation type corresponding to the operation request, where the operation type includes a read operation or a write operation;

[0011] The determining of the execution mode of the operation request includes: determining the execution mode of the operation request according to the operation type corresponding to the operation request and the preset operation type.

[0012] In a possible implementation manner, determining the execution manner of the operation request includes: feeding back preset data to the requesting party, wherein the preset data is different from the protection data.

[0013] In a possible implementation, the metadata is further used to indicate preset identity information that is allowed to read and write the storage location;

[0014] The method further includes: acquiring third indication information according to the operation request of the requesting party, wherein the third indication information is used to indicate the identity information of the requesting party;

[0015] The determining of the execution mode of the operation request includes:

[0016] If the identity information of the requesting party is in the preset identity information, the operation corresponding to the operation request is executed.

[0017] In a possible implementation, the protection data is a boot file of an operating system;

[0018] The method further comprises:

[0019] When the operating system is in an installed state, an operation request from the requester is intercepted.

[0020] According to another aspect of the present disclosure, a burning method is provided, the method comprising:

[0021] Acquire protection data, metadata of the protection data, and firmware of a hard disk, wherein the metadata is used to indicate a storage location of the protection data in the hard disk;

[0022] Packing the metadata, the protection data and the firmware of the hard disk into the same file;

[0023] The same file is burned into the firmware storage space to protect the protection data.

[0024] In a possible implementation, the metadata is further used to indicate a preset operation type allowed to be performed on the storage location and / or preset identity information that is allowed to read and write the storage location.

[0025] In a possible implementation, the protection data is a boot file of an operating system;

[0026] The method further comprises:

[0027] Obtaining a storage path of the boot file in the file system;

[0028] The storage location of the boot file in the hard disk is determined based on a mapping relationship between a storage path in the file system and a storage location in the hard disk, and a storage path of the boot file in the file system.

[0029] According to another aspect of the present disclosure, a data protection device is provided, the device comprising:

[0030] An acquisition module, configured to acquire first indication information according to an operation request of a requesting party, wherein the first indication information is used to indicate a target location in a hard disk corresponding to the operation request;

[0031] The acquisition module is further used to acquire metadata of the protection data; wherein the metadata is used to indicate the storage location of the protection data in the hard disk, and the metadata, the protection data and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space;

[0032] A determination module is used to determine the execution mode of the operation request when the target location overlaps with the storage location.

[0033] According to another aspect of the present disclosure, a burning device is provided, the device comprising:

[0034] an acquisition module, used for acquiring protection data, metadata of the protection data and firmware of a hard disk, wherein the metadata is used for indicating a storage location of the protection data in the hard disk;

[0035] A packaging module, used for packaging the metadata, the protection data and the firmware of the hard disk into the same file;

[0036] The burning module is used to burn the same file into the firmware storage space to protect the protection data.

[0037] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0038] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, wherein the computer program instructions implement the above method when executed by a processor.

[0039] According to another aspect of the present disclosure, a computer program product is provided, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0040] Through various aspects of the present disclosure, according to the operation request of the requesting party, first indication information is obtained, and the first indication information is used to indicate the target position in the hard disk corresponding to the operation request; metadata of the protection data is obtained; wherein the metadata is used to indicate the storage position of the protection data in the hard disk, and the metadata, the protection data and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space; when the target position and the storage position overlap, the execution method of the operation request is determined. In this way, the operation request of the requesting party is not directly executed, but when the target position in the hard disk corresponding to the operation request of the requesting party overlaps with the storage position of the protection data in the hard disk, the execution method of the operation request is determined, which can effectively prevent the protection data in the hard disk from being arbitrarily read and written, thereby preventing the protection data from being lost or stolen, and realizing the security protection of the protection data. In addition, the metadata, protection data and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space. The protection data and metadata in the firmware storage space will not be arbitrarily tampered with. If the protection data stored in the hard disk is damaged, the protection data can also be quickly restored through the protection data backed up in the firmware storage space; at the same time, the accuracy of the storage location of the protection data indicated by the metadata in the hard disk is guaranteed.

[0041] Further features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.

[0043] Figure 1 A flow chart showing a data protection method according to an embodiment of the present disclosure;

[0044] Figure 2 A flow chart showing a data protection method according to an embodiment of the present disclosure is shown;

[0045] Figure 3 A schematic diagram showing protection of a boot file BootMgrfw.efi according to an embodiment of the present disclosure is shown;

[0046] Figure 4 A flow chart showing a data protection method according to an embodiment of the present disclosure is shown;

[0047] Figure 5 A flow chart showing a data protection method according to an embodiment of the present disclosure is shown;

[0048] Figure 6 A flowchart of a burning method according to an embodiment of the present disclosure is shown;

[0049] Figure 7 A structural diagram of a data protection device according to an embodiment of the present disclosure is shown;

[0050] Figure 8 A structural diagram of a burning device according to an embodiment of the present disclosure is shown;

[0051] Fig. 9 A block diagram of an electronic device 1900 according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0052] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0053] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0054] The term "and / or" herein is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C can represent including any one or more elements selected from the set consisting of A, B, and C.

[0055] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0056] A hard disk can be used to store data. Sometimes, some data stored in the hard disk is not intended to be used by a third party or is accidentally deleted. In this case, it is necessary to protect the specified data in the hard disk. In the prior art, the specified data is protected at the operating system level, for example, the BitLocker driver protects certain data stored on the operating system volume. However, for this method of protecting specific data at the operating system level, some software can bypass the protection of the operating system and directly read and write the specific data, that is, the protection effect of this method on the data is limited and cannot meet the requirements of data protection.

[0057] In order to solve the above technical problems, the embodiment of the present disclosure provides a data protection method (detailed description is provided below), which obtains first indication information according to the operation request of the requester, and the first indication information is used to indicate the target position in the hard disk corresponding to the operation request; obtains metadata of the protection data; wherein the metadata is used to indicate the storage position of the protection data in the hard disk, and the metadata, the protection data and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space; when the target position and the storage position overlap, determines the execution method of the operation request. In this way, the operation request of the requester is not directly executed, but when the target position in the hard disk corresponding to the operation request of the requester overlaps with the storage position of the protection data in the hard disk, determines the execution method of the operation request, which can effectively prevent the protection data in the hard disk from being read and written arbitrarily, thereby preventing the protection data from being lost or stolen, and realizing the security protection of the protection data. In addition, the metadata, protection data and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space. The protection data and metadata in the firmware storage space will not be arbitrarily tampered with. If the protection data stored in the hard disk is damaged, the protection data can also be quickly restored through the protection data backed up in the firmware storage space; at the same time, the accuracy of the storage location of the protection data indicated by the metadata in the hard disk is guaranteed.

[0058] Exemplarily, the data protection method can be executed by an electronic device such as a terminal device or a server, or by one or more processors configured in the electronic device; the terminal device can be a user equipment (User Equipment, UE), a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a personal digital assistant (Personal Digital Assistant, PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc.; Exemplarily, the data protection method can be implemented by a processor calling a computer-readable instruction stored in a memory, for example, the data protection method can be implemented by a processor calling a hard disk firmware stored in a read-only memory (Read-Only Memory, ROM).

[0059] Figure 1 A flow chart of a data protection method according to an embodiment of the present disclosure is shown as follows: Figure 1 As shown, the data protection method may include the following steps:

[0060] Step 101: Obtain first indication information according to an operation request from a requesting party.

[0061] Exemplarily, the requester may be any subject that requests to perform read and write operations on a target location in the hard disk, and the embodiments of the present disclosure do not impose any limitation on this; for example, the requester may be an application, a functional module, or an electronic device.

[0062] Exemplarily, the operation request of the requesting party can be intercepted, and then the first indication information can be obtained according to the intercepted operation request. For example, the operation request of the requesting party can be intercepted by a pre-configured Hook (hook function), and the interception conditions can also be pre-configured according to the needs. As an example, taking the boot file of the operating system as the protected data, the operation request of the requesting party can be intercepted when the operating system is in the installed state; and then the operations of steps 101, 102 and 103 are performed to determine the execution method of the operation request, rather than directly executing the operation request, so as to intercept the operation request when the operating system is in the installed state, so that the boot file is not arbitrarily read or tampered with. Among them, the boot file is a necessary file for the startup of the operating system. It plays an important role when the operating system starts, and is responsible for a series of tasks such as detecting the system hardware environment, initializing the operating system, and starting other system services. Exemplarily, the operating system may include: Windows operating system, Unix operating system, Unix-like operating system, Mac OS operating system, Chrome OS operating system, etc. Taking Windows operating system as an example, the protection data may be a Unified Extensible Firmware Interface (UEFI) boot file. UEFI is a computer Basic Input Output System (BIOS) system specification, which is used to define the software interface between the operating system and the system firmware. As an alternative to BIOS, UEFI is responsible for power-on self-test, contacting the operating system, and providing an interface connecting the operating system and the hardware. BIOS is a firmware that starts the Windows system, runs hardware checks, and starts the operating system. It is usually solidified in the ROM of the computer motherboard. Its main function is to complete the power-on self-test of the system, the initialization of each functional module in the system, the basic input / output driver of the system, and boot the operating system.

[0063] The first indication information is used to indicate the target location in the hard disk corresponding to the operation request, which is the location in the hard disk of the data that the requester wants to read, or the location in the hard disk of the data that the requester requests to write.

[0064] As an example, a hard disk usually has multiple sectors. Each sector is a sector-shaped area divided by tracks on the internal circular metal disk of the hard disk for storing data. Each sector has a unique number. For example, a hard disk has 1024 tracks, and each track is divided into 63 sectors. Then the sector numbers of track 0 are 1 to 63, the starting sector number of track 1 is 64, and the last sector number of the last track is 64512. For a certain data stored in the hard disk, the storage location of the data in the hard disk can be indicated by all the sector numbers where the data is located. The data can be stored in one or more sectors of the hard disk. When stored in multiple sectors of the hard disk, the multiple sectors can be distributed continuously or discretely. Usually, the multiple sectors where the data is located are distributed continuously. At this time, the number of the starting sector where the data is located and the number of sectors where the data is located can be used to indicate the storage location of the data in the hard disk. For example, if the data is stored in sectors 1 and 2, the storage location of the data in the hard disk can be indicated by the starting sector number 1 and the number of sectors 2. Exemplarily, the first indication information is the number of a sector of the hard disk and the number of sectors. The sector number is used as the number of the starting sector. The sector number and the number of sectors can indicate the target position in the hard disk corresponding to the operation request; for example, the first indication information is the number of the starting sector 5 and the number of sectors 3, which means that the target position in the hard disk corresponding to the operation request of the requester is sector 5, sector 6, and sector 7.

[0065] Step 102: Obtain metadata of the protected data.

[0066] The metadata is used to indicate the storage location of the protection data in the hard disk.

[0067] The protected data is data stored in the hard disk that the user does not want to be used by a third party, read or written arbitrarily, or accidentally deleted; it is understandable that any type and amount of data in the hard disk can be pre-set as protected data as needed; illustratively, the protected data can include files, images, text, audio, code, and other types of data. Exemplarily, there can be multiple protected data to form a group of protected data, and accordingly, the metadata is used to indicate the storage location of the group of protected data in the hard disk, so that the group of protected data can be protected at the same time.

[0068] Exemplarily, the storage location of each protection data in the hard disk can be represented by all the sector numbers where the protection data is located; wherein, when all the sectors where the protection data is located are continuously distributed, the number of the starting sector where the protection data is located and the number of sectors where the protection data is located can be used to represent the storage location of the protection data in the hard disk; exemplarily, the metadata of the protection data can record the number of a certain sector of the hard disk and the number of sectors, and the number of the sector is used as the number of the starting sector. The number of the sector and the number of sectors can indicate the storage location of the protection data in the hard disk; for example, the metadata of the protection data records the number of the starting sector 1 and the number of sectors 3, indicating that the protection data is stored in sectors 1, sector 2, and sector 3 of the hard disk.

[0069] The metadata, the protection data and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space. The firmware storage space is a space for storing the firmware of the hard disk; the firmware of the hard disk can be understood as "solidified software". Unlike ordinary software, it is a program code solidified inside the integrated circuit and used to guide the hard disk to work. In this way, the protection data and the metadata of the protection data are pre-packaged in the same file with the firmware of the hard disk, and the same file is pre-burned into the firmware storage space. If the protection data stored in the hard disk is damaged, the protection data can also be quickly restored through the protection data backed up in the firmware storage space; at the same time, the metadata of the protection data is stored in the firmware storage space and will not be arbitrarily tampered with, thereby ensuring the accuracy of the storage location of the protection data indicated by the metadata in the hard disk.

[0070] In a possible implementation, the pre-burning of the same file into the firmware storage space may include: the pre-burning of the same file into the firmware storage space in a bit-by-bit writing manner. In this way, the same file is pre-burned into the firmware storage space in a safe bit-by-bit writing manner, further improving the data security of the protection data and the metadata of the protection data.

[0071] Exemplarily, the firmware storage space is located in a read-only memory (ROM); that is, metadata of the protection data, protection data, and files packaged with the firmware of the hard disk can be stored in the ROM. For example, they can be pre-burned into the ROM in a bit-by-bit write manner. Since the data in the ROM can only be read and cannot be modified at will, it is ensured that the protection data and the metadata of the protection data will not be tampered with.

[0072] It should be noted that the execution order of the above steps 101 and 102 is not limited; as an example, the first indication information can be obtained according to the operation request of the requesting party, and then the metadata of the protection data can be obtained. For example, after obtaining the operation request of the requesting party, the operation request can be parsed to obtain the first indication information; and then in response to the operation request, the metadata of the protection data can be read from the firmware storage space. As another example, the metadata of the protection data can be obtained first, and then the first indication information can be obtained according to the operation request of the requesting party. For example, the metadata of the protection data can be read from the firmware storage space, and then after obtaining the operation request of the requesting party, the operation request can be parsed to obtain the first indication information.

[0073] Step 103: When the target location overlaps with the storage location, determine the execution method of the operation request.

[0074] In this step, when the target location corresponding to the operation request of the requester overlaps with the storage location of the protection data on the hard disk, it indicates that if the operation corresponding to the operation request of the requester is executed, it is possible for the requester to read the protection data, rewrite the protection data or delete the protection data; therefore, the operation corresponding to the operation request is not directly executed, but the execution method of the operation request of the requester is determined to prevent the protection data from being arbitrarily read, deleted or modified.

[0075] Exemplarily, the target position corresponding to the operation request of the requester can be compared with the storage position of the protection data on the hard disk to determine whether the target position and the storage position of the protection data on the hard disk overlap, and then when the target position corresponding to the operation request of the requester overlaps with the storage position of the protection data on the hard disk, determine the execution method of the operation request. Exemplarily, when the target position corresponding to the operation request does not overlap with the storage position of the protection data on the hard disk, it can be known that the operation corresponding to the operation request of the requester will not target the protection data, and the operation corresponding to the operation request of the requester can be executed.

[0076] As an example, the first indication information may be the number of a certain sector of the hard disk and the number of sectors, so that all sectors of the hard disk corresponding to the operation request can be determined; the metadata of the protection data may record the number of a certain sector of the hard disk and the number of sectors, so that all sectors of the hard disk stored with the protection data can be determined. If there is any identical sector among all sectors of the hard disk corresponding to the operation request and all sectors of the hard disk stored with the protection data, it can be determined that the target position overlaps with the storage position of the protection data on the hard disk; otherwise, it is determined that the target position does not overlap with the storage position of the protection data on the hard disk. For example, the number of the starting sector recorded in the metadata of the protection data is 1 and the number of sectors is 1, that is, the protection data is stored in sector 1 of the hard disk, and the first indication information is that the number of the starting sector is 1 and the number of sectors is 3, that is, the operation request corresponds to three sectors 1, 2, and 3 in the hard disk, including sector 1, that is, including the sector where the protection data is located. At this time, it is determined that the target position in the hard disk corresponding to the operation request of the requester overlaps with the storage position of the protection data in the hard disk, and it is necessary to further determine the execution method of the operation request to prevent the risk of arbitrary reading or modification of the protection data of sector 1 caused by directly executing the operation corresponding to the operation request. For another example, the metadata of the protected data records the starting sector numbered 1, and the number of sectors is 2, that is, the protected data is stored in sectors 1 and 2 of the hard disk; the first indication information records the starting sector numbered 2, and the number of sectors is 3, that is, the operation request corresponds to sectors 2, 3, and 4 of the hard disk, including sector 2. At this time, it is determined that the target location in the hard disk corresponding to the operation request of the requester overlaps with the storage location of the protected data in the hard disk, and it is necessary to further determine the execution method of the operation request of the requester to prevent the risk of arbitrary reading or modification of the protected data in sector 2 caused by directly executing the operation corresponding to the operation request. For another example, the starting sector number recorded in the metadata of the protection data is 1, and the number of sectors is 2, that is, the protection data is stored in sectors 1 and 2 of the hard disk; the starting sector number recorded in the first indication information is 3, and the number of sectors is 3, that is, the operation request corresponds to sectors 3, 4, and 5 of the hard disk, and does not include the sector where the protection data is located. At this time, it is determined that there is no overlap between the target location in the hard disk corresponding to the operation request of the requester and the storage location of the protection data in the hard disk, that is, the requester will not read the protection data or write data to the storage location of the protection data in the hard disk, then the operation corresponding to the operation request of the requester can be executed.

[0077] In the disclosed embodiment, according to the operation request of the requesting party, first indication information is obtained, and the first indication information is used to indicate the target position in the hard disk corresponding to the operation request; metadata of the protection data is obtained; wherein the metadata is used to indicate the storage position of the protection data in the hard disk, and the metadata, the protection data and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space; when there is an overlap between the target position and the storage position, the execution method of the operation request is determined. In this way, the operation request of the requesting party is not directly executed, but when the target position in the hard disk corresponding to the operation request of the requesting party overlaps with the storage position of the protection data in the hard disk, the execution method of the operation request is determined, which can effectively prevent the protection data in the hard disk from being read and written arbitrarily, thereby preventing the protection data from being lost or stolen, and realizing the security protection of the protection data. In addition, the metadata, protection data and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space. The protection data and metadata in the firmware storage space will not be arbitrarily tampered with. If the protection data stored in the hard disk is damaged, the protection data can also be quickly restored through the protection data backed up in the firmware storage space; at the same time, the accuracy of the storage location of the protection data indicated by the metadata in the hard disk is guaranteed.

[0078] The following is an exemplary description of possible implementation methods of determining the execution method of the operation request in the above step 103.

[0079] In scenario 1, the metadata of the protected data is also used to indicate the preset operation type allowed to be performed on the storage location of the protected data in the hard disk. Therefore, in the above step 103, the execution method of the operation request can be determined based on the preset operation type allowed to be performed on the storage location of the protected data in the hard disk and the operation type corresponding to the operation request of the requesting party.

[0080] Figure 2 A flow chart of a data protection method according to an embodiment of the present disclosure is shown as follows: Figure 2 As shown, the following steps may be included:

[0081] Step 201: Obtain first indication information according to an operation request from a requesting party.

[0082] This step can refer to the above Figure 1 The related description in step 101 will not be repeated here.

[0083] Step 202: Obtain second indication information according to the operation request of the requesting party;

[0084] The second indication information is used to indicate the operation type corresponding to the operation request, and the operation type includes a read operation or a write operation, wherein a read operation indicates reading data at a certain location, and a write operation indicates writing data to a certain location or deleting data at a certain location.

[0085] Exemplarily, the operation type corresponding to the operation request of the requester can be determined according to the second indication information, that is, it is determined whether the requester wants to perform a read operation or a write operation on the target location in the hard disk.

[0086] It should be noted that the above step 201 can be performed before step 202, can be performed after step 202, or step 201 and step 202 can be performed simultaneously, and there is no limitation on this. For example, after obtaining the operation request of the requesting party, the operation request can be parsed to obtain the first indication information and the second indication information.

[0087] Step 203: Obtain metadata of the protected data.

[0088] This step can refer to the above Figure 1 The relevant statement in step 102.

[0089] The metadata of the protection data is used to indicate the storage location of the protection data in the hard disk; and is also used to indicate the type of preset operations allowed to be performed on the storage location.

[0090] Exemplarily, the preset operation type may be a read operation, i.e., the metadata of the protection data is also used to indicate that only a read operation is allowed for the storage location of the protection data in the hard disk. Exemplarily, the preset operation type may be a write operation, i.e., the metadata of the protection data is also used to indicate that only a write operation is allowed for the storage location of the protection data in the hard disk.

[0091] Since the metadata of the protection data, the protection data and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space, the metadata of the protection data will not be arbitrarily tampered with, thereby ensuring the accuracy of the storage location of the protection data in the hard disk indicated by the metadata and the preset operation types allowed for the storage location.

[0092] Step 204: When the target location overlaps with the storage location, determine the execution method of the operation request according to the operation type corresponding to the operation request and the preset operation type.

[0093] In one possible implementation, determining the execution method of the operation request based on the operation type corresponding to the operation request and the preset operation type may include: if the operation type corresponding to the operation request is the same as the preset operation type, executing the operation corresponding to the operation request; otherwise, not executing the operation corresponding to the operation request.

[0094] Exemplarily, the operation type corresponding to the operation request of the requester indicated by the second indication information can be compared with the preset operation type allowed to be performed on the storage location of the protected data on the hard disk indicated by the metadata of the protected data. If the two are the same, it indicates that the operation corresponding to the operation request of the requester is allowed, and the operation corresponding to the operation request will not pose a threat to the security of the protected data. In this case, the operation corresponding to the operation request can be executed; if the two are different, it indicates that the operation corresponding to the operation request of the requester is not allowed, and executing the operation corresponding to the operation request may pose a threat to the security of the protected data. In this case, the operation corresponding to the operation request is not executed to ensure the security of the protected data.

[0095] As an example, the preset operation type can be a read operation. If the operation type corresponding to the operation request of the requesting party is also a read operation, the operation corresponding to the operation request of the requesting party can be executed, that is, the data stored at the target location in the hard disk can be fed back to the requesting party. If the operation type corresponding to the operation request of the requesting party is a write operation, the operation corresponding to the operation request will not be executed. In this way, the requesting party cannot write to the storage location of the protected data in the hard disk, thereby effectively preventing the protected data from being tampered with at will. For example, if the data cleaning software, as the requesting party, requests to write to the storage location of the protected data in the hard disk, the operation request of the data cleaning software will not be executed, thereby preventing the protected data from being cleaned.

[0096] As another example, the preset operation type may be a write operation. If the operation type corresponding to the operation request of the requesting party is also a write operation, the operation corresponding to the operation request of the requesting party may be executed. If the operation type corresponding to the operation request of the requesting party is a read operation, the operation corresponding to the operation request will not be executed. In this way, the requesting party cannot perform a read operation on the storage location of the protected data on the hard disk, thereby effectively preventing the protected data from being arbitrarily read.

[0097] For example, taking the boot file of the operating system in the computer as the protected data, that is, only the storage location A of the boot file in the hard disk is allowed to be read; the boot file, the storage location A of the boot file in the hard disk, the preset operation type-read operation, the firmware of the hard disk, etc. can be pre-packaged in the same file, and the same file can be pre-burned into the firmware storage space. In this way, after the computer is powered on, if the requester sends an operation request to the firmware of the hard disk, the firmware of the hard disk will parse the operation request after receiving the operation request, and obtain the target location B in the hard disk corresponding to the operation request and the operation type corresponding to the operation request; the hard disk firmware obtains the storage location A of the boot file in the hard disk and the preset operation type-read operation from the firmware storage space; if the target location B overlaps with the storage location A, it is further determined whether the operation type corresponding to the operation request is a read operation. If so, the operation request is executed so that the requester can read the boot file. If not, the operation request is not executed, that is, any write to the storage location A is invalid, thereby preventing any destructive write and avoiding the boot file from being arbitrarily modified or replaced.

[0098] For example, the requester is BIOS, the protected data is the boot file BootMgrfw.efi, and only reading the boot file BootMgrfw.efi is allowed. Figure 3 FIG. 4 shows a schematic diagram of protecting the boot file BootMgrfw.efi according to an embodiment of the present disclosure, as shown in FIG. Figure 3As shown, the protected sector in the hard disk is the sector where the boot file BootMgrfw.efi is located. The boot file BootMgrfw.efi, the sector where the boot file BootMgrfw.efi is located, the preset operation type - read operation, and the hard disk firmware can be packaged in the same file in advance, and the same file can be pre-burned into the ROM. After the computer is powered on, the BIOS sends an operation request to the firmware of the hard disk. After receiving the operation request, the firmware of the hard disk parses the operation request and obtains the sector in the hard disk corresponding to the operation request and the operation type corresponding to the operation request; the hard disk firmware obtains the sector where the boot file BootMgrfw.efi is located and the preset operation type-read operation from the firmware storage space; if the sector in the hard disk corresponding to the BIOS operation request is the same as the sector where the boot file BootMgrfw.efi is located, and the operation type corresponding to the operation request is a read operation, the read operation can be performed, for example, the boot file BootMgrfw.efi can be returned to the memory area specified by the BIOS through the hard disk interface, and then the BIOS can process the boot file BootMgrfw.efi in the memory area; if the sector in the hard disk corresponding to the BIOS operation request is the same as the sector where the boot file BootMgrfw.efi is located, and the operation type corresponding to the operation request is a write operation, the write operation is not performed, that is, the BIOS cannot modify or delete the boot file BootMgrfw.efi. In this way, the BIOS cannot write data to the sector where the boot file BootMgrfw.efi is located, and can only read the boot file BootMgrfw.efi from the sector where the boot file BootMgrfw.efi is located, thereby effectively protecting the security of the boot file BootMgrfw.efi and preventing any destructive writing.

[0099] In the disclosed embodiment, first indication information is obtained according to the operation request of the requesting party; second indication information is obtained according to the operation request of the requesting party; metadata of the protection data is obtained; the metadata is used to indicate the storage location of the protection data in the hard disk, and is also used to indicate the preset operation type allowed for the storage location; when the target location overlaps with the storage location, the execution method of the operation request is determined according to the operation type corresponding to the operation request and the preset operation type. As an example, when the operation type corresponding to the operation request is the same as the preset operation type, the operation corresponding to the operation request is executed, so that only the requesting party is allowed to perform operations that comply with the preset operation type on the target location, for example, only read operations can be allowed, but write operations can not be allowed, so as to effectively prevent the protection data from being arbitrarily destructively rewritten.

[0100] In scenario 2, the metadata of the protected data is also used to indicate the preset identity information of the storage location of the hard disk that allows the protected data to be read and written. Thus, in the above step 103, the execution method of the operation request of the requester can be determined based on the preset identity information and the identity information of the requester.

[0101] Figure 4 A flow chart of a data protection method according to an embodiment of the present disclosure is shown as follows: Figure 4 As shown, the following steps are included:

[0102] Step 401: Obtain first indication information according to an operation request from a requesting party.

[0103] This step can refer to the above Figure 1 The related description in step 101 will not be repeated here.

[0104] Step 402: Obtain third indication information according to the operation request of the requesting party.

[0105] The third indication information is used to indicate the identity information of the requesting party. Each requesting party may have unique identity information, and the identity information of different requesting parties is different.

[0106] It should be noted that the above step 401 can be performed before step 402, can be performed after step 402, or step 401 and step 402 can be performed simultaneously, and there is no limitation on this. For example, after obtaining the operation request of the requesting party, the information carried in the operation request can be parsed to obtain the first indication information and the third indication information.

[0107] As an example, after obtaining the operation request from the requester, the information carried in the operation request may be parsed to obtain the first indication information, the second indication information, and the third indication information.

[0108] Step 403: Obtain metadata of the protected data.

[0109] This step can refer to the above Figure 1 The relevant statement in step 102.

[0110] The metadata of the protected data is used to indicate the storage location of the protected data in the hard disk, and is also used to indicate the preset identity information that is allowed to read and write the storage location. The preset identity information can also be called a preset whitelist, which can include one or more identity information that the user trusts that is allowed to read and write the storage location of the protected data in the hard disk.

[0111] As an example, the metadata of the protection data is also used to indicate the type of preset operations allowed to be performed on the storage location.

[0112] Since the metadata of the protection data, the protection data and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space; the metadata of the protection data will not be arbitrarily tampered with; thereby ensuring the accuracy of the storage location of the protection data in the hard disk indicated by the metadata and the preset identity information that allows reading and writing of the storage location.

[0113] Step 404: When the target location overlaps with the storage location, if the identity information of the requesting party is in the preset identity information, then execute the operation corresponding to the operation request.

[0114] In a possible implementation, when the target location overlaps with the storage location, if the identity information of the requesting party is not in the preset identity information, the operation corresponding to the operation request is not performed.

[0115] Exemplarily, it can be determined whether the identity information of the requester is in the preset identity information indicated by the metadata that allows reading and writing the storage location; if the identity information of the requester is in the preset identity information, it indicates that the requester is trusted by the user, and the operation corresponding to the operation request of the requester is safe by default, and the operation corresponding to the operation request can be performed to read the data in the target location in the hard disk, or to modify or delete the data in the target location in the hard disk, thereby meeting the needs of the requester. If the identity information of the requester is not in the preset identity information, it indicates that the requester is not trusted by the user, and the operation corresponding to the operation request of the requester has unsafe risks, and the operation corresponding to the operation request can be not performed, thereby ensuring that the requester whose identity information is not in the preset identity information will not perform read and write operations on the protected data, thereby achieving effective protection of the protected data.

[0116] For example, taking the boot file of the operating system in the computer as the protected data, the preset identity information may include identity information 1, identity information 2, and identity information 3. The boot file, the storage location A of the boot file in the hard disk, identity information 1, identity information 2, identity information 3, the firmware of the hard disk, etc. may be pre-packaged in the same file, and the same file may be pre-burned into the firmware storage space. In this way, after the computer is powered on, the requester may send a read operation request to the firmware of the hard disk. After receiving the read operation request, the firmware of the hard disk parses the read operation request and obtains the target location B corresponding to the read operation request; the hard disk firmware obtains the storage location A of the boot file in the hard disk from the firmware storage space. If the target location B overlaps with the storage location A, it further determines whether the identity information of the requester is identity information 1, identity information 2, or identity information 3. If so, the read operation is performed, and if not, the read operation is not performed; thereby preventing untrusted requesters from reading or tampering with the boot file. For example, the untrusted requester may be data cleaning software, that is, the preset identity information does not include data cleaning software, thereby preventing the boot file from being cleaned.

[0117] In a possible implementation, when the target location and the storage location overlap, if the identity information of the requester is in the preset identity information, and the operation type corresponding to the operation request is the same as the preset operation type, then the operation corresponding to the operation request is performed. Exemplarily, the target location in the hard disk corresponding to the operation request of the requester indicated by the first indication information can be compared with the storage location of the protected data in the hard disk indicated by the metadata, the operation type corresponding to the operation request of the requester indicated by the second indication information can be compared with the preset operation type allowed for the storage location indicated by the metadata, and the identity information of the requester indicated by the third indication information can be compared with the preset identity information indicated by the metadata that allows reading and writing the storage location, so as to determine whether the target location and the storage location overlap, whether the identity information of the requester is in the preset identity information, and whether the operation type corresponding to the operation request of the requester is the same as the preset operation type. In this way, only the requester trusted by the user is allowed to perform the preset operation type on the storage location of the protected data in the hard disk, so as to achieve effective protection of the protected data.

[0118] In the disclosed embodiment, first indication information is obtained according to the operation request of the requesting party; third indication information is obtained according to the operation request of the requesting party; metadata of the protected data is obtained; the metadata is used to indicate the storage location of the protected data in the hard disk, and is also used to indicate the preset identity information that allows reading and writing the storage location; in the case where the target location overlaps with the storage location, if the identity information of the requesting party is in the preset identity information, the operation corresponding to the operation request is performed. Thus, only trusted requesting parties are allowed to perform read and write operations on the storage location of the protected data in the hard disk, preventing the protected data from being read or tampered by malicious third parties, and achieving effective protection of the protected data.

[0119] Scenario 3: In the above step 103, determining the execution method of the operation request of the requesting party may include: feeding back preset data to the requesting party.

[0120] Figure 5 A flow chart of a data protection method according to an embodiment of the present disclosure is shown as follows: Figure 5 As shown, the following steps are included:

[0121] Step 501: Obtain first indication information according to an operation request of a requesting party;

[0122] This step can refer to the above Figure 1 The relevant statement in step 101.

[0123] As an example, after obtaining the operation request from the requesting party, the information carried in the operation request may be parsed to obtain the first indication information; the second indication information and / or the third indication information may also be obtained.

[0124] Step 502: Obtain metadata of the protected data.

[0125] This step can refer to the above Figure 1 The relevant statement in step 102.

[0126] Among them, the metadata of the protection data is used to indicate the storage location of the protection data in the hard disk; as an example, the metadata of the protection data is also used to indicate the preset operation type allowed for the storage location; or, it is also used to indicate the preset identity information that allows reading and writing the storage location.

[0127] Step 503: When the target location overlaps with the storage location, feed back the preset data to the requesting party.

[0128] The preset data is different from the protection data. The preset data may also be referred to as fake data. The preset data may be set as required, without limitation, and may be, for example, random data or other data other than the protection data. Exemplarily, the preset data, metadata of the protection data, the protection data, and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space to ensure that the preset data will not be tampered with at will.

[0129] For example, if the protected data is the boot file of the operating system in the computer, the boot file, the storage location A of the boot file in the hard disk, the preset data, the firmware of the hard disk, etc. can be pre-packaged in the same file, and the same file can be pre-burned into the firmware storage space. In this way, after the computer is powered on, the requester can send a read operation request to the firmware of the hard disk. After receiving the read operation request, the firmware of the hard disk parses the read operation request and obtains the target location B corresponding to the read operation request; the hard disk firmware obtains the storage location A of the boot file in the hard disk from the firmware storage space. If the target location B overlaps with the storage location A, the preset data is fed back to the requester, thereby effectively preventing the leakage of the protected data.

[0130] In a possible implementation, when the target location and the storage location overlap, if the operation type corresponding to the operation request is the same as the preset operation type indicated by the second indication information, the preset data is fed back to the requester. Exemplarily, the preset operation type may be a read operation, that is, when the operation type corresponding to the operation request of the requester is a read operation, the read operation of the requester is not performed, but the preset data is fed back to the requester, so that the requester cannot read the protected data, effectively preventing the leakage of the protected data.

[0131] In a possible implementation, when the target location overlaps with the storage location, if the identity information of the requester is in the preset identity information indicated by the third indication information, and the operation type corresponding to the operation request is the same as the preset operation type indicated by the second indication information, the preset data is fed back to the requester. Exemplarily, the preset operation type may be a read operation, that is, when the operation type corresponding to the operation request of the requester is a read operation, and the requester is a trusted requester, the read operation of the requester is not performed, but the preset data is fed back to the requester, so that the requester cannot read the protected data, effectively preventing the protected data and the preset data from being read by an untrusted third party.

[0132] In the disclosed embodiment, according to the operation request of the requesting party, the first indication information is obtained; the metadata of the protection data is obtained; and when the target location and the storage location overlap, the preset data is fed back to the requesting party; wherein the preset data is different from the protection data. In this way, when the target location in the hard disk corresponding to the operation request of the requesting party overlaps with the storage location of the protection data in the hard disk, the preset data different from the protection data is fed back to the requesting party, so that the requesting party cannot read the protection data, thereby preventing the protection data from being abnormally read out, effectively preventing the protection data from being leaked, and ensuring the security of the protection data.

[0133] The following is a detailed description of the process of burning the same file of the protection data, the metadata of the protection data and the firmware of the hard disk packaged into the firmware storage space in the above data protection method.

[0134] Figure 6 A flowchart of a burning method according to an embodiment of the present disclosure is shown. Exemplarily, the burning method can be executed by an electronic device, and as an example, can be executed by a burning device of a hard disk manufacturer, so that the burning is completed by cooperating with the hard disk manufacturer. Figure 6 As shown, the method may include the following steps:

[0135] Step 601: Obtain protection data, metadata of the protection data, and firmware of the hard disk.

[0136] The detailed description of the protection data, metadata, and firmware of the hard disk can be referred to in the previous description. The user can select the data stored in the hard disk that is not to be used by a third party, is not to be read or written arbitrarily, or is not to be accidentally deleted as the protection data according to the needs; the user can also configure the metadata to indicate the content according to the needs.

[0137] Wherein, the metadata is used to indicate the storage location of the protection data in the hard disk. As an example, the protection data is the boot file of the operating system; then the storage path of the boot file in the file system can be obtained; and then based on the mapping relationship between the storage path in the file system and the storage location in the hard disk, and the storage path of the boot file in the file system, the storage location of the boot file in the hard disk is determined. Wherein, the storage path in the file system represents the location of the file in the file system; for example, taking the boot file BootMgrfw.efi of the operating system as an example; the storage path of BootMgrfw.efi in the file system is usually in the C:\boot\uefi\ directory. The mapping relationship between the storage path in the file system and the storage location in the hard disk can be recorded in the Flash Mapping Table (FMT). In this way, based on the storage path of BootMgrfw.efi in the file system in the C:\boot\uefi\ directory, the flash mapping table is usually searched to determine the starting sector number and the number of sectors where BootMgrfw.efi is stored in the hard disk.

[0138] In a possible implementation, the metadata of the protection data is also used to indicate the preset operation type allowed for the storage location and / or the preset identity information that is allowed to read and write the storage location.

[0139] Among them, the specific description of the preset operation type and the preset identity information can refer to the relevant statements in the previous text. The user can configure the preset operation type and preset identity information according to the needs. For example, if the user expects that the protected data will not be modified or replaced by the requesting party, the read operation can be configured as the preset operation type, that is, only the read operation is allowed for the storage location of the protected data in the hard disk; for another example, if the user expects that only the trusted requesting party can read or modify the protected data, one or more identity information trusted by the user can be configured as the preset identity information, that is, only the requesting party corresponding to the one or more identity information trusted by the user is allowed to read and write the protected data.

[0140] Exemplarily, the metadata of the protection data is also used to indicate the hash value of the protection data; the hash value can be configured by the user, or can be obtained from a trusted third party. For example, if the protection data is the boot file of the operating system, the hash value of the boot file can be obtained from the publisher of the boot file. Exemplarily, after the burning device obtains the protection data, the protection data can be hash-checked; for example, the protection data can be calculated by a hash algorithm to calculate a hash value, and the calculated hash value can be compared with the hash value indicated by the metadata; if the two hash values ​​are equal, it can be confirmed that the obtained protection data has not been tampered with or damaged, thereby ensuring the authenticity of the protection data. In addition, the hash value indicated by the metadata is also used by the firmware of the hard disk to send the hash value to the requester while feeding back the protection data to the requester, so that the requester can perform security verification and other operations on the protection data.

[0141] Exemplarily, the metadata of the protection data is also used to indicate information such as the size of the protection data and the storage path of the protection data in the file system.

[0142] In a possible implementation, the metadata includes: a storage location of at least one protection data in the hard disk, a hash value of at least one protection data, or a size of at least one protection data. A plurality of protection data may be configured as a group. Thus, a group of protected data may be formed, thereby protecting a plurality of data at the same time.

[0143] In a possible implementation, preset data may also be obtained. The preset data may also be referred to as fake data. For a specific description of the preset data, reference may be made to the related descriptions in the foregoing text.

[0144] Step 602: Pack the metadata, the protection data, and the firmware of the hard disk into the same file.

[0145] In this step, after receiving the protection data selected by the user, the metadata of the protection data configured by the user, and the firmware of the hard disk, the burning device can package the metadata, the protection data, and the firmware of the hard disk into the same file; illustratively, the burning device can package the protection data that has been hash-verified, the metadata of the configured protection data, and the firmware of the hard disk into the same file.

[0146] As an example, the burning device may package metadata of the protection data, preset data, protection data, and firmware of the hard disk into the same file.

[0147] Step 603: Burn the same file into the firmware storage space to protect the protection data.

[0148] Exemplarily, the burning device can burn the above-mentioned packaged same file into the firmware storage space in a bit-by-bit write mode. For example, the packaged same file can be burned into the ROM in a bit-by-bit write mode by compressing.

[0149] In this way, through the above steps 601 to 603, the protection data, the metadata of the protection data and the firmware of the hard disk are packaged in the same file, and the same file is burned into the firmware storage space. The hard disk and the firmware storage space are configured in the electronic device. When the requesting party requests to access the hard disk, by executing the above steps Figure 1 , Figure 2 , Figure 4 or Figure 5 The data protection method shown can thereby achieve protection of protected data.

[0150] For example, after the same file is burned into the firmware storage space, a Hook function can be configured to intercept the operation request of the requester, and the conditions for starting the interception can also be configured according to the needs. As an example, taking the boot file of the operating system as the protected data, the interception can be started when the operating system is installed, and the operation request of the requester can be intercepted, and then the above-mentioned Figure 1 The operations of steps 101, 102 and 103 shown in the figure are performed to determine the execution mode of the operation request, rather than directly executing the operation request, so as to protect the data from being arbitrarily read or tampered with.

[0151] Furthermore, if the user wants to stop protecting the protected data, the hard disk firmware in the firmware storage space can be upgraded to remove or modify the protected data, metadata of the protected data and other information in the firmware storage space to stop protecting the protected data.

[0152] For example, the user can use the boot file BootMgrfw.efi in the C:\boot\uefi\ directory of the operating system's C drive as protection data. Based on the flash mapping table, the starting sector number and the number of sectors where the boot file BootMgrfw.efi is stored on the hard disk can be determined; the user expects that after the operating system is installed, the boot file BootMgrfw.efi can only be read, and cannot be modified or deleted; the user can configure the preset operation type as a read operation. After obtaining the boot file BootMgrfw.efi, the starting sector number and the number of sectors where the boot file BootMgrfw.efi is stored on the hard disk (that is, the storage location of the boot file BootMgrfw.efi on the hard disk), the preset operation type-read operation, and the firmware of the hard disk, the burning device packages these data in the same file and burns the same file into the firmware storage space; in this way, in the electronic device configured with the firmware storage space and the hard disk, when the operating system is in the installed state, the protection of the boot file BootMgrfw.efi can be started. Specifically, the requesting party's request to the hard disk can be intercepted. The process further determines whether the operation type corresponding to the operation request is a read operation. If so, the operation request is executed so that the requesting party can read the boot file BootMgrfw.efi. If not, the operation request is not executed, that is, the requesting party cannot write data to the storage location, thereby preventing the boot file BootMgrfw.efi from being arbitrarily modified or replaced.

[0153] In an embodiment of the present disclosure, protection data, metadata of the protection data, and firmware of a hard disk are obtained, wherein the metadata is used to indicate a storage location of the protection data in the hard disk; the metadata, the protection data, and the firmware of the hard disk are packaged in the same file; the same file is burned into a firmware storage space to protect the protection data; in addition, the metadata, the protection data, and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space, the protection data and metadata in the firmware storage space will not be arbitrarily tampered with, and if the protection data stored in the hard disk is damaged, the protection data can also be quickly restored through the protection data backed up in the firmware storage space; at the same time, the accuracy of the storage location of the protection data indicated by the metadata in the hard disk is guaranteed.

[0154] Based on the same inventive concept, the disclosed embodiment also provides a data protection device; Figure 7 A structural diagram of a data protection device according to an embodiment of the present disclosure is shown as follows: Figure 7 As shown, the device includes: a first acquisition module 701, used to obtain first indication information according to an operation request of the requesting party, wherein the first indication information is used to indicate a target position in the hard disk corresponding to the operation request; the first acquisition module 701 is also used to obtain metadata of protection data; wherein the metadata is used to indicate a storage position of the protection data in the hard disk, and the metadata, the protection data and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space; a determination module 702 is used to determine the execution method of the operation request when there is an overlap between the target position and the storage position.

[0155] In a possible implementation manner, the pre-burning of the same file into the firmware storage space includes: pre-burning the same file into the firmware storage space in a bit-by-bit writing manner.

[0156] In one possible implementation, the metadata is also used to indicate a preset operation type allowed for the storage location; the first acquisition module 701 is also used to: obtain second indication information according to the operation request of the requesting party, the second indication information is used to indicate the operation type corresponding to the operation request, and the operation type includes a read operation or a write operation; the determination module 702 is also used to: determine the execution method of the operation request according to the operation type corresponding to the operation request and the preset operation type.

[0157] In a possible implementation, the determination module 702 is further configured to: feed back preset data to the requesting party, wherein the preset data is different from the protection data.

[0158] In one possible implementation, the metadata is also used to indicate preset identity information that allows reading and writing of the storage location; the first acquisition module 701 is also used to: obtain third indication information according to the operation request of the requesting party, and the third indication information is used to indicate the identity information of the requesting party; the determination module 702 is also used to: if the identity information of the requesting party is in the preset identity information, then execute the operation corresponding to the operation request.

[0159] In a possible implementation, the protection data is a boot file of an operating system; the determination module 702 is further used to: when the operating system is in an installed state, intercept an operation request from the requesting party.

[0160] Based on the same inventive concept, the disclosed embodiment also provides a burning device; Figure 8 A structural diagram of a burning device according to an embodiment of the present disclosure is shown as follows: Figure 8As shown, the device includes: a second acquisition module 801, used to acquire protection data, metadata of the protection data and firmware of the hard disk, wherein the metadata is used to indicate the storage location of the protection data in the hard disk; a packaging module 802, used to package the metadata, the protection data and the firmware of the hard disk into the same file; and a burning module 803, used to burn the same file into the firmware storage space to protect the protection data.

[0161] In a possible implementation, the metadata is further used to indicate a preset operation type allowed to be performed on the storage location and / or preset identity information that is allowed to read and write the storage location.

[0162] In one possible implementation, the protection data is the boot file of the operating system; the second acquisition module 801 is also used to: obtain the storage path of the boot file in the file system; based on the mapping relationship between the storage path in the file system and the storage location in the hard disk, and the storage path of the boot file in the file system, determine the storage location of the boot file in the hard disk.

[0163] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0164] The embodiment of the present disclosure also provides a computer-readable storage medium on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor. The computer-readable storage medium can be a volatile or non-volatile computer-readable storage medium.

[0165] An embodiment of the present disclosure further proposes an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0166] The embodiments of the present disclosure also provide a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0167] Fig. 9 1 is a block diagram of an electronic device 1900 according to an embodiment of the present disclosure. For example, the electronic device 1900 may be provided as a server or a terminal device. Fig. 9, the electronic device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions executable by the processing component 1922, such as an application. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0168] The electronic device 1900 may also include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output interface 1958 (I / O interface). The electronic device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server 2003. TM , Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM or similar.

[0169] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the electronic device 1900 to perform the above method.

[0170] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0171] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0172] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0173] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0174] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0175] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0176] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0177] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0178] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A data protection method, characterized in that: The method comprises: Acquire first indication information according to the operation request of the requesting party, where the first indication information is used to indicate a target location in the hard disk corresponding to the operation request; Obtain metadata of the protection data; wherein the metadata is used to indicate a storage location of the protection data in the hard disk, the metadata, the protection data and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space; In a case where the target location overlaps with the storage location, a method for executing the operation request is determined.

2. The method according to claim 1, characterized in that The same file is pre-burned into the firmware storage space, including: The same file is pre-burned into the firmware storage space in a bit-by-bit writing manner.

3. The method according to claim 1, characterized in that The metadata is also used to indicate the type of preset operations allowed for the storage location; The method further comprises: Acquire second indication information according to the operation request of the requesting party, where the second indication information is used to indicate an operation type corresponding to the operation request, where the operation type includes a read operation or a write operation; The determining of the execution mode of the operation request includes: Determine the execution mode of the operation request according to the operation type corresponding to the operation request and the preset operation type.

4. The method according to claim 1, characterized in that: The determining of the execution mode of the operation request includes: Feedback preset data to the requesting party, wherein the preset data is different from the protection data.

5. The method according to claim 1, characterized in that The metadata is also used to indicate preset identity information that is allowed to read and write the storage location; The method further comprises: Acquire third indication information according to the operation request of the requesting party, where the third indication information is used to indicate the identity information of the requesting party; The determining of the execution mode of the operation request includes: If the identity information of the requesting party is in the preset identity information, the operation corresponding to the operation request is executed.

6. The method according to claim 1, characterized in that The protection data is a boot file of the operating system; The method further comprises: When the operating system is in an installed state, an operation request from the requester is intercepted.

7. A burning method, characterized in that: The method comprises: Acquire protection data, metadata of the protection data, and firmware of a hard disk, wherein the metadata is used to indicate a storage location of the protection data in the hard disk; Packing the metadata, the protection data and the firmware of the hard disk into the same file; The same file is burned into the firmware storage space to protect the protection data.

8. The method according to claim 7, characterized in that The metadata is also used to indicate the preset operation type allowed to be performed on the storage location and / or the preset identity information allowed to read and write the storage location.

9. The method according to claim 7, characterized in that: The protection data is a boot file of the operating system; The method further comprises: Obtaining a storage path of the boot file in the file system; The storage location of the boot file in the hard disk is determined based on a mapping relationship between a storage path in the file system and a storage location in the hard disk, and a storage path of the boot file in the file system.

10. A data protection device, characterized in that: The device comprises: An acquisition module, configured to acquire first indication information according to an operation request of a requesting party, wherein the first indication information is used to indicate a target location in a hard disk corresponding to the operation request; The acquisition module is further used to acquire metadata of the protection data; wherein the metadata is used to indicate the storage location of the protection data in the hard disk, and the metadata, the protection data and the firmware of the hard disk are pre-packaged in the same file, and the same file is pre-burned into the firmware storage space; A determination module is used to determine the execution mode of the operation request when the target location overlaps with the storage location.

11. A burning device, characterized in that: The device comprises: an acquisition module, used for acquiring protection data, metadata of the protection data and firmware of a hard disk, wherein the metadata is used for indicating a storage location of the protection data in the hard disk; A packaging module, used for packaging the metadata, the protection data and the firmware of the hard disk into the same file; The burning module is used to burn the same file into the firmware storage space to protect the protection data.

12. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method described in any one of claims 1 to 9.

13. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images