A method, device and storage medium for disk encryption and decryption

Abstract

The present invention belongs to the technical field of disk encryption and decryption, and provides a method, device and storage medium for disk encryption and decryption. The method includes: extracting internal data of the main device equipped with the disk to be accessed within a preset time period before tracing based on an access request; wherein the preset time period is a time area between the timestamp of the current access request and the timestamp of the last shutdown operation; when traversing the internal data to confirm that there is communication between the main device and an external device, extracting device information of the external device and the communication duration between the external device and the main device; when it is determined that the external device and the main device communicate for the first time and the communication duration is greater than a preset duration threshold, sending a first instruction to the display front end; wherein the first instruction is used to require the user who sends the access request to input a backup key. The present invention further ensures the security of user disk data.

Description

Technical Field

[0001] The present invention relates to the technical field of disk encryption and decryption, and particularly to a method, device and storage medium for disk encryption and decryption. Background Art

[0002] As a storage component in a computer device, a disk stores a large amount of important data related to users, and even privacy-sensitive data. Therefore, how to ensure the security of the data in the disk is of great value for protecting the rights and interests of users.

[0003] Based on this, in the prior art, access to the data in the disk requires key verification. However, in actual applications, the key is often obtained by various illegal means. For example, in some cases, when encrypting using BitLocker based on the TPM module, the key can be obtained by connecting an external data grabber, and the plaintext data of the disk can be obtained using the key. Then, all the plaintext data can be compared using an analyzer after being grabbed to obtain the plaintext data corresponding to the key, and the key can be cracked; thus illegally invading the user's disk.

[0004] It can be seen that only by setting the key cannot ensure the security of the user's disk data. Summary of the Invention

[0005] The purpose of the present invention is to provide a method, device and storage medium for disk encryption and decryption to improve the technical problem that the security of the user's disk data cannot be ensured by setting the key in the prior art.

[0006] To achieve the above object, the present invention proposes the following technical solutions:

[0007] In a first aspect, the present technical solution provides a method for disk encryption and decryption. The method includes:

[0008] Extracting internal data of the main device equipped with the disk to be accessed within a preset period before tracing based on an access request; wherein, the access request is used to request to obtain the data in the disk to be accessed, and carries a disk key therein; the preset period is the time area between the time stamp of the current access request and the time stamp of the last shutdown operation;

[0009] When traversing the internal data to confirm that there is communication between the main device and an external device, extracting the device information of the external device and the communication duration between the external device and the main device; wherein, the device information includes: device IP address and device type;

[0010] When it is determined that the external device and the main device are communicating for the first time and the communication duration is greater than a preset duration threshold, a first instruction is sent to the display front end; wherein the first instruction is used to require the user who sends the access request to enter a backup key.

[0011] Furthermore, the method of extracting the internal data of the main device equipped with the disk to be accessed within a preset period of time based on the access request includes:

[0012] Obtaining the timestamp of the access request to determine when a preset update cycle has been reached, sending a first feedback to the display front end of the main device; wherein the first feedback is used to remind that the disk key carried in the access request has expired;

[0013] A second instruction is sent to a mobile device associated with the main device to perform a custom key reset; wherein the second instruction carries a random key generated in real time, which is used to input into the display front end of the main device to trigger the custom key reset.

[0014] Further, when it is determined that the external device and the main device are communicating for the first time and the communication duration is greater than a preset duration threshold, after sending a first instruction to the display front end; it includes:

[0015] When it is determined that the backup key is entered incorrectly and the number of incorrect entries is greater than a preset number threshold, the disk to be accessed is locked to prohibit access, and a warning message is sent to a mobile device associated with the main device;

[0016] Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

[0017] Furthermore, when it is determined that the external device and the main device are communicating for the first time and the communication duration is greater than a preset duration threshold, sending a first instruction to the display front end includes:

[0018] Sending a third instruction to the display front end; wherein the third instruction is used to obtain a shard key corresponding to the backup key;

[0019] If it is determined that a correct sharding key is received within a preset time interval, the third instruction is sent in a loop until all sharding keys are obtained;

[0020] The shard keys are concatenated to obtain the backup key, and the disk to be accessed is allowed to be decrypted.

[0021] Further, the determining that a correct sharding key is received within a preset time interval, then executing the sending of the third instruction in a loop until all sharding keys are obtained; includes:

[0022] If it is determined that the correct sharding key is not received within the preset time interval, the third instruction is stopped from being sent, the disk to be accessed is locked to prohibit access, and a warning message is sent to a mobile device associated with the main device;

[0023] Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

[0024] In the second aspect, the technical solution provides a device for disk encryption and decryption. It includes:

[0025] A data retrieval module is used to extract internal data of a main device equipped with a disk to be accessed within a preset period of time based on an access request; wherein the access request is used to request the acquisition of data in the disk to be accessed, and carries a disk key; the preset period of time is the time zone between the timestamp of the current access request and the timestamp of the last shutdown operation;

[0026] A data traversal module is used to traverse the internal data to confirm that the main device and the external device are communicating, and then extract the device information of the external device and the communication duration between the external device and the main device; wherein the device information includes: device IP address and device type;

[0027] The abnormal verification module is used to determine that the external device and the main device are communicating for the first time, and when the communication duration is greater than a preset duration threshold, send a first instruction to the display front end; wherein the first instruction is used to require the user who sends the access request to enter a backup key.

[0028] Further, including:

[0029] A feedback sending module, used for obtaining the timestamp of the access request to determine when a preset update period has been reached, and sending a first feedback to the display front end of the main device; wherein the first feedback is used to remind that the disk key carried in the access request has expired;

[0030] An update reset module is used to send a second instruction to a mobile device associated with the main device to reset the custom key; wherein the second instruction carries a random key generated in real time, which is used to input the display front end of the main device to trigger the custom key reset.

[0031] Further, including:

[0032] The abnormal warning module is used to determine that the backup key is input incorrectly, and when the number of incorrect inputs exceeds a preset number threshold, lock the disk to be accessed to prohibit access, and send a warning message to a mobile device associated with the main device;

[0033] Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

[0034] In a third aspect, the technical solution provides an electronic device, comprising at least one processor, the processor being coupled to a memory, the memory storing a computer program, and the computer program being configured to execute the method when executed by the processor.

[0035] In a fourth aspect, the technical solution provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a computer, the method described above is implemented.

[0036] Beneficial effects:

[0037] It can be seen from the above technical solutions that the technical solution of the present invention provides a method for disk encryption and decryption to solve the technical defect of low security level in the prior art when only key setting is used to protect user disk data.

[0038] The method includes: first, based on the access request, extract the internal data of the main device equipped with the disk to be accessed within the preset time period; wherein, the access request is used to request the acquisition of the data in the disk to be accessed, which carries the disk key; the preset time period is the time zone between the timestamp of this access request and the timestamp of the last shutdown operation. Then, when the internal data is traversed to confirm that there is communication between the main device and the external device, the device information of the external device and the communication duration between the external device and the main device are extracted; wherein, the device information includes: device IP address and device type. Finally, when it is determined that the external device and the main device are communicating for the first time and the communication duration is greater than the preset duration threshold, a first instruction is sent to the display front end; wherein, the first instruction is used to require the user who sent the access request to enter a backup key.

[0039] In summary, in the process of processing an access request, this technical solution does not merely verify whether the key carried therein is correct to confirm the legitimacy of the request. Instead, it screens and analyzes the internal data within a preset time in the past to determine whether there is a risk that the key has been illegally obtained. And it continues to verify through the backup key. On the one hand, it avoids misjudging the risk of illegal intrusion and thus affecting the normal acquisition of disk data; on the other hand, it also avoids the risk of disk data leakage in the case where the key has been illegally obtained.

[0040] It should be understood that all combinations of the foregoing concepts and additional concepts described in more detail below can be regarded as part of the inventive subject matter of the present disclosure as long as such concepts do not contradict each other.

[0041] The foregoing and other aspects, embodiments, and features of the teachings of the present invention can be more fully understood from the following description in conjunction with the accompanying drawings. Other additional aspects of the present invention, such as the features and / or beneficial effects of exemplary embodiments, will be apparent in the following description or will be learned through the practice of specific embodiments in accordance with the teachings of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The drawings are not intended to be drawn to scale. In the drawings, each identical or nearly identical component shown in various figures may be represented by the same reference numeral. For clarity, not every component is labeled in each figure. Now, embodiments of various aspects of the present invention will be described by way of example and with reference to the drawings, wherein:

[0043] Figure 1 is a flowchart of the method for disk encryption and decryption described in this embodiment;

[0044] Figure 2 is a flowchart of periodically resetting the key in this embodiment;

[0045] Figure 3 is a flowchart of obtaining a backup key in another way;

[0046] Figure 4 is a flowchart of processing an incorrect input of the backup key;

[0047] Figure 5 is a structural block diagram of the device for disk encryption and decryption described in this embodiment;

[0048] Figure 6 is a structural block diagram of the electronic device described in this embodiment. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0049] To make the objectives, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the described embodiments of the present invention without creative efforts shall fall within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein shall have the ordinary meanings understood by those of ordinary skill in the art to which the present invention pertains.

[0050] The terms "first", "second" and similar terms used in the specification and claims of this application do not denote any order, quantity or importance, but are only used to distinguish different components. Similarly, unless the context clearly indicates otherwise, singular forms such as "a", "an" or "the" and similar terms do not denote a limitation of quantity, but mean that there is at least one. The terms "including" or "comprising" and similar terms are intended to mean that the elements or items appearing before "including" or "comprising" cover the features, wholes, steps, operations, elements and / or components listed after "including" or "comprising", and do not exclude the existence or addition of one or more other features, wholes, steps, operations, elements, components and / or their combinations. The terms "upper", "lower", "left", "right", etc. are only used to indicate relative positional relationships, and when the absolute position of the object being described changes, the relative positional relationship may also change accordingly.

[0051] As a storage component in a computer device, a disk stores a large amount of important data related to users, and even privacy-sensitive data. Therefore, how to ensure the security of the data in the disk is of great value for protecting the rights and interests of users. Based on this, in the prior art, access to the data in the disk requires key verification. However, in actual applications, the key is often obtained by various illegal means, so the security of the user's disk data cannot be effectively ensured. Therefore, this embodiment aims to provide a method for disk encryption and decryption to improve this technical defect.

[0052] The following specifically introduces the method for disk encryption and decryption according to this embodiment with reference to the accompanying drawings.

[0053] As Figure 1 shown, the method includes the following steps:

[0054] Step S102: Extract the internal data of the main device equipped with the disk to be accessed within a preset look-back period based on the access request.

[0055] In specific implementation, the access request is used to request to obtain data in the disk to be accessed, and it carries a disk key. The preset time period is the time area between the time stamp of this access request and the time stamp of the last shutdown operation. In order to reduce the risk of the key being illegally obtained, the minimum number of digits and the minimum character combination type of the key are specified.

[0056] As a specific implementation manner, in order to improve data security, in combination with Figure 2 as shown, before step S102, it further includes:

[0057] Step S100.2: When the time stamp of the access request is obtained and it is judged that the preset update period is reached, send a first feedback to the display front end of the main device.

[0058] In this embodiment, the first feedback is used to remind that the disk key carried in the access request has expired.

[0059] Step S100.4: Send a second instruction to the mobile device associated with the main device to perform custom key reset.

[0060] Specifically, the second instruction carries a randomly generated key for inputting into the display front end of the main device to trigger custom key reset.

[0061] At this time, based on steps S100.2 to S100.4, even if the key carried in the access request is illegally obtained, the risk of illegal disk intrusion can be reduced by setting the validity period of this type of key and making it automatically invalid when it expires.

[0062] Step S104: When traversing the internal data to confirm that there is communication between the main device and the external device, extract the device information of the external device and the communication duration between the external device and the main device.

[0063] Specifically, the device information includes the device IP address and the device type.

[0064] Step S106: When it is judged that the external device and the main device are communicating for the first time and the communication duration is greater than the preset duration threshold, send a first instruction to the display front end.

[0065] Among them, the first instruction is used to require the user who sends the access request to input a backup key.

[0066] Considering that there is a risk that the disk to be accessed is about to be illegally accessed when the backup key needs to be sent. Therefore, in combination with Figure 3 as shown, step S106 specifically includes:

[0067] Step S106.2: Send a third instruction to the display front end.

[0068] The third instruction is used to obtain a shard key corresponding to the backup key.

[0069] Step S106.4: if it is determined that a correct sharding key is received within a preset time interval, the third instruction is sent in a loop until all sharding keys are obtained.

[0070] In a specific implementation, if it is determined that the correct sharding key is not received within a preset time interval, the sending of the third instruction is stopped, the disk to be accessed is locked to prohibit access, and a warning message is sent to a mobile device associated with the main device.

[0071] Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

[0072] Step S106.6: Concatenate the shard keys to obtain the backup key, and allow the disk to be accessed to be decrypted.

[0073] At this time, the input difficulty can be increased during the process of obtaining the backup key to reduce the risk of the backup key also being illegally obtained.

[0074] As a specific implementation method, Figure 4 As shown, the following processing is performed when the backup key is entered incorrectly:

[0075] Step S106.2': when it is determined that the backup key is input incorrectly and the number of incorrect inputs is greater than a preset number threshold, the disk to be accessed is locked to prohibit access, and a warning message is sent to a mobile device associated with the main device.

[0076] Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

[0077] At this time, step S106.2' can determine that the risk of the key being illegally obtained is high, and take corresponding measures to prevent disk data leakage, while providing corresponding means to ensure that legitimate users continue to access the disk.

[0078] The above program can run in a processor or can also be stored in a memory (or referred to as a computer-readable storage medium). A computer-readable medium includes permanent and non-permanent, removable and non-removable media and can implement information storage by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of a computer's storage medium include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory, or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassette tapes, magnetic disk storage, or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device. As defined herein, a computer-readable medium does not include transitory computer-readable media such as modulated data signals and carrier waves.

[0079] These computer programs can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process. Thus, the instructions executed on the computer or other programmable device provide for implementing the steps for the functions specified in Figure 1 one process or multiple processes and / or Figure 1 one block or multiple blocks. The corresponding different steps can be implemented by different modules.

[0080] Based on this, this embodiment further provides a device for disk encryption and decryption. As Figure 5 shown, the device includes:

[0081] A data retrieval module, configured to extract internal data of a main device equipped with a disk to be accessed within a preset period before based on an access request; wherein, the access request is used to request to obtain data in the disk to be accessed, and carries a disk key therein; the preset period is a time range between the timestamp of this access request and the timestamp of the last shutdown operation.

[0082] A data traversal module, configured to traverse the internal data to extract device information of the external device and the communication duration between the external device and the main device when it is confirmed that there is communication between the main device and the external device; wherein, the device information includes: device IP address and device type.

[0083] The abnormal verification module is used to determine that the external device and the main device are communicating for the first time, and when the communication duration is greater than a preset duration threshold, send a first instruction to the display front end; wherein the first instruction is used to require the user who sends the access request to enter a backup key.

[0084] The device is used to implement the steps of the above method, so what has been described has not been repeated here.

[0085] For example, the device further comprises:

[0086] A feedback sending module is used to obtain the timestamp of the access request to determine when a preset update cycle has been reached, and send a first feedback to the display front end of the main device; wherein the first feedback is used to remind that the disk key carried in the access request has expired.

[0087] An update reset module is used to send a second instruction to a mobile device associated with the main device to reset the custom key; wherein the second instruction carries a random key generated in real time, which is used to input the display front end of the main device to trigger the custom key reset.

[0088] For another example, the device further includes:

[0089] The abnormal warning module is used to determine that the backup key is input incorrectly, and when the number of incorrect inputs exceeds a preset threshold, the disk to be accessed is locked to prohibit access, and a warning message is sent to a mobile device associated with the main device.

[0090] Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

[0091] Combination Figure 6 As shown, this embodiment further provides an electronic device, comprising at least one processor, the processor being coupled to a memory, the memory storing a computer program, and the computer program being configured to execute the method when being executed by the processor.

[0092] Meanwhile, this embodiment also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a computer, the method described above is implemented.

[0093] Since the device, electronic device and storage medium are constructed based on the method, they also have the technical advantage of further ensuring the security of user disk data during actual use.

[0094] Although the present invention has been disclosed above in its preferred embodiments, it is not intended to limit the present invention. Those of ordinary skill in the technical field to which the present invention pertains can make various modifications and refinements without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention shall be determined by the scope defined in the claims.

Claims

1. A method for disk encryption and decryption, characterized in that: include: Extracting internal data of a main device equipped with a disk to be accessed within a preset period of time based on an access request; wherein the access request is used to request to obtain data in the disk to be accessed, and carries a disk key; the preset period of time is the time zone between the timestamp of the current access request and the timestamp of the last shutdown operation; When the internal data is traversed to confirm that the main device and the external device are communicating, the device information of the external device and the communication duration between the external device and the main device are extracted; wherein the device information includes: device IP address and device type; When it is determined that the external device and the main device are communicating for the first time and the communication duration is greater than a preset duration threshold, it is confirmed that the disk key carried in the access request is at risk of illegal acquisition, and a first instruction is sent to the display front end; wherein, the first instruction is used to require the user who sends the access request to enter a backup key.

2. The method for disk encryption and decryption according to claim 1, characterized in that: The method of extracting the internal data of the main device equipped with the disk to be accessed within a preset period of time based on the access request includes: Obtaining the timestamp of the access request to determine when a preset update cycle has been reached, sending a first feedback to the display front end of the main device; wherein the first feedback is used to remind that the disk key carried in the access request has expired; A second instruction is sent to a mobile device associated with the main device to perform a custom key reset; wherein the second instruction carries a random key generated in real time, which is used to input into the display front end of the main device to trigger the custom key reset.

3. The method for disk encryption and decryption according to claim 1, characterized in that: The method of determining that the external device and the main device are communicating for the first time and the communication duration is greater than a preset duration threshold, and sending a first instruction to the display front end includes: When it is determined that the backup key is entered incorrectly and the number of incorrect entries is greater than a preset number threshold, the disk to be accessed is locked to prohibit access, and a warning message is sent to a mobile device associated with the main device; Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

4. The method for disk encryption and decryption according to claim 1, characterized in that: The method of determining that the external device and the main device are communicating for the first time and the communication duration is greater than a preset duration threshold, sending a first instruction to the display front end includes: Sending a third instruction to the display front end; wherein the third instruction is used to obtain a shard key corresponding to the backup key; If it is determined that a correct sharding key is received within a preset time interval, the third instruction is sent in a loop until all sharding keys are obtained; The shard keys are concatenated to obtain the backup key, and the disk to be accessed is allowed to be decrypted.

5. The method for disk encryption and decryption according to claim 4, characterized in that: The determining that a correct sharding key is received within a preset time interval, and then executing the sending of the third instruction in a loop until all sharding keys are obtained; comprises: If it is determined that the correct sharding key is not received within the preset time interval, the third instruction is stopped from being sent, the disk to be accessed is locked to prohibit access, and a warning message is sent to a mobile device associated with the main device; Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

6. A device for disk encryption and decryption, characterized in that: include: A data retrieval module is used to extract internal data of a main device equipped with a disk to be accessed within a preset period of time based on an access request; wherein the access request is used to request the acquisition of data in the disk to be accessed, and carries a disk key; the preset period of time is the time zone between the timestamp of the current access request and the timestamp of the last shutdown operation; A data traversal module is used to traverse the internal data to confirm that the main device and the external device are communicating, and then extract the device information of the external device and the communication duration between the external device and the main device; wherein the device information includes: device IP address and device type; The abnormal verification module is used to determine that the external device and the main device are communicating for the first time, and when the communication duration is greater than a preset duration threshold, send a first instruction to the display front end; wherein the first instruction is used to require the user who sends the access request to enter a backup key.

7. The device for disk encryption and decryption according to claim 6, characterized in that: include: A feedback sending module, used for obtaining the timestamp of the access request to determine when a preset update period has been reached, and sending a first feedback to the display front end of the main device; wherein the first feedback is used to remind that the disk key carried in the access request has expired; An update reset module is used to send a second instruction to a mobile device associated with the main device to reset the custom key; wherein the second instruction carries a random key generated in real time, which is used to input the display front end of the main device to trigger the custom key reset.

8. The device for disk encryption and decryption according to claim 6, characterized in that: include: The abnormal warning module is used to determine that the backup key is input incorrectly, and when the number of incorrect inputs exceeds a preset number threshold, lock the disk to be accessed to prohibit access, and send a warning message to a mobile device associated with the main device; Among them, the warning information is used to remind the main device that there is a risk of abnormal access to the disk to be accessed, and to inform the associated mobile device of the way to release the locked state of the disk to be accessed; among them, the way to release the locked state includes mobile device message verification and email verification.

9. An electronic device, characterized in that: The method comprises at least one processor, wherein the processor is coupled to a memory, wherein a computer program is stored in the memory, and wherein the computer program is configured to execute the method according to any one of claims 1 to 5 when executed by the processor.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a computer, the method according to any one of claims 1 to 5 is implemented.

Images