Data processing apparatus and data processing method

Abstract

The invention provides data processing equipment, and relates to the technical field of computers. The data processing apparatus includes: a storage unit including a first region and a second region associated with the first region, identification data being pre-stored in the second region, and the second region having a function of being written with data; and a controller configured to write the read write data to the first region, in response to a state in which the write data is written to the first region, it is determined whether the write data satisfies a security condition based on a state of the identification data stored in the second region.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to the field of data processing and data storage technology. Background Art

[0002] Some computer devices allow users to store personalized data in the system's Extensible Firmware Interface system partition (ESP), which allows users to personalize some display interfaces of the system. However, this also reduces the security of system operation. If the data written by the user into the ESP poses a security risk, the system cannot run safely. Summary of the invention

[0003] The present disclosure provides a data processing device and a data processing method.

[0004] According to one aspect of the present disclosure, there is provided a data processing device, comprising: a storage unit, comprising a first area and a second area associated with the first area, identification data being pre-stored in the second area, and the second area having a function of being written with data; and a controller, configured to write the read write data into the first area; in response to a state in which the write data is written into the first area, determining whether the write data satisfies a security condition based on a state of the identification data stored in the second area.

[0005] According to an embodiment of the present disclosure, the end address of the first area and the start address of the second area are associated write addresses, and the controller is configured to write the read write data into the first area, including: in response to determining that the data amount of the write data is less than or equal to the capacity of the first area, writing the write data into the first area.

[0006] According to an embodiment of the present disclosure, the end address of the first area and the start address of the second area are associated write addresses, and the controller is configured to write the read write data into the second area, including: in response to determining that the amount of write data is less than the capacity of the first area, writing the write data into the first area; and writing supplementary data into a free area of ​​the first area, the free area being an area in the first area that is not filled with write data.

[0007] According to an embodiment of the present disclosure, the controller is configured to: obtain the status of the identification data stored in the second area in response to a read instruction for write data; and read the write data stored in the first area in response to determining that the status of the identification data stored in the second area is a complete state.

[0008] According to an embodiment of the present disclosure, the storage area further includes a third area, and the third storage area is used to store startup data verified by the boot protection mechanism, and the startup data is non-editable data.

[0009] Another aspect of the present disclosure provides a data processing method, including: obtaining write data; and writing the write data into a first area in a storage unit; wherein the storage unit includes the first area and a second area associated with the second area, identification data is pre-stored in the second area, and the second area has the function of being written with data; the state of the identification data stored in the second area after the write data is written into the first area indicates whether the write data meets the security conditions.

[0010] According to an embodiment of the present disclosure, writing write data into a first area in a storage unit includes verifying the read initial data; in response to determining that the initial data passes the verification, encrypting the initial data to obtain the write data; and writing the write data into a second area.

[0011] According to an embodiment of the present disclosure, in response to determining that the initial data passes verification, the initial data is encrypted to obtain write data, including: verifying the data amount of the initial data; and in response to determining that the data amount is consistent with a reference data amount of the initial data, encrypting the initial data to obtain write data.

[0012] According to an embodiment of the present disclosure, in response to determining that the initial data passes verification, the initial data is encrypted to obtain write data, including: in response to determining that the initial data passes verification, the initial data is encrypted and encoded using a preset key to obtain write data, and the data content of the write data is different from the data content of the initial data.

[0013] According to an embodiment of the present disclosure, the write data includes image data; writing the read write data into the second area in the storage unit includes: identifying image features of the image data; in response to the image features passing verification, encapsulating the image data to obtain a data block; and writing the data block into the first area.

[0014] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0016] Figure 1 is a structural schematic diagram of a data processing device according to an embodiment of the present disclosure;

[0017] Figure 2 is a schematic structural diagram of a storage unit according to an embodiment of the present disclosure;

[0018] Figure 3 is a schematic structural diagram of a storage unit according to another embodiment of the present disclosure;

[0019] Figure 4 is a schematic structural diagram of a storage unit according to another embodiment of the present disclosure;

[0020] Figure 5 is a flowchart of a data processing method according to an embodiment of the present disclosure;

[0021] Figure 6 is a structural schematic diagram of a data processing device according to an embodiment of the present disclosure; and

[0022] Figure 7 is a schematic block diagram of an example electronic device for implementing an embodiment of the present disclosure. DETAILED DESCRIPTION

[0023] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0024] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision, disclosure and application of the data involved (including but not limited to user personal information) comply with the provisions of relevant laws and regulations, take necessary confidentiality measures, and do not violate public order and good morals.

[0025] Figure 1 It is a structural diagram of a data processing device according to an embodiment of the present disclosure.

[0026] like Figure 1 As shown, the data processing device 100 includes a storage unit 110 and a controller 120 .

[0027] In the embodiment of the present disclosure, the storage unit 110 may be a Basic Input Output System Non-Volatile Random Access Memory (BIOS NVRAM). The storage unit 110 may store running programs required for running a BIOS system or a Unified Extensible Firmware Interface (UEFI) program.

[0028] The controller 120 may be a chip integrated on a mainboard. After the data processing device 100 is powered on, the mainboard is also powered on. The controller 120 may read an operating program required to operate the BIOS system from the storage unit 110 and execute the operating program, thereby realizing the operation of the BIOS system.

[0029] In the embodiment of the present disclosure, the storage unit 110 includes a first area and a second area associated with the first area. The second area stores identification data in advance, and the second area has the function of being written with data. The controller 120 writes the read write data into the first area.

[0030] For example, the controller 120 stores identification data in the second area of ​​the storage unit 110 in advance. After the controller 120 reads the write data, the controller 120 writes the write data into the first area of ​​the storage unit 110. The first area is associated with the second area, and the identification data stored in the second area can characterize the security of the write data stored in the first area. The content of the identification data can be set according to actual needs.

[0031] For example, the user stores configuration data for personalized settings in the ESP. The controller 120 reads the configuration data from the ESP and writes the configuration data into the first area of ​​the storage unit 110. The second area of ​​the storage unit 110 associated with the first area is pre-written with identification data.

[0032] In the embodiment of the present disclosure, the controller 120 determines whether the write data satisfies the security condition based on the status of the identification data stored in the second area in response to the status of the write data being written into the first area.

[0033] For example, the state of writing the write data to the first area may be whether the write data is completely written. The state of the identification data stored in the second area includes whether the identification data in the second area is complete. In the case where the controller 120 determines that the write data has been completely written to the first area, the controller 120 determines whether the identification data in the current second area is complete. If the identification data in the second area is complete after the write data is completely written to the first area, the controller 120 can determine that the write data currently stored in the first area is safe. If the identification data in the second area is missing after the write data is completely written to the first area, the controller 120 can determine that the write data currently stored in the first area is unsafe.

[0034] In the embodiment of the present disclosure, identification data is pre-stored in the second area, but data can be written into the second area. For example, if data is written into the second area, the identification data pre-stored in the second area will be overwritten.

[0035] The writing principle of the controller 120 is that the controller 120 only writes the write data into the first area, which can ensure that the identification data pre-stored in the second area will not be overwritten, thereby ensuring the integrity of the identification data in the second area.

[0036] In the disclosed embodiment, a malicious operator may control the controller 120 to perform an attacking data write operation. For example, the malicious operator may write the write data carrying malicious data directly into the storage area 110. Since both the first area and the second area can be written with data, the malicious operator will write the write data carrying malicious data into the second area. If the amount of write data carrying malicious data is large, in order to ensure that the malicious data can be written, the malicious operator will write all the write data carrying malicious data into the storage unit 110 as much as possible, so that both the first area and the second area of ​​the storage unit 110 are filled.

[0037] After the write data is completely written into the storage unit 110 , the controller 120 determines whether the written write data is safe based on the state of the identification data currently stored in the second area.

[0038] In the embodiment of the present disclosure, by pre-writing flag data in the second area and setting the controller 120 to only write write data to the first area, the difference between malicious write and normal write can be used to identify the malicious operator performing malicious write behavior by utilizing the state of the flag data in the second area, thereby determining the security of the write data.

[0039] Figure 2 is a schematic structural diagram of a storage unit according to an embodiment of the present disclosure.

[0040] like Figure 2 As shown, the storage unit 210 includes a first region 211 and a second region 212 .

[0041] In the embodiment of the present disclosure, the end address of the first area 211 and the start address of the second area 212 are associated write addresses.

[0042] For example, the addresses of the first area 211 and the second area 212 may be continuous. For example, the start address of the second area 212 is the next write address of the end address of the first area 211, and the end address of the first area 211 is continuous with the start address of the second area 212. Without restricting the writing behavior, the write data may be written into the first area 211 and the second area 212 in sequence. If the first area 211 does not have enough capacity to store the write data, the write data may be written into the second area 212 continuously.

[0043] For example, the address of the first area 211 is 0-60, and the address of the second area 212 is 61-80. Each address can store 1 byte of data, and the second area 212 pre-stores 20 bytes of identification data. The amount of data written can be 70 bytes. Under the premise of not constraining the writing behavior, the written data can be written to addresses 0-70 in sequence. In this case, the data stored in 61-70 in the second area 212 is overwritten. After the written data is completely written to the storage unit 210, the controller can determine that the identification data stored in the second area 212 is missing. Therefore, the controller determines that the written data in the storage unit 210 is unsafe.

[0044] For example, the addresses of the first area 211 and the second area 212 may be discontinuous. For example, the start address of the second area 212 is the next write address of the end address of the first area 211, but the end address of the first area 211 is discontinuous with the start address of the second area 212. Without restricting the writing behavior, the write data may also be written into the first area 211 and the second area 212 in sequence. If the first area 211 does not have enough capacity to store the write data, the write data may be written into the second area 212 continuously.

[0045] For example, the address of the first area 211 is 0-60, and the address of the second area 212 is 80-100. The amount of the written data may be 70 bytes. Without constraining the writing behavior, the written data may be written to addresses 0-60 and 80-90 in sequence. In this case, the data stored in addresses 80-90 in the second area 212 is overwritten. After the written data is completely written to the storage unit 210, the controller may also determine that the identification data stored in the second area 212 is missing. Therefore, the controller determines that the written data in the storage unit 210 is unsafe.

[0046] In some embodiments, the controller writing the read write data into the first region 211 may include: in response to determining that the data amount of the write data is less than or equal to the capacity of the first region 211 , writing the write data into the first region 211 .

[0047] In the embodiment of the present disclosure, in the absence of malicious manipulation by a malicious operator, the data writing behavior of the controller is still restricted, and the controller can only write the write data to the first area 211. Before the controller writes the write data to the first area 211, the controller determines whether the amount of the write data is less than or equal to the capacity of the first area 211. If the amount of the write data is less than or equal to the capacity of the first area 211, the controller considers that the first area 211 is sufficient to store the write data, and writes the write data to the first area 211.

[0048] If the amount of the written data is greater than the capacity of the first area 211, the controller considers that the first area 211 is insufficient to store the written data. In this case, the controller compresses the written data so that the amount of the compressed written data is less than or equal to the capacity of the first area 211, and then writes the compressed written data into the first area 211.

[0049] In some embodiments, if the amount of the written data is less than the capacity of the first area 211, the controller writes the written data into the first area 211. In order to prevent the idle area in the first area 211 from being maliciously written, the controller writes the supplementary data into the idle area of ​​the first area, where the idle area is the area in the first area 211 that is not filled with the written data. For example, the supplementary data may be data "00" or other data that does not affect the content of the written data.

[0050] In the embodiment of the present disclosure, when it is determined that the write data cannot fill up the first area 211, the controller fills the first area 211 with supplementary data so that the first area 211 is filled up, thereby preventing malicious writing. In addition, filling up the first area 211 can also simplify the controller's subsequent reading of data from the first area 211. The controller can read data from a specific address segment of the first area 211 and filter out the supplementary data in the read data, thereby obtaining the required write data.

[0051] In the embodiment of the present disclosure, the capacity of the first area 211 may be determined based on the capacity of the storage unit 210 and the capacity of the second area 212. The capacity of the storage unit 210 is predetermined, and the capacity of the second area 212 may be determined based on the amount of identification data pre-written into the second area 212. Therefore, based on the difference between the capacity of the storage unit 210 and the capacity of the second area 212, the capacity of the first storage area is determined.

[0052] In some embodiments, after the write data is written to the storage unit 210, when the controller needs to read the write data from the storage unit 210 for personalized configuration, the controller can obtain the status of the identification data stored in the second area 212 in response to a read instruction for the write data; and in response to determining that the status of the identification data stored in the second area 212 is a complete state, read the write data stored in the first area 211.

[0053] In the embodiment of the present disclosure, although the controller's writing mode is controlled to identify the security of the written data during the data writing process, the controller may still make a wrong judgment. In order to further improve the security, before the written data in the storage unit 210 is used, in response to a read instruction for the written data stored in the first area 211, the controller obtains the current state of the identification data stored in the second area 212 to determine the security of the written data in the first area 211 based on the state of the identification data in the second area 212.

[0054] In the embodiment of the present disclosure, if the state of the identification data in the second area 212 is complete, the controller can read the write data from the first area 211 and perform personalized configuration based on the read write data. If the state of the identification data in the second area 212 is missing, the controller can clear all data in the storage area 210 and re-write the identification data in the second area 212 to prevent malicious data from affecting the operation of the BIOS system.

[0055] Figure 3 is a schematic structural diagram of a storage unit according to another embodiment of the present disclosure.

[0056] like Figure 3 As shown, the memory cell 310 may include a plurality of first regions 311_1 , 311_2 , 311_3 and a plurality of second regions 312_1 , 312_2 , 312_3 . Figure 3 The number of first regions and the number of second regions shown are merely illustrative.

[0057] Each first region has an associated second region. For example, the first region 311_1 is associated with the second region 312_1 to determine the security of the written data stored in the first region 311_1 through the identification data stored in the second region 312_1. The first region 311_2 is associated with the second region 312_2 to determine the security of the written data stored in the first region 311_2 through the identification data stored in the second region 312_2. The first region 311_3 is associated with the second region 312_3 to determine the security of the written data stored in the first region 311_3 through the identification data stored in the second region 312_3.

[0058] In the embodiment of the present disclosure, the plurality of first areas 311_1 , 311_2 , 311_3 may be used to store a plurality of write data to store a plurality of personalized configuration information.

[0059] In the embodiment of the present disclosure, if the amount of written data is greater than the capacity of a single first region, the controller may write the written data into multiple first regions in sequence to store the written data through the multiple first regions. The capacities of the multiple first regions 311_1, 311_2, 311_3 may be the same or different.

[0060] For example, if the controller determines that the amount of the write data is greater than the capacity of the first region 311_1 but less than the capacity of the first region 311_2, the controller may write the write data into the first region 311_2. For example, if the controller determines that the amount of the write data is greater than the capacity of any single first region, the controller may write the write data into the first region 311_1 and write the remaining portion of the write data that has not been written into the first region 311_2 and the first region 311_3 in sequence, indicating that the write data is completely written into the first region of the storage unit 310.

[0061] Figure 4 is a schematic structural diagram of a storage unit according to another embodiment of the present disclosure.

[0062] like Figure 4 As shown, the storage unit 410 includes a first region 411 , a second region 412 , and a third region 413 .

[0063] In the embodiment of the present disclosure, the first area 411 and the second area 412 may refer to the first area 211 and the second area 212 described above, which will not be described again for the sake of brevity.

[0064] In the disclosed embodiment, the third area is used to store the startup data verified by the boot protection mechanism, and the startup data is non-editable data. Before the BIOS system starts, the boot protection mechanism Intel Boot Guard needs to verify the integrity of the startup data in the third area and whether there is a signature. The startup data stored in the third area cannot be modified. For example, the third area can be closed, and the controller cannot modify the data in the third area or write data to the third data. Compared with the first area and the second area, the data stored in the third area has higher security.

[0065] In the embodiment of the present disclosure, the storage unit 410 may further include a fourth area, and the data in the fourth area is controlled by the secure boot program Secure Boot. The fourth area may store data other than the boot data and the personalized configuration data of the BIOS system operation data.

[0066] The first area 411 and the second area 412 are also controlled by the secure boot program Secure Boot. The secure boot program Secure Boot can prevent known malicious signatures DBX, so the secure boot program Secure Boot can also prevent malicious operators from tampering with the data in the first area 411 and the second area 412. Since the second area 412 can be used to verify the security of the data in the first area 411, the data stored in the first area 411 has higher security than that in the fourth area.

[0067] Figure 5 It is a flowchart of a data processing method according to an embodiment of the present disclosure.

[0068] like Figure 5 As shown, the data processing method 500 of this embodiment may include operations S510 to S520.

[0069] In operation S510 , write data is obtained.

[0070] In operation S520, write data is written to a first region in a memory cell.

[0071] In the embodiment of the present disclosure, the storage unit includes a first area and a second area associated with the second area, the second area pre-stores identification data, and the second area has the function of being written with data; after the written data is written into the first area, the state of the identification data stored in the second area indicates whether the written data meets the security condition

[0072] In the embodiment of the present disclosure, the data processing method 500 may refer to the execution operation of the controller 120 described above. For the sake of simplicity, similar parts will not be repeated.

[0073] In some embodiments, operation S520, writing write data into the first area in the storage unit may include: verifying the read initial data; in response to determining that the initial data passes the verification, encrypting the initial data to obtain the write data; and writing the write data into the second area.

[0074] In the disclosed embodiment, the initial data may be data read by the controller from the ESP. Before writing the data read from the ESP into the storage unit, the initial data is verified to determine that the read initial data does not include malicious data. Encrypting the verified initial data can prevent the initial data from being tampered with.

[0075] For example, the data volume of the initial data is verified, and in response to determining that the data volume is consistent with the reference data volume of the initial data, the initial data is encrypted to obtain the write data. The reference data volume can be determined from the header information of the initial data.

[0076] The header information of the initial data records the reference data volume of the initial data. If a malicious operator adds malicious data to the initial data, the actual data volume of the initial data obtained by the controller is inconsistent with the reference data volume.

[0077] In response to the actual data amount of the acquired initial data being consistent with the reference data amount, the controller can encrypt the initial data to obtain write data, and write the write data into the first area of ​​the storage unit. In response to the actual data amount of the acquired initial data being inconsistent with the reference data amount, the controller feeds back abnormal information and clears the initial data.

[0078] In some embodiments, in response to determining that the initial data passes verification, encrypting the initial data to obtain write data may include: in response to determining that the initial data passes verification, encrypting the initial data using a preset key to obtain write data, wherein the data content of the write data is different from the data content of the initial data.

[0079] In the disclosed embodiment, the data content in the initial data can be changed by encrypting the initial data with a preset key. For example, the data content of the initial data is 101010. After being encrypted and encoded with the preset key, the written data obtained is 111000. For example, the binary data of the initial data is logically operated with the binary data in the preset key to obtain the written data.

[0080] In the disclosed embodiment, a malicious operator may add characteristic data to the initial data, and after the characteristic data is written into the storage unit together with the initial data, the malicious operator may locate the characteristic data through sniffing technology, thereby locating the storage address of the storage system data to attack the system.

[0081] If the characteristic data is not identified during the verification process, the data content of the characteristic data is changed by encrypting the initial data, which makes it impossible for malicious operators to locate the characteristic data through sniffing technology.

[0082] In the embodiment of the present disclosure, during the use of the written data, the written data can be decrypted and encoded using a preset key to obtain initial data.

[0083] In the disclosed embodiment, after the initial data is encrypted, a secure boot signature may be added to the encrypted data. The secure boot signature is managed by the secure boot program Secure Boot, thereby increasing the security of written data.

[0084] In the disclosed embodiment, in the process of writing the initial data into the storage unit, a first security line is set to verify the data volume of the initial data. When it is determined that the initial data has not been tampered with, a second security line is set for the initial data that has passed the verification. In the second line, the initial data that has passed the verification is encrypted using a private key. If the initial data including malicious data bypasses the first security line, the data form and data content of the malicious data can be changed by encrypting the initial data, thereby preventing the storage unit from being located using the sniffing technology of the characteristic string.

[0085] In an embodiment of the present disclosure, the write data may include image data. Operation S520 of writing the read write data into the second area of ​​the storage unit may include: identifying image features of the image data; in response to the image features passing verification, encapsulating the image data to obtain a data block; and writing the data block into the first area.

[0086] For example, if the written data is an image logo that is personalized by the user, the format of the image logo is checked for security based on the image features of the image logo. For example, the image logo is automatically uploaded to the cloud for artificial intelligence (AI) verification. Cloud AI is used to filter unhealthy and uncivilized pictures and text content that violates laws and regulations, and the image data written to the storage unit are all legal and compliant data.

[0087] In the disclosed embodiment, a secure boot signature is added to the image data that has passed the AI ​​verification, and the image data is encapsulated in capsule firmware to obtain multiple capsule data blocks. When using the image data for logo personalization configuration, the controller only needs to read the data block including the image logo and retain the data required for other updates to perform the update operation, simplifying the update process.

[0088] For example, when the computer device is powered on again, the controller reads the data block including the image logo from the storage unit and uploads the data block to the remote AI again, so that the cloud AI is used again to perform image feature analysis and verification before using the image logo to ensure that the personalized image logo is legal and compliant.

[0089] In the embodiment of the present disclosure, after writing the write data into the storage unit, in response to the state of writing the write data into the first area, it is determined whether the write data meets the security condition based on the state of the identification data stored in the second area. When reading the write data from the storage unit for personalized configuration, in response to a read instruction for the write data, the state of the identification data stored in the second area is obtained; and in response to determining that the state of the identification data stored in the second area is a complete state, the write data stored in the first area is read.

[0090] Figure 6 It is a structural diagram of a data processing device according to an embodiment of the present disclosure.

[0091] Figure 6 The block diagram schematically shows a data processing device according to an embodiment of the present disclosure.

[0092] like Figure 6 As shown, the data processing device 600 includes an obtaining module 610 and a writing module 620 .

[0093] In the embodiment of the present disclosure, the data processing device 600 can be used to implement the reference Figure 5 The data processing method according to the embodiment of the present disclosure is described.

[0094] The obtaining module 610 may perform, for example, operation S510 to obtain write data.

[0095] The write module 620 may perform, for example, operation S520 for writing the write data into the first region in the storage unit.

[0096] For example, any multiple of the acquisition module 610 and the write module 620 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 610 and the write module 620 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the acquisition module 610 and the write module 620 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0097] In an embodiment of the present disclosure, a storage unit includes a first area and a second area associated with the second area, identification data is pre-stored in the second area, and the second area has the function of being written with data; the state of the identification data stored in the second area after the write data is written to the first area indicates whether the write data meets the security conditions.

[0098] In the disclosed embodiment, the write module 620 is used to verify the read initial data; in response to determining that the initial data passes the verification, encrypt the initial data to obtain write data; and write the write data into the second area.

[0099] In the embodiment of the present disclosure, the above-mentioned write module 620 executes encryption processing on the initial data to obtain write data in response to determining that the initial data passes verification, including: verifying the data amount of the initial data; and in response to determining that the data amount is consistent with the reference data amount of the initial data, encrypting the initial data to obtain write data.

[0100] In the embodiment of the present disclosure, the write module 620 executes, in response to determining that the initial data passes the verification, encrypting the initial data to obtain the write data, including: in response to determining that the initial data passes the verification, encrypting and encoding the initial data using a preset key to obtain the write data, and the data content of the write data is different from the data content of the initial data.

[0101] In the disclosed embodiment, the written data includes image data. The writing module 620 is used to identify image features of the image data; in response to the image features passing the verification, encapsulate the image data to obtain a data block; and write the data block into the first area.

[0102] In the embodiment of the present disclosure, the writing module 620 is further configured to write the writing data into the first region in response to determining that the amount of the writing data is less than or equal to the capacity of the first region.

[0103] In the embodiment of the present disclosure, the above-mentioned writing module 620 is also used to write the write data into the first area in response to determining that the amount of the write data is less than the capacity of the first area; and write the supplementary data into the free area of ​​the first area, the free area being the area in the first area that is not filled with the write data.

[0104] In the embodiment of the present disclosure, the data processing device 600 may further include a reading module. The reading module is used to obtain the state of the identification data stored in the second area in response to a read instruction for writing data; and in response to determining that the state of the identification data stored in the second area is a complete state, read the writing data stored in the first area.

[0105] In the embodiment of the present disclosure, the storage area further includes a third area, and the third area is used to store startup data verified by the boot protection mechanism, and the startup data is non-editable data.

[0106] It should be noted that the collection, storage, use, processing, transmission, provision, disclosure and application of user personal information involved in the technical solution of this disclosure are in compliance with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals. In the technical solution of this disclosure, the user's authorization or consent is obtained before obtaining or collecting user personal information.

[0107] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0108] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement the method of an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0109] like Figure 7 As shown, the electronic device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0110] Multiple components in the electronic device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the electronic device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0111] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 701 performs the various methods and processes described above, such as data processing methods. For example, in some embodiments, the data processing method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the data processing method described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to perform the data processing method in any other appropriate manner (e.g., by means of firmware).

[0112] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0113] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0114] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0115] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0116] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0117] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. Among them, the server may be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0118] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0119] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A data processing device, comprising: A storage unit, comprising a first area and a second area associated with the first area, wherein identification data is pre-stored in the second area and the second area has a function of being written with data; as well as A controller configured to write the read write data into the first area; In response to a state in which the write data is written into the first area, it is determined whether the write data satisfies a security condition based on a state of the identification data stored in the second area.

2. The device according to claim 1, wherein the end address of the first area and the start address of the second area are associated write addresses, and the controller is configured to write the read write data into the first area, comprising: In response to determining that the data amount of the write data is less than or equal to the capacity of the first area, the write data is written into the first area.

3. The device according to claim 1, wherein the end address of the first area and the start address of the second area are associated write addresses, and the controller is configured to write the read write data into the second area, comprising: In response to determining that the amount of the write data is less than the capacity of the first area, writing the write data into the first area; as well as The supplementary data is written into a free area of ​​the first area, where the free area is an area of ​​the first area that is not filled with the written data.

4. The device according to claim 1, wherein the controller is configured to: In response to a read instruction for the write data, acquiring a state of the identification data stored in the second area; and In response to determining that the state of the identification data stored in the second area is a complete state, the write data stored in the first area is read.

5. The device according to any one of claims 1 to 4, wherein the storage area further comprises a third area, wherein the third area is used to store startup data for boot protection mechanism verification, and the startup data is non-editable data.

6. A data processing method, comprising: Get the written data; as well as Writing the write data into a first area in a storage unit; The storage unit includes a first area and a second area associated with the second area, the second area stores identification data in advance, and the second area has a function of being written with data; The state of the identification data stored in the second area after the write data is written into the first area indicates whether the write data satisfies a security condition.

7. The method according to claim 6, wherein writing the write data into the first area of ​​the storage unit comprises: Verify the initial data read; In response to determining that the initial data passes verification, encrypting the initial data to obtain the write data; as well as The write data is written into the second area.

8. The method according to claim 7, in response to determining that the initial data passes verification, encrypting the initial data to obtain the write data, comprises: Verifying the data volume of the initial data; as well as In response to determining that the data amount is consistent with the reference data amount of the initial data, the initial data is encrypted to obtain the write data.

9. The method according to claim 7, wherein in response to determining that the initial data passes verification, encrypting the initial data to obtain the write data comprises: In response to determining that the initial data passes verification, the initial data is encrypted and encoded using a preset key to obtain the write data, and the data content of the write data is different from the data content of the initial data.

10. The method according to claim 6, wherein the write data comprises image data; and the step of writing the read write data into the second area of ​​the storage unit comprises: identifying image features of the image data; In response to the image feature passing the verification, encapsulating the image data to obtain a data block; as well as The data block is written into the first area.

Images