Data processing method and device for secure mobile storage and storage equipment

Abstract

The invention relates to the technical field of storage, in particular to a data processing method and device for secure mobile storage and storage device.The method is executed by the storage device, the storage device comprises a visible storage area and a hidden storage area, and the method comprises the steps that in the power-on state, root directory information of a visible storage partition is obtained, the root directory information comprises file item data of each stored file in the visible storage partition; when it is queried that target file item data exists in the root directory information, it is determined that a directional storage function is started, and a target file corresponding to the target file item data is created by a user and written in through an upper computer; when the file to be stored is received, if it is determined that the directional storage function is started, the file to be stored is transferred to the hidden storage area, and the storage file in the hidden storage area can be accessed after the permission authentication is passed. According to the scheme, the privacy of the user data in the storage device can be improved.

Description

Technical Field

[0001] The present application relates to the field of storage technology, and in particular to a data processing method, apparatus and storage device for secure mobile storage. Background Art

[0002] Removable storage devices are a new generation of memory devices based on semiconductor flash memory, with a flash memory chip, such as TF card, NM card and eMMC chip, vehicle storage chip, USB flash drive, SSD hard disk, etc. Due to the small size, fast data transmission speed, hot pluggable and other excellent features of this storage device, it is widely used in portable devices such as electronic dictionaries, mobile phones, Pad tablets, digital cameras, vehicle navigation, smart vehicle terminals and other devices.

[0003] After the storage device is connected to the host computer through an interface, the storage device is powered on, and the host computer's operating system can read / write the data in the storage device. In order to improve privacy and thus protect user data, in related technologies, data can be encrypted before being written to the storage device. However, storage devices can be used by anyone, and anyone can write or read files into or from the storage device; and in some special scenarios, such as when the user's storage device is lent or lost, the user's data in the storage device, even if encrypted, can be easily stolen by others. The security of data in storage devices is also receiving more and more attention from users.

[0004] How to improve the privacy of user data in storage devices is an urgent problem that needs to be solved. Summary of the invention

[0005] Based on this, it is necessary to provide a data processing method, apparatus and storage device for secure mobile storage that can improve the privacy of user data in the storage device in response to the above technical problems.

[0006] In a first aspect, the present application provides a data processing method for secure mobile storage, the method being executed by a storage device, the storage device comprising a visible storage area and a hidden storage area, the method comprising:

[0007] In a power-on state, obtaining root directory information of a visible storage partition, the root directory information including file item data of each stored file in the visible storage partition;

[0008] When it is found that the target file item data exists in the root directory information, it is determined to enable the directional storage function, and the target file corresponding to the target file item data is created by the user and written by the host computer;

[0009] When receiving the file to be stored, if it is determined that the directional storage function has been turned on, the file to be stored is transferred to the hidden storage area, wherein the storage file in the hidden storage area can be accessed after the authority authentication is passed.

[0010] In one embodiment, each of the files to be stored corresponds to an initial data address, and the initial data address is a storage address in the visible storage area; transferring the files to be stored to the hidden storage area includes:

[0011] Screening the files to be stored based on the initial data address, and determining that the user files in the files to be stored are redirection files;

[0012] The redirected file is transferred to the hidden storage area, the access permission of the hidden storage area is a protection permission, and the protection permission restricts the access to the files stored in the hidden storage area.

[0013] In one embodiment, the filtering of the files to be stored based on the initial data address and determining that the user files in the files to be stored are redirected files includes:

[0014] The to-be-stored files are screened based on a screening condition and the initial data address, and the to-be-stored files that meet the screening condition are determined to be user files, wherein the screening condition is that the initial data address is greater than the file allocation table address and greater than the root directory address;

[0015] It is determined that the user file is a redirection file.

[0016] In one embodiment, the redirection file includes one-to-one correspondence between the file content data to be stored and the file item data to be stored, and transferring the redirection file to the hidden storage area includes:

[0017] Allocating a first storage address for the file content data to be stored in the hidden storage area, and storing the file content data to be stored in the first storage address;

[0018] A second storage address is allocated in the hidden storage area for the file item data to be stored, and the file item data to be stored is stored in the second storage address.

[0019] In one embodiment, the file item data to be stored includes a storage address of corresponding file content data to be stored, and after storing the file content data to be stored in the first storage address, transferring the file item data to be stored to the second storage address includes:

[0020] Acquire a mapping relationship table, wherein the mapping relationship table includes a correspondence between an initial data address of each stored file content data and a first storage address in the hidden storage area;

[0021] Based on the initial data address corresponding to the file to be stored, determining from the mapping relationship table a first storage address of the stored file content data corresponding to the file item data to be stored;

[0022] Based on the first storage address of the stored file content data corresponding to the file item data to be stored, updating the storage address of the stored file content data in the file item data to be stored;

[0023] The updated file item data to be stored is transferred to the second storage address.

[0024] In one of the embodiments, after determining to enable the directional storage function, the method further includes:

[0025] Delete the target file.

[0026] In one embodiment, the method further comprises:

[0027] In response to a trigger instruction sent by the host computer, the authentication information is sent to the host computer, so that the host computer encrypts the received authentication information to obtain a ciphertext to be authenticated;

[0028] Receiving the ciphertext to be authenticated, and decrypting the ciphertext to be authenticated to obtain decrypted information;

[0029] Compare the decrypted information with the pre-stored authentication information, and determine whether the authority authentication of the host computer is passed according to the comparison result;

[0030] If the comparison result indicates that the authority authentication of the host computer is passed, the access authority of the hidden storage area is modified to a pass authority, and the pass authority indicates that the files stored in the hidden storage area can be accessed.

[0031] In a second aspect, the present application further provides a data processing device for secure mobile storage, the device comprising a root directory information acquisition module, a directional storage function determination module and a transfer module, wherein:

[0032] A root directory information acquisition module, used to acquire the root directory information of the visible storage partition when powered on, wherein the root directory information includes file item data of each stored file in the visible storage partition;

[0033] A directional storage function determination module, used to determine to enable the directional storage function when the target file item data is found in the root directory information, wherein the target file corresponding to the target file item data is created by the user and written by the host computer;

[0034] The transfer module is used to transfer the file to be stored to the hidden storage area when receiving the file to be stored, if it is determined that the directional storage function has been turned on, wherein the storage file in the hidden storage area can be accessed after the authority authentication is passed.

[0035] In a third aspect, the present application also provides a storage device for secure mobile storage, comprising a storage unit and a controller, wherein the storage unit comprises a visible storage area and a hidden storage area;

[0036] The controller is in communication with the storage unit, a computer program is stored on the controller, and the following steps are implemented when the controller executes the computer program:

[0037] In a power-on state, obtaining root directory information of a visible storage partition, the root directory information including file item data of each stored file in the visible storage partition;

[0038] When it is found that the target file item data exists in the root directory information, it is determined to enable the directional storage function, and the target file corresponding to the target file item data is created by the user and written by the host computer;

[0039] When receiving the file to be stored, if it is determined that the directional storage function has been turned on, the file to be stored is transferred to the hidden storage area, wherein the storage file in the hidden storage area can be accessed after the authority authentication is passed.

[0040] In a fourth aspect, the present application further provides a computer program product for secure mobile storage, including a computer program, which implements the following steps when executed by a processor:

[0041] In a power-on state, obtaining root directory information of a visible storage partition, the root directory information including file item data of each stored file in the visible storage partition;

[0042] When it is found that the target file item data exists in the root directory information, it is determined to enable the directional storage function, and the target file corresponding to the target file item data is created by the user and written by the host computer;

[0043] When receiving the file to be stored, if it is determined that the directional storage function has been turned on, the file to be stored is transferred to the hidden storage area, wherein the storage file in the hidden storage area can be accessed after the authority authentication is passed.

[0044] According to the above-mentioned data processing method, device and storage device for secure mobile storage, when a user needs to create and write a target file, target file item data of the target file will be added to the root directory information; when the storage device is powered on, the storage device needs to obtain the root directory information and search whether the target file item data exists. If it is determined that the target file item data exists, it is determined to enable the directional transfer function, so that the storage device transfers the received file to a hidden storage area that cannot be directly read by the host computer; the user does not need to use other software programs in the host computer to directly write the data to be protected into the hidden storage area, and the data to be protected by the user is transferred to the hidden storage area by the storage device itself, which reduces data leakage caused by the participation of external devices and improves data security; at the same time, when the user loses or lends the storage device, the method of enabling directional transfer by creating a target file that meets the preset rules is also difficult for the user to know, so other users cannot enable the directional transfer function, that is, other users cannot write data into the hidden storage area, thereby improving the privacy of user data in the hidden storage area. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] FIG1 is an application environment diagram of a data processing method in one embodiment;

[0047] FIG2 is a schematic flow chart of a data processing method in one embodiment;

[0048] FIG3 is a logic diagram of determining whether to enable the directional storage function in one embodiment;

[0049] FIG4 is a schematic flow chart of the steps of transferring a file to be stored to a hidden storage area in one embodiment;

[0050] FIG5 is a schematic diagram of a process of screening files to be stored in one embodiment;

[0051] FIG6 is a schematic diagram of a flow chart of steps for transferring redirected files to a hidden storage area in one embodiment;

[0052] FIG7 is a logical diagram of transferring redirected files to a hidden storage area in one embodiment;

[0053] FIG8 is a schematic diagram of a process of authentication of permissions of a storage device to a host computer in one embodiment;

[0054] FIG9 is a logic diagram of reading data in a hidden storage area in one embodiment;

[0055] FIG10 is a block diagram of a data processing device in one embodiment;

[0056] FIG. 11 is a diagram showing the internal structure of a storage device in one embodiment. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0058] The data method provided in the embodiment of the present application can be applied in the application environment as shown in Figure 1. Among them, the storage device 102 communicates with the host computer 104 through an interface. The data storage system can store data that the host computer 104 needs to process. The data storage system can be integrated on the host computer 104, or it can be placed on the cloud or other network servers. When the storage device 102 is connected to the host computer 104 through an interface, the interface supplies power to the storage device 102. When the storage device 102 is powered, the host computer 104 can read and write data to the storage device 102.

[0059] Among them, the storage device 102 can be an electronic device with an integrated storage device, which can be but is not limited to various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc.; the storage device 102 can also be an independent storage device, such as TF (Trans Flash) card, NM (Nano Memory) card and eMMC (Embedded Multi Media Card) chip, car-mounted storage chip, U disk, SSD (Solid State Disk) hard disk, etc.

[0060] The host computer 104 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, etc.

[0061] In order to more clearly describe the implementation process of the scheme in the embodiment of the present application, the relevant technology in this field is first described here. In the FAT file system, the storage device is divided into multiple fixed-size blocks, called clusters. Each cluster can store one or more continuous sectors. When the PC needs to write data, the file system will allocate enough clusters to store the data according to the size and demand of the data. The allocation of these clusters is dynamic and is determined by the file system according to the current storage status and strategy.

[0062] There is a key data structure in the FAT file system - the File Allocation Table (FAT). This table records the allocation status of each cluster on the storage device, including which clusters are free and which clusters have been allocated to files or directories. When the file system allocates clusters for new data, it updates the corresponding entries in the FAT to reflect the new status of these clusters.

[0063] The FAT file system also maintains a root directory for recording file information. Each file has a corresponding file item data, which is also called the directory item of the file. The file item data includes the file name, extension, file attributes, starting cluster number and other information. When a file is created or modified, the file system will update the corresponding directory item to reflect the latest information of the file.

[0064] After allocating enough clusters and updating the FAT table and directory entries, the file system will write the data to the specified clusters. This writing process is completed by the host computer and the file system on the storage device. The operating system sends a write request to the file system, and the file system is responsible for converting the request into a specific write operation on the storage device.

[0065] In an exemplary embodiment, as shown in FIG2 , a data processing method for secure mobile storage is provided, and the method is applied to the storage device 102 in FIG1 as an example for explanation; wherein the storage device includes a storage unit and a controller, and the storage unit includes a visible storage area and a hidden storage area. The data processing method for secure mobile storage includes the following steps 01 to 03, and is executed by the controller of the storage device, wherein:

[0066] Step 01: In the power-on state, obtain the root directory information of the visible storage partition, the root directory information includes the file item data of each stored file in the visible storage partition.

[0067] For the embodiments of the present application, when the storage device is connected to the host computer through an interface, the visible storage area in the storage device can be directly accessed by the host computer, that is, the host computer can read and write data in the visible storage area. Only after the host computer has authenticated the permissions of the storage device can the hidden storage area of ​​the storage device be accessed by the host computer.

[0068] Specifically, the file allocation table and the root directory table are both stored in the visible storage area. When a file is written to the visible storage area, the written content consists of two parts: one part is the file content data, and the other part is the file item data; the file content data includes the specific content of the file, and the file item data includes the file name, extension, file attributes, starting cluster number and other information. Each file stored in the visible storage area can be queried in the root directory table. When the controller is powered on, it is triggered to obtain the root directory information in the visible storage partition. The root directory information is the root directory table of the visible storage area. The controller parses the obtained root directory information and skips the volume label, cluster bitmap file, and uppercase character file.

[0069] Step 02: When it is found that the target file item data exists in the root directory information, it is determined to enable the directional storage function. The target file corresponding to the target file item data is created by the user and written by the host computer.

[0070] For the embodiment of the present application, the controller queries whether the target file item data exists in the root directory information; wherein, the task of the controller querying whether the target file item data exists in the root directory information is triggered to be executed in response to the power-on state of the controller, and is only executed once. wherein, the target file corresponding to the target file item data is created by the user and written to the visible storage area of ​​the storage device by the host computer. specifically, the controller compares each file item data in the root directory information with the preset rules, and determines the file item data that meets the preset rules as the target file item data. specifically, the preset rules can be one or more of the target name, the file with the target extension, and the target format. the preset rules can be set or modified by the user.

[0071] In one example, the user can set the preset rule that the target name is A+B, that is, when the controller finds the file item data containing the file name A+B in the root directory information, it determines the file item data as the target file item data. Further, the controller records the file allocation table address and the root directory table address.

[0072] Step 03: When receiving the file to be stored, if it is determined that the directional storage function has been turned on, the file to be stored is transferred to the hidden storage area, wherein the stored files in the hidden storage area can be accessed after the authority authentication is passed.

[0073] Specifically, the judgment logic diagram for determining whether to enable the directional storage function is shown in Figure 3. If it is determined that the target file item data exists in the root directory information, it indicates that the corresponding target file exists in the visible storage area, and the controller determines to enable the directional storage function; when the directional storage function is enabled, the files written to the storage device through the host computer will be transferred to the hidden storage area; when the directional storage function is not enabled, the files written to the storage device by the user through the host computer will be stored in the visible storage area.

[0074] It should be noted that when the user uses a storage device to connect to the host computer, the controller of the storage device is powered on and obtains the root directory information to determine whether the target file item data exists. At this time, since the user has not yet created and written the target file, the root directory information does not contain the target file item data. After the user creates the target file and writes it to the visible storage area, the root directory information in the visible storage area is also updated so that the target file item data exists. The user needs to plug and unplug the storage device again to power off the storage device and reconnect it to the host computer through the interface. At this time, the controller of the storage device is powered on, and the controller obtains the root directory information to determine whether the target file item data exists in the root directory information, and then turns on the directed storage function.

[0075] In the above-mentioned data processing method for secure mobile storage, when a user needs to create and write a target file, target file item data of the target file will be added to the root directory information; when the storage device is powered on, the storage device needs to obtain the root directory information and search whether the target file item data exists. If it is determined that the target file item data exists, it is determined to enable the directional transfer function so that the storage device transfers the received file to a hidden storage area that cannot be directly read by the host computer; the user does not need to use other software programs in the host computer to directly write the data to be protected into the hidden storage area, and the data to be protected by the user is transferred to the hidden storage area by the storage device itself, which reduces the probability of data leakage caused by the participation of external devices and improves the security of the data; at the same time, when the user loses or lends the storage device, the method of enabling directional transfer by creating a target file that meets the preset rules is also difficult for the user to know, so other users cannot enable the directional transfer function, that is, other users cannot write data into the hidden storage area, thereby improving the privacy of user data in the hidden storage area.

[0076] After creating and writing the target file, the user can manually delete the target file to turn off the directional storage function; further, in one embodiment, the controller deletes the target file after determining to turn on the directional storage function. That is, the directional storage function is only valid once and does not have the effect of repeated use.

[0077] Further, in one embodiment, referring to FIG. 4 , in step 03, transferring the file to be stored to the hidden storage area may specifically include steps 031 and 032, wherein:

[0078] 031. Screen the files to be stored based on the initial data address, and determine that the user files in the files to be stored are redirected files.

[0079] Specifically, the file written by the host computer to the controller is first sent by the host computer to the controller of the storage device, and the controller stores the file in the visible storage area or the hidden storage area. Among them, the file sent by the host computer to the controller is a file to be stored, and the host computer reads the file allocation table in the visible storage area of ​​the storage device, and based on the occupancy of the cluster in the storage device represented by the file allocation table, allocates an initial data address to each file to be stored, and the initial data address is the storage address in the visible storage area.

[0080] Specifically, the files that the user wants to write to the storage device through the host computer may be user files that need to be written to the hidden storage area, or they may be system settings files that need to be written to the visible storage area; therefore, in order to accurately write user data to the hidden storage area and avoid writing system settings files to the hidden storage area, it is necessary to screen the storage files to determine the user files among the files to be stored, and determine the user files as redirected files.

[0081] 032. Transfer the accessible redirected files to the accessible hidden storage area.

[0082] Specifically, the redirected file is a file that needs to be written into the hidden storage area, that is, a user file. The access permission of the hidden storage area is protection permission by default, and the protection permission restricts the access to the files stored in the hidden storage area, thereby realizing the protection of the files stored in the hidden storage area.

[0083] In one embodiment, in step 031, the process of screening the files to be stored based on the initial data address and determining that the user files in the files to be stored are redirected files may specifically include: screening the files to be stored based on the screening condition and the initial data address, and determining that the files to be stored that meet the screening condition are user files, and determining that the user files are redirected files. The screening condition is that the initial data address is greater than the file allocation table address and greater than the root directory address.

[0084] Specifically, the order of storage addresses in the storage device is divided according to the order of MBR (Master Boot Record) address, DMR address, file allocation table address, root directory table address and user data address. In addition, when storing data, the file system in the storage device stores it in the order of MBR (Master Boot Record) address, DMR address, file allocation table address, root directory table address and user data address. Among them, the MBR address and DMR address can be considered as the storage address of the system file of the storage device; the file allocation table address is used to store the file allocation table, and the root directory table address is used to store the root directory table; only the user data address is used to store user files.

[0085] The process of the controller of the storage device screening the files to be stored received from the host computer is shown in FIG5. The controller of the storage device will compare the initial data address of the received files to be stored with the screening conditions, thereby implementing the screening of the files to be stored. Specifically, if the initial data address corresponding to the file to be stored is less than the file allocation table address, it indicates that the file to be stored is a system file, and the system file is directly written to the corresponding initial data address without being transferred to the hidden storage area. If the initial data address corresponding to the file to be stored is greater than the file allocation table address, it indicates that the file to be stored is not a system file, but a user file, that is, it needs to be transferred to the hidden storage area.

[0086] Furthermore, for the to-be-stored file whose initial data address is greater than the file allocation table address, it is a user file, but the user file includes two parts, namely, file content data and file item data. When the directional storage function is turned on, the file item data is not directly updated to the root directory table, because both the file item data and the corresponding file content data need to be transferred to the hidden storage area. Therefore, when the file content data is not stored in the visible storage area, the file item data cannot be updated to the root directory table of the visible storage area; thus, the file item data in the root directory table of the visible storage area corresponds one-to-one with the file content data stored in the visible storage area.

[0087] In one embodiment, the redirection file includes one-to-one correspondence between the to-be-stored file content data and the to-be-stored file item data; referring to FIG. 6 , transferring the redirection file to the hidden storage area may specifically include steps 0321 and 0322, wherein:

[0088] Step 0321, allocating a first storage address for the file content data to be stored in the hidden storage area, and storing the file content data to be stored in the first storage address;

[0089] Step 0322: Allocate a second storage address for the file item data to be stored in the hidden storage area, and store the file item data to be stored in the second storage address.

[0090] For the embodiment of the present application, for the redirected files that need to be transferred to the hidden storage area, including file item data and file content data, the file content data is stored in the file content position of the hidden storage area, and the file item data is stored in the file item position of the hidden storage area, that is, the file item data and the file content data are stored separately in the hidden storage area.

[0091] Specifically, referring to Figure 7, the controller of the storage device determines which of the redirected file are file item data and which are file content data; and the controller assigns a storage address in a hidden storage area to each file content data, that is, a first storage address, and the controller stores each file content data to the corresponding first storage address to achieve writing of the file content data; the controller assigns a storage address in a hidden storage area to each file item data, that is, a second storage address, and the controller stores each file item data to the corresponding second storage address to achieve writing of the file item data.

[0092] Furthermore, the file item data to be stored includes the storage address of the corresponding file content data to be stored. When the upper computer sends data to the controller, the storage address recorded in the file item data is the initial data address of the corresponding file content data in the visible storage area; however, since the controller transfers the file content data to the hidden storage area, when the file item data is stored in the hidden storage area, the content of the file item data is updated based on the actual storage address of the file content data corresponding to the file item data, wherein the actual storage address of the file content data is the first storage address of the file content data stored in the hidden storage area.

[0093] Therefore, step 0322 is executed after step 0321 is executed, that is, the controller first stores the file content data to the first storage address, and then stores the file item data to the second storage address.

[0094] Further, referring to FIG. 7 , in step 0322 , transferring the file item data to be stored to the second storage address may specifically include:

[0095] Obtain a mapping relationship table; based on the initial data address corresponding to the file to be stored, determine from the mapping relationship table the first storage address of the stored file content data corresponding to the file item data to be stored, and based on the first storage address of the stored file content data corresponding to the file item data to be stored, update the storage address of the stored file content data in the accessible file item data to be stored; and transfer the updated file item data to be stored to the second storage address.

[0096] Specifically, the mapping relationship table includes the correspondence between the initial data address of each stored file content data in the hidden storage area and the first storage address; since step 0322 is executed after step 0321, each file content data has been stored to its corresponding first storage address at this time, so the mapping relationship table can be obtained at this time. The update address is the first storage address of the stored file content data corresponding to the file item data to be stored; based on the correspondence between the unique initial data address between the file item data and the file content data, the controller determines the first storage address of the file content data corresponding to the file item data from the mapping relationship table, and then uses the determined first storage address as the update address. The storage address of the corresponding file data in the file item data is updated based on the updated address, and then the updated file item data is stored to the corresponding second storage address.

[0097] In another embodiment, transferring the updated file item data to be stored to the second storage address may also include regenerating new file item data based on the file item data and the updated address, and then storing the new file item data to the second storage address, wherein generating the new file item data may specifically include: obtaining excerpt data from the file item data, and then generating new file item data using the excerpt data and the updated address; wherein the excerpt data may include a file suffix and a file size. The generated new file item data only includes the file suffix, the file size, and the storage address (first storage address) of the corresponding file item data.

[0098] Specifically, the specific content of the excerpt is not specifically limited in the embodiments of the present application, as long as the excerpt is less than all the content contained in the file item data.

[0099] The file item data is stored in units of 512 bytes in the second storage location, and the valid data is 32 bytes. Taking exFAT as an example, the format of the file name of the new file item data saved in the second storage location is shown in Table 1:

[0100] Table 1

[0101]

[0102] The file item data or file name is stored in units of 512 bytes, and the storage order is as shown in Table 2.

[0103] Table 2

[0104]

[0105] Specifically, the file content data is stored in the order in which it is written, and the file size is stored in multiples of 512. For file content data whose size is less than a multiple of 512, it is padded to a multiple of 512 for storage; the actual size of the file content data is obtained from 0x08~0x0B of the file name, and the file content data storage order is shown in Table 3.

[0106] Table 3

[0107]

[0108] Through the above steps, the process of writing the file content data and the file item data into the hidden storage area can be realized.

[0109] Furthermore, when reading data stored in the hidden storage area of ​​the storage device, the storage device is connected to the host computer through an interface. When the storage device is powered on, it is necessary to perform permission authentication on the host computer, and only after the host computer passes the permission authentication of the storage device can the file data stored in the hidden storage area of ​​the storage device be accessed by the host computer.

[0110] Specifically, the process of the storage device authenticating the authority of the host computer, referring to FIG. 8 , may include steps 04 to 07, wherein:

[0111] Step 04: In response to the trigger instruction sent by the host computer, the authentication information is sent to the host computer, so that the host computer encrypts the received authentication information to obtain the ciphertext to be authenticated;

[0112] Step 05: Receive the ciphertext to be authenticated, and decrypt the ciphertext to be authenticated to obtain decrypted information.

[0113] Specifically, the controller of the storage device can generate a random number, and the generated random number has a validity period, wherein the specific duration of the validity period is not specifically limited in the embodiments of the present application. A dedicated tool software is installed in the host computer, and the host computer can call a preset API interface through the dedicated tool software to send a request permission authentication instruction to the controller of the storage device. After receiving the request permission authentication instruction, the controller will generate a random number and feed the random number back to the host computer. The host computer encrypts the received random number through the encryption algorithm built into the dedicated tool software to obtain the ciphertext to be authenticated, and sends the ciphertext to be authenticated to the control of the storage device for permission authentication. When the controller of the storage device receives the ciphertext to be authenticated, it decrypts the ciphertext to be authenticated to obtain decryption information.

[0114] Step 06: Compare the decrypted information with the pre-stored authentication information, and determine whether the host computer's authority authentication is passed based on the comparison result;

[0115] Step 07: If the comparison result indicates that the permission authentication of the host computer is passed, the access permission of the hidden storage area is modified to read and write permission.

[0116] Specifically, the controller compares the decrypted information with the pre-stored random number, wherein the pre-stored random number is the random number fed back by the controller to the host computer. If the decrypted information matches the pre-stored random number, the controller determines that the host computer's authority authentication has passed; if the decrypted information does not match the pre-stored random number, the controller determines that the host computer's authority authentication has failed.

[0117] Referring to Figure 9, after the permission authentication of the upper computer is passed, the controller modifies the access permission of the accessible hidden storage area to the pass permission. The accessible pass permission indicates that the files stored in the accessible hidden storage area are accessible, so that the upper computer can read, write, modify, delete and other processing operations on the files stored in the hidden storage area; and, while the storage device is powered on, the hidden storage area is modified to have read and write permissions that are continuously valid; when the storage device loses power, the read and write permissions of the hidden storage area become invalid, and the access permission of the hidden storage area is modified to the hidden permission again; that is, the read and write permissions of the hidden storage area are also valid once.

[0118] The controller reads the file item data from the file item storage location in the hidden storage area, and reads the corresponding file content data based on the storage address (first storage address) of the file content data in the file item data; the controller determines whether the reading of the file content data is successful. If the reading is successful, it indicates that there is still unread file content data, and then further parses the file item data, extracts the storage address (first storage address) and size of the corresponding file content in the file item data, reads the file content data in the hidden partition, and then writes it to the host computer. If the reading is unsuccessful, it indicates that there is no unread file data in the hidden storage area, and the reading is completed.

[0119] In the above process, when the user reads the file data in the hidden storage area through the host computer, it is necessary to go through the permission authentication process, and the user will have to wait for a long time. In one possible case, after the user stores the file in the hidden storage area of ​​the storage device, if a long time has passed, the user needs to find the data. At this time, the user may not be sure whether there is the required file in the hidden storage area. Therefore, it is possible that after the user performs permission authentication through the host computer, the user reads the data in the hidden storage area, but finds that there is no required file in the hidden storage area; this process will delay the user's time, thereby delaying the user's efficiency in finding files.

[0120] Therefore, in order to protect the file data in the hidden storage area and to facilitate prompting the user to improve the efficiency of the user in finding files, in one embodiment, the data processing method of the present application also includes a process of generating a prompt list for the user based on the data in the hidden storage area, which may specifically include the steps of:

[0121] Each time the storage device accesses the host computer, the controller receives the MAC address of the host computer sent by the host computer, records the access times of each MAC address, and marks the MAC addresses whose access times exceed the target threshold as common addresses.

[0122] When the controller writes each file item data into the corresponding second storage address, it records the last modification time of each file item data; and when the file data corresponding to the file item data is modified, the file item data is modified accordingly and the last modification time of the file item data is updated. When the controller of the storage device is powered on, the controller scans the last modification time of each file item data in the hidden storage area and obtains the current time through the host computer. The file item data whose writing time is longer than the target time is marked as forgotten data.

[0123] Specifically, the write duration is the time difference between the current time and the last modification time; the target duration and the target threshold can be set by the user, and the specific values ​​of the target duration and the target threshold are not specifically limited in the embodiments of the present application.

[0124] When the storage device is powered on, the controller obtains the MAC address of the currently connected host computer and determines whether the currently connected MAC address is a common address; if it is determined that the currently connected MAC address is a common address, the controller traverses each forgotten data in the hidden storage area, and generates a temporary file item data for each forgotten data, and summarizes each temporary file item data to generate a prompt list, and stores the prompt list in the visible storage area. Among them, the temporary file item data may include a file suffix and a file size. Specifically, the specific content of the temporary file item is not specifically limited in the embodiments of the present application, as long as the temporary file item content is less than all the content contained in the forgotten data.

[0125] Furthermore, the controller sets a validity period for the reminder list, which can be 5 minutes or 10 minutes, and the specific duration of the validity period can be set by the user. After the validity period is reached, the controller deletes the reminder list. Among them, the reminder list is set to read-only permission during the validity period, that is, only viewing is allowed, but modification and copying are not allowed.

[0126] Through the above technical solution, when the user connects the storage device to a commonly used host computer, the storage device can generate a prompt list of related information of the forgotten data and store it in the visible storage area, and the user can directly read the prompt list through the host computer. The user can use the prompt list to determine whether there are required files in the hidden storage area, and then determine whether to perform permission authentication through a dedicated software tool to read the file data in the hidden storage area. In addition, since the temporary file item data in the prompt list contains less content, only the file name and file size, and does not contain other key content, therefore, by displaying it to the user through the prompt list, it is convenient for the user to roughly understand what data is stored in the hidden storage area, but because the prompt list will be deleted after the validity period, it also reduces the risk of the user's data details in the hidden storage area being leaked.

[0127] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0128] Based on the same inventive concept, the embodiment of the present application also provides a data processing device for implementing the data processing method for secure mobile storage involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more data processing device embodiments provided below can refer to the limitations of the data processing method for secure mobile storage above, and will not be repeated here.

[0129] In an exemplary embodiment, as shown in FIG. 10 , a data processing device for secure mobile storage is provided, the data processing device comprising a root directory information acquisition module 1001, a directional storage function determination module 1002, and a transfer module 1003, wherein:

[0130] The root directory information acquisition module 1001 is used to acquire the root directory information of the visible storage partition when the power is on, and the root directory information includes the file item data of each stored file in the visible storage partition;

[0131] A directional storage function determination module 1002 is used to determine to enable the directional storage function when the target file item data exists in the root directory information, and the target file corresponding to the target file item data is created by the user and written by the host computer;

[0132] The transfer module 1003 is used to transfer the file to be stored to the hidden storage area when receiving the file to be stored, if it is determined that the directional storage function has been turned on, wherein the storage file in the hidden storage area can be accessed after the authority authentication is passed.

[0133] When the user needs to create and write a target file, the target file item data of the target file will be added to the root directory information; when the storage device is powered on, the storage device will obtain the root directory information and search whether the target file item data exists. If it is determined that the target file item data exists, the directional transfer function is enabled, so that the storage device can transfer the received file to a hidden storage area that cannot be directly read by the host computer; the user does not need to use other software programs in the host computer to directly write the data to be protected to the hidden storage area, and the storage device itself transfers the data to be protected to the hidden storage area, which reduces data leakage caused by external devices and improves data security; at the same time, when the user loses or lends the storage device, it is difficult for the user to know that the directional transfer is enabled by creating a target file that meets the preset rules. Therefore, other users cannot enable the directional transfer function, that is, other users cannot write data to the hidden storage area, thereby improving the privacy of user data in the hidden storage area.

[0134] In one embodiment, each file to be stored corresponds to an initial data address, and the initial data address is a storage address in the visible storage area; the transfer module 1003 is specifically used to:

[0135] Screening the files to be stored based on the initial data address, and determining that the user files in the files to be stored are redirected files;

[0136] The redirected files are transferred to the hidden storage area. The access permission of the hidden storage area is the protection permission. The protection permission restricts the access to the files stored in the hidden storage area.

[0137] In one embodiment, the transfer module 1003 is specifically used for:

[0138] Based on the screening condition and the initial data address, the files to be stored are screened, and the files to be stored that meet the screening condition are determined to be user files, and the screening condition is that the initial data address is greater than the file allocation table address and greater than the root directory address;

[0139] Make sure the user file is a redirected file.

[0140] In one embodiment, the transfer module 1003 is specifically used for:

[0141] Allocating a first storage address for the file content data to be stored in the hidden storage area, and storing the file content data to be stored in the first storage address;

[0142] A second storage address is allocated in the hidden storage area for the file item data to be stored, and the file item data to be stored is stored in the second storage address.

[0143] In one embodiment, after storing the accessible file content data to be stored in the accessible first storage address, the transfer module 1003 is specifically used to:

[0144] Acquire a mapping relationship table, where the accessible mapping relationship table includes a correspondence between an initial data address of each stored file content data and a first storage address in the accessible hidden storage area;

[0145] Based on the initial data address corresponding to the accessible file to be stored, determining the first storage address of the stored file content data corresponding to the accessible file item data to be stored from the accessible mapping relationship table;

[0146] Based on the first storage address of the stored file content data corresponding to the accessible file item data to be stored, updating the storage address of the stored file content data in the accessible file item data to be stored;

[0147] The updated accessible file item data to be stored is transferred to the accessible second storage address.

[0148] In one embodiment, the data processing device further includes a deletion module, and the deletion module is specifically used to:

[0149] After confirming to enable the directed storage function, delete the target file.

[0150] In one embodiment, the data processing device further includes an authentication module, wherein the authentication module is specifically configured to:

[0151] In response to a trigger instruction sent by the host computer, the authentication information is sent to the host computer, so that the host computer encrypts the received authentication information to obtain a ciphertext to be authenticated;

[0152] Receive the ciphertext to be authenticated, and decrypt the ciphertext to be authenticated to obtain decrypted information;

[0153] Compare the decrypted information with the pre-stored authentication information, and determine whether the host computer's permission authentication is passed based on the comparison result;

[0154] If the comparison result indicates that the authority authentication of the upper computer is passed, the access permission of the hidden storage area is modified to the pass permission, and the pass permission indicates that the files stored in the hidden storage area can be accessed.

[0155] Each module in the above data processing device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of the controller in the storage device in the form of hardware, or can be stored in the controller in the storage device in the form of software, so that the controller can call and execute the operations corresponding to each module.

[0156] In an exemplary embodiment, referring to FIG11 , a storage device for secure mobile storage is provided, including a storage unit and a controller. The storage unit includes a visible storage area and a hidden storage area; the controller is in communication connection with the storage unit, a computer program is stored on the controller, and when the controller executes the computer program, the method steps in the above data processing method embodiment are implemented.

[0157] Those skilled in the art will understand that the structure shown in FIG. 11 is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the storage device to which the scheme of the present application is applied. The specific storage device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0158] In one embodiment, a computer program product for secure mobile storage is provided, including a computer program. When the computer program is executed by a processor, the method steps in the above-mentioned data processing method embodiment for secure mobile storage are implemented.

[0159] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0160] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0161] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0162] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data processing method for secure mobile storage, characterized in that: The method is performed by a storage device, wherein the storage device includes a visible storage area and a hidden storage area, and the method includes: In a power-on state, obtaining root directory information of a visible storage partition, the root directory information including file item data of each stored file in the visible storage partition; When it is found that the target file item data exists in the root directory information, it is determined to enable the directional storage function, and the target file corresponding to the target file item data is created by the user and written by the host computer; When receiving the file to be stored, if it is determined that the directional storage function has been turned on, the file to be stored is transferred to the hidden storage area, wherein the storage file in the hidden storage area can be accessed after the authority authentication is passed.

2. The method according to claim 1, characterized in that: Each of the files to be stored corresponds to an initial data address, and the initial data address is a storage address in the visible storage area; The transferring the to-be-stored file to the hidden storage area comprises: Screening the files to be stored based on the initial data address, and determining that the user files in the files to be stored are redirection files; The redirected file is transferred to the hidden storage area, the access permission of the hidden storage area is a protection permission, and the protection permission restricts the access to the files stored in the hidden storage area.

3. The method according to claim 2, characterized in that The screening of the files to be stored based on the initial data address and determining that the user files in the files to be stored are redirection files includes: The to-be-stored files are screened based on a screening condition and the initial data address, and the to-be-stored files that meet the screening condition are determined to be user files, wherein the screening condition is that the initial data address is greater than the file allocation table address and greater than the root directory address; It is determined that the user file is a redirection file.

4. The method according to claim 2 or 3, characterized in that: The redirection file includes one-to-one corresponding file content data to be stored and file item data to be stored, and transferring the redirection file to the hidden storage area includes: Allocating a first storage address for the file content data to be stored in the hidden storage area, and storing the file content data to be stored in the first storage address; A second storage address is allocated in the hidden storage area for the file item data to be stored, and the file item data to be stored is stored in the second storage address.

5. The method according to claim 4, characterized in that The file item data to be stored includes a storage address of the corresponding file content data to be stored. After storing the file content data to be stored in the first storage address, transferring the file item data to be stored to the second storage address includes: Acquire a mapping relationship table, wherein the mapping relationship table includes a correspondence between an initial data address of each stored file content data and a first storage address in the hidden storage area; Based on the initial data address corresponding to the file to be stored, determining from the mapping relationship table a first storage address of the stored file content data corresponding to the file item data to be stored; Based on the first storage address of the stored file content data corresponding to the file item data to be stored, updating the storage address of the stored file content data in the file item data to be stored; The updated file item data to be stored is transferred to the second storage address.

6. The method according to claim 1, characterized in that After enabling the directional storage function, the following is also included: Delete the target file.

7. The method according to claim 1, characterized in that The method further comprises: In response to a trigger instruction sent by the host computer, the authentication information is sent to the host computer, so that the host computer encrypts the received authentication information to obtain a ciphertext to be authenticated; Receiving the ciphertext to be authenticated, and decrypting the ciphertext to be authenticated to obtain decrypted information; Compare the decrypted information with the pre-stored authentication information, and determine whether the authority authentication of the host computer is passed according to the comparison result; If the comparison result indicates that the authority authentication of the host computer is passed, the access authority of the hidden storage area is modified to a pass authority, and the pass authority indicates that the files stored in the hidden storage area can be accessed.

8. A data processing device for secure mobile storage, characterized in that: The device comprises a root directory information acquisition module, a directional storage function determination module and a transfer module, wherein: A root directory information acquisition module, used to acquire the root directory information of the visible storage partition when powered on, wherein the root directory information includes file item data of each stored file in the visible storage partition; A directional storage function determination module, used to determine to enable the directional storage function when the target file item data is found in the root directory information, wherein the target file corresponding to the target file item data is created by the user and written by the host computer; The transfer module is used to transfer the file to be stored to the hidden storage area when receiving the file to be stored, if it is determined that the directional storage function has been turned on, wherein the storage file in the hidden storage area can be accessed after the authority authentication is passed.

9. A storage device for secure mobile storage, comprising a storage unit and a controller, characterized in that: The storage unit includes a visible storage area and a hidden storage area; The controller is in communication with the storage unit, a computer program is stored on the controller, and the controller implements the steps of the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer program product for secure mobile storage, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images