Linux-based data security protection method and device, medium and product

Abstract

The invention provides a Linux-based data security protection method and device, a medium and a product. The Linux-based data security protection method comprises the following steps: creating a first partition and a second partition in a Linux system data disk; formatting, mounting and unloading of the first partition are executed through the Linux system; deploying a security program in the first partition, and simultaneously deploying an independent running environment as a security program running environment; mounting the first partition and operating the second partition through the security program, wherein the operation comprises formatting, mounting and unloading of the second partition, encryption and decryption of the second partition and data operation of the second partition in the security program; and unloading the first partition after the operation. According to the method, the security protection of the data is realized without an upper-layer application, specific software for encryption and decryption is not used, an intermediate decryption file is not generated, and the protection scheme is safer and more flexible.

Description

Technical Field

[0001] The present invention belongs to the field of information technology, and in particular relates to a data security protection method, device, medium and product based on Linux. Background Art

[0002] With the advent of the information age, data security has become more and more concerned by everyone, and everyone is paying more and more attention to the protection of personal privacy data. Many software also support data security encryption functions, such as WPS, office, etc., but these encryptions can only encrypt this type of files and cannot encrypt data in other formats. Another common method is to use specific encryption and decryption software for encryption and decryption. Decryption operations are required before data processing, and encryption is required after data processing. Due to the existence of decrypted files, it is easy to leak information.

[0003] The shortcomings of the technical solutions in the prior art are summarized as follows: 1) Use software-specific encryption and decryption functions, such as wps, office, etc. The encryption and decryption functions implemented by these software cannot encrypt and decrypt data in different formats, so this method is not universal.

[0004] 2) Use a dedicated encryption and decryption tool. The problem with this solution is that it needs to be decrypted each time it is used, and encryption needs to be performed each time it is used, and it is impossible to directly operate the encrypted file. Since there must be decrypted files during the operation, once the decrypted files are leaked, it will inevitably lead to leakage. Summary of the invention

[0005] The purpose of the present invention is to provide a data security protection method, device, medium and product based on Linux, which does not require the use of upper-level applications to implement data security protection, does not use specific encryption and decryption software, does not generate intermediate decryption files, and the protection scheme is more secure and flexible.

[0006] In order to achieve the above object, the technical solution of the present invention is as follows: A data security protection method based on Linux, comprising: S1. Create a first partition and a second partition on the Linux system data disk; format, mount, and unmount the first partition through the Linux system; S2. Deploy the security program in the first partition and deploy an independent operating environment as the security program operating environment; S3, mounting the first partition and operating the second partition through the security program, wherein the operation includes formatting and mounting and unmounting the second partition, encrypting and decrypting the second partition, and operating data of the second partition in the security program; after the operation, the first partition is unmounted.

[0007] Furthermore, the Linux system data disk in step S1 is a physical disk or a virtual data disk.

[0008] Furthermore, the independent operating environment in step S2 is a virtual machine.

[0009] Furthermore, the deployment of the security program in step S2 includes: S201, deploy the startup password of the security program; S202, deploying the second partition encryption and decryption function and the second partition encryption and decryption key; S203, deploying the second partition formatting, mounting, and unmounting functions; S204: Deploy data operation functions of the second partition, including creating, deleting, reading, and writing data.

[0010] On the other hand, the present invention also proposes a data security protection device based on Linux, comprising: Partition creation module: creates the first partition and the second partition on the Linux system data disk; formats, mounts and unmounts the first partition through the Linux system; Deployment module: deploy the security program in the first partition and deploy an independent operating environment as the security program operating environment; Operation module: mount the first partition and operate the second partition through the security program, the operation includes formatting and mounting and unmounting the second partition, encrypting and decrypting the second partition, and data operation of the second partition in the security program; uninstall the first partition after the operation.

[0011] Furthermore, the Linux system data disk in the partition creation module is a physical disk or a virtual data disk.

[0012] Furthermore, the independent operating environment in the first partition deployment module is a virtual machine or a container.

[0013] Furthermore, the security program of the first partition deployment module includes: Startup password unit: deploy the startup password of the security program; Encryption and decryption unit: deploys the second partition encryption and decryption functions and the encryption and decryption keys of the second partition; Partition operation unit: deploy the second partition formatting, mounting, and unmounting functions; Data operation unit: deploys the data operation functions of the second partition, including data creation, deletion, reading, and writing.

[0014] The present invention also provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is used to execute the above-mentioned Linux-based data security protection method.

[0015] The present invention also provides a computer program product, including a computer program, wherein when the computer program is executed by a processor, the above-mentioned Linux-based data security protection method is implemented.

[0016] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention creates a first partition for storing the security program running environment and security program of the second partition (security partition), creates the second partition as a security partition for data operations, and provides an independent and secure area for data security protection.

[0017] 2. The present invention creates an independent security program running environment to provide a necessary security environment for the running of the security program.

[0018] 3. The present invention encrypts the second partition (security partition) by running a security program. No matter what format or type of data is, as long as it is placed in the second partition, it can be encrypted and protected. At the same time, it can prevent other people from bypassing the security program and directly operating the second partition.

[0019] 4. The present invention allows the data in the second partition (security partition) to be operated only in the security program, and does not directly generate decrypted intermediate data, thus avoiding leakage of decrypted data files during the operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 is a schematic diagram of a process of initializing a data disk according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the process of initializing a security protection partition according to an embodiment of the present invention; Figure 3 is a schematic diagram of a secure data operation flow in an embodiment of the present invention; Figure 4 is a schematic diagram of the initialization process of the security program of an embodiment of the present invention; Figure 5 It is a flowchart of performing data operations through a security program according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0022] The specific steps of this embodiment include three parts: initialization of the data disk; initialization of the security protection partition; and secure data operation.

[0023] 1. The initialization process of the data disk is as follows Figure 1 As shown, including: 1.1 Start the process.

[0024] 1.2 Determine whether to create a virtual disk. This solution supports both physical disk and virtual disk to achieve data security protection. If you use virtual disk to achieve data security protection, proceed to the next step. If you use real disk to achieve data security protection, jump to step 4.

[0025] 1.3 Create a virtual data disk.

[0026] 1.4 Create partition 1, which is used to store the security program running environment and security programs of the security protection partition (partition 2).

[0027] 1.5 Create partition 2. Partition 2 is a security protection partition. All data in it will be protected to ensure data security. The encryption and decryption process can only be performed by the security program, and the data including the secret key is also solidified into the security program.

[0028] 1.6 Format the partition 1. Format the partition as ext4 file system. Of course, you can also format it as other file systems.

[0029] 1.7 Mount partition one.

[0030] 1.8 Deploy the security program operating environment and security program. The security program operating environment is an independent operating environment, which is completely isolated from the system operating environment. This solution uses a virtual machine to implement this operating environment, that is, using a virtual machine to run software, such as tools similar to VirtualBox and VMware Workstation. Through these tools, a new virtual machine is created, and then the virtual machine system is installed. Of course, other solutions such as Docker containers can also be used. The security program is a special program used to operate the security partition. Other programs cannot operate the data in the security partition.

[0031] 1.9 Unmount partition one.

[0032] 1.10 End the process.

[0033] 2. Initialize the security protection partition process as follows Figure 2 As shown, including: 2.1 Start the process.

[0034] 2.2 Mount partition one.

[0035] 2.3 Start the security program operating environment.

[0036] 2.4 Start the safety program.

[0037] 2.5 Set the startup password.

[0038] 2.6 Initialize the encryption and decryption key of partition 2. The encryption and decryption key of partition 2 can be a fixed string of characters, and the key is fixed in the security program. The said fixing means that by defining the key in the code, the key is directly fixed into the code. The key is fixed and cannot be modified. Of course, since the key is fixed in the code, the user does not know the password. It can be understood that no one knows the key, only the program itself knows it.

[0039] The secret key can also be made to change dynamically, and can be sent to the user via text message in the form of a dynamic password. The user obtains the dynamic password through the system each time before entering it, and the system sends it via text message.

[0040] 2.7 Format partition 2.

[0041] 2.8 Turn off the security program.

[0042] 2.9 Close the operating environment of the security program.

[0043] 2.10 Unmount partition one.

[0044] 2.11 End the process.

[0045] 3. Security data operation process Figure 3 As shown, including: 3.1 Start the process.

[0046] 3.2 Mount partition one.

[0047] 3.3 Start the security program operating environment.

[0048] 3.4 Start the safety program.

[0049] 3.5 Enter the security password.

[0050] 3.6 Determine whether the password is correct. If it is correct, jump to the next step. If the password is incorrect, jump to step 10.

[0051] 3.7 Mount partition 2.

[0052] 3.8 Complete data protection operations, including data creation, data deletion, data reading, data writing, etc.

[0053] 3.9 Uninstall Security Partition 2.

[0054] 3.10 Turn off the security program.

[0055] 3.11 Close the security program running environment.

[0056] 3.12 Unmount partition one.

[0057] 3.13 End the process.

[0058] 4. Regarding the safety program described in this embodiment, the structure and functions include the following: Startup password unit: used to set the startup password of the safety program. The startup password needs to be entered and verified each time the safety program is started.

[0059] Encryption and decryption unit: This unit solidifies the secret key for encrypting and decrypting partition two in the code of the security program. The security program uses the secret key to encrypt partition two. Each time the security program is used to perform data operations, the key needs to be initialized. When partition two is mounted in the security program, it is decrypted and then data operations are performed. After the operation, partition two is encrypted when it is unmounted, and then the security program is exited.

[0060] Partition operation unit: used for formatting, mounting, and unmounting of partition 2. Partition 2 formatting is required in the process of initializing the security protection partition, which is achieved by calling the mkfs.ext4 command. The security data operation process requires mounting and unmounting of partition 2, which is achieved by calling the mount command and umount command.

[0061] Data operation unit: deploys the data operation functions of partition 2, including data creation, deletion, reading, and writing.

[0062] The initialization process of the safety program is as follows Figure 4 As shown: 4.01 Start the security program interface; 4.02 Set the startup password; 4.03 Start password saving; 4.04 Initialize the encryption and decryption key of partition 2; the key is a fixed string of characters; 4.05 Format partition 2. The formatting is implemented by calling the mkfs.ext4 command in code. When formatting, you need to enter a key, which can be the key of the fixed characters mentioned above that is automatically entered through the code.

[0063] The data operation process of the security program is as follows Figure 5 As shown: 4.11 Start the security program interface; 4.12 Enter the startup password; 4.13 Verify password; 4.14 Initialize the encryption and decryption keys of partition 2; 4.15 Mount partition 2; use code to call the mount command to implement, when mounting, you need to enter the decryption key, you can use the code to automatically enter the key of the fixed characters; 4.16 After the mounting is completed, a new folder (i.e. the file data in Partition 2) will appear on the security program interface. The operations of all files in the folder are no different from the normal operations in the system. 4.17 Perform normal file operations, including reading, writing, deleting, creating, etc.; 4.18 The operation is completed to uninstall partition 2.

[0064] It can be seen from this embodiment that the key points of the present invention include: (1) initialization of the data disk, partitioning the data disk (which can be hardware or a virtual machine), creating two partitions, partition one is used to store the security program running environment and security program, and partition two is used to store security data; (2) initialization of the data protection zone partition, by mounting partition one, and starting the security program running environment and security program of partition one, initializing the partition of partition two, in order to ensure security, setting the startup password of the security program, all encryption and decryption related secret keys are solidified into the code to prevent the leakage of secret keys, thereby causing data security leakage, after completing the initialization, closing the security program and running environment, and uninstalling the environment; (3) security data operation, by mounting partition one, and starting the security program running environment and security program of partition one, after starting the security program, enter the security password, operate the data in the security partition through the security program, after completing all security data operations, close the security program and running environment, and uninstall the environment.

[0065] The above-mentioned embodiments are only preferred implementations of the present invention, and are only used to help understand the method and core ideas of the present application. The protection scope of the present invention is not limited to the above-mentioned embodiments. All technical solutions under the idea of ​​the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A data security protection method based on Linux, characterized in that: include: S1. Create the first partition and the second partition on the Linux system data disk; Format, mount and unmount the first partition through the Linux system; S2. Deploy the security program in the first partition and deploy an independent operating environment as the security program operating environment; S3, mounting the first partition and operating the second partition through the security program, wherein the operation includes formatting and mounting and unmounting the second partition, encrypting and decrypting the second partition, and operating data of the second partition in the security program; after the operation, the first partition is unmounted.

2. The Linux-based data security protection method according to claim 1, characterized in that: The Linux system data disk in step S1 is a physical disk or a virtual data disk.

3. The Linux-based data security protection method according to claim 1, characterized in that: The independent operating environment described in step S2 is a virtual machine.

4. The Linux-based data security protection method according to claim 1, characterized in that: The deployment of the safety program in step S2 includes: S201, deploy the startup password of the security program; S202, deploying the second partition encryption and decryption function and the second partition encryption and decryption key; S203, deploying the second partition formatting, mounting, and unmounting functions; S204: deploy data operation functions of the second partition, including creating, deleting, reading, and writing data.

5. A data security protection device based on Linux, characterized in that: include: Partition creation module: creates the first partition and the second partition on the Linux system data disk; Format, mount and unmount the first partition through the Linux system; Deployment module: deploy the security program in the first partition and deploy an independent operating environment as the security program operating environment; Operation module: mount the first partition and operate the second partition through the security program, the operation includes formatting and mounting and unmounting the second partition, encrypting and decrypting the second partition, and data operation of the second partition in the security program; uninstall the first partition after the operation.

6. The Linux-based data security protection device according to claim 5, characterized in that: The Linux system data disk in the partition creation module is a physical disk or a virtual data disk.

7. The Linux-based data security protection device according to claim 5, characterized in that: The independent operating environment in the first partition deployment module is a virtual machine or a container.

8. The Linux-based data security protection device according to claim 5, characterized in that: The safety program of the first partition deployment module includes: Startup password unit: deploy the startup password of the security program; Encryption and decryption unit: deploys the second partition encryption and decryption functions and the encryption and decryption keys of the second partition; Partition operation unit: deploy the second partition formatting, mounting, and unmounting functions; Data operation unit: deploys the data operation functions of the second partition, including data creation, deletion, reading, and writing.

9. A computer-readable storage medium storing a computer program, characterized in that: The computer program is used to execute the Linux-based data security protection method as described in any one of claims 1-4.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the Linux-based data security protection method as described in any one of claims 1 to 4 is implemented.

Images