Mobile storage device protection method and device for intranet, equipment and medium

Abstract

The invention provides a mobile storage device protection method for an intranet. The method can be applied to the technical field of big data and the technical field of privacy computing. The method comprises the following steps: in response to a mobile storage device insertion event, performing isolation processing on data in the mobile storage device; obtaining a directory file in the mobile storage device, and generating a first directory file; traversing the first directory file to generate a first directory file identifier; obtaining a plurality of historical directory file identifiers, and performing consistency comparison on the first directory file identifier and the plurality of historical directory file identifiers; and if the first directory file identifier is the same as at least one historical directory file identifier in the plurality of historical directory file identifiers, de-isolating data in the mobile storage device. The invention further provides a mobile storage device protection device for the intranet, equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of big data technology, specifically to the field of privacy computing technology, and in particular to a method, apparatus, equipment, medium and program product for protecting a mobile storage device for an intranet. Background Art

[0002] In enterprises including banks, with the development of computer network technology, the demand for mobile storage devices in intranets has gradually increased. However, the frequent use of mobile storage devices can easily lead to viruses and other attacks on the intranet through the mobile storage devices, causing losses.

[0003] At present, the common protection scheme for mobile storage devices in the intranet is to perform virus detection on mobile storage devices such as USB flash drives inserted into the intranet. However, this method requires virus detection every time a mobile storage device such as a USB flash drive is inserted, resulting in a waste of server CPU resources, memory resources, and disk IO resources. In addition, virus detection takes time, resulting in reduced work efficiency. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a method, apparatus, device, medium and program product for protecting a mobile storage device in an intranet.

[0005] According to a first aspect of the present disclosure, a mobile storage device protection method for an intranet is provided, the method comprising: in response to a mobile storage device insertion event, isolating data in the mobile storage device; obtaining a directory file in the mobile storage device to generate a first directory file; traversing the first directory file to generate a first directory file identifier; obtaining a plurality of historical directory file identifiers, comparing the first directory file identifier with the plurality of historical directory file identifiers for consistency; and if the first directory file identifier is the same as at least one of the plurality of historical directory file identifiers, releasing the isolation of the data in the mobile storage device.

[0006] According to an embodiment of the present disclosure, traversing the first directory file to generate a first directory file identifier includes: parsing the first directory file to generate a directory file list for the first directory file; calculating a hash value of the first directory file based on the directory file list of the first directory file; and generating a first directory file identifier based on the hash value of the directory file.

[0007] According to an embodiment of the present disclosure, a hash value of the first directory file is calculated based on the directory file list of the first directory file, including: obtaining data in the directory file list of the first directory file, preprocessing the data in the directory file list of the first directory file to generate preprocessed directory file list data; performing string combination on the preprocessed directory file list data to generate a preprocessed directory file list data string; and performing hash calculation on the preprocessed directory file list data string to generate a hash value of the first directory file.

[0008] According to an embodiment of the present disclosure, the data in the directory file list includes: directory name, file name, file modification time, and file size. The data in the directory file list of the first directory file is preprocessed to generate preprocessed directory file list data, including: performing data preprocessing on the directory name of the first directory file according to a preset unified directory hierarchy format to generate a directory name of the preprocessed first directory file; performing data preprocessing on the file name of the first directory file according to a preset unified suffix format to generate a file name of the preprocessed first directory file; performing data preprocessing on the file modification time of the first directory file according to a preset unified time format to generate a modification time of the preprocessed first directory file; and performing data preprocessing on the file size of the first directory file according to a preset unified unit format to generate a file size of the preprocessed first directory file.

[0009] According to an embodiment of the present disclosure, a hash calculation is performed on the preprocessed directory file list data string to generate a hash value for the first directory file, including: inputting an encrypted hash function into the preprocessed directory file list data string to generate a 256-bit hash value; performing hexadecimal conversion on the 256-bit hash value to generate a hexadecimal hash value; and obtaining the first 32 characters from the hexadecimal hash value to generate a hash value for the first directory file.

[0010] According to an embodiment of the present disclosure, the method also includes: if the first directory file identifier is different from any of the multiple historical directory file identifiers, performing antivirus processing on the data in the mobile storage device; and performing antivirus processing on the data in the mobile storage device to release isolation.

[0011] According to an embodiment of the present disclosure, the method also includes: after performing antivirus processing on the mobile storage device, obtaining the directory file in the antivirus-processed mobile storage device to generate a second directory file; traversing the second directory file to generate a second directory file identifier; and obtaining the second directory file identifier and updating the second directory file identifier to the multiple historical directory file identifiers.

[0012] According to a second aspect of the present disclosure, a mobile storage device protection device for an intranet is provided, and the device includes: an isolation module, which is used to isolate the data in the mobile storage device in response to the mobile storage device insertion event; a first generation module, which is used to obtain the directory file in the mobile storage device and generate a first directory file; a second generation module, which is used to traverse the first directory file and generate a first directory file identifier; a comparison module, which is used to obtain multiple historical directory file identifiers and compare the first directory file identifier with the multiple historical directory file identifiers for consistency; and a first de-isolation module, which is used to de-isolate the data in the mobile storage device if the first directory file identifier is the same as at least one historical directory file identifier among the multiple historical directory file identifiers.

[0013] According to an embodiment of the present disclosure, the second generation module includes: a fifth generation module, used to parse the first directory file and generate a directory file list of the first directory file; a calculation module, used to calculate the hash value of the first directory file based on the directory file list of the first directory file; and a sixth generation module, used to generate a first directory file identifier based on the hash value of the directory file.

[0014] According to an embodiment of the present disclosure, the calculation module includes: a seventh generation module, used to obtain data in the directory file list of the first directory file, preprocess the data in the directory file list of the first directory file, and generate preprocessed directory file list data; an eighth generation module, used to perform string combination on the preprocessed directory file list data to generate a preprocessed directory file list data string; and a ninth generation module, used to perform hash calculation on the preprocessed directory file list data string to generate a hash value of the first directory file.

[0015] According to an embodiment of the present disclosure, the data in the directory file list includes: directory name, file name, file modification time, and file size. The seventh generation module includes: a tenth generation module, which is used to perform data preprocessing on the directory name of the first directory file according to a preset unified directory hierarchy format to generate a directory name of the preprocessed first directory file; an eleventh generation module, which is used to perform data preprocessing on the file name of the first directory file according to a preset unified suffix format to generate a file name of the preprocessed first directory file; a twelfth generation module, which is used to perform data preprocessing on the file modification time of the first directory file according to a preset unified time format to generate the modification time of the preprocessed first directory file; and a thirteenth generation module, which is used to perform data preprocessing on the file size of the first directory file according to a preset unified unit format to generate the file size of the preprocessed first directory file.

[0016] According to an embodiment of the present disclosure, the seventh generation module includes: a fourteenth generation module, which is used to input the encrypted hash function of the preprocessed directory file list data string to generate a 256-bit hash value; a fifteenth generation module, which is used to convert the 256-bit hash value into hexadecimal to generate a hexadecimal hash value; and a sixteenth generation module, which is used to obtain the first 32 characters from the hexadecimal hash value to generate a hash value for the first directory file.

[0017] According to an embodiment of the present disclosure, the device also includes: an antivirus module, which is used to perform antivirus processing on the data in the mobile storage device if the first directory file identifier is different from any of the multiple historical directory file identifiers; and a second de-isolation module, which is used to perform de-isolation processing on the data in the mobile storage device after the antivirus processing.

[0018] According to an embodiment of the present disclosure, the device also includes: a third generation module, which is used to obtain the directory file in the mobile storage device after the antivirus processing, and generate a second directory file; a fourth generation module, which is used to traverse the second directory file and generate a second directory file identifier; and an update module, which is used to obtain the second directory file identifier and update the second directory file identifier to the multiple historical directory file identifiers.

[0019] According to the third aspect of the present disclosure, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned mobile storage device protection method for an intranet.

[0020] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which executable instructions or computer programs are stored. When the instructions or computer programs are executed by a processor, the processor executes the above-mentioned mobile storage device protection method for an intranet.

[0021] According to a fifth aspect of the present disclosure, a computer program product is also provided, including a computer program, which implements the above-mentioned mobile storage device protection method for an intranet when executed by a processor.

[0022] This solution obtains the directory file of the mobile storage device, generates the directory file identifier of the mobile storage device and compares the consistency with the historical directory file identifier in the server, and determines in advance whether the target mobile device needs virus detection. It can identify that when there is no data change in the mobile storage device, there is no need to perform data detection. This solves the problem that when mobile storage devices such as USB flash drives are transmitting data in the enterprise intranet, virus detection needs to be performed every time the mobile storage device is inserted, resulting in a waste of computer resources and low work efficiency. If virus detection is not performed, it is easy for viruses to invade the intranet and cause losses. It achieves the technical effect of saving CPU resources, memory resources, disk IO resources and network resources, and improving work efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0024] Figure 1 A diagram schematically illustrates an application scenario of a mobile storage device protection method and apparatus for an intranet according to an embodiment of the present disclosure;

[0025] Figure 2 A flowchart of a mobile storage device protection method for an intranet according to an embodiment of the present disclosure is schematically shown;

[0026] Figure 3 A flowchart for generating a first directory file identifier in a mobile storage device protection method for an intranet according to an embodiment of the present disclosure is schematically shown;

[0027] Figure 4 A flowchart schematically shows a method for protecting a mobile storage device in an intranet according to an embodiment of the present disclosure for generating a hash value of a first directory file;

[0028] Figure 5 A flowchart of generating pre-processed directory file list data in a mobile storage device protection method for an intranet according to an embodiment of the present disclosure is schematically shown;

[0029] Figure 6A flowchart for calculating a hash value of a first directory file in a mobile storage device protection method for an intranet according to an embodiment of the present disclosure is schematically shown;

[0030] Figure 7 A flowchart of an embodiment of a mobile storage device protection method for an intranet according to an embodiment of the present disclosure is schematically shown;

[0031] Figure 8 A structural block diagram schematically shows a mobile storage device protection device for an intranet according to an embodiment of the present disclosure; and

[0032] Fig. 9 A block diagram of an electronic device suitable for implementing a mobile storage device protection method for an intranet according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0033] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0034] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0035] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0036] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0037] Some block diagrams and / or flow charts are shown in the accompanying drawings. It should be understood that some blocks or combinations thereof in the block diagrams and / or flow charts may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable control device, so that these instructions, when executed by the processor, may create a device for implementing the functions / operations described in these block diagrams and / or flow charts.

[0038] First, the technical terms that appear in this article are explained as follows:

[0039] SHA-512 (Secure Hash Algorithm 512-bit) algorithm: A cryptographic hash function that accepts a maximum input of 2 to the power of 128 bits and processes it into a fixed-size 512-bit output.

[0040] An embodiment of the present disclosure provides a method for protecting a mobile storage device for an intranet, the method comprising: in response to a mobile storage device insertion event, isolating data in the mobile storage device; obtaining a directory file in the mobile storage device to generate a first directory file; traversing the first directory file to generate a first directory file identifier; obtaining a plurality of historical directory file identifiers, comparing the first directory file identifier with the plurality of historical directory file identifiers for consistency; and if the first directory file identifier is the same as at least one of the plurality of historical directory file identifiers, releasing the isolation of the data in the mobile storage device.

[0041] According to the embodiments of the present disclosure, a technical means is used to obtain a directory file of a mobile storage device, generate a directory file identifier of the mobile storage device, and compare the identifier of the directory file of the mobile storage device with the historical directory file identifier in the server for consistency, so as to determine in advance whether the target mobile device needs virus detection and killing. It can be identified that when no data change occurs in the mobile storage device, there is no need to perform data detection and killing. This solves the problem that when a mobile storage device such as a USB flash drive is used for data transmission in an enterprise intranet, a virus detection and killing needs to be performed each time the mobile storage device is inserted, resulting in a waste of computer resources and low work efficiency. If a virus detection and killing is not performed, it is easy for viruses to invade the intranet and cause losses. This achieves the technical effect of saving CPU resources, memory resources, disk IO resources and network resources and improving work efficiency.

[0042] Figure 1 The following schematically shows an application scenario diagram of the mobile storage device protection method and apparatus for an intranet according to an embodiment of the present disclosure. It should be noted that: Figure 1The examples shown are merely scenarios in which the embodiments of the present disclosure can be applied, to help those skilled in the art understand the technical content of the present disclosure, but do not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0043] like Figure 1 As shown, the application scenario 100 according to this embodiment may include an application scenario for mobile storage device protection in an intranet. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0044] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0045] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0046] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0047] It should be noted that the mobile storage device protection method for the intranet provided by the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the mobile storage device protection device for the intranet provided by the embodiment of the present disclosure can generally be set in the server 105. The mobile storage device protection method for the intranet provided by the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Correspondingly, the mobile storage device protection device for the intranet provided by the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0048] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0049] The following will be based on Figure 1 The scene described by Figure 2~Figure 7 The mobile storage device protection method for the intranet of the disclosed embodiment is described in detail. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principle of the present disclosure, and the implementation of the present disclosure is not limited in this respect. On the contrary, the implementation of the present disclosure can be applied to any applicable scenario.

[0050] Figure 2 The flowchart of the mobile storage device protection method for an intranet according to an embodiment of the present disclosure is schematically shown.

[0051] like Figure 2 As shown, the method 200 includes steps S201-S210.

[0052] Step S201, in response to a mobile storage device insertion event, isolating data in the mobile storage device.

[0053] Step S202, obtaining a directory file in the mobile storage device, and generating a first directory file.

[0054] Step S203, traverse the first directory file to generate a first directory file identifier.

[0055] Figure 3 The flowchart of generating the first directory file identifier in the mobile storage device protection method for the intranet according to the embodiment of the present disclosure is schematically shown.

[0056] like Figure 3As shown, the method 300 includes steps S301 to S303.

[0057] Step S301: parse the first directory file to generate a directory file list of the first directory file.

[0058] For example, all directory files in the mobile storage device are traversed to generate a directory file list, including the directory name, file name, file modification time, and file size.

[0059] Step S302: Calculate a hash value of the first directory file based on the directory file list of the first directory file.

[0060] Figure 4 The flowchart of generating a hash value of a first directory file in a mobile storage device protection method for an intranet according to an embodiment of the present disclosure is schematically shown.

[0061] like Figure 4 As shown, the method 400 includes steps S401 to S403.

[0062] Step S401, obtaining data in the directory file list of the first directory file, preprocessing the data in the directory file list of the first directory file, and generating preprocessed directory file list data, wherein the data in the directory file list includes: directory name, file name, file modification time, and file size.

[0063] Figure 5 The flowchart of generating pre-processed directory file list data in the mobile storage device protection method for an intranet according to an embodiment of the present disclosure is schematically shown.

[0064] like Figure 5 As shown, the method 500 includes steps S501 to S504.

[0065] Step S501 , performing data preprocessing on the directory name of the first directory file according to a preset unified directory hierarchy format to generate a preprocessed directory name of the first directory file.

[0066] For example, directory names are uniformly preprocessed in the format of "first-level directory / second-level directory / ...".

[0067] Step S502, performing data preprocessing on the file name of the first directory file according to a preset unified suffix format to generate a preprocessed file name of the first directory file.

[0068] For example, the file name is uniformly preprocessed by adding the file format as a suffix, such as file name 1.xxx.

[0069] Step S503: preprocess the file modification time of the first directory file according to a preset unified time format to generate a preprocessed modification time of the first directory file.

[0070] For example, the file modification time is uniformly preprocessed in the 15-digit format of YYYYMMDD:HHMMSS.

[0071] Step S504: performing data preprocessing on the file size of the first directory file according to a preset unified unit format to generate the preprocessed file size of the first directory file.

[0072] For example, the file size is uniformly converted into KB for preprocessing, with two decimal places retained.

[0073] By preprocessing the directory name, file name, file modification time, and file size in the data in the directory file list in a unified format, the accuracy of the generated hash value can be further improved.

[0074] Return to reference Figure 4 In step S402, the preprocessed directory file list data is subjected to character string combination to generate a preprocessed directory file list data character string.

[0075] For example, for each file in a directory file, the directory name, file name, modification time, and file size information are combined as a string to generate a preprocessed directory file list data string. The string combination rule is as follows: directory name / file name.file suffix / modification time / file size, such as first-level directory / second-level directory / ... / file name 1.xxx / YYYYMMDD:HHMMSS / file size.

[0076] Step S403, performing hash calculation on the preprocessed directory file list data string to generate a hash value of the first directory file.

[0077] Figure 6 The flowchart of calculating the hash value of the first directory file in the mobile storage device protection method for the intranet according to the embodiment of the present disclosure is schematically shown.

[0078] Step S601: input the preprocessed directory file list data string into an encrypted hash function to generate a 256-bit hash value.

[0079] For example, the preprocessed directory file list data string uses the SHA-512 algorithm to generate a 256-bit hash value.

[0080] Step S602: convert the 256-bit hash value into hexadecimal to generate a hexadecimal hash value.

[0081] For example, a hexadecimal hash value is generated by obtaining a hexadecimal representation of the hash value.

[0082] Step S603, obtaining the first 32 characters from the hexadecimal hash value to generate a hash value for the first directory file.

[0083] For example, the first 32 characters of the hexadecimal hash value are taken as the final hash value of the first directory file.

[0084] By inputting the encrypted hash function to generate the hash value, the reliability of the generated hash value can be further improved. By processing the data model data in the directory file list of the first directory file into a string format and performing the hash calculation, the accuracy of the generated hash value can be improved.

[0085] Return to reference Figure 3 In step S303, a first directory file identifier is generated based on the hash value of the directory file.

[0086] For example, the file name and the corresponding 128-bit Hash value are saved in the scan file to generate a first directory file identifier.

[0087] By calculating the hash value of the first directory file and generating the first directory file identifier, the accuracy and reliability of the first directory file identifier can be improved.

[0088] Return to reference Figure 2 In step S204, multiple historical directory file identifiers are obtained, and the first directory file identifier is compared with the multiple historical directory file identifiers for consistency.

[0089] For example, when any of the information such as the file name, file modification time, and file size changes, the generated 128-bit hash value will be different. Generate a first directory file identifier by calculating the hash value of the current file information. Compare the first directory file identifier with multiple historical directory file identifiers in the server for consistency. This is used to determine whether the files in the mobile storage used for the intranet have been updated, and then determine whether a check and kill process is required. Among them, the multiple historical directory file identifiers are all directory file identifiers generated in response to the mobile storage device insertion event and saved to the server before the first directory file identifier is generated.

[0090] Step S205: If the first directory file identifier is the same as at least one of the multiple historical directory file identifiers, the data in the mobile storage device is de-isolated.

[0091] For example, if the first directory file identifier is the same as at least one of the multiple historical directory file identifiers, it means that the mobile storage device has been checked and killed before, and there is no data change in the mobile storage device. There is no need to perform a full disk virus check and remove the isolation of the data in the mobile storage device.

[0092] Step S206: If the first directory file identifier is different from any of the multiple historical directory file identifiers, antivirus processing is performed on the data in the mobile storage device.

[0093] For example, if the first directory file identifier is different from any of the multiple historical directory file identifiers, it means that the mobile storage device has not been checked and killed before, or the mobile storage device has been checked and killed before but there are data changes in the mobile storage device.

[0094] Step S207, performing a quarantine removal process on the antivirus data in the mobile storage device.

[0095] By performing antivirus processing on data in mobile storage devices with different identifiers, the technical effect of preventing viruses from invading the intranet and causing losses can be achieved.

[0096] Step S208, after performing antivirus processing on the mobile storage device, obtaining the directory file in the mobile storage device after the antivirus processing, and generating a second directory file.

[0097] Step S209, traverse the second directory file and generate a second directory file identifier.

[0098] Step S210: Obtain the second directory file identifier, and update the second directory file identifier into the multiple historical directory file identifiers.

[0099] By checking and killing the directory files in the mobile storage device, generating a second directory file identifier and iteratively updating it to multiple historical directory file identifiers, the invalidity of multiple historical directory file identifiers can be improved, making the consistency comparison result more accurate.

[0100] Figure 7 The flowchart of an embodiment of the mobile storage device protection method for an intranet according to the embodiment of the present disclosure is schematically shown.

[0101] like Figure 7As shown, this embodiment takes a USB flash drive as an example to demonstrate the process. For an external USB flash drive, after the intranet virus is checked and killed, a special scan file is generated in the USB flash drive, tentatively named scan_file. If the system detects that there is no scan_file file in the USB flash drive or the content of the file is incorrect, normal use is not allowed before the USB flash drive completes the virus check and killing.

[0102] The steps for generating the scan file scan_file specifically include: traversing all directory files in the USB flash drive, generating a directory file list, including directory name, file name, file modification time, and file size. In the process of traversing the file, the data needs to be preprocessed, and the specific operations are as follows: the directory name is uniformly processed in the format of "first-level directory / second-level directory / ..."; the file name is uniformly added with the file format as a suffix, such as the file name 1.xxx; the file modification time is uniformly processed in the 15-digit format of YYYYMMDD:HHMMSS; the file size is uniformly converted to KB as a unit, retaining two decimal places. For each file in the list, the directory name, file name, modification time, and file size information are combined according to the string, and a 128-bit hash value is generated using the Hash algorithm. The specific method is as follows: the combined string is used as input, and the SHA-512 algorithm is used to generate a 256-bit hash value, and the hexadecimal representation of the hash value is obtained, and the first 32 characters are intercepted as the final hash value. The string combination rule is as follows: directory name / file name.file suffix / modification time / file size, such as first-level directory / second-level directory / ... / file name 1.xxx / YYYYMMDD:HHMMSS / file size. Finally, the file name and the corresponding 128-bit hash value are saved in the scan file scan_file. For example:

[0103] aaa.xxx777c1e04d0318a3b80c2da7cfca477babfd295b9

[0104] bbb.xxxa5699fb8f52f873eb2a52b231fece138aa622523

[0105] When any of the information such as the file name, file modification time, and file size changes, the generated 128-bit hash value will be different. By calculating the hash value of the current file information and comparing the corresponding hash value in scan_file, we can determine whether the file has been updated. The generated scan_file will generate a unique ID information corresponding to the corresponding USB flash drive. After saving a copy in the current computer, it will be uploaded to the cloud server. The server will use the unique ID as the folder name, and the folder will contain the corresponding scan_file file. Subsequent additions and modifications will be synchronized with the corresponding files on the server to prevent the scan_file file in the USB flash drive from being maliciously tampered with.

[0106] When performing a quick virus scan on a USB flash drive, for a USB flash drive that has been scanned and has generated a scan_file, if there is no change after comparing the corresponding files maintained on the server, there is no need to perform a full virus scan.

[0107] If the file in the USB flash drive has been updated, the file size and modification time have changed, and the file hash value calculated by the system is different from the hash value recorded in scan_file, the in-line antivirus system will perform a virus scan on the file. If no virus is found after the scan, the hash value in scan_file will be updated, and the scan_file saved on the server will be updated synchronously.

[0108] If a new file is added to the USB flash drive and cannot be found in the scan file scan_file, the in-line antivirus system will check and kill this file. If no virus is found after the check, the hash value in scan_file is updated, and the scan_file file saved on the server is updated synchronously.

[0109] If the file is deleted in the USB flash drive, the system will update the scan_file file accordingly. The specific method of updating is as follows: delete the corresponding data items in the original scan_file and synchronously update the corresponding scan_file file on the server.

[0110] If a virus is found during the anti-virus scanning process, the file will be isolated and the network will be disabled. The network will be enabled after the maintenance personnel confirm that there is no risk.

[0111] The disclosed embodiments can ensure that an external USB flash drive must be checked and killed by an antivirus system before being used in an intranet, thereby preventing the risk of foreign virus invasion; saving virus checking and killing time, and more accurately locating and killing files; and having a fast detection speed, which only requires traversing the USB flash drive file system, and performing quick Hash calculations and comparing scanned files to quickly complete USB flash drive detection, thereby facilitating safe use of USB flash drives.

[0112] Figure 8The structural block diagram of the mobile storage device protection device for intranet according to the embodiment of the present disclosure is schematically shown.

[0113] like Figure 8 As shown, the device 800 includes: an isolation module 801, a first generation module 802, a second generation module 803, a comparison module 804, a first isolation release module 805, an antivirus module 806, a second isolation release module 807, a third generation module 808, a fourth generation module 809 and an update module 810.

[0114] The isolation module 801 is used to isolate the data in the mobile storage device in response to the mobile storage device insertion event. In one embodiment, the isolation module 801 can be used to execute the step S201 described above, which will not be described in detail here.

[0115] The first generating module 802 is used to obtain the directory file in the mobile storage device and generate a first directory file. In one embodiment, the first generating module 802 can be used to execute the step S202 described above, which will not be described in detail here.

[0116] The second generating module 803 is used to traverse the first directory file and generate a first directory file identifier. In one embodiment, the second generating module 803 can be used to execute the step S203 described above.

[0117] The second generation module 803 includes: a fifth generation module, a calculation module and a sixth generation module.

[0118] The fifth generating module is used to parse the first directory file and generate a directory file list of the first directory file. In one embodiment, the fifth generating module can be used to execute the step S301 described above, which will not be described in detail here.

[0119] The calculation module is used to calculate the hash value of the first directory file based on the directory file list of the first directory file. In one embodiment, the calculation module can be used to execute step S302 described above.

[0120] The calculation module includes: a seventh generation module, an eighth generation module and a ninth generation module.

[0121] The seventh generation module is used to obtain the data in the directory file list of the first directory file, preprocess the data in the directory file list of the first directory file, and generate the preprocessed directory file list data. In one embodiment, the seventh generation module can be used to execute step S401 described above.

[0122] The seventh generation module includes: a tenth generation module, an eleventh generation module, a twelfth generation module and a thirteenth generation module.

[0123] The tenth generating module is used to perform data preprocessing on the directory name of the first directory file according to a preset unified directory hierarchy format to generate a preprocessed directory name of the first directory file. In one embodiment, the tenth generating module can be used to execute step S501 described above, which will not be repeated here.

[0124] The eleventh generating module is used to perform data preprocessing on the file name of the first directory file according to a preset unified suffix format to generate the preprocessed file name of the first directory file. In one embodiment, the eleventh generating module can be used to execute step S502 described above, which will not be repeated here.

[0125] The twelfth generation module is used to perform data preprocessing on the file modification time of the first directory file according to a preset unified time format to generate the modification time of the first directory file after preprocessing. In one embodiment, the twelfth generation module can be used to execute step S503 described above, which will not be repeated here.

[0126] The thirteenth generating module is used to perform data preprocessing on the file size of the first directory file according to a preset unified unit format to generate the file size of the first directory file after preprocessing. In one embodiment, the thirteenth generating module can be used to execute step S504 described above, which will not be described in detail here.

[0127] The eighth generation module is used to combine the preprocessed directory file list data into character strings to generate a preprocessed directory file list data character string. In one embodiment, the eighth generation module can be used to execute step S402 described above, which will not be described in detail here.

[0128] The ninth generating module is used to perform hash calculation on the preprocessed directory file list data string to generate a hash value of the first directory file. In one embodiment, the ninth generating module can be used to execute step S403 described above.

[0129] The ninth generation module includes: a fourteenth generation module, a fifteenth generation module and a sixteenth generation module.

[0130] The fourteenth generation module is used to input the preprocessed directory file list data string into an encrypted hash function to generate a 256-bit hash value. In one embodiment, the fourteenth generation module can be used to execute step S601 described above, which will not be described in detail here.

[0131] The fifteenth generation module is used to perform hexadecimal conversion on the 256-bit hash value to generate a hexadecimal hash value. In one embodiment, the fifteenth generation module can be used to execute the above-described step S602, which will not be described in detail here.

[0132] The sixteenth generation module is used to obtain the first 32 characters from the hexadecimal hash value to generate the hash value of the first directory file. In one embodiment, the sixteenth generation module can be used to execute the step S603 described above, which will not be repeated here.

[0133] The sixth generation module is used to generate a first directory file identifier based on the hash value of the directory file. In one embodiment, the sixth generation module can be used to execute step S303 described above, which will not be described in detail here.

[0134] Return to reference Figure 8 The comparison module 804 is used to obtain multiple historical directory file identifiers and compare the first directory file identifier with the multiple historical directory file identifiers for consistency. In one embodiment, the comparison module 804 can be used to execute the step S204 described above, which will not be repeated here.

[0135] The first de-isolation module 805 is used to de-isolate the data in the mobile storage device if the first directory file identifier is the same as at least one of the multiple historical directory file identifiers. In one embodiment, the first de-isolation module 805 can be used to execute step S205 described above, which will not be repeated here.

[0136] The antivirus module 806 is used to perform antivirus processing on the data in the mobile storage device if the first directory file identifier is different from any of the multiple historical directory file identifiers. In one embodiment, the antivirus module 806 can be used to execute the step S206 described above, which will not be repeated here.

[0137] The second de-isolation module 807 is used to de-isolate the anti-virus data in the mobile storage device. In one embodiment, the second de-isolation module 807 can be used to execute the step S207 described above, which will not be described in detail here.

[0138] The third generation module 808 is used to obtain the directory file in the mobile storage device after antivirus processing to generate a second directory file. In one embodiment, the third generation module 808 can be used to execute the step S208 described above, which will not be repeated here.

[0139] The fourth generating module 809 is used to traverse the second directory file and generate a second directory file identifier. In one embodiment, the fourth generating module 809 can be used to execute the above-described step S209, which will not be described in detail here.

[0140] The updating module 810 is used to obtain the second directory file identifier and update the second directory file identifier to the multiple historical directory file identifiers. In one embodiment, the updating module 810 can be used to execute the above-described step S210, which will not be described in detail here.

[0141] According to an embodiment of the present disclosure, any multiple modules among the isolation module 801, the first generation module 802, the second generation module 803, the comparison module 804, the first isolation release module 805, the antivirus module 806, the second isolation release module 807, the third generation module 808, the fourth generation module 809 and the update module 810 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the isolation module 801, the first generation module 802, the second generation module 803, the comparison module 804, the first de-isolation module 805, the antivirus module 806, the second de-isolation module 807, the third generation module 808, the fourth generation module 809 and the update module 810 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or can be implemented in any one of the three implementation methods of software, hardware and firmware, or in an appropriate combination of any of them. Alternatively, at least one of the isolation module 801, the first generation module 802, the second generation module 803, the comparison module 804, the first de-isolation module 805, the anti-virus module 806, the second de-isolation module 807, the third generation module 808, the fourth generation module 809 and the update module 810 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is executed.

[0142] Fig. 9 A block diagram of an electronic device suitable for implementing a mobile storage device protection method for an intranet according to an embodiment of the present disclosure is schematically shown.

[0143] like Fig. 9As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 to a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0144] In RAM903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM902 and RAM903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM902 and / or RAM903. It should be noted that the program can also be stored in one or more memories other than ROM902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0145] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the I / O interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0146] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0147] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or the RAM 903 described above and / or one or more memories other than the ROM 902 and the RAM 903.

[0148] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the mobile storage device protection method for an intranet provided by the embodiment of the present disclosure.

[0149] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0150] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0151] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0152] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0153] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0154] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0155] The embodiments of the present disclosure are described above. However, these embodiments are only for the purpose of illustration and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A mobile storage device protection method for an intranet, characterized in that: The method includes: In response to a mobile storage device insertion event, isolating data in the mobile storage device; Obtaining a directory file in the mobile storage device to generate a first directory file; Traversing the first directory file to generate a first directory file identifier; Acquire multiple historical directory file identifiers, and compare the first directory file identifier with the multiple historical directory file identifiers for consistency; and If the first directory file identifier is the same as at least one of the multiple historical directory file identifiers, the data in the mobile storage device is de-isolated.

2. The method according to claim 1, characterized in that Traversing the first directory file to generate a first directory file identifier includes: Parsing the first directory file to generate a directory file list of the first directory file; Calculating a hash value of the first directory file based on the directory file list of the first directory file; and A first directory file identifier is generated based on the hash value of the directory file.

3. The method according to claim 2, characterized in that Calculating a hash value of the first directory file based on the directory file list of the first directory file includes: Acquire data in the directory file list of the first directory file, preprocess the data in the directory file list of the first directory file, and generate preprocessed directory file list data; Combining the preprocessed directory file list data by character string combination to generate a preprocessed directory file list data character string; and A hash calculation is performed on the preprocessed directory file list data string to generate a hash value of the first directory file.

4. The method according to claim 3, characterized in that: The data in the directory file list includes: directory name, file name, file modification time, and file size. The data in the directory file list of the first directory file is preprocessed to generate preprocessed directory file list data, including: Performing data preprocessing on the directory name of the first directory file according to a preset unified directory hierarchy format to generate a preprocessed directory name of the first directory file; Performing data preprocessing on the file name of the first directory file according to a preset unified suffix format to generate a file name of the first directory file after preprocessing; Performing data preprocessing on the file modification time of the first directory file according to a preset unified time format to generate a preprocessed modification time of the first directory file; and The file size of the first directory file is preprocessed according to a preset unified unit format to generate a preprocessed file size of the first directory file.

5. The method according to claim 3, characterized in that: Performing hash calculation on the preprocessed directory file list data string to generate a hash value of the first directory file includes: Inputting the preprocessed directory file list data string into an encrypted hash function to generate a 256-bit hash value; Converting the 256-bit hash value into hexadecimal to generate a hexadecimal hash value; and The first 32 characters are obtained from the hexadecimal hash value to generate a hash value for the first directory file.

6. The method according to any one of claims 1 to 5, characterized in that: The method further includes: If the first directory file identifier is different from any of the multiple historical directory file identifiers, performing antivirus processing on the data in the mobile storage device; and The data in the mobile storage device that has been disinfected is de-isolated.

7. The method according to claim 6, characterized in that The method further includes: After performing antivirus processing on the mobile storage device, obtaining a directory file in the mobile storage device after the antivirus processing, and generating a second directory file; Traversing the second directory file to generate a second directory file identifier; and The second directory file identifier is obtained, and the second directory file identifier is updated into the multiple historical directory file identifiers.

8. A mobile storage device protection device for an intranet, characterized in that: The device includes: An isolation module, used for isolating data in the mobile storage device in response to a mobile storage device insertion event; A first generating module, used for acquiring a directory file in the mobile storage device and generating a first directory file; A second generating module, used for traversing the first directory file and generating a first directory file identifier; a comparison module, configured to obtain a plurality of historical directory file identifiers, and compare the first directory file identifier with the plurality of historical directory file identifiers for consistency; and The first de-isolation module is used to de-isolate the data in the mobile storage device if the first directory file identifier is the same as at least one historical directory file identifier among the multiple historical directory file identifiers.

9. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images