Methods, devices, equipment, and media for protecting mobile storage devices used in intranets.

Abstract

This disclosure provides a method for protecting mobile storage devices within an intranet. It can be applied to the fields of big data technology and privacy computing technology. The method includes: in response to a mobile storage device insertion event, isolating data in the mobile storage device; obtaining directory files in the mobile storage device and generating a first directory file; traversing the first directory file and generating a first directory file identifier; obtaining multiple historical directory file identifiers, comparing the first directory file identifier with the multiple historical directory file identifiers for consistency; and if the first directory file identifier is the same as at least one of the multiple historical directory file identifiers, then de-isolating the data in the mobile storage device. This disclosure also provides a mobile storage device protection apparatus, device, storage medium, and program product for intranets.

Description

Technical Field

[0001] This disclosure relates to the field of big data technology, specifically to the field of privacy computing technology, and in particular to a method, apparatus, device, medium, and program product for protecting mobile storage devices on intranets. Background Technology

[0002] In enterprises, including banks, the demand for mobile storage devices on internal networks is gradually increasing with the development of computer network technology. However, frequent use of mobile storage devices can easily lead to attacks such as viruses attacking the internal network through these devices, causing losses.

[0003] Currently, the common solution for protecting removable storage devices on intranets is to scan and remove viruses from USB flash drives and other removable storage devices inserted into the intranet. However, this method requires a virus scan every time a USB flash drive or other removable storage device is inserted, resulting in a waste of server CPU resources, memory resources, and disk I / O resources. Furthermore, virus scanning takes time, leading to reduced work efficiency. Summary of the Invention

[0004] In view of the above problems, this disclosure provides a method, apparatus, device, medium and program product for protecting mobile storage devices in intranets.

[0005] According to a first aspect of this disclosure, a method for protecting mobile storage devices in an intranet is provided. The method includes: in response to a mobile storage device insertion event, isolating data in the mobile storage device; obtaining directory files in the mobile storage device and generating a first directory file; traversing the first directory file and generating a first directory file identifier; obtaining multiple historical directory file identifiers and comparing the first directory file identifier with the multiple historical directory file identifiers for consistency; and if the first directory file identifier is the same as at least one of the multiple historical directory file identifiers, then de-isolating the data in the mobile storage device.

[0006] According to an embodiment of this disclosure, traversing the first directory file to generate a first directory file identifier includes: parsing the first directory file to generate a directory file list of the first directory file; calculating the hash value of the first directory file based on the directory file list of the first directory file; and generating a first directory file identifier based on the hash value of the directory file.

[0007] According to an embodiment of this disclosure, calculating the hash value of the first directory file based on the directory file list of the first directory file includes: obtaining data from the directory file list of the first directory file; preprocessing the data from the directory file list of the first directory file to generate preprocessed directory file list data; combining strings in the preprocessed directory file list data to generate a preprocessed directory file list data string; and performing hash calculation on the preprocessed directory file list data string to generate the hash value of the first directory file.

[0008] According to embodiments of this disclosure, the data in the directory file list includes: directory name, file name, file modification time, and file size. Preprocessing the data in the directory file list of the first directory file to generate preprocessed directory file list data includes: preprocessing the directory name of the first directory file according to a preset unified directory hierarchy format to generate a preprocessed directory name for the first directory file; preprocessing the file name of the first directory file according to a preset unified suffix format to generate a preprocessed file name for the first directory file; preprocessing the file modification time of the first directory file according to a preset unified time format to generate a preprocessed modification time for the first directory file; and preprocessing the file size of the first directory file according to a preset unified unit format to generate a preprocessed file size for the first directory file.

[0009] According to an embodiment of this disclosure, performing a hash calculation on the preprocessed directory file list data string to generate the hash value of the first directory file includes: inputting the preprocessed directory file list data string into an encrypted hash function to generate a 256-bit hash value; converting the 256-bit hash value into hexadecimal to generate a hexadecimal hash value; and obtaining the first 32 characters from the hexadecimal hash value to generate the hash value of the first directory file.

[0010] According to an embodiment of this disclosure, the method further includes: if the first directory file identifier is different from any of the plurality of historical directory file identifiers, then performing antivirus processing on the data in the mobile storage device; and performing de-isolation processing on the data in the mobile storage device after antivirus processing.

[0011] According to an embodiment of this disclosure, the method further includes: performing antivirus processing on the mobile storage device, obtaining the directory files in the antivirus-processed mobile storage device, and generating a second directory file; traversing the second directory file to generate a second directory file identifier; and obtaining the second directory file identifier and updating the second directory file identifier to the plurality of historical directory file identifiers.

[0012] According to a second aspect of this disclosure, a mobile storage device protection device for an intranet is provided. The device includes: an isolation module for isolating data in the mobile storage device in response to a mobile storage device insertion event; a first generation module for acquiring directory files in the mobile storage device and generating a first directory file; a second generation module for traversing the first directory file and generating a first directory file identifier; a comparison module for acquiring multiple historical directory file identifiers and comparing the first directory file identifier with the multiple historical directory file identifiers for consistency; and a first de-isolation module for de-isolerating the data in the mobile storage device if the first directory file identifier is identical to at least one of the multiple historical directory file identifiers.

[0013] According to an embodiment of this disclosure, the second generation module includes: a fifth generation module, configured to parse the first directory file and generate a directory file list of the first directory file; a calculation module, configured to calculate the hash value of the first directory file based on the directory file list of the first directory file; and a sixth generation module, configured to generate a first directory file identifier based on the hash value of the directory file.

[0014] According to an embodiment of this disclosure, the calculation module includes: a seventh generation module, configured to obtain data from the directory file list of the first directory file, preprocess the data from the directory file list of the first directory file, and generate preprocessed directory file list data; an eighth generation module, configured to perform string combination on the preprocessed directory file list data to generate a preprocessed directory file list data string; and a ninth generation module, configured to perform hash calculation on the preprocessed directory file list data string to generate a hash value of the first directory file.

[0015] According to embodiments of this disclosure, the data in the directory file list includes: directory name, file name, file modification time, and file size. The seventh generation module includes: a tenth generation module, used to preprocess the directory name of the first directory file according to a preset unified directory hierarchy format to generate a preprocessed directory name of the first directory file; an eleventh generation module, used to preprocess the file name of the first directory file according to a preset unified suffix format to generate a preprocessed file name of the first directory file; a twelfth generation module, used to preprocess the file modification time of the first directory file according to a preset unified time format to generate a preprocessed modification time of the first directory file; and a thirteenth generation module, used to preprocess the file size of the first directory file according to a preset unified unit format to generate a preprocessed file size of the first directory file.

[0016] According to an embodiment of this disclosure, the seventh generation module includes: a fourteenth generation module, used to input the preprocessed directory file list data string into an encrypted hash function to generate a 256-bit hash value; a fifteenth generation module, used to convert the 256-bit hash value into hexadecimal to generate a hexadecimal hash value; and a sixteenth generation module, used to extract the first 32 characters from the hexadecimal hash value to generate the hash value of the first directory file.

[0017] According to an embodiment of this disclosure, the device further includes: an antivirus module, configured to perform antivirus processing on the data in the removable storage device if the first directory file identifier is different from any of the plurality of historical directory file identifiers; and a second de-isolation module, configured to de-isolate the data in the removable storage device after antivirus processing.

[0018] According to an embodiment of this disclosure, the device further includes: a third generation module, configured to perform antivirus processing on the mobile storage device, obtain the directory files in the mobile storage device after antivirus processing, and generate a second directory file; a fourth generation module, configured to traverse the second directory file and generate a second directory file identifier; and an update module, configured to obtain the second directory file identifier and update the second directory file identifier to the plurality of historical directory file identifiers.

[0019] According to a third aspect of this disclosure, an electronic device is provided, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the aforementioned mobile storage device protection method for intranets.

[0020] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided that stores executable instructions or a computer program thereon, which, when executed by a processor, cause the processor to perform the aforementioned method for protecting mobile storage devices for intranets.

[0021] According to the fifth aspect of this disclosure, a computer program product is also provided, including a computer program that, when executed by a processor, implements the above-described method for protecting mobile storage devices for intranets.

[0022] This solution uses a technical means to obtain the directory file of a mobile storage device, generate a directory file identifier for the mobile storage device, and compare it with the historical directory file identifiers in the server to determine in advance whether the target mobile device needs virus scanning. It can identify that when the data on the mobile storage device has not changed, there is no need to perform data scanning. This solves the technical problem that when mobile storage devices such as USB flash drives are used for data transfer on the enterprise intranet, virus scanning is required every time the mobile storage device is inserted, which wastes computer resources and reduces work efficiency. On the other hand, if virus scanning is not performed, it is easy for viruses to invade the intranet and cause losses. This solution saves CPU resources, memory resources, disk I / O resources, and network resources, and improves work efficiency. Attached Figure Description

[0023] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0024] Figure 1 The illustration schematically depicts an application scenario of a mobile storage device protection method and apparatus for an intranet according to embodiments of the present disclosure;

[0025] Figure 2 A flowchart illustrating a method for protecting mobile storage devices on an intranet according to an embodiment of the present disclosure is shown schematically.

[0026] Figure 3 This illustration schematically shows a flowchart of generating a first directory file identifier in a mobile storage device protection method for an intranet according to an embodiment of the present disclosure;

[0027] Figure 4 This illustration schematically shows a flowchart of generating a hash value for a first directory file in a mobile storage device protection method for an intranet according to an embodiment of the present disclosure;

[0028] Figure 5 This illustration schematically shows a flowchart of generating preprocessed directory file list data in a mobile storage device protection method for an intranet according to an embodiment of the present disclosure;

[0029] Figure 6This illustration schematically shows a flowchart of calculating the hash value of a first directory file in a mobile storage device protection method for an intranet according to an embodiment of the present disclosure;

[0030] Figure 7 The flowchart illustrates one embodiment of a mobile storage device protection method for an intranet according to embodiments of the present disclosure.

[0031] Figure 8 A schematic diagram illustrating a structural block diagram of a mobile storage device protection device for an intranet according to an embodiment of the present disclosure; and

[0032] Figure 9 A block diagram of an electronic device suitable for implementing a mobile storage device protection method for an intranet, according to an embodiment of the present disclosure, is illustrated schematically. Detailed Implementation

[0033] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0034] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0035] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0036] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0037] The accompanying drawings show some block diagrams and / or flowcharts. It should be understood that some blocks or combinations thereof in the block diagrams and / or flowcharts can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable control device, so that when executed by the processor, these instructions can create means for implementing the functions / operations described in these block diagrams and / or flowcharts.

[0038] First, the technical terms used in this article are explained as follows:

[0039] SHA-512 (Secure Hash Algorithm 512-bit) algorithm: A cryptographic hash function that takes a maximum of 2^128 bits as input and processes it into a fixed-size 512-bit output.

[0040] This disclosure provides a method for protecting mobile storage devices within an intranet. The method includes: in response to a mobile storage device insertion event, isolating data in the mobile storage device; obtaining directory files in the mobile storage device and generating a first directory file; traversing the first directory file and generating a first directory file identifier; obtaining multiple historical directory file identifiers and comparing the first directory file identifier with the multiple historical directory file identifiers for consistency; and if the first directory file identifier is the same as at least one of the multiple historical directory file identifiers, then de-isolating the data in the mobile storage device.

[0041] According to the embodiments of this disclosure, by obtaining the directory file of the mobile storage device, generating a directory file identifier for the mobile storage device, and comparing its consistency with the historical directory file identifier in the server, a technical means is used to determine in advance whether the target mobile device needs virus scanning. This method can identify that when the data on the mobile storage device has not changed, there is no need to perform data scanning. This solves the technical problem that when mobile storage devices such as USB flash drives are used for data transmission on an enterprise intranet, virus scanning is required every time the mobile storage device is inserted, which wastes computer resources and reduces work efficiency. On the other hand, if virus scanning is not performed, it can easily lead to virus intrusion into the intranet and cause losses. This achieves the technical effect of saving CPU resources, memory resources, disk I / O resources, and network resources, and improving work efficiency.

[0042] Figure 1 The illustration schematically depicts an application scenario of a mobile storage device protection method and apparatus for an intranet according to embodiments of the present disclosure. It should be noted that... Figure 1The examples shown are merely examples of scenarios in which the embodiments of this disclosure can be applied, to help those skilled in the art understand the technical content of this disclosure, but do not mean that the embodiments of this disclosure cannot be used in other devices, systems, environments or scenarios.

[0043] like Figure 1 As shown, application scenario 100 according to this embodiment may include an application scenario for protecting mobile storage devices within an intranet. Network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0044] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0045] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0046] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0047] It should be noted that the mobile storage device protection method for intranets provided in this disclosure can generally be executed by server 105. Correspondingly, the mobile storage device protection device for intranets provided in this disclosure can generally be installed in server 105. The mobile storage device protection method for intranets provided in this disclosure can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the mobile storage device protection device for intranets provided in this disclosure can also be installed in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0048] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0049] The following will be based on Figure 1 The described scene, through Figures 2-7 A detailed description of the method for protecting mobile storage devices on an intranet, based on the disclosed embodiments, is provided. It should be noted that the above application scenarios are shown only to facilitate understanding of the spirit and principles of this disclosure, and the implementation of this disclosure is not limited in any way. Rather, the implementation of this disclosure can be applied to any applicable scenario.

[0050] Figure 2 A flowchart illustrating a method for protecting mobile storage devices on an intranet according to an embodiment of the present disclosure is shown.

[0051] like Figure 2 As shown, the method 200 includes steps S201 to S210.

[0052] Step S201: In response to the mobile storage device insertion event, the data in the mobile storage device is isolated.

[0053] Step S202: Obtain the directory file in the mobile storage device and generate the first directory file.

[0054] Step S203: Traverse the first directory files and generate the first directory file identifier.

[0055] Figure 3 The flowchart illustrating the generation of a first directory file identifier in a mobile storage device protection method for an intranet according to an embodiment of the present disclosure is shown.

[0056] like Figure 3As shown, the method 300 includes steps S301 to S303.

[0057] Step S301: Parse the first directory file to generate a directory file list of the first directory file.

[0058] For example, iterate through all directory files in the removable storage device and generate a list of directory files, including directory name, file name, file modification time, and file size.

[0059] Step S302: Calculate the hash value of the first directory file based on the directory file list of the first directory file.

[0060] Figure 4 The flowchart illustrating the generation of the hash value of a first directory file in a mobile storage device protection method for an intranet according to an embodiment of the present disclosure is shown.

[0061] like Figure 4 As shown, the method 400 includes steps S401 to S403.

[0062] Step S401: Obtain the data from the directory file list of the first directory file, preprocess the data from the directory file list of the first directory file, and generate preprocessed directory file list data. The data in the directory file list includes: directory name, file name, file modification time, and file size.

[0063] Figure 5 The flowchart illustrating the generation of preprocessed directory file list data in a mobile storage device protection method for an intranet according to an embodiment of the present disclosure is shown.

[0064] like Figure 5 As shown, the method 500 includes steps S501 to S504.

[0065] Step S501: The directory name of the first directory file is preprocessed according to a preset unified directory hierarchy format to generate the preprocessed directory name of the first directory file.

[0066] For example, directory names are preprocessed according to the format "first-level directory / second-level directory / ...".

[0067] Step S502: The filenames of the first directory files are preprocessed according to a preset unified suffix format to generate preprocessed filenames for the first directory files.

[0068] For example, filenames can be preprocessed by adding the file format as a suffix, such as filename 1.xxx.

[0069] Step S503: The modification time of the first directory file is preprocessed according to a preset unified time format to generate the preprocessed modification time of the first directory file.

[0070] For example, file modification times are uniformly preprocessed according to the 15-bit format YYYYMMDD:HHMMSS.

[0071] Step S504: The file size of the first directory file is preprocessed according to a preset uniform unit format to generate the preprocessed file size of the first directory file.

[0072] For example, file sizes are uniformly converted to KB for preprocessing, and two decimal places are retained.

[0073] By preprocessing the directory names, file names, file modification times, and file sizes in the directory file list into a unified format, the accuracy of the generated hash values ​​can be further improved.

[0074] Return to reference Figure 4 In step S402, the preprocessed directory file list data is combined into strings to generate a preprocessed directory file list data string.

[0075] For example, for each file in the directory file, the directory name, file name, modification time, and file size information are combined as strings to generate a preprocessed directory file list data string. The string combination rules are as follows: directory name / file name.file extension / modification time / file size, such as first-level directory / second-level directory / ... / file name 1.xxx / YYYYMMDD:HHMMSS / file size.

[0076] Step S403: Perform hash calculation on the preprocessed directory file list data string to generate the hash value of the first directory file.

[0077] Figure 6 The flowchart illustrating the calculation of the hash value of a first directory file in a mobile storage device protection method for an intranet according to an embodiment of the present disclosure is shown.

[0078] Step S601: Input the preprocessed directory file list data string into the cryptographic hash function to generate a 256-bit hash value.

[0079] For example, the preprocessed directory file list data string can be used with the SHA-512 algorithm to generate a 256-bit hash value.

[0080] Step S602: Convert the 256-bit hash value to hexadecimal to generate a hexadecimal hash value.

[0081] For example, a hexadecimal hash value can be generated by obtaining the hexadecimal representation of the hash value.

[0082] Step S603: Obtain the first 32 characters from the hexadecimal hash value to generate the hash value of the first directory file.

[0083] For example, the first 32 characters of the hexadecimal hash value are extracted and used as the final hash value of the first directory file.

[0084] The reliability of the generated hash value can be further improved by using an encrypted hash function. The accuracy of the generated hash value can be improved by processing the data in the directory listing of the first directory file into a string format before performing hash calculations.

[0085] Return to reference Figure 3 In step S303, a first directory file identifier is generated based on the hash value of the directory file.

[0086] For example, the file name and its corresponding 128-bit hash value are stored in the scan file to generate the first directory file identifier.

[0087] By calculating the hash value of the first directory file and generating the first directory file identifier, the accuracy and reliability of the first directory file identifier can be improved.

[0088] Return to reference Figure 2 In step S204, multiple historical directory file identifiers are obtained, and the first directory file identifier is compared with the multiple historical directory file identifiers for consistency.

[0089] For example, any change in the filename, file modification time, or file size will result in a different 128-bit hash value. A first directory file identifier is generated by calculating the hash value of the current file information. This first directory file identifier is then compared with multiple historical directory file identifiers on the server to determine if files within the removable storage used on the intranet have been updated, and consequently, whether or not they need to be scanned and removed. The multiple historical directory file identifiers are all directory file identifiers generated in response to removable storage device insertion events and saved on the server before the first directory file identifier was generated.

[0090] Step S205: If the first directory file identifier is the same as at least one of the plurality of historical directory file identifiers, then the data in the mobile storage device is deisolated.

[0091] For example, if the first directory file identifier is the same as at least one of the multiple historical directory file identifiers, it means that the removable storage device has been previously scanned and there is no data change in the removable storage device. Therefore, a full system virus scan is not required, and the data in the removable storage device should be de-isolated.

[0092] Step S206: If the first directory file identifier is different from any of the multiple historical directory file identifiers, then the data in the mobile storage device is subjected to antivirus processing.

[0093] For example, if the first directory file identifier is different from any of the historical directory file identifiers, it indicates that this removable storage device has not been scanned or cleaned before, or that this removable storage device has been scanned or cleaned before, but data has been modified on the removable storage device.

[0094] Step S207: De-isolate the data in the mobile storage device after it has been disinfected.

[0095] By performing antivirus processing on data from removable storage devices with different identifiers, it is possible to prevent viruses from invading the internal network and causing losses.

[0096] Step S208: After performing antivirus processing on the mobile storage device, obtain the directory file in the mobile storage device after antivirus processing, and generate a second directory file.

[0097] Step S209: Traverse the second directory files and generate the second directory file identifier.

[0098] Step S210: Obtain the second directory file identifier and update the second directory file identifier to the plurality of historical directory file identifiers.

[0099] By generating a second directory file identifier from the directory files in the scanned removable storage device and iteratively updating it to multiple historical directory file identifiers, the invalidity of multiple historical directory file identifiers can be improved, making the consistency comparison results more accurate.

[0100] Figure 7 The flowchart illustrates one embodiment of a mobile storage device protection method for an intranet according to embodiments of the present disclosure.

[0101] like Figure 7As shown in the example, this embodiment uses a USB flash drive as an example to demonstrate the process. For external USB flash drives, after the internal network virus scan, a special scan file will be generated in the USB flash drive, tentatively named "scan_file". If the system detects that the USB flash drive does not have this "scan_file" file or that the file content is incorrect, normal use is not allowed before the USB flash drive completes the virus scan.

[0102] The steps for generating the scan file (scan_file) include: traversing all directories and files on the USB drive to generate a list of directory files, including directory name, file name, file modification time, and file size. During file traversal, the data needs to be preprocessed as follows: directory names are uniformly processed according to the format "first-level directory / second-level directory / ..."; file names are uniformly appended with the file format as a suffix, such as filename1.xxx; file modification times are uniformly processed according to the 15-digit format YYYYMMDD:HHMMSS; and file sizes are uniformly converted to KB and rounded to two decimal places. For each file in the list, the directory name, file name, modification time, and file size information are combined as strings, and a 128-bit hash value is generated using a hash algorithm. Specifically, the combined string is used as input, and the SHA-512 algorithm is used to generate a 256-bit hash value. The hexadecimal representation of the hash value is obtained, and the first 32 characters are truncated as the final hash value. The string combination rules are as follows: directory name / filename.file extension / modification time / file size, such as first-level directory / second-level directory / ... / filename1.xxx / YYYYMMDD:HHMMSS / file size. Finally, the filename and its corresponding 128-bit hash value are stored in the scan file `scan_file`. For example:

[0103] aaa.xxx777c1e04d0318a3b80c2da7cfca477babfd295b9

[0104] bbb.xxxa5699fb8f52f873eb2a52b231fece138aa622523

[0105] Any change to the filename, modification time, or size will result in a different 128-bit hash value. The hash value of the current file is calculated and compared to the corresponding hash value in the `scan_file` to determine if the file has been updated. Each generated `scan_file` is assigned a unique ID representing the corresponding USB drive. A copy is saved on the current computer and then uploaded to the cloud server. The server uses this unique ID as the folder name, containing the corresponding `scan_file` file. Subsequent additions and modifications are synchronized with the corresponding file on the server to prevent malicious tampering of the `scan_file` file on the USB drive.

[0106] When performing a quick scan on a USB drive, if a scan has been completed and a scan_file has been generated, and there are no changes after comparing it with the corresponding file maintained on the server, a full scan is not necessary.

[0107] If files on the USB drive have been updated, resulting in changes to file size and modification time, the system's calculated file hash value will differ from the hash value recorded in scan_file. The in-house antivirus system will then scan this file for viruses. If no viruses are found, the system will update the hash value in scan_file and simultaneously update the scan_file file stored on the server.

[0108] If a new file is added to the USB drive and cannot be found in the scan file (scan_file), the in-house antivirus system will scan and remove the file. If no virus is found after the scan, the hash value in scan_file will be updated, and the scan_file file stored on the server will be updated synchronously.

[0109] If files are deleted from the USB drive, the system will update the scan_file accordingly. The specific update method is as follows: delete the corresponding data items in the original scan_file, and synchronously update the corresponding scan_file on the server.

[0110] If the in-house antivirus system detects a virus during a scan, the file will be quarantined and the network will be disabled until maintenance personnel confirm there is no risk and then the network will be enabled.

[0111] This embodiment of the invention ensures that external USB drives must be scanned and removed by the antivirus system before being used on the intranet, thus preventing the risk of external virus intrusion; it saves virus scanning time and more accurately locates and removes files; the detection speed is fast, requiring only a traversal of the USB drive's file system and quick hash calculation to compare and scan files, thus completing the USB drive detection quickly and facilitating the safe use of USB drives.

[0112] Figure 8A schematic block diagram of a mobile storage device protection device for an intranet according to an embodiment of the present disclosure is shown.

[0113] like Figure 8 As shown, the device 800 includes: an isolation module 801, a first generation module 802, a second generation module 803, a comparison module 804, a first de-isolation module 805, an antivirus module 806, a second de-isolation module 807, a third generation module 808, a fourth generation module 809, and an update module 810.

[0114] The isolation module 801 is used to isolate the data in the mobile storage device in response to a mobile storage device insertion event. In one embodiment, the isolation module 801 can be used to perform step S201 described above, which will not be repeated here.

[0115] The first generation module 802 is used to obtain the directory files in the mobile storage device and generate a first directory file. In one embodiment, the first generation module 802 can be used to execute step S202 described above, which will not be repeated here.

[0116] The second generation module 803 is used to traverse the first directory files and generate a first directory file identifier. In one embodiment, the second generation module 803 can be used to execute step S203 described above.

[0117] The second generation module 803 includes: a fifth generation module, a calculation module, and a sixth generation module.

[0118] The fifth generation module is used to parse the first directory file and generate a directory file list of the first directory file. In one embodiment, the fifth generation module can be used to perform step S301 described above, which will not be repeated here.

[0119] The calculation module is used to calculate the hash value of the first directory file based on the directory file list of the first directory file. In one embodiment, the calculation module can be used to perform step S302 described above.

[0120] The calculation module includes: the seventh generation module, the eighth generation module, and the ninth generation module.

[0121] The seventh generation module is used to obtain data from the directory file list of the first directory file, preprocess the data from the directory file list of the first directory file, and generate preprocessed directory file list data. In one embodiment, the seventh generation module can be used to execute step S401 described above.

[0122] The seventh generation module includes: the tenth generation module, the eleventh generation module, the twelfth generation module, and the thirteenth generation module.

[0123] The tenth generation module is used to preprocess the directory names of the first directory file according to a preset unified directory hierarchy format to generate preprocessed directory names for the first directory file. In one embodiment, the tenth generation module can be used to execute step S501 described above, which will not be repeated here.

[0124] The eleventh generation module is used to preprocess the filenames of the first directory file according to a preset unified suffix format to generate preprocessed filenames for the first directory file. In one embodiment, the eleventh generation module can be used to execute step S502 described above, which will not be repeated here.

[0125] The twelfth generation module is used to preprocess the file modification times of the first directory file according to a preset unified time format to generate preprocessed modification times of the first directory file. In one embodiment, the twelfth generation module can be used to execute step S503 described above, which will not be repeated here.

[0126] The thirteenth generation module is used to preprocess the file size of the first directory file according to a preset uniform unit format, and generate the preprocessed file size of the first directory file. In one embodiment, the thirteenth generation module can be used to execute step S504 described above, which will not be repeated here.

[0127] The eighth generation module is used to perform string combination on the preprocessed directory file list data to generate a preprocessed directory file list data string. In one embodiment, the eighth generation module can be used to execute step S402 described above, which will not be repeated here.

[0128] The ninth generation module is used to perform hash calculation on the preprocessed directory file list data string to generate the hash value of the first directory file. In one embodiment, the ninth generation module can be used to execute step S403 described above.

[0129] The ninth generation module includes the fourteenth generation module, the fifteenth generation module, and the sixteenth generation module.

[0130] The fourteenth generation module is used to input the preprocessed directory file list data string into an encrypted hash function to generate a 256-bit hash value. In one embodiment, the fourteenth generation module can be used to execute step S601 described above, which will not be repeated here.

[0131] The fifteenth generation module is used to convert the 256-bit hash value into hexadecimal form to generate a hexadecimal hash value. In one embodiment, the fifteenth generation module can be used to execute step S602 described above, which will not be repeated here.

[0132] The sixteenth generation module is used to obtain the first 32 characters from the hexadecimal hash value and generate the hash value of the first directory file. In one embodiment, the sixteenth generation module can be used to execute step S603 described above, which will not be repeated here.

[0133] The sixth generation module is used to generate a first directory file identifier based on the hash value of the directory file. In one embodiment, the sixth generation module can be used to execute step S303 described above, which will not be repeated here.

[0134] Return to reference Figure 8 The comparison module 804 is used to obtain multiple historical directory file identifiers and compare the first directory file identifier with the multiple historical directory file identifiers for consistency. In one embodiment, the comparison module 804 can be used to perform step S204 described above, which will not be repeated here.

[0135] The first de-isolation module 805 is configured to de-isolate the data in the removable storage device if the first directory file identifier is the same as at least one of the plurality of historical directory file identifiers. In one embodiment, the first de-isolation module 805 may be used to execute step S205 described above, which will not be repeated here.

[0136] The antivirus module 806 is configured to perform antivirus processing on the data in the removable storage device if the first directory file identifier is different from any of the plurality of historical directory file identifiers. In one embodiment, the antivirus module 806 may be used to execute step S206 described above, which will not be repeated here.

[0137] The second de-isolation module 807 is used to de-isolate the data in the mobile storage device after it has been disinfected. In one embodiment, the second de-isolation module 807 can be used to execute step S207 described above, which will not be repeated here.

[0138] The third generation module 808 is used to perform antivirus processing on the removable storage device, obtain the directory files in the antivirus-processed removable storage device, and generate a second directory file. In one embodiment, the third generation module 808 can be used to execute step S208 described above, which will not be repeated here.

[0139] The fourth generation module 809 is used to traverse the second directory files and generate a second directory file identifier. In one embodiment, the fourth generation module 809 can be used to execute step S209 described above, which will not be repeated here.

[0140] The update module 810 is used to obtain the second directory file identifier and update the second directory file identifier into the plurality of historical directory file identifiers. In one embodiment, the update module 810 can be used to perform step S210 described above, which will not be repeated here.

[0141] According to embodiments of this disclosure, any and more modules selected from the isolation module 801, the first generation module 802, the second generation module 803, the comparison module 804, the first de-isolation module 805, the antivirus module 806, the second de-isolation module 807, the third generation module 808, the fourth generation module 809, and the update module 810 can be combined into a single module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in a single module. According to embodiments of this disclosure, at least one of the isolation module 801, the first generation module 802, the second generation module 803, the comparison module 804, the first de-isolation module 805, the antivirus module 806, the second de-isolation module 807, the third generation module 808, the fourth generation module 809, and the update module 810 can be at least partially implemented as hardware circuits, such as field-programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits (ASICs), or any other reasonable means of integrating or packaging circuits, or implemented in hardware or firmware, or in any one of the three implementation methods of software, hardware, and firmware, or in a suitable combination of any of them. Alternatively, at least one of the isolation module 801, the first generation module 802, the second generation module 803, the comparison module 804, the first de-isolation module 805, the antivirus module 806, the second de-isolation module 807, the third generation module 808, the fourth generation module 809, and the update module 810 can be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0142] Figure 9 A block diagram of an electronic device suitable for implementing a mobile storage device protection method for an intranet, according to an embodiment of the present disclosure, is illustrated schematically.

[0143] like Figure 9As shown, an electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0144] RAM 903 stores various programs and data required for the operation of electronic device 900. Processor 901, ROM 902, and RAM 903 are interconnected via bus 904. Processor 901 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 902 and / or RAM 903. It should be noted that the programs may also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0145] According to embodiments of this disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the I / O interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0146] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0147] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903 described above.

[0148] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the mobile storage device protection method for intranets provided in embodiments of this disclosure.

[0149] When the computer program is executed by the processor 901, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0150] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0151] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0152] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0153] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0154] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0155] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A method for protecting mobile storage devices on an intranet, characterized in that, The method includes: In response to a removable storage device insertion event, the data in the removable storage device is isolated. Obtain the directory files in the removable storage device and generate a first directory file; Traverse the files in the first directory and generate the file identifier for the first directory; Obtain multiple historical directory file identifiers, and perform a consistency comparison between the first directory file identifier and the multiple historical directory file identifiers; and If the first directory file identifier is the same as at least one of the plurality of historical directory file identifiers, then the data in the removable storage device is de-isolated. The process of traversing the first directory files and generating a first directory file identifier includes: The first directory file is parsed to generate a directory file list of the first directory file. The data in the directory file list includes: directory name, file name, file modification time, and file size. Based on the directory file list of the first directory file, calculate the hash value of the first directory file; and A first directory file identifier is generated based on the hash value of the directory file.

2. The method according to claim 1, characterized in that, Based on the directory file list of the first directory file, calculate the hash value of the first directory file, including: Obtain the data from the directory file list of the first directory file, preprocess the data from the directory file list of the first directory file, and generate preprocessed directory file list data; The preprocessed directory file list data is then combined with other strings to generate a preprocessed directory file list data string; and The preprocessed directory file list data string is hashed to generate the hash value of the first directory file.

3. The method according to claim 2, characterized in that: The data in the directory file list of the first directory file is preprocessed to generate preprocessed directory file list data, including: The directory name of the first directory file is preprocessed according to a preset unified directory hierarchy format to generate the preprocessed directory name of the first directory file. The filenames of the first directory files are preprocessed according to a preset unified suffix format to generate preprocessed filenames of the first directory files. The modification times of the first directory files are preprocessed according to a preset unified time format to generate preprocessed modification times of the first directory files; and The file size of the first directory file is preprocessed according to a preset uniform unit format to generate the preprocessed file size of the first directory file.

4. The method according to claim 2, characterized in that: Perform a hash calculation on the preprocessed directory file list data string to generate the hash value of the first directory file, including: The preprocessed directory file list data string is input into an encrypted hash function to generate a 256-bit hash value; The 256-bit hash value is converted to hexadecimal to generate a hexadecimal hash value; and The first 32 characters are extracted from the hexadecimal hash value to generate the hash value of the first directory file.

5. The method according to any one of claims 1 to 4, characterized in that, The method also includes: If the first directory file identifier is different from any of the plurality of historical directory file identifiers, then the data in the removable storage device is subjected to antivirus processing; and The data in the mobile storage device that has undergone virus scanning is then de-isolated.

6. The method according to claim 5, characterized in that, The method also includes: After performing antivirus processing on the removable storage device, obtain the directory files in the antivirus-processed removable storage device and generate a second directory file; Traverse the files in the second directory and generate the file identifier for the second directory; and Obtain the second directory file identifier and update the second directory file identifier to the plurality of historical directory file identifiers.

7. A protective device for mobile storage devices used in an intranet, characterized in that, The device includes: An isolation module is used to isolate the data in the mobile storage device in response to a mobile storage device insertion event; The first generation module is used to obtain the directory file in the mobile storage device and generate a first directory file; The second generation module is used to traverse the first directory files and generate the first directory file identifier; The comparison module is used to obtain multiple historical directory file identifiers and perform a consistency comparison between the first directory file identifier and the multiple historical directory file identifiers; and The first de-isolation module is configured to de-isolate the data in the removable storage device if the first directory file identifier is the same as at least one of the plurality of historical directory file identifiers. The process of traversing the first directory files and generating a first directory file identifier includes: The first directory file is parsed to generate a directory file list of the first directory file. The data in the directory file list includes: directory name, file name, file modification time, and file size. Based on the directory file list of the first directory file, calculate the hash value of the first directory file; and A first directory file identifier is generated based on the hash value of the directory file.

8. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images