Data backup method and apparatus, and network attached storage device

Abstract

The invention provides a data backup method and device and network attached storage equipment, and the method comprises the steps that when it is monitored that contents of a newly added file or an existing file in a data safe box are changed, a first storage system verifies file header information of a to-be-backed-up file, and the to-be-backed-up file is the newly added file or the file with the changed contents; if the file header information passes verification, the first storage system transmits the file to be backed up to a second storage system; the second storage system verifies the file header information of the received file to be backed up and extracts hidden verification information; if the file header information passes the verification and the hidden verification information is correct, the second storage system performs complete backup on the to-be-backed-up file; otherwise, discarding the file to be backed up. According to the invention, the first storage system can be prevented from being infected by the backup file of the second storage system after being attacked by the ransomware, and the security of user data is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data backup method and device, and a network attached storage device. Background Art

[0002] As the mainstream data storage and backup device for individuals or small teams, NAS (Network Attached Storage) products are becoming more and more popular among consumers. NAS can provide users with a variety of data storage backup and sharing, access sharing interfaces, and is especially friendly to data backup support for mobile devices.

[0003] However, as a lightweight, private storage service, NAS's own network security protection capabilities are far inferior to mature cloud storage (cloud disk) services. As a general network product, NAS is also subject to common network security vulnerabilities.

[0004] Secondly, the most feared thing for users’ valuable data is not the theft of plain text, but the attack of ransomware. Especially when the core important data of users is attacked, most of them will choose to compromise with the attacker due to the importance and irrecoverability of the data. Due to many factors such as competitive costs, NAS product manufacturers have very limited investment in security protection.

[0005] How to solve the security issues of NAS products through relatively low-cost solutions deserves in-depth consideration. Summary of the invention

[0006] One of the purposes of the present invention is to provide a data backup method and device, and a network attached storage device in view of the problems existing in the prior art.

[0007] The technical solution provided by the present invention is as follows: A data backup method, comprising: When monitoring that a new file is added to the data safe or the content of an existing file has changed, the first storage system verifies the file header information of the file to be backed up, and the file to be backed up is a new file or a file with changed content; each file in the data safe conforms to a preset format, including file header information, header verification information, and a payload part embedded with hidden verification information; If the file header information verification passes, the first storage system transfers the file to be backed up to the second storage system; The second storage system verifies the file header information of the received file to be backed up; If the file header information verification passes, the second storage system extracts the embedded hidden verification information from the payload portion of the file to be backed up; If the hidden verification information is correct, the second storage system performs a complete backup of the file to be backed up; otherwise, the file to be backed up is discarded.

[0008] In some embodiments, the second storage system extracts embedded hidden verification information from the payload portion of the file to be backed up, including: The second storage system performs entropy decoding on the payload portion of the file to be backed up, and extracts embedded hidden verification information from the entropy-decoded information.

[0009] In some embodiments, determining whether the hidden verification information is correct includes: If the hidden verification information is consistent with the preset embedded information, the hidden verification information is correct, otherwise it is incorrect.

[0010] In some embodiments, it also includes: The preset embedded information is the header verification information of the file to be backed up or a part thereof; The second storage system obtains header verification information of the file to be backed up, and obtains preset embedded information according to the header verification information.

[0011] In some embodiments, the entropy decoding algorithm is a Golomb-Rice decoding algorithm.

[0012] In some embodiments, the first storage system transmits the files to be backed up to the second storage system through a unidirectional transmission channel.

[0013] In some embodiments, it also includes: When a fault occurs, the second storage system sends an optical signal loaded with Morse code data corresponding to the fault code by flashing the light emitting diode; The first storage system captures the light signal through the photosensitive device, decodes the light signal, and obtains the Morse coded data loaded in the light signal; according to the preset Morse coding table, the Morse coded data is converted into a corresponding fault code.

[0014] The present invention also provides a data backup device, comprising: a first storage system and a second storage system; The first storage system includes: A data safe is used to store important user data; each file in the data safe conforms to a preset format, including file header information, header checksum information, and a payload portion embedded with hidden checksum information; The first verification module is used to verify the file header information of the backup file when monitoring the data safe for a new file or a change in the content of an existing file, and determine whether the file header information verification passes; the backup file is a new file or a file with changed content; A transmission module, used for transmitting the file to be backed up to the second storage system if the file header information verification passes; The second storage system includes: The second verification module is used to verify the file header information of the received file to be backed up, and determine whether the file header information verification passes; The payload verification module is used to extract the embedded hidden verification information from the payload part of the file to be backed up, and determine whether the extracted hidden verification information is correct; The backup module is used to perform a complete backup of the backup file if the extracted hidden verification information is correct.

[0015] In some embodiments, the payload verification module is also used to perform entropy decoding on the payload part of the file to be backed up if the file header information verification passes, and extract the embedded hidden verification information from the information after entropy decoding; if the hidden verification information is consistent with the preset embedded information, the hidden verification information is correct, otherwise the hidden verification information is incorrect.

[0016] The present invention also provides a network attached storage device, comprising the data backup device described in any one of the aforementioned embodiments.

[0017] The data backup method and device, and the network attached storage device provided by the present invention can at least bring the following beneficial effects: 1. The present invention adds a second storage system to back up important user data to the second storage system. When backing up data, the file format and hidden verification information of the payload part are verified to prevent problematic data from contaminating the second storage system, thereby effectively protecting the backup data, thereby achieving high availability of user data and anti-ransomware purposes.

[0018] 2. The present invention can feed back the fault code of the second storage system by adding a unidirectional physical path for reporting fault information in the reverse direction, thereby improving the maintainability of the second storage system; and because of its extremely low communication rate, it can ensure that information leakage of the second storage system is very limited. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The following will explain the preferred implementation mode in a clear and understandable manner with reference to the accompanying drawings, and further explain the above-mentioned characteristics, technical features, advantages and implementation methods of a data backup method and apparatus, and a network attached storage device.

[0020] Figure 1 is a flow chart of an embodiment of a data backup method of the present invention; Figure 2 It is a structural schematic diagram of an embodiment of a data backup device of the present invention; Figure 3is a schematic structural diagram of an embodiment of a network attached storage device of the present invention; Figure 4 It is a structural schematic diagram of another embodiment of a data backup device of the present invention. DETAILED DESCRIPTION

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the specific implementation methods of the present invention will be described below with reference to the accompanying drawings. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings and other implementation methods can be obtained based on these drawings without creative work.

[0022] In order to simplify the drawings, only the parts related to the present invention are schematically shown in each figure, and they do not represent the actual structure of the product. In addition, in order to simplify the drawings and facilitate understanding, in some figures, only one of the parts with the same structure or function is schematically drawn or marked. In this article, "one" not only means "only one", but also means "more than one".

[0023] One embodiment of the present invention, as Figure 1 As shown, a data backup method includes: Step S100 When monitoring that a new file is added to the data safe or the content of an existing file has changed, the first storage system verifies the file header information of the file to be backed up. The file to be backed up is a new file or a file with changed content in the data safe.

[0024] Step S200: Determine whether the file header information verification is passed. If the file header information verification is passed, execute step S300; otherwise, execute step S210.

[0025] Step S210: The first storage system issues an alarm for the file to be backed up.

[0026] Step S300: The first storage system transfers the files to be backed up to the second storage system.

[0027] The data safe is a storage area in the first storage system for storing important user data. Each file in the data safe conforms to a preset format, which includes file header information, header check information, and a payload portion embedded with hidden check information.

[0028] The file header information can be defined according to actual needs, such as including the version information of the file, the generation time, etc. The header verification information is verification information generated according to the file header information in a preset verification method. The header verification information can be generated according to the file header information using existing technologies, such as cyclic redundancy check CRC, checksum, hash function MD5, etc.

[0029] Existing information hiding technologies, such as lossless compression domain algorithms, can be used to embed hidden verification information into user payload data (carrier), and the user payload data embedded with hidden verification information is used as the payload part of the corresponding file in the data safe. The user payload data can be the user's original data (plain text), or the ciphertext obtained by encrypting the user's original data.

[0030] The first storage system monitors file changes in the data safe. When it is found that the file content in the data safe has changed or a new file has been added, it triggers the first storage system to back up the changed file or the new file. The first storage system sends the file to be backed up to the second storage system for the second storage system to perform data backup, and the backup file is stored in the second storage system. Before data transmission, the first storage system first checks whether the file format of the file to be backed up is legal. If it is illegal, an alarm is issued or an alarm is issued to the upper layer, and the file to be backed up is not transmitted to the second storage system. The file format check includes the verification of the file header information. If the verification information generated according to the file header information is inconsistent with the header verification information, the file header information verification fails; otherwise, the verification passes. If the verification fails, it means that the file to be backed up may be infected by a virus and does not need to be sent to the second storage system to avoid contaminating the second storage system.

[0031] Step S400 The second storage system verifies the file header information of the received file to be backed up; Step S500 determines whether the file header information verification is passed; if the file header information verification is passed, step S600 is executed; otherwise, step S510 is executed; Step S510: the second storage system discards the files to be backed up; Step S600: The second storage system extracts the embedded hidden verification information from the payload portion of the file to be backed up; Step S610 determines whether the extracted hidden verification information is correct; if correct, execute step S700; otherwise, execute step S620; Step S620: the second storage system discards the files to be backed up; Step S700: The second storage system performs a complete backup of the files to be backed up.

[0032] The second storage system has a simpler structure than the first storage system and a relatively smaller storage capacity, and may only include an MCU controller and a storage device. The second storage system monitors the port for receiving data, and receives data if data arrives. Parse the received file according to the preset format, extract the file header information and header verification information of the file to be backed up from the received data, and verify the file header information of the received file to be backed up. If the verification information generated based on the file header information is inconsistent with the header verification information, the file header information verification fails; otherwise, the verification passes. If the verification fails, it means that there is a problem with the received data, and the data received this time is discarded.

[0033] If the file header information verification passes, the embedded hidden verification information is extracted from the payload part of the file. The hidden verification information can be extracted using a decoding algorithm corresponding to the encoding algorithm used to embed the hidden verification information into the carrier. It is determined whether the extracted hidden verification information is correct. If the hidden verification information is correct, a full backup is performed on the received file to be backed up, otherwise, the data received this time is discarded.

[0034] If the hidden check information extracted from the payload is consistent with the preset embedded information, the hidden check information is correct, otherwise the hidden check information is incorrect. The preset embedded information may be a pre-agreed value.

[0035] A file backup can be created based on the file name and attributes carried in the header of the received data packet, and a full backup can be performed. Due to storage capacity limitations, the number of full backups of the same file stored in the second storage system can be limited to no more than N (for example, N<=16). If it does not exceed N, the previous backup of the same file will not be overwritten; otherwise, the earliest backup of the same file will be overwritten.

[0036] In order to prevent important user data from being attacked by ransomware, this embodiment backs up important user data to a second storage system. When backing up data, the header check information and the hidden check information in the payload part of the file are verified to prevent problematic data from infecting the second storage system. This can effectively protect the backup data, thereby achieving high availability of user data and anti-ransomware purposes.

[0037] In one embodiment, step S600 includes: Step S601: The second storage system uses an entropy decoding algorithm to extract embedded hidden verification information from the payload portion of the file to be backed up.

[0038] Specifically, the entropy coding algorithm is a lossless compression domain information embedding algorithm, and entropy decoding is the corresponding information extraction algorithm.

[0039] The payload part of the backup file is entropy-encoded to embed bit-level information, that is, the hidden verification information is embedded into the user payload data through the entropy coding algorithm to obtain the payload part of the file. Therefore, the second storage system uses an entropy decoding algorithm to extract the embedded hidden verification information from the payload part of the backup file.

[0040] Since entropy encoding all user payload data will result in a long corresponding entropy decoding time, it is preferred to entropy encode only part of the user payload data. For example, it is agreed that only the first 16 bytes of the user payload data are entropy encoded, and 2 bytes of hidden check information are embedded in the entropy encoding process to obtain new 16-byte payload data (with 2 bytes of hidden check information embedded in it), and the new 16-byte payload data replaces the first 16 bytes of the user's original payload data. The obtained new user payload data is the payload part of the file.

[0041] After such a file is sent to the second storage system, the second storage system verifies the file header information and then uses an entropy decoding algorithm to extract the embedded hidden verification information from a preset position of the payload part of the file to be backed up. For example, entropy decoding is performed on the first 16 bytes of data (preset position) of the payload part, and the embedded hidden verification information is extracted from the entropy decoded information (i.e., the 2-byte verification data hidden in the corresponding 16 bytes is obtained).

[0042] In this embodiment, by embedding specified verification information in the payload using entropy coding, and the second storage system extracting the verification information from the payload using entropy decoding, the second storage system can further improve the accuracy of identifying abnormal files, thereby preventing the backed-up files from being contaminated.

[0043] In one embodiment, the preset embedded information is the header verification information of the file to be backed up or a part thereof.

[0044] In this embodiment, the preset embedded information is not fixed data, but variable data, which is header verification information or part thereof. The second storage system obtains header verification information from the file to be backed up, obtains preset embedded information according to the header verification information; obtains the payload part of the file to be backed up, extracts the embedded hidden verification information from the payload part; determines whether the extracted hidden verification information is consistent with the preset embedded information; if they are consistent, the extracted hidden verification information is correct; otherwise, it is incorrect.

[0045] For example, if the header check information is 32 bits, and the preset embedded information is the first 16 bits of the header check information, if the extracted hidden check information (16 bits) is consistent with the preset embedded information (16 bits), the extracted hidden check information is correct; otherwise, it is incorrect.

[0046] In one embodiment, the entropy encoding algorithm is a Golomb-Rice encoding algorithm, and the entropy decoding algorithm is a Golomb-Rice decoding algorithm.

[0047] In one embodiment, the first storage system transmits the files to be backed up to the second storage system through a unidirectional transmission channel.

[0048] The one-way transmission channel can use a one-way optical shutter component. The use of one-way transmission can effectively prevent interactive network attack penetration and avoid reverse data contamination caused by systemic vulnerabilities.

[0049] One embodiment of the present invention, as Figure 2 As shown, a data backup device 100 includes a first storage system 110 and a second storage system 120 .

[0050] The first storage system 110 includes: The data safe 111 is used to store important user data; each file in the data safe conforms to a preset format, including file header information, header verification information and a payload part embedded with hidden verification information.

[0051] The first verification module 112 is used to verify the file header information of the backup file when monitoring that a new file is added to the data safe or the content of an existing file has changed, and determine whether the file header information verification passes; the backup file is a new file or a file with changed content.

[0052] The transmission module 113 is used to transmit the file to be backed up to the second storage system if the file header information verification passes.

[0053] The alarm module 114 is used to cause the first storage system to issue an alarm prompt to the file to be backed up if the file header information verification fails.

[0054] The second storage system 120 includes: The second verification module 121 is used to verify the file header information of the received file to be backed up, and determine whether the file header information verification passes; if not, the file to be backed up is discarded.

[0055] The payload verification module 122 is used to extract the embedded hidden verification information from the payload part of the file to be backed up if the file header verification information passes, and determine whether the extracted hidden verification information is correct.

[0056] The backup module 123 is used to perform a complete backup of the file to be backed up if the extracted hidden verification information is correct.

[0057] In one embodiment, the payload verification module is also used to perform entropy decoding on the payload part of the file to be backed up if the file header information verification passes, and extract the embedded hidden verification information from the information after entropy decoding; if the extracted hidden verification information is consistent with the preset embedded information, the hidden verification information is correct, otherwise the hidden verification information is incorrect.

[0058] In one embodiment, the preset embedded information is the header verification information of the file to be backed up or a part thereof.

[0059] The payload verification module is also used to obtain header verification information from the file to be backed up, and obtain preset embedded information based on the header verification information; extract the embedded hidden verification information from the payload part of the file to be backed up; determine whether the extracted hidden verification information is consistent with the preset embedded information; if consistent, the extracted hidden verification information is correct; otherwise, it is incorrect.

[0060] In one embodiment, the entropy encoding algorithm is a Golomb-Rice encoding algorithm, and the entropy decoding algorithm is a Golomb-Rice decoding algorithm.

[0061] In one embodiment, the first storage system transmits the to-be-backed-up file to the second storage system via a unidirectional transmission channel, which may be a unidirectional optical shutter component.

[0062] It should be noted that the embodiment of the data backup device provided by the present invention and the embodiment of the data backup method provided above are based on the same inventive concept and can achieve the same technical effect. Therefore, other specific contents of the embodiment of the data backup device can refer to the contents of the embodiment of the data backup method provided above.

[0063] The present invention also provides a specific application example, such as Figure 4 As shown, a data backup device includes a first storage system, a unidirectional transmission device and a second storage system. Through a special customized transmission protocol, the user's important data is backed up and stored in the second storage system. When restoring data, the first storage system and the second storage system can be connected through a temporary external network cable, such as an RJ45 network cable to complete the data recovery purpose.

[0064] The one-way transmission device uses a one-way optical shutter component. The function of the one-way optical shutter component is to enable data to be transmitted in one direction. It is a physical one-way isolation, which avoids reverse contamination of data caused by systematic vulnerabilities.

[0065] The first storage system has a logical area for storing important user data, which is defined as a "data safe". The data in the logical storage area is stored in the form of encrypted files in a specific format.

[0066] The file format is described using the self-parseable ASN.1 specification, including file header information, header checksum information, and a ciphertext payload with embedded hidden checksum information. The header checksum information is the CRC checksum information generated based on the file header information.

[0067] The ciphertext payload part embedded with hidden verification information is generated through the following steps: the first storage system encrypts the original user data according to a preset encryption algorithm, and embeds bit-level information in the obtained ciphertext using entropy coding, and the embedded hidden verification information is the header verification information of the file.

[0068] A special data transmission service process runs in the first storage system. This process monitors the file changes in the data safe. When a file content change or a new file (i.e., a file to be backed up) is found, the file format of the file to be backed up is first identified. If the file format is illegal, an alarm is sent to the upper layer. If the file format is correct, the file to be backed up is sent to the second storage system through the one-way optical gate network port.

[0069] Compared with the first storage system, the second storage system has a simpler structure and a relatively smaller storage capacity. It includes an MCU controller and a storage device. The transmission verification service process in the second storage system is also a resident process. When data arrives at the monitoring network port, it triggers a system interrupt, activates the data receiving thread, and then determines the file format of the received file; if the file header information is verified, the payload part of the file is entropy decoded to extract the embedded hidden verification information. If the hidden verification information is correct, a file backup is created based on the file name and attributes carried in the data packet header for full overlay storage. The number of full backups of the same file does not exceed N (for example, N<=16). Once exceeded, the earliest backup of the same file will be cyclically overwritten.

[0070] If the file header information verification fails, or the hidden verification information is incorrect, the received data is discarded.

[0071] To ensure the reliability of one-way data backup, once the first storage system starts the data transmission service, the transmitted file will be transmitted twice.

[0072] The entropy coding technology uses Golomb-Rice coding, which is a lossless information embedding algorithm. The average embedded information ratio can reach 0.169bpb. For the smallest packet of the payload part, 20 bits of hidden information can be embedded. In order to extract the hidden check information quickly and conveniently, we only embed the pre-agreed 16 bits of information in the first 16 bytes of encrypted packet data. This 16-bit hidden check information can be used as a validity verification credential.

[0073] During data recovery, the backup network ports of the first storage system and the second storage system are temporarily connected via a network cable. At this time, the data recovery subprocess of the data transmission service process on both sides will be activated, and a network connection will be established. The second storage system will transmit the backup file list and its attribute information to the first storage system. The first storage system will display the list of data to be recovered through an interface, and the user will select the backup file to recover the data file.

[0074] When the first storage system is invaded by a ransomware virus, the worst case scenario is that the files in the data safe can be accessed by means of system privilege escalation, and then the original files are encrypted and deleted "indiscriminately". In this case, according to the logic of this device, the data transmission service of the data safe will be triggered, and the service will send the contaminated files one by one, but the transmission verification service of the second storage system will verify the file format and hidden verification information of the received files, and the contaminated files will inevitably fail to pass the verification and be rejected.

[0075] Hidden verification information can be agreed upon in advance by both parties. Even if a malicious attacker can analyze the secure file format and forge it, the information embedding algorithm and specific embedded information cannot be obtained. Therefore, it is impossible to completely forge a legitimate encrypted file to deceive the transmission verification link of the second storage system, thereby ensuring that the second storage system will not be easily contaminated.

[0076] Since the second storage system is a relatively independent circuit system, there is no timely and effective feedback path for its operation status monitoring. Therefore, a one-way transmission channel with an ultra-low communication rate is also designed for the second storage system to report fault information. The principle is: add a high-brightness light-emitting diode to the second storage system, and add a photosensitive device to the first storage system. When the second storage system fails, Morse encoding is performed through the flashing of the light-emitting diode, and the light signal loaded with Morse coded data corresponding to the fault code is sent out. The photosensitive device of the first storage system captures the light signal, decodes the received light signal, obtains the Morse coded data loaded in the light signal, decodes the Morse coded data to obtain the corresponding fault code, and then reports the fault information to the application layer. Morse encoding and decoding can be performed according to the corresponding relationship between the preset Morse code and the flash time.

[0077] The transmission rate of this ultra-low communication rate unidirectional transmission channel is configured by the second storage system, and the fault code is basically reported at a rate of no more than 0.5 byte / s. The added reverse ultra-low speed signal transmission method can not only feedback the abnormal status of the second storage system to facilitate operation and maintenance judgment, but also limit the reverse transmission information entropy to avoid data loss.

[0078] In one embodiment, the entropy coding execution program and hidden verification information of the first operating system are written into a hardware security module HSM (Hardware Security Modules), and the hardware security module is upgraded by firmware, which can further enhance the security of the system.

[0079] In this embodiment, the first storage system only backs up "safe files" in a custom format to the second storage system, and uses entropy coding to embed specified verification information in the ciphertext payload part of the encrypted file. The file is double-checked by file format and hidden verification information, which can prevent the second storage system from being attacked by smart ransomware viruses, more reliably protect users' important data files, and support recovery at any time node; by adding a reverse ultra-low speed signal transmission method, the operability and maintainability of the second storage system can be improved.

[0080] One embodiment of the present invention, as Figure 3 As shown, a network attached storage device includes the data backup apparatus 100 described in the above embodiment.

[0081] It should be noted that the above embodiments can be freely combined as needed. The above are only preferred embodiments of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be regarded as the protection scope of the present invention.

Claims

1. A data backup method, characterized in that: include: When monitoring that a new file is added to the data safe or the content of an existing file has changed, the first storage system verifies the file header information of the file to be backed up, where the file to be backed up is the new file or the file with changed content; Each file in the data safe conforms to a preset format, wherein the preset format includes file header information, header check information, and a payload portion in which hidden check information is embedded; If the file header information verification passes, the first storage system transfers the file to be backed up to the second storage system; The second storage system verifies the received file header information of the file to be backed up; If the file header information verification passes, the second storage system extracts the embedded hidden verification information from the payload part of the file to be backed up; If the hidden verification information is correct, the second storage system performs a complete backup of the file to be backed up; Otherwise, the file to be backed up is discarded.

2. The data backup method according to claim 1, characterized in that: The second storage system extracts the embedded hidden verification information from the payload portion of the file to be backed up, including: The second storage system uses an entropy decoding algorithm to extract embedded hidden verification information from the payload portion of the file to be backed up.

3. The data backup method according to claim 1, characterized in that: Determining whether the hidden verification information is correct includes: If the hidden verification information is consistent with the preset embedded information, the hidden verification information is correct, otherwise it is incorrect.

4. The data backup method according to claim 3, characterized in that: Also includes: The preset embedded information is the header verification information of the file to be backed up or a part thereof; The second storage system obtains header verification information of the file to be backed up, and obtains the preset embedded information according to the header verification information.

5. The data backup method according to claim 2, characterized in that: The entropy decoding algorithm is the Golomb-Rice decoding algorithm.

6. The data backup method according to claim 1, characterized in that: The first storage system transmits the to-be-backed-up file to the second storage system through a unidirectional transmission channel.

7. The data backup method according to claim 1, characterized in that: Also includes: When a fault occurs, the second storage system sends an optical signal loaded with Morse code data corresponding to the fault code by flashing a light emitting diode; The first storage system captures the optical signal through a photosensitive device, decodes the optical signal, and obtains Morse coded data loaded in the optical signal; and converts the Morse coded data into a corresponding fault code according to a preset Morse coding table.

8. A data backup device, characterized in that: include: a first storage system and a second storage system; The first storage system comprises: A data safe for storing important user data; each file in the data safe conforms to a preset format, including file header information, header check information, and a payload portion embedded with hidden check information; A first verification module is used to verify the file header information of the backup file when monitoring the data safe for a new file or a change in the content of an existing file, and determine whether the file header information verification passes; the backup file is the new file or the file with changed content; A transmission module, used for transmitting the file to be backed up to the second storage system if the file header information verification passes; The second storage system comprises: The second verification module is used to verify the file header information of the received file to be backed up, and determine whether the file header information verification passes; A payload verification module, used to extract embedded hidden verification information from the payload part of the file to be backed up, and determine whether the extracted hidden verification information is correct; The backup module is used to perform a complete backup of the file to be backed up if the extracted hidden verification information is correct.

9. The data backup device according to claim 8, characterized in that: The payload verification module is also used to, if the file header information verification passes, perform entropy decoding on the payload part of the file to be backed up, and extract the embedded hidden verification information from the information after entropy decoding; if the hidden verification information is consistent with the preset embedded information, the hidden verification information is correct, otherwise the hidden verification information is incorrect.

10. A network attached storage device, characterized in that: Includes the data backup device as described in any one of claims 8-9.

Images