Authority management method and equipment of storage equipment and storage medium

Abstract

The invention discloses an authority management method and equipment for storage equipment and a storage medium, and relates to the technical field of authority management of the storage equipment, and the method comprises the following steps: dividing a storage space of the mobile storage equipment, carrying out initialization processing when a computer is connected for the first time, setting an authority management password, and generating an authority management table; giving and adjusting access authority to the computer connected with the mobile storage device; collecting daily use records of the mobile storage device, and predicting the use condition of the mobile storage device to obtain predicted use data of the device; dynamically adjusting the access authority of the mobile storage device based on the device prediction use data; the method is used for solving the problems that when an existing storage device authority management technology manages the authority of the mobile storage device, a management strategy is too static, the authority management strategy cannot be adjusted in time according to the use condition of the mobile storage device, and meanwhile the safety of stored data cannot be guaranteed in combination with multiple factors.

Description

Technical Field

[0001] The present invention relates to the technical field of storage device authority management, and in particular to a storage device authority management method, device and storage medium. Background Art

[0002] Storage device permission management technology is a technology used to control and manage user or system process access to data and resources in storage devices. It sets a series of rules and mechanisms to clarify the scope of permission for different users or processes to read, write, delete, execute and other operations on storage devices to ensure data security, integrity and confidentiality.

[0003] When managing the permissions of mobile storage devices, the existing storage device permission management technology is mostly static. Once the permissions are set, they will not change for a long time, making it difficult to strike a good balance between data security and user convenience. The previous permission management cannot reasonably allocate permissions according to the actual use of the device, resulting in users opening redundant permissions during certain idle periods, while in certain working periods, the work efficiency is low due to permission restrictions. For example, in the patent application with publication number CN110569650A, a method and system for managing permissions of mobile storage devices based on a domestic operating system are disclosed. The management method used in the solution to control file access behavior is static. The permission management is not flexible enough and cannot respond to changes in the device usage status. Moreover, the existing storage device permission management technology often relies on a single password authentication when managing the permissions of mobile storage devices, which has many risks. For example, the password may be guessed, stolen or obtained through brute force cracking. In addition, the existing technology usually divides the space of mobile storage devices in a relatively simple manner, and the password authentication process is relatively cumbersome, resulting in inconvenience for users to use the process. Therefore, when the existing storage device permission management technology manages the permissions of mobile storage devices, the management strategy is too static, and it is impossible to adjust the permission management strategy in time according to the usage of the mobile storage device, and combine multiple factors to ensure the security of stored data. Summary of the invention

[0004] The present invention aims to solve at least one of the technical problems in the prior art to a certain extent, by dividing the storage space of a mobile storage device, performing initialization processing when connecting to a computer for the first time, setting a permission management password, generating a permission management table; granting and adjusting access rights; collecting daily use records of the mobile storage device, predicting the use of the mobile storage device, and then dynamically adjusting the access rights of the mobile storage device; so as to solve the problem that the existing storage device permission management technology is too static when managing the permissions of the mobile storage device, and the permission management policy cannot be adjusted in time according to the use of the mobile storage device, and at the same time combine multiple factors to ensure the security of stored data.

[0005] To achieve the above objectives, in a first aspect, the present application provides a method for managing permissions of a storage device, comprising the following steps:

[0006] Divide the storage space of the mobile storage device, perform initialization processing when the mobile storage device is connected to the computer for the first time, set the permission management password, and generate a permission management table;

[0007] Granting and adjusting access rights to computers connected to mobile storage devices based on the rights management password and the rights management table;

[0008] Collect daily usage records of mobile storage devices to obtain device usage data, and predict the usage of mobile storage devices based on the device usage data to obtain device predicted usage data;

[0009] Dynamically adjust access permissions for mobile storage devices based on device predicted usage data.

[0010] Furthermore, the storage space of the mobile storage device is divided, initialization processing is performed when the mobile storage device is connected to the computer for the first time, a permission management password is set, and a permission management table is generated, including the following sub-steps:

[0011] The storage space of the mobile storage device is divided into an unencrypted space, a weakly encrypted space and a strongly encrypted space, and the sizes of the weakly encrypted space and the strongly encrypted space are dynamically adjusted according to the amount of data stored in the space;

[0012] Initialization processing: When the storage device is connected to the computer for the first time, the UUID of the computer is obtained by using the storage device, and a key generation process is performed based on the UUID. The obtained key is marked as the first management key, and the computer connected for the first time is marked as the management computer;

[0013] Based on the management computer, a password is set for the weak encryption space and the strong encryption space of the mobile storage device, marked as the permission management password; and two tables are generated, marked as the first table and the second table respectively, the first management key is recorded in the first table, and the first table and the second table are stored in the strong encryption space.

[0014] Furthermore, the key generation process based on UUID includes the following sub-steps:

[0015] Convert the hexadecimal UUID to a binary UUID, divide the binary UUID into 4 parts evenly, and mark them as the first part sequence, the second part sequence, the third part sequence, and the fourth part sequence according to the order in the UUID; obtain the first a1 bits of binary data of the first part sequence, which is recorded as the first chaotic sequence; invert the second part sequence, and obtain the last a1 bits of binary data, which is recorded as the second chaotic sequence; perform XOR calculation on the corresponding digits of the third part sequence and the fourth part sequence, and record the obtained sequence as the third chaotic sequence; divide the fourth part sequence into two parts evenly, perform NOR operation on the corresponding digits of the two parts, and then record the obtained sequence as the fourth chaotic sequence;

[0016] The first chaotic sequence, the second chaotic sequence, the third chaotic sequence and the fourth chaotic sequence are sequentially connected and marked as a fifth chaotic sequence, and a hash operation is performed on the fifth chaotic sequence, and the operation result is marked as a first management key.

[0017] Furthermore, granting and adjusting the access rights to the computer connected to the mobile storage device based on the rights management password and the rights management table includes the following sub-steps:

[0018] The access rights of mobile storage devices are divided into first-level access rights, second-level access rights, third-level access rights and fourth-level access rights, wherein the first-level access rights include: reading and writing files in the unencrypted space, the second-level access rights include: deleting and executing files in the unencrypted space, reading files in the weakly encrypted space, and the first-level access rights; the third-level access rights include: writing, deleting and executing files in the weakly encrypted space, and the second-level access rights; the fourth-level access rights include: reading, writing, deleting and executing files in the strongly encrypted space, and the third-level access rights.

[0019] Furthermore, granting and adjusting the access rights to the computer connected to the mobile storage device based on the rights management password and the rights management table also includes the following sub-steps:

[0020] When the mobile storage device is connected to the computer, the mobile storage device obtains the UUID of the computer, performs key generation processing based on the UUID, and compares the obtained key with the keys in the first table and the second table. If the key is completely consistent with the key in the first table, the computer is identified as a management computer; if the key is completely consistent with a key in the second table, the computer is identified as a trusted computer; otherwise, the computer is identified as an unknown computer;

[0021] If the mobile storage device is connected to the management computer, the third-level access right will be opened. If the permission management password is entered correctly, the fourth-level access right will be opened.

[0022] If the mobile storage device is connected to a trusted computer, the second-level access permission is enabled. If the permission management password is entered correctly, the third-level access permission is enabled.

[0023] If the mobile storage device is connected to an unknown computer, the first-level access permission will be released. If the permission management password is entered correctly, the third-level access permission will be released.

[0024] If the mobile storage device opens the fourth level access right, the UUID of the non-management computer is input into the mobile storage device, the mobile storage device performs key generation processing based on the UUID, and can write the obtained key into the second table.

[0025] Furthermore, collecting daily usage records of mobile storage devices to obtain device usage data, and predicting the usage of mobile storage devices based on the device usage data, and obtaining the device prediction usage data includes the following sub-steps:

[0026] Acquire the device status of the mobile storage device at a first time interval, and if the mobile storage device is connected to the computer and there is one or more of a read operation, a write operation, a delete operation, and an execute operation within the first time length, then determine that the mobile storage device is in use, otherwise determine that the mobile storage device is in an idle state, and the use state is recorded as "1" and the idle state is recorded as "0"; mark the obtained usage of the mobile storage device as device usage data, the first time interval is T1, and the first time length is T2;

[0027] Denote any data in the device usage data as Vi, where i represents the time when Vi is obtained. Traverse the device usage data. If Vi in the device usage data satisfies V(i+1)=V(i-1) and Vi≠V(i+1), then Vi is judged to be an abnormal point, and the abnormal point Vi is replaced by V(i+1), where V(i+1) is the data obtained at the last acquisition time of Vi, and V(i-1) is the data obtained at the next acquisition time of Vi.

[0028] The device usage data is divided into first time periods and marked as working periods; the working period marking includes: if the ratio of the number of 1s in any first time period to the total number of 0s and 1s in the period is less than 1%, then the first time period is marked as a rest period, otherwise the first time period is marked as a working period; the first time period is T0; based on the device usage data, all data in the rest period are eliminated, and the remaining device usage data is marked as the first usage data;

[0029] The device usage data is divided into the second time period. If the number of 1s in any second time period is greater than or equal to the number of 0s, the second time period is set to 1 as a whole. Otherwise, the second time period is set to 0 as a whole. After completion, the second usage data is obtained, and the second time period is T3.

[0030] Furthermore, collecting daily usage records of mobile storage devices to obtain device usage data, and predicting the usage of mobile storage devices based on the device usage data, and obtaining the device prediction usage data also includes the following sub-steps:

[0031] Based on the temporal convolutional network, the temporal convolutional network is trained using the first usage data and the second usage data, and the model training hyperparameter settings include: the initial learning rate is set to e1, the training round is set to e2, the batch size is set to e3, and the learning rate is reduced by 10% after every e4 training rounds;

[0032] After the training is completed, the time convolution network trained with the first use data is marked as a first prediction model; the time convolution network trained with the second use data is marked as a second prediction model;

[0033] Based on the first usage data, the first prediction model is used to predict the usage of the mobile storage device in the first time period in the future to obtain the first prediction data; based on the second usage data, the second prediction model is used to predict the usage of the mobile storage device in the third time period in the future to obtain the second prediction data; the third time period is T4, T4>T0;

[0034] The second prediction data is divided into the first time period and the working period is marked, and the second reference data is obtained after completion; the first prediction data is labeled based on the second reference data, if the first prediction data corresponds to the rest period within the second reference data, the label of the first prediction data is marked as invalid; if the first prediction data corresponds to the working period within the second reference data, the label of the first prediction data is marked as valid, and the first reference data is obtained after completion;

[0035] The first reference data and the second reference data are marked as device prediction usage data.

[0036] Furthermore, dynamically adjusting the access rights of the mobile storage device based on the device predicted usage data includes the following sub-steps:

[0037] If the tag of the first reference data is valid, the permissions are dynamically adjusted within the time corresponding to "1" in the first reference data;

[0038] Dynamic adjustment of permissions includes: adjusting the first-level access permissions to read, write, delete, and execute files in the unencrypted space; adjusting the second-level access permissions to read, write, execute, and the adjusted first-level access permissions for files in the weakly encrypted space.

[0039] In a second aspect, the present application provides an electronic device, including a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps in the above method are performed.

[0040] In a third aspect, the present application provides a storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps in the above method are performed.

[0041] Beneficial effects of the present invention: The present invention divides the storage space of the mobile storage device, performs initialization processing when the mobile storage device is connected to the computer for the first time, sets the permission management password, and generates a permission management table; grants and adjusts access rights to the computer connected to the mobile storage device based on the permission management password and the permission management table; collects daily use records of the mobile storage device to obtain device use data, predicts the use of the mobile storage device based on the device use data, and obtains device predicted use data; dynamically adjusts the access rights of the mobile storage device based on the device predicted use data; can timely adjust the permission management strategy according to the use of the mobile storage device, and at the same time combines space division, UUID and password authentication to ensure the security of stored data;

[0042] The present invention timely adjusts the permission management strategy by predicting the usage of the mobile storage device. The advantage is that the access rights of the device can be restricted in time when the device is not in use, thereby improving security. The access rights can be reasonably allocated according to the prediction of the usage time to avoid idleness and waste of resources. The permission allocation is performed by calculating the UUID, so that the permission can be reasonably allocated without entering the password authentication, and a more convenient usage experience can be provided to the user under the premise of ensuring security. The working cycle and the rest cycle are marked in the prediction process, so that the prediction failure caused by rest days can be avoided while ensuring the accuracy of the prediction, thereby avoiding the risk of data leakage caused by errors in dynamic adjustment of permissions. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 is a flow chart of the steps of the method of the present invention;

[0044] Figure 2 Granting access rights to the present invention to the flowchart;

[0045] Figure 3 A flow chart for dynamically adjusting access rights of the present invention;

[0046] Figure 4 It is a schematic structural diagram of the electronic device of the present invention. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] Example 1, please refer to Figure 1 See Figure 1 As shown, in a first aspect, the present application provides a method for managing permissions of a storage device, comprising the following steps:

[0049] Step S1, divide the storage space of the mobile storage device, perform initialization processing when the mobile storage device is connected to the computer for the first time, set the permission management password, and generate a permission management table; Step S1 includes the following sub-steps:

[0050] Step S101, the storage space of the mobile storage device is divided into an unencrypted space, a weakly encrypted space and a strongly encrypted space, and the sizes of the weakly encrypted space and the strongly encrypted space are dynamically adjusted according to the amount of data stored in the space; the unencrypted space is convenient for users to quickly store and share temporary, non-sensitive data; the weakly encrypted space is suitable for data that requires a certain degree of security but does not require high confidentiality, such as work documents; the strongly encrypted area is used to store extremely sensitive data, such as commercial secrets, personal privacy information, etc.;

[0051] Step S102, initialization processing; Step S102 includes the following sub-steps:

[0052] Step S1021, when the storage device is first connected to the computer, the UUID of the computer is obtained by using the storage device, and a key generation process is performed based on the UUID, the obtained key is marked as the first management key, and the computer connected for the first time is marked as the management computer; UUID is also called universal unique identification code, which is a 128-bit identifier composed of numbers and letters, usually represented by 32 hexadecimal digits;

[0053] Step S1022: a password is set for the weak encryption space and the strong encryption space of the mobile storage device based on the management computer, and is marked as a permission management password; the permission management password may be a character password or a biometric password, such as a fingerprint, and the permission management password is set to build a multi-layer protection for the mobile storage device in combination with the first management key;

[0054] Step S1023, generating two tables, marked as the first table and the second table respectively, recording the first management key in the first table, and storing the first table and the second table in the strong encryption space; the first table only stores the first management key generated by the management computer UUID, and the second table can store keys generated by other computer UUIDs, so as to facilitate subsequent permission management;

[0055] Step S103, performing key generation processing based on the UUID, step S103 includes the following sub-steps:

[0056] Step S1031, converting the hexadecimal UUID into a binary UUID, dividing the binary UUID into four parts evenly, and marking them as a first part sequence, a second part sequence, a third part sequence, and a fourth part sequence according to the order in the UUID; for example, a computer UUID is 03560274-043C-0598-3E06-B30700080009, then after conversion to binary, the first part sequence is 110101011000000010011101000274, the second part sequence is 100001111000000010110011000, the third part sequence is 111110000001101011001100000111, and the fourth part sequence is 1000000000000001001;

[0057] Step S1032, obtaining the first a1 bits of binary data of the first partial sequence, recorded as the first chaotic sequence; in this embodiment, a1 is 16, for example, the first partial sequence is 110101011000000010011101000274, the first 16 bits are 1101010110000000, that is, the first chaotic sequence is 1101010110000000

[0058] Step S1033, invert the second partial sequence, and obtain the last a1 bits of binary data, which are recorded as the second chaotic sequence; for example, if the second partial sequence is 100001111000000010110011000, the last 16 bits are 0000010110011000, which are inverted to 1111101001100111, that is, the second chaotic sequence is 1111101001100111;

[0059] Step S1034, perform XOR calculation on the corresponding digits of the third partial sequence and the fourth partial sequence, and record the obtained sequence as the third chaotic sequence; the XOR calculation rule is that if the two values ​​are 0 or both are 1, the result is 0, otherwise the result is 1. For example, the third partial sequence is 111110000001101011001100000111, and the fourth partial sequence is 10000000000000001001; then the third chaotic sequence is 111110000011101011001100001110

[0060] Step S1035, the fourth sequence is evenly divided into two parts, and the two parts are subjected to a corresponding digit OR operation, and the resulting sequence is recorded as a fourth chaotic sequence; the OR calculation rule is that the result is 1 only when both values ​​are 0, otherwise it is 0. For example, the fourth sequence is 10000000000000001001, which is evenly divided into two parts, 1000000000 and 0000001001, then the fourth chaotic sequence is 0111110110

[0061] Step S1036, connecting the first chaotic sequence, the second chaotic sequence, the third chaotic sequence and the fourth chaotic sequence in sequence, marking them as a fifth chaotic sequence, and performing a hash operation on the fifth chaotic sequence. The hash operation is also called a hash function, which is a function that maps data of any length to a hash value of a fixed length. In this embodiment, the SHA-256 hash algorithm is used, and the operation result is marked as a first management key.

[0062] In the specific implementation process, the UUID is subjected to complex operations such as segmentation, extraction, reversal and combination, and finally a hash function is used to generate the final key, which makes it almost impossible to reversely derive the original UUID from the generated key. Even if the key is leaked, it is difficult for an attacker to obtain the UUID used to identify the device, thereby protecting the security of the device identification information. In addition, the process of generating the key is not a simple direct conversion, but involves a variety of irregular operations. It is difficult for an attacker to guess the specific association between the key and the UUID, which greatly increases the difficulty of brute force cracking or obtaining the key by guessing. For example, if an attacker does not know the specific calculation rules and combination methods, it is difficult to construct the correct key.

[0063] Step S2, granting and adjusting access rights to the computer connected to the mobile storage device based on the rights management password and the rights management table; Step S2 includes the following sub-steps:

[0064] Step S201, dividing the access rights of the mobile storage device into first-level access rights, second-level access rights, third-level access rights and fourth-level access rights, wherein the first-level access rights include: reading and writing files in the non-encrypted space, the second-level access rights include: deleting and executing files in the non-encrypted space, reading files in the weakly encrypted space, and the first-level access rights; the third-level access rights include: writing, deleting and executing files in the weakly encrypted space, and the second-level access rights; the fourth-level access rights include: reading, writing, deleting and executing files in the strongly encrypted space, and the third-level access rights;

[0065] Step S202, when the mobile storage device is connected to the computer, the mobile storage device obtains the UUID of the computer, and performs key generation processing based on the UUID, and compares the obtained key with the keys in the first table and the second table. If the key is completely consistent with the key in the first table, the computer is identified as a management computer; if the key is completely consistent with a key in the second table, the computer is identified as a trusted computer; otherwise, the computer is identified as an unknown computer; the key in the second table can be added by the user;

[0066] Step S203, see Figure 2 As shown, if the mobile storage device is connected to the management computer, the third-level access right is opened, and if the right management password is entered correctly, the fourth-level access right is opened; that is, the fourth-level access right requires dual authentication of the right management password and the management computer;

[0067] Step S204: if the mobile storage device is connected to a trusted computer, the second-level access right is opened, and if the right management password is correctly entered, the third-level access right is opened;

[0068] Step S205, if the mobile storage device is connected to an unknown computer, the first-level access right is opened, and if the right management password is correctly entered, the third-level access right is opened;

[0069] Step S206, if the mobile storage device opens the fourth level access right, the UUID of the non-management computer is input into the mobile storage device, the mobile storage device performs key generation processing based on the UUID, and can write the obtained key into the second table; because the second table is stored in the strong encryption area, the fourth level access right is required to write;

[0070] In the specific implementation process, permission management is performed by directly identifying the computer's UUID, which provides convenience for users while ensuring data security; by dividing areas with different encryption strengths, data can be layered for protection, and data in non-encrypted areas can be directly accessed without any decryption process. For example, when some commonly used files need to be quickly transferred between different computers, they can be directly copied and used from the non-encrypted area of ​​the mobile storage device, meeting diverse data storage and management needs.

[0071] Step S3, collecting daily usage records of the mobile storage device to obtain device usage data, and predicting the usage of the mobile storage device based on the device usage data to obtain device predicted usage data; Step S3 includes the following sub-steps:

[0072] Step S301, obtaining the device status of the mobile storage device at a first time interval. If the mobile storage device is connected to the computer and there is one or more of a read operation, a write operation, a delete operation and an execute operation within the first time length, the mobile storage device is judged to be in a use state. Otherwise, the mobile storage device is judged to be in an idle state. The first time length is T2. In this embodiment, the first time length T2 is 30 minutes. The device status of the mobile storage device is judged to ensure the accuracy of subsequent data acquisition and prevent the state of the mobile storage device being only connected to the computer but not used from being misjudged as a use state.

[0073] Step S302, the usage status is recorded as "1", and the idle status is recorded as "0"; the usage status of the obtained mobile storage device is marked as device usage data, and the first time interval is T1. In this embodiment, the first time interval is 2 minutes, that is, the device status of the mobile storage device is obtained once every 2 minutes;

[0074] Step S303, record any data in the device usage data as Vi, where i represents the time when Vi is obtained, traverse the device usage data, and if Vi in the device usage data satisfies V(i+1)=V(i-1) and Vi≠V(i+1), then determine that Vi is an abnormal point, and replace the abnormal point Vi with V(i+1), where V(i+1) is the data obtained at the last acquisition time of Vi, and V(i-1) is the data obtained at the next acquisition time of Vi; for example, the device usage data obtained from 14:00 to 14:30 is 11111111011111111. From the data, the mobile storage device should have been used from 14:00 to 14:30, and "0" is obviously wrong data, so "0" should be changed to "1";

[0075] Step S303, dividing the device usage data into first time periods and marking the working period; the working period marking includes: if the ratio of the number of 1s in any first time period to the total number of 0s and 1s in the period is less than 1%, then marking the first time period as a rest period, otherwise marking the first time period as a working period; the first time period is T0; in this embodiment, the first time period is 1 day, i.e. 24 hours, i.e., if the ratio of the number of 1s in the device usage data of one day to the total number of 0s and 1s is less than 1%, then this day is a rest period, and this is done to identify the user's rest day;

[0076] Step S304, based on the device usage data, all data in the rest period are removed, and the remaining device usage data is marked as the first usage data; because when predicting the usage in the first time period in the future, the rest period, that is, the data collected on the user's rest day, is not referenceable, so it needs to be removed;

[0077] Step S305, divide the device usage data into the second time period, if the number of 1s in any second time period is greater than or equal to the number of 0s, then the second time period is set to 1 as a whole, otherwise the second time period is set to 0 as a whole, and the second usage data is obtained after completion, and the second time period is T3; in this embodiment, the second time period T3 is 20 minutes, that is, the device usage data collected at the first time interval is merged into data with the second time period as a new interval, for example, data with an interval of 2 minutes is merged into data with an interval of 20 minutes, if the data collected within 20 minutes is 1110000000, the number of 0s is greater than the number of 1s, so the entire 20 minutes is set to 0, because the purpose of subsequent long-term prediction of the use of mobile storage devices is mainly to predict the working cycle and the rest cycle, and data with too high a collection frequency is not helpful for the prediction result, and the prediction efficiency will be affected due to too much data, so it is necessary to divide and merge;

[0078] Step S306, based on the temporal convolutional network, the temporal convolutional network is trained using the first usage data and the second usage data, and the model training hyperparameter settings include: the initial learning rate is set to e1, the training round is set to e2, the batch size is set to e3, and the learning rate is reduced by 10% after every e4 training rounds; in this embodiment, e1=0.001, e2=200, e3=32, e4=10, that is, the learning rate is multiplied by 0.9 after every 10 rounds, for example, the learning rate is 0.001 at the beginning, and after 10 rounds of training, the learning rate becomes 0.0009;

[0079] Step S307, after the training is completed, the temporal convolutional network trained with the first use data is marked as a first prediction model; the temporal convolutional network trained with the second use data is marked as a second prediction model;

[0080] Step S308, predicting the usage of the mobile storage device in the first time period in the future based on the first usage data using the first prediction model to obtain first prediction data; the prediction mainly predicts the specific usage of the mobile storage device, for example, if the first time period is 1 day, then predicting when the mobile storage device will be used and when it will not be used in the next day; and predicting the data for one day usually requires 3-5 days of data;

[0081] Step S309, predicting the usage of the mobile storage device in the third time period in the future based on the second usage data using the second prediction model to obtain second prediction data; the third time period is T4, T4>T0; the prediction mainly predicts the working cycle and rest cycle of the mobile storage device. In this embodiment, the third time period T4 is 7 days, that is, predicting which day is the working cycle and which day is the rest cycle in the next 7 days;

[0082] Step S310, dividing the second prediction data into the first time period and marking the working period, and obtaining the second reference data after completion; for example, in this embodiment, the third time period T4 is 7 days, and the first time period is 1 day, that is, marking which day is the rest period and which day is the working period based on the prediction data of the next 7 days;

[0083] Step S311, label the first prediction data based on the second reference data. If the first prediction data corresponds to a rest period in the second reference data, the label of the first prediction data is marked as invalid; if the first prediction data corresponds to a working period in the second reference data, the label of the first prediction data is marked as valid. After completion, the first reference data is obtained; because the first prediction data only predicts the usage within the working period, it is impossible to predict the rest period. For example, when predicting the usage of a day, it is impossible to predict whether tomorrow is a rest period, so the second reference data is needed as an auxiliary judgment. If the second reference data shows that tomorrow is a rest period, it means that the usage predicted in the first prediction data is invalid because it will not be used tomorrow.

[0084] Step S312, marking the first reference data and the second reference data as device predicted usage data;

[0085] In the specific implementation process, the time convolution network is a deep learning architecture specifically used to process time series data, and is specially designed for processing time series; the basic structure includes an input layer, multiple convolution layers, an optional pooling layer and an output layer; the input layer receives time series data, such as the usage status sequence of a mobile storage device every minute; the convolution layer extracts features by sliding the convolution kernel on the time dimension; the pooling layer can be used to reduce the data dimension, and the output layer outputs the prediction result according to the specific task; when training the time convolution network, the first usage data and the second usage data need to be divided into a training set and a test set respectively, and a loss function and an evaluation function are set, and then the time convolution network is trained with two training sets respectively. After the training is completed, the corresponding test sets are used for testing respectively, and then the evaluation function is used for evaluation. If it fails, the training continues until it passes. In this embodiment, the loss function is the mean square error, and the mean square error formula is as follows: Among them, MSE is the mean square error, Yi is the predicted value, and Xi is the actual value; the evaluation function is the accuracy, that is, the proportion of predicted points to all predicted points is calculated, and it is considered qualified when the accuracy is greater than 90%.

[0086] Step S4, dynamically adjusting the access rights of the mobile storage device based on the device predicted usage data; Step S4 includes the following sub-steps:

[0087] Step S401, see Figure 3 As shown, if the tag of the first reference data is valid, the permission is dynamically adjusted within the time corresponding to "1" in the first reference data; the time corresponding to "1" is the predicted usage time of the mobile storage device;

[0088] Step S402, dynamic adjustment of permissions includes: adjusting the first-level access permission to read, write, delete and execute files in the non-encrypted space, and adjusting the second-level access permission to read, write, execute files in the weakly encrypted space, and the adjusted first-level access permission;

[0089] In the specific implementation process, permissions are dynamically adjusted only within the time corresponding to "1" in order to ensure the security of the mobile storage device, because the mobile storage device will not be used all the time during the first time period. For example, if the working hours of a day are from 9 a.m. to 6 p.m., permissions are dynamically adjusted only from 9 a.m. to 6 p.m., which improves the user experience while ensuring security.

[0090] Example 2, please refer to Figure 4 As shown, Figure 4The structural diagram of an electronic device is illustrated, and the electronic device may include: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus. The memory stores computer-readable instructions, and the processor can call the instructions in the memory. When the computer-readable instructions are executed by the processor, the steps in a method, device and storage medium for managing permissions of a storage device are executed to achieve the following functions: partitioning the storage space of a mobile storage device, performing initialization processing when the mobile storage device is connected to a computer for the first time, setting a permission management password, and generating a permission management table; granting and adjusting access rights to a computer connected to the mobile storage device based on the permission management password and the permission management table; collecting daily use records of the mobile storage device to obtain device use data, predicting the use of the mobile storage device based on the device use data, and obtaining device predicted use data; and dynamically adjusting the access rights of the mobile storage device based on the device predicted use data.

[0091] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0092] Embodiment 3, the present application also provides a computer-readable storage medium, the present application provides a storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps in the permission management method, device and storage medium of the above storage device are executed to achieve the following functions: divide the storage space of the mobile storage device, perform initialization processing when the mobile storage device is connected to the computer for the first time, set a permission management password, and generate a permission management table; grant and adjust access rights of the computer connected to the mobile storage device based on the permission management password and the permission management table; collect daily usage records of the mobile storage device to obtain device usage data, predict the usage of the mobile storage device based on the device usage data, and obtain device predicted usage data; dynamically adjust the access rights of the mobile storage device based on the device predicted usage data.

[0093] Through the description of the above implementation methods, the embodiments of the present invention can be provided as methods, systems or computer program products. Based on such an understanding, the above technical solutions can be essentially or partly contributed to the prior art in the form of software products, which can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and include several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0094] In the embodiments provided in the present application, it should be understood that the disclosed system or method can be implemented in other ways. The embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or units can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of systems, modules and units can be electrical, mechanical or other forms.

[0095] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for managing permissions of a storage device, characterized in that: The steps include: Divide the storage space of the mobile storage device, perform initialization processing when the mobile storage device is connected to the computer for the first time, set the permission management password, and generate a permission management table; Granting and adjusting access rights to computers connected to mobile storage devices based on the rights management password and the rights management table; Collect daily usage records of mobile storage devices to obtain device usage data, and predict the usage of mobile storage devices based on the device usage data to obtain device predicted usage data; Dynamically adjust access permissions for mobile storage devices based on device predicted usage data.

2. A method for managing permissions of a storage device according to claim 1, characterized in that: The steps of dividing the storage space of the mobile storage device, initializing the mobile storage device when it is first connected to the computer, setting the permission management password, and generating the permission management table include the following sub-steps: The storage space of the mobile storage device is divided into an unencrypted space, a weakly encrypted space and a strongly encrypted space, and the sizes of the weakly encrypted space and the strongly encrypted space are dynamically adjusted according to the amount of data stored in the space; Initialization processing: When the storage device is connected to the computer for the first time, the UUID of the computer is obtained by using the storage device, and a key generation process is performed based on the UUID. The obtained key is marked as the first management key, and the computer connected for the first time is marked as the management computer; A password is set for the weak encryption space and the strong encryption space of the mobile storage device based on the management computer, and is marked as the permission management password; Two tables are generated, marked as a first table and a second table respectively, the first management key is recorded in the first table, and the first table and the second table are stored in the strong encryption space.

3. A method for managing permissions of a storage device according to claim 2, characterized in that: The key generation process based on UUID includes the following sub-steps: Convert the hexadecimal UUID to a binary UUID, divide the binary UUID into 4 parts evenly, and mark them as the first part sequence, the second part sequence, the third part sequence, and the fourth part sequence according to the order in the UUID; obtain the first a1 bits of binary data of the first part sequence, which is recorded as the first chaotic sequence; invert the second part sequence, and obtain the last a1 bits of binary data, which is recorded as the second chaotic sequence; perform XOR calculation on the corresponding digits of the third part sequence and the fourth part sequence, and record the obtained sequence as the third chaotic sequence; divide the fourth part sequence into two parts evenly, perform NOR operation on the corresponding digits of the two parts, and then record the obtained sequence as the fourth chaotic sequence; The first chaotic sequence, the second chaotic sequence, the third chaotic sequence and the fourth chaotic sequence are sequentially connected and marked as a fifth chaotic sequence, and a hash operation is performed on the fifth chaotic sequence, and the operation result is marked as a first management key.

4. A method for managing permissions of a storage device according to claim 3, characterized in that: The granting and adjusting of access rights to a computer connected to a mobile storage device based on a rights management password and a rights management table includes the following sub-steps: The access rights of mobile storage devices are divided into first-level access rights, second-level access rights, third-level access rights and fourth-level access rights, wherein the first-level access rights include: reading and writing files in the unencrypted space, the second-level access rights include: deleting and executing files in the unencrypted space, reading files in the weakly encrypted space, and the first-level access rights; the third-level access rights include: writing, deleting and executing files in the weakly encrypted space, and the second-level access rights; the fourth-level access rights include: reading, writing, deleting and executing files in the strongly encrypted space, and the third-level access rights.

5. A method for managing permissions of a storage device according to claim 4, characterized in that: The granting and adjusting of access rights to a computer connected to a mobile storage device based on the rights management password and the rights management table also includes the following sub-steps: When the mobile storage device is connected to the computer, the mobile storage device obtains the UUID of the computer, performs key generation processing based on the UUID, and compares the obtained key with the keys in the first table and the second table. If the key is completely consistent with the key in the first table, the computer is identified as a management computer; if the key is completely consistent with a key in the second table, the computer is identified as a trusted computer; otherwise, the computer is identified as an unknown computer; If the mobile storage device is connected to the management computer, the third-level access right will be opened. If the permission management password is entered correctly, the fourth-level access right will be opened. If the mobile storage device is connected to a trusted computer, the second-level access permission is enabled. If the permission management password is entered correctly, the third-level access permission is enabled. If the mobile storage device is connected to an unknown computer, the first-level access permission will be released. If the permission management password is entered correctly, the third-level access permission will be released. If the mobile storage device opens the fourth level access right, the UUID of the non-management computer is input into the mobile storage device, the mobile storage device performs key generation processing based on the UUID, and can write the obtained key into the second table.

6. A method for managing permissions of a storage device according to claim 5, characterized in that: Collecting daily usage records of mobile storage devices to obtain device usage data, and predicting the usage of mobile storage devices based on the device usage data. Obtaining the device prediction usage data includes the following sub-steps: Acquire the device status of the mobile storage device at a first time interval, if the mobile storage device is connected to the computer and there is one or more of a read operation, a write operation, a delete operation and an execute operation within the first time length, then determine that the mobile storage device is in use, otherwise determine that the mobile storage device is in an idle state, and the use state is recorded as "1", and the idle state is recorded as "0"; mark the usage of the acquired mobile storage device as device usage data, the first time interval is T1, and the first time length is T2; Denote any data in the device usage data as Vi, where i represents the time when Vi is obtained. Traverse the device usage data. If Vi in the device usage data satisfies V(i+1)=V(i-1) and Vi≠V(i+1), then Vi is judged to be an abnormal point, and the abnormal point Vi is replaced by V(i+1), where V(i+1) is the data obtained at the last acquisition time of Vi, and V(i-1) is the data obtained at the next acquisition time of Vi. The device usage data is divided into first time periods and marked as working periods; the working period marking includes: if the ratio of the number of 1s in any first time period to the total number of 0s and 1s in the period is less than 1%, then the first time period is marked as a rest period, otherwise the first time period is marked as a working period; the first time period is T0; based on the device usage data, all data in the rest period are eliminated, and the remaining device usage data is marked as the first usage data; The device usage data is divided into the second time period. If the number of 1s in any second time period is greater than or equal to the number of 0s, the second time period is set to 1 as a whole. Otherwise, the second time period is set to 0 as a whole. After completion, the second usage data is obtained, and the second time period is T3.

7. A method for managing permissions of a storage device according to claim 6, characterized in that: Collecting daily usage records of mobile storage devices to obtain device usage data, and predicting the usage of mobile storage devices based on the device usage data, and obtaining the device prediction usage data also includes the following sub-steps: Based on the temporal convolutional network, the temporal convolutional network is trained using the first usage data and the second usage data, and the model training hyperparameter settings include: the initial learning rate is set to e1, the training round is set to e2, the batch size is set to e3, and the learning rate is reduced by 10% after every e4 training rounds; After the training is completed, the time convolution network trained with the first use data is marked as a first prediction model; the time convolution network trained with the second use data is marked as a second prediction model; Based on the first usage data, the first prediction model is used to predict the usage of the mobile storage device in the first time period in the future to obtain the first prediction data; based on the second usage data, the second prediction model is used to predict the usage of the mobile storage device in the third time period in the future to obtain the second prediction data; the third time period is T4, T4>T0; The second prediction data is divided into the first time period and the working period is marked, and the second reference data is obtained after completion; the first prediction data is labeled based on the second reference data, if the first prediction data corresponds to the rest period within the second reference data, the label of the first prediction data is marked as invalid; if the first prediction data corresponds to the working period within the second reference data, the label of the first prediction data is marked as valid, and the first reference data is obtained after completion; The first reference data and the second reference data are marked as device prediction usage data.

8. A method for managing permissions of a storage device according to claim 7, characterized in that: Dynamically adjusting access rights to mobile storage devices based on device predicted usage data includes the following sub-steps: If the tag of the first reference data is valid, the permissions are dynamically adjusted within the time corresponding to "1" in the first reference data; Dynamic adjustment of permissions includes: adjusting the first-level access permissions to read, write, delete, and execute files in the unencrypted space; adjusting the second-level access permissions to read, write, execute, and the adjusted first-level access permissions for files in the weakly encrypted space.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the steps in the method according to any one of claims 1 to 7 are executed.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps in the method according to any one of claims 1 to 7 are executed.

Images