A permission management method and device of a storage device and a storage medium

Abstract

The application discloses a kind of authority management method, equipment and storage medium of storage device, it is related to storage device authority management technical field, including the following steps: the storage space of mobile storage device is divided, initialization processing is carried out when first connecting computer, set authority management password, and generate authority management table;And the access authority of computer connected with mobile storage device is given and adjustment;Collect the daily use record of mobile storage device, predict the use of mobile storage device, obtain equipment predicted use data;Based on equipment predicted use data, the access authority of mobile storage device is dynamically adjusted;The application is used to solve the problem that the existing storage device authority management technology is too static when managing the authority of mobile storage device, cannot adjust authority management strategy in time according to the use of mobile storage device, and combines multiple factors to ensure the security of storage data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of storage device permission management, in particular to a storage device permission management method, device and storage medium. BACKGROUND

[0002] Storage device permission management technology is a technology for controlling and managing user or system process access to data and resources in a storage device; it sets a series of rules and mechanisms to clearly define the permission range of different users or processes for reading, writing, deleting, executing and other operations on the storage device, to ensure the security, integrity and confidentiality of data.

[0003] The existing storage device permission management technology is mostly static in managing the permissions of mobile storage devices, and once the permissions are set, they will not change for a long time, making it difficult to strike a good balance between data security and user convenience. The previous permission management cannot reasonably allocate permissions according to the actual use of the device, resulting in the opening of excess permissions during some idle periods, while in some work periods, the work efficiency is low due to permission restrictions. For example, in the patent application with publication number CN110569650A, a mobile storage device permission management method and system based on a domestic operating system are disclosed. The management method used when controlling file access behavior is fixed and unchangeable, and the permission management is not flexible enough to respond to changes in device usage status. Moreover, the existing storage device permission management technology often relies on a single password authentication when managing the permissions of mobile storage devices, which poses many risks, such as the password being guessed, stolen or obtained through brute force cracking. In addition, the existing technology usually divides the space of the mobile storage device in a single way, and the password authentication process is cumbersome, making the user experience inconvenient. Therefore, the existing storage device permission management technology is too static in managing the permissions of mobile storage devices, and cannot adjust the permission management strategy in a timely manner according to the use of the mobile storage device, while combining multiple factors to ensure the security of the stored data. SUMMARY

[0004] The present application aims to at least solve one of the technical problems in the prior art, by dividing the storage space of the mobile storage device, initializing the process when first connecting the computer, setting the permission management password, generating the permission management table; and giving and adjusting the access permission; collecting the daily use records of the mobile storage device, predicting the use of the mobile storage device, and dynamically adjusting the access permission of the mobile storage device; to solve the problem that the existing storage device permission management technology is too static in managing the permissions of the mobile storage device, and cannot adjust the permission management strategy in time according to the use of the mobile storage device, and at the same time, combined with multiple factors to ensure the security of the storage data.

[0005] To achieve the above-mentioned purpose, in a first aspect, the present application provides a permission management method of a storage device, comprising the following steps:

[0006] Divide the storage space of the mobile storage device, initialize the process when the mobile storage device first connects the computer, set the permission management password, and generate the permission management table;

[0007] Based on the permission management password and the permission management table, the access permission of the computer connected to the mobile storage device is given and adjusted;

[0008] Collect the daily use records of the mobile storage device to obtain device use data, predict the use of the mobile storage device based on the device use data to obtain device predicted use data;

[0009] Based on the device predicted use data, the access permission of the mobile storage device is dynamically adjusted.

[0010] Further, dividing the storage space of the mobile storage device, initializing the process when the mobile storage device first connects the computer, setting the permission management password, and generating the permission management table comprises the following sub-steps:

[0011] The storage space of the mobile storage device is divided into unencrypted space, weakly encrypted space and strongly encrypted space, and the space size of the weakly encrypted space and the strongly encrypted space is dynamically adjusted according to the amount of data stored in the space;

[0012] Initialization process: when the storage device first accesses the computer, the UUID of the computer is obtained by using the storage device, and the key generation process is performed based on the UUID, the obtained key is marked as the first management key, and the computer first accessed is marked as the management computer;

[0013] The management computer sets a password based on the weak encryption space and the strong encryption space of the mobile storage device, and marks it as a permission management password; and generates two tables, respectively marked as a first table and a second table, records the first management key in the first table, and stores the first table and the second table in the strong encryption space.

[0014] Further, the key generation process based on the UUID includes the following sub-steps:

[0015] The UUID in hexadecimal is converted into a UUID in binary, the UUID in binary is evenly divided into four parts, and the four parts are marked as a first part sequence, a second part sequence, a third part sequence, and a fourth part sequence in the order of front and back in the UUID; the first a1 bits of the first part sequence are obtained, and are marked as a first chaotic sequence; the second part sequence is negated, and the last a1 bits are obtained, and are marked as a second chaotic sequence; the third part sequence and the fourth part sequence are XOR calculated in corresponding digits, and the obtained sequence is marked as a third chaotic sequence; the fourth part sequence is evenly divided into two parts, and the two parts are OR NOT calculated in corresponding digits, and the obtained sequence is marked as a fourth chaotic sequence;

[0016] The first chaotic sequence, the second chaotic sequence, the third chaotic sequence, and the fourth chaotic sequence are sequentially connected, marked as a fifth chaotic sequence, the fifth chaotic sequence is subjected to a hash operation, and the operation result is marked as a first management key.

[0017] Further, the permission giving and adjusting of the computer connected to the mobile storage device based on the permission management password and the permission management table includes the following sub-steps:

[0018] The access permission of the mobile storage device is divided into a first-level access permission, a second-level access permission, a third-level access permission, and a fourth-level access permission, wherein the first-level access permission includes reading and writing of files in the non-encryption space, the second-level access permission includes deleting and executing files in the non-encryption space, reading files in the weak encryption space, and the first-level access permission; the third-level access permission includes writing, deleting, and executing files in the weak encryption space, and the second-level access permission; and the fourth-level access permission includes reading, writing, deleting, and executing files in the strong encryption space, and the third-level access permission.

[0019] Further, the permission giving and adjusting of the computer connected to the mobile storage device based on the permission management password and the permission management table includes the following sub-steps:

[0020] When the mobile storage device connects the computer, the mobile storage device acquires the UUID of the computer, and performs key generation processing based on the UUID, compares the obtained key with the keys in the first table and the second table, if the key is completely consistent with the key in the first table, the computer is identified as a management computer, if the key is completely consistent with a key in the second table, the computer is identified as a trusted computer, otherwise the computer is identified as an unknown computer;

[0021] If the mobile storage device connects the management computer, the three-level access permission is opened, and if the permission management password is correctly input again, the four-level access permission is opened;

[0022] If the mobile storage device connects the trusted computer, the two-level access permission is opened, and if the permission management password is correctly input again, the three-level access permission is opened;

[0023] If the mobile storage device connects the unknown computer, the one-level access permission is opened, and if the permission management password is correctly input again, the three-level access permission is opened;

[0024] If the mobile storage device opens the four-level access permission, the UUID of the non-management computer is input into the mobile storage device, the mobile storage device performs key generation processing based on the UUID, and the obtained key can be written into the second table.

[0025] Further, the daily use record of the mobile storage device is collected to obtain device use data, the use of the mobile storage device is predicted based on the device use data to obtain device predicted use data, including the following sub-steps:

[0026] The device state of the mobile storage device is acquired at a first time interval, if the mobile storage device connects the computer and one or more of the read operation, write operation, delete operation and execute operation exist within a first time length, it is judged that the mobile storage device is in use state, otherwise it is judged that the mobile storage device is in idle state, the use state is marked as "1", and the idle state is marked as "0"; the use of the mobile storage device is marked as device use data, the first time interval is T1, and the first time length is T2;

[0027] Any data in the device use data is marked as Vi, where i represents the time when Vi is acquired, the device use data is traversed, if Vi in the device use data satisfies V(i+1)=V(i-1) and Vi≠V(i+1), it is judged that Vi is an abnormal point, the abnormal point Vi is replaced by V(i+1), where V(i+1) is the data acquired at the previous acquisition time of Vi, and V(i-1) is the data acquired at the next acquisition time of Vi;

[0028] Divide the device usage data into first time periods and mark work periods; the work period marking includes: if the number of 1s in any first time period is less than 1% of the total number of 0s and 1s in the period, mark the first time period as a rest period, otherwise mark the first time period as a work period; the first time period is T0; remove all data in the rest period based on the device usage data, and mark the remaining device usage data as first usage data;

[0029] Divide the device usage data into second time periods, if the number of 1s in any second time period is greater than or equal to the number of 0s, set the second time period as 1 as a whole, otherwise set the second time period as 0 as a whole, and obtain second usage data after completion, the second time period is T3.

[0030] Further, collect daily usage records of the mobile storage device to obtain device usage data, and predict the use of the mobile storage device based on the device usage data to obtain device prediction usage data, which further includes the following sub-steps:

[0031] Based on the time convolution network, the first usage data and the second usage data are used to train the time convolution network, and the model training hyperparameter setting includes: the initial learning rate is set to e1, the training round is set to e2, the batch size is set to e3, and the learning rate is reduced by 10% after every e4 training rounds;

[0032] After training is completed, the time convolution network trained by the first usage data is marked as a first prediction model; and the time convolution network trained by the second usage data is marked as a second prediction model;

[0033] Based on the first usage data, the first prediction model is used to predict the use of the mobile storage device in a future first time period to obtain first prediction data; based on the second usage data, the second prediction model is used to predict the use of the mobile storage device in a future third time period to obtain second prediction data; the third time period is T4, and T4>T0;

[0034] Divide the second prediction data into first time periods and mark work periods, and obtain second reference data after completion; based on the second reference data, the first prediction data is labeled, if the first prediction data corresponds to a rest period in the second reference data, the label of the first prediction data is marked as invalid; if the first prediction data corresponds to a work period in the second reference data, the label of the first prediction data is marked as valid, and first reference data is obtained after completion;

[0035] The first reference data and the second reference data are marked as device prediction usage data.

[0036] Further, dynamically adjusting the access permission of the mobile storage device based on the device prediction use data comprises the following sub-steps:

[0037] If the label of the first reference data is valid, the permission is dynamically adjusted in the time corresponding to the "1" in the first reference data.

[0038] The permission dynamic adjustment comprises: adjusting the first-level access permission to read, write, delete and execute the file in the non-encryption space, adjusting the second-level access permission to read, write and execute the file in the weak encryption space, and adjusting the first-level access permission after adjustment.

[0039] In a second aspect, the application provides an electronic device comprising a processor and a memory, wherein the memory stores computer readable instructions, and when the computer readable instructions are executed by the processor, the steps of the above method are executed.

[0040] In a third aspect, the application provides a storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the above method are executed.

[0041] The application has the following beneficial effects: the application divides the storage space of the mobile storage device, performs initialization processing when the mobile storage device is connected to a computer for the first time, sets a permission management password, and generates a permission management table; the access permission of the computer connected to the mobile storage device is given and adjusted based on the permission management password and the permission management table; daily use records of the mobile storage device are collected to obtain device use data, the use of the mobile storage device is predicted based on the device use data to obtain device prediction use data; the access permission of the mobile storage device is dynamically adjusted based on the device prediction use data; the permission management strategy can be adjusted in a timely manner according to the use of the mobile storage device, and the security of the stored data is ensured by combining space division, UUID and password authentication;

[0042] The application adjusts the permission management strategy in a timely manner by predicting the use of the mobile storage device, and has the advantages that the access permission of the device can be limited in a timely manner when the device is not used, the security is improved, the access permission is reasonably allocated according to the prediction of the use time, and the idle and waste of resources are avoided; the permission is allocated by calculating the UUID, the permission can be reasonably allocated without inputting the password authentication, the user is provided with a more convenient use experience under the premise of ensuring the security; the work period and the rest period are marked in the prediction process, the prediction accuracy can be ensured, the prediction failure caused by the rest day is avoided, and the risk of data leakage caused by the failure of the permission dynamic adjustment is avoided. BRIEF DESCRIPTION OF DRAWINGS

[0043] Figure 1 The figure is a step flowchart of the method of the application.

[0044] Figure 2 Flow chart for access permission giving of the present application;

[0045] Figure 3 Flow chart for dynamic adjustment of access permission of the present application;

[0046] Figure 4 Structure schematic diagram of the electronic device of the present application. DETAILED DESCRIPTION

[0047] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0048] Embodiment 1, please refer to Figure 1 as shown, in a first aspect, the present application provides a permission management method of a storage device, comprising the following steps: Figure 1 Step S1, dividing the storage space of the mobile storage device, initializing when the mobile storage device is connected to a computer for the first time, setting a permission management password, and generating a permission management table; step S1 comprises the following sub-steps:

[0049] Step S101, dividing the storage space of the mobile storage device into non-encryption space, weak encryption space and strong encryption space, and dynamically adjusting the space size of the weak encryption space and the strong encryption space according to the amount of data stored in the space; the non-encryption space is convenient for users to quickly store and share temporary and non-sensitive data; the weak encryption space is suitable for data that needs a certain security but does not need high confidentiality, such as work documents; and the strong encryption area is used to store extremely sensitive data, such as business secrets and personal privacy information;

[0050] Step S102, initialization processing; step S102 comprises the following sub-steps:

[0051] Step S1021, when the storage device is connected to a computer for the first time, the UUID of the computer is obtained by using the storage device, and key generation processing is performed based on the UUID, the obtained key is marked as the first management key, and the computer connected for the first time is marked as the management computer; UUID, also known as universal unique identifier, is a 128-bit identifier composed of numbers and letters, usually represented by 32 hexadecimal digits;

[0052]

[0053] ​Step S1022, setting a password based on the management computer to the weak encryption space and the strong encryption space of the mobile storage device, marked as the permission management password; the permission management password can be a character password, or a biological password, such as a fingerprint, and the permission management password is set to construct the multi-layer protection of the mobile storage device in combination with the first management key;

[0054] Step S1023, generating two tables, respectively marked as the first table and the second table, recording the first management key in the first table, and storing the first table and the second table in the strong encryption space; the first table only stores the first management key generated by the management computer UUID, and the second table can store the keys generated by other computer UUIDs, thereby facilitating subsequent permission management;

[0055] Step S103, performing key generation processing based on the UUID, and step S103 includes the following sub-steps:

[0056] Step S1031, converting the UUID in hexadecimal to the UUID in binary, evenly dividing the UUID in binary into four parts, and marking them as the first part sequence, the second part sequence, the third part sequence, and the fourth part sequence in the order of front and back in the UUID; for example, if the UUID of a computer is 03560274-043C-0598-3E06-B30700080009, then after conversion to binary, the first part sequence is 110101011000000010011101000274, the second part sequence is 100001111000000010110011000, the third part sequence is 1111100000011010110011000000111, and the fourth part sequence is 10000000000000001001;

[0057] Step S1032, obtaining the first a1-bit binary data of the first part sequence, denoted as the first chaotic sequence; in this embodiment, a1 is 16, for example, the first part sequence is 110101011000000010011101000274, and the first 16 bits are 1101010110000000, i.e., the first chaotic sequence is 1101010110000000

[0058] Step S1033, taking the complement of the second part sequence and obtaining the last a1-bit binary data, denoted as the second chaotic sequence; for example, if the second part sequence is 100001111000000010110011000, then the last 16 bits are 0000010110011000, and after taking the complement, they are 1111101001100111, i.e., the second chaotic sequence is 1111101001100111;

[0059] Step S1034, XOR calculation is performed on the third partial sequence and the fourth partial sequence, and the obtained sequence is recorded as a third chaotic sequence; the XOR calculation rule is that if both values are 0 or both are 1, the result is 0, otherwise the result is 1; for example, the third partial sequence is 111110000001101011001100000111, and the fourth partial sequence is 10000000000000001001; then the third chaotic sequence is 111110000011101011001100001110.

[0060] Step S1035, the fourth partial sequence is evenly divided into two parts, and NOR operation is performed on the obtained two parts, and the obtained sequence is recorded as a fourth chaotic sequence; the NOR calculation rule is that only when both values are 0, the result is 1, otherwise 0; for example, the fourth partial sequence is 10000000000000001001, which is evenly divided into two parts 1000000000 and 0000001001, and the fourth chaotic sequence is 0111110110.

[0061] Step S1036, the first chaotic sequence, the second chaotic sequence, the third chaotic sequence and the fourth chaotic sequence are sequentially connected, marked as a fifth chaotic sequence, and the fifth chaotic sequence is subjected to a hash operation; the hash operation is also called a hash function, which is a function of mapping data of an arbitrary length to a hash value of a fixed length; in this embodiment, SHA-256 hash algorithm is used, and the operation result is marked as a first management key;

[0062] In the specific implementation process, complex segmentation, extraction, reversal and combination operations are performed on the UUID, and finally a hash function is used to generate the final key, which makes it almost impossible to deduce the original UUID from the generated key, even if the key is leaked, it is difficult for an attacker to obtain the UUID used to identify the device, thereby protecting the security of the device identification information, and the process of generating the key is not a simple direct conversion, but contains a variety of irregular operations; it is difficult for an attacker to guess the specific association between the key and the UUID, greatly increasing the difficulty of brute force or guessing the key; for example, if an attacker does not know the specific calculation rule and combination method, it is difficult to construct a correct key.

[0063] Step S2, giving and adjusting the access permission of the computer connected with the mobile storage device based on the permission management password and the permission management table; step S2 includes the following substeps:

[0064] Step S201, the access permission of the mobile storage device is divided into first access permission, second access permission, third access permission and fourth access permission, wherein the first access permission includes reading and writing of the file in the non-encryption space, the second access permission includes deleting and executing of the file in the non-encryption space, reading of the file in the weak encryption space, and the first access permission; the third access permission includes writing, deleting and executing of the file in the weak encryption space, and the second access permission; the fourth access permission includes reading, writing, deleting and executing of the file in the strong encryption space, and the third access permission;

[0065] Step S202, when the mobile storage device is connected to the computer, the mobile storage device acquires the UUID of the computer, and performs key generation processing based on the UUID, compares the obtained key with the keys in the first table and the second table, if the key in the first table is completely consistent, the computer is identified as a management computer, if the key in the second table is completely consistent, the computer is identified as a trusted computer, otherwise the computer is identified as an unknown computer; the key in the second table can be added by the user;

[0066] Step S203, please refer to Figure 2 If the mobile storage device is connected to the management computer, the third access permission is opened, and if the permission management password is correctly inputted, the fourth access permission is opened; that is, the fourth access permission needs the permission management password and the management computer double authentication;

[0067] Step S204, if the mobile storage device is connected to the trusted computer, the second access permission is opened, and if the permission management password is correctly inputted, the third access permission is opened;

[0068] Step S205, if the mobile storage device is connected to the unknown computer, the first access permission is opened, and if the permission management password is correctly inputted, the third access permission is opened;

[0069] Step S206, if the mobile storage device opens the fourth access permission, the UUID of the non-management computer is inputted into the mobile storage device, the mobile storage device performs key generation processing based on the UUID, and the obtained key can be written into the second table; because the second table is stored in the strong encryption area, the fourth access permission is needed to write into it;

[0070] In the specific implementation process, the permission management is performed by directly identifying the UUID of the computer, which provides convenience for user use while ensuring data security; by dividing regions with different encryption strengths, the data can be protected in layers, and the data in the non-encryption region can be directly accessed without any decryption process. For example, when some commonly used files need to be quickly transmitted between different computers, the files can be directly copied and used from the non-encryption region of the mobile storage device, thereby meeting diversified data storage and management requirements.

[0071] Step S3, collecting daily use records of the mobile storage device to obtain device use data, predicting the use of the mobile storage device based on the device use data to obtain device predicted use data; step S3 includes the following sub-steps:

[0072] Step S301, obtaining the device state of the mobile storage device at a first time interval. If the mobile storage device is connected to a computer and one or more of the read operation, the write operation, the delete operation, and the execution operation exist within a first time length, it is judged that the mobile storage device is in a use state, otherwise it is judged that the mobile storage device is in an idle state. The first time length is T2. In this embodiment, the first time length T2 is 30 minutes. The device state of the mobile storage device is judged to ensure the accuracy of subsequent data acquisition and prevent the state of the mobile storage device being connected to the computer without being used from being misjudged as a use state.

[0073] Step S302, marking the use state as "1" and the idle state as "0". The obtained use of the mobile storage device is marked as device use data. The first time interval is T1. In this embodiment, the first time interval is 2 minutes, that is, the device state of the mobile storage device is obtained every 2 minutes.

[0074] Step S303, marking any data in the device use data as Vi, where i represents the time when Vi is obtained. The device use data is traversed. If Vi in the device use data satisfies V(i+1)=V(i-1) and Vi≠V(i+1), it is judged that Vi is an abnormal point. The abnormal point Vi is replaced by V(i+1), where V(i+1) is the data obtained at the previous acquisition time of Vi, and V(i-1) is the data obtained at the next acquisition time of Vi. For example, the device use data obtained from 14:00 to 14:30 is 1111111011111111. According to the data, the mobile storage device should be used from 14:00 to 14:30. The "0" is obviously incorrect data, so the "0" is changed to "1".

[0075] Step S303, dividing the device usage data into first time periods, and marking work periods; the work period marking includes: if the number of 1s in any first time period is less than 1% of the total number of 0s and 1s in the period, marking the first time period as a rest period, otherwise marking the first time period as a work period; the first time period is T0; in this embodiment, the first time period is 1 day, i.e. 24 hours, i.e. if the number of 1s in the device usage data of a day is less than 1% of the total number of 0s and 1s, the day is a rest period, which is to identify the user's rest day;

[0076] Step S304, removing all data in the rest period based on the device usage data, and marking the remaining device usage data as first usage data; because the data collected in the rest period, i.e. the user's rest day, is not referenceable when predicting the usage in the first time period later, it is removed;

[0077] Step S305, dividing the device usage data into second time periods, if the number of 1s in any second time period is greater than or equal to the number of 0s, marking the second time period as 1, otherwise marking the second time period as 0, and obtaining second usage data after completion; the second time period is T3; in this embodiment, the second time period T3 is 20 minutes, i.e. merging the device usage data collected at the first time interval into data at the new interval of the second time period, for example, merging the data at the interval of 2 minutes into data at the interval of 20 minutes, if the data collected in 20 minutes is 1110000000, the number of 0s is greater than the number of 1s, so the 20 minutes are marked as 0 as a whole, which is because the purpose of the subsequent long-time prediction of the mobile storage device usage is mainly to predict the work period and the rest period, and the data collected at a high frequency is not helpful for the prediction result, and too much data will affect the prediction efficiency, so the division and merging are performed;

[0078] Step S306, based on the time convolution network, using the first usage data and the second usage data to respectively train the time convolution network, the model training hyperparameter setting includes: setting the initial learning rate as e1, setting the training rounds as e2, setting the batch size as e3, and reducing the learning rate by 10% after every e4 training rounds; in this embodiment, e1=0.001, e2=200, e3=32, and e4=10, i.e. multiplying the learning rate by 0.9 after every 10 rounds, for example, the learning rate is 0.001 at the beginning, and the learning rate becomes 0.0009 after 10 rounds of training;

[0079] Step S307, after the training is completed, the time convolution network trained by the first use data is marked as a first prediction model; and the time convolution network trained by the second use data is marked as a second prediction model.

[0080] Step S308, based on the first use data, the first prediction model is used to predict the use of the mobile storage device in a future first time period, to obtain first prediction data; the prediction mainly predicts the specific use of the mobile storage device, for example, if the first time period is one day, the use of the mobile storage device in the future one day is predicted, and the use of the mobile storage device in the future one day is predicted; and the prediction of one day of data often needs 3-5 days of data.

[0081] Step S309, based on the second use data, the second prediction model is used to predict the use of the mobile storage device in a future third time period, to obtain second prediction data; the third time period is T4, T4>T0; the prediction mainly predicts the working period and the rest period of the mobile storage device, and in the embodiment, the third time period T4 is 7 days, that is, the future 7 days are predicted, and the working period and the rest period are marked;

[0082] Step S310, the second prediction data is divided into a first time period, and a working period is marked, and after completion, second reference data is obtained; for example, in the embodiment, the third time period T4 is 7 days, and the first time period is 1 day, that is, based on the prediction data of the future 7 days, the rest period and the working period are marked;

[0083] Step S311, based on the second reference data, the first prediction data is labeled, if the first prediction data corresponds to the rest period in the second reference data, the label of the first prediction data is marked as invalid; if the first prediction data corresponds to the working period in the second reference data, the label of the first prediction data is marked as valid, and after completion, first reference data is obtained; because the first prediction data only predicts the use in the working period, it is impossible to predict the rest period, for example, the use in one day is predicted, and it is impossible to predict whether tomorrow is a rest period, so the second reference data is needed as an auxiliary judgment, if the second reference data shows that tomorrow is a rest period, it means that the use predicted in the first prediction data is invalid, because tomorrow is not used;

[0084] Step S312, the first reference data and the second reference data are marked as device prediction use data.

[0085] In the specific implementation process, the time convolution network is a deep learning architecture specially used for processing time series data, which is specially designed for processing time series; the basic structure includes an input layer, multiple convolution layers, optional pooling layers and an output layer; the input layer receives time series data, such as the usage state sequence of the mobile storage device every minute; the convolution layer extracts features by sliding the convolution kernel in the time dimension; the pooling layer can be used to reduce the data dimension, and the output layer outputs the prediction result according to the specific task; when training the time convolution network, the first usage data and the second usage data need to be divided into training sets and test sets respectively, and a loss function and an evaluation function need to be set, then the two training sets are used to train the time convolution network respectively, after the training is completed, the corresponding test sets are used for testing, and then the evaluation function is used for evaluation, if it is unqualified, continue to train, until it is qualified, in this embodiment, the loss function is mean square error, and the mean square error formula is as follows: Wherein MSE is the mean square error, Yi is the predicted value, and Xi is the actual value; the evaluation function is the accuracy, that is, the proportion of the predicted points in all prediction points, when the accuracy is greater than 90%, it is considered to be qualified.

[0086] Step S4, dynamically adjusting the access permission of the mobile storage device based on the device predicted usage data; step S4 includes the following substeps:

[0087] Step S401, please refer to Figure 3 If the label of the first reference data is valid, the permission is dynamically adjusted in the time corresponding to "1" in the first reference data; the time corresponding to "1" is the predicted usage time of the mobile storage device;

[0088] Step S402, the permission dynamic adjustment includes: adjusting the first-level access permission to read, write, delete and execute the file in the non-encryption space, adjusting the second-level access permission to read, write and execute the file in the weak encryption space, and adjusting the first-level access permission after adjustment;

[0089] In the specific implementation process, only the time corresponding to "1" is dynamically adjusted, in order to ensure the security of the mobile storage device, because the mobile storage device will not be used all the time in the first time period, for example, the working time of one day is from 9:00 to 18:00, and only the permission is dynamically adjusted from 9:00 to 18:00, which improves the user experience on the basis of ensuring the security.

[0090] Embodiment 2, please refer to Figure 4 As shown in the figure, Figure 4An example is shown in a structural diagram of an electronic device, which can include a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete the communication among each other through the communication bus. The memory stores computer readable instructions, and the processor can invoke the instructions in the memory, and when the computer readable instructions are executed by the processor, the steps in the method, device and storage medium for managing the authority of a storage device are run to implement the following functions: dividing the storage space of a mobile storage device, initializing the mobile storage device when it is connected to a computer for the first time, setting an authority management password, and generating an authority management table; based on the authority management password and the authority management table, giving and adjusting the access authority of the computer connected to the mobile storage device; collecting the daily use records of the mobile storage device to obtain device use data, predicting the use of the mobile storage device based on the device use data to obtain device predicted use data; and dynamically adjusting the access authority of the mobile storage device based on the device predicted use data.

[0091] In addition, the logical instructions in the memory described above can be implemented in the form of a software functional unit and sold or used as an independent product, which can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium, includes a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0092] Embodiment 3, the present application also provides a computer readable storage medium, and the present application provides a storage medium, which stores a computer program, and the computer program is executed by a processor to run the steps in the method, device and storage medium for managing the authority of a storage device to implement the following functions: dividing the storage space of a mobile storage device, initializing the mobile storage device when it is connected to a computer for the first time, setting an authority management password, and generating an authority management table; based on the authority management password and the authority management table, giving and adjusting the access authority of the computer connected to the mobile storage device; collecting the daily use records of the mobile storage device to obtain device use data, predicting the use of the mobile storage device based on the device use data to obtain device predicted use data; and dynamically adjusting the access authority of the mobile storage device based on the device predicted use data.

[0093] Through the description of the above embodiments, the embodiments of the present application can be provided as a method, a system or a computer program product. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in the various embodiments or some parts of the embodiments.

[0094] In the embodiments provided by the present application, it should be understood that the disclosed system or method can be implemented in other manners. The above described embodiments are merely exemplary, for example, the division of modules or units can be different from the above, the implementation can be combined or integrated in other manners, and some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the modules or units can be electrical, mechanical or other forms.

[0095] Finally, it should be noted that the above embodiments are merely used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still make modifications to the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for managing permissions of a storage device, characterized in that, Includes the following steps: The storage space of the mobile storage device is divided, and initialization is performed when the mobile storage device is first connected to the computer. A permission management password is set and a permission management table is generated. Access permissions for computers connected to removable storage devices are granted and adjusted based on access management passwords and access management tables. Collect daily usage records of mobile storage devices to obtain device usage data, and predict the usage of mobile storage devices based on the device usage data to obtain predicted device usage data; Dynamically adjust access permissions for mobile storage devices based on predicted device usage data; Collecting daily usage records of mobile storage devices to obtain device usage data, and predicting the usage of mobile storage devices based on this data, to obtain predicted device usage data includes the following sub-steps: The device status of the mobile storage device is obtained at a first time interval. If the mobile storage device is connected to the computer and one or more of the following operations are performed within the first time length: read operation, write operation, delete operation, and execute operation, then the mobile storage device is determined to be in use. Otherwise, the mobile storage device is determined to be in idle state. The use state is recorded as "1" and the idle state is recorded as "0". The obtained usage information of the mobile storage device is marked as device usage data. The first time interval is T1 and the first time length is T2. Let Vi be any data in the device usage data, where i represents the time when Vi was acquired. Traverse the device usage data. If Vi in the device usage data satisfies V(i+1)=V(i-1) and Vi≠V(i+1), then Vi is determined to be an outlier. Replace the outlier Vi with V(i+1), where V(i+1) is the data acquired at the previous acquisition time of Vi and V(i-1) is the data acquired at the next acquisition time of Vi. The equipment usage data is divided into first time periods and marked with work cycles. The work cycle marking includes: if the ratio of the number of 1s to the total number of 0s and 1s in any first time period is less than 1%, then the first time period is marked as a rest period; otherwise, the first time period is marked as a work period. The first time period is T0. Based on the equipment usage data, all data in the rest periods are removed, and the remaining equipment usage data is marked as the first usage data. The device usage data is divided into a second time period. If the number of 1s in any second time period is greater than or equal to the number of 0s, the entire second time period is set to 1; otherwise, the entire second time period is set to 0. After this is completed, the second usage data is obtained. The second time period is T3.

2. The method for managing permissions of a storage device according to claim 1, characterized in that, The process of partitioning the storage space of the mobile storage device, initializing it upon first connection to the computer, setting a permission management password, and generating a permission management table includes the following sub-steps: The storage space of the mobile storage device is divided into unencrypted space, weakly encrypted space and strongly encrypted space. The size of the weakly encrypted space and the strongly encrypted space is dynamically adjusted according to the amount of data stored in the space. Initialization process: When the storage device is connected to the computer for the first time, the storage device is used to obtain the computer's UUID, and a key generation process is performed based on the UUID. The obtained key is marked as the first management key, and the computer connected for the first time is marked as the management computer. The management computer sets a password for the weakly encrypted and strongly encrypted spaces of the mobile storage device, and marks it as the access control password. Two tables are generated, labeled as Table 1 and Table 2 respectively. The first management key is recorded in Table 1, and Table 1 and Table 2 are stored in a strongly encrypted space.

3. The method for managing access permissions of a storage device according to claim 2, characterized in that, Key generation based on UUID includes the following sub-steps: Convert the hexadecimal UUID to a binary UUID. Divide the binary UUID into four equal parts and label them as the first, second, third, and fourth parts according to their order within the UUID. Obtain the first a1 bits of the first part sequence, denoted as the first disordered sequence. Invert the second part sequence and obtain the last a1 bits, denoted as the second disordered sequence. Perform a bitwise XOR operation on the corresponding bits of the third and fourth parts sequences, and denot the resulting sequence as the third disordered sequence. Divide the fourth part sequence into two equal parts and perform a bitwise NOR operation on the corresponding bits of the two parts, denoting the resulting sequence as the fourth disordered sequence. The first chaotic sequence, the second chaotic sequence, the third chaotic sequence, and the fourth chaotic sequence are connected in sequence and labeled as the fifth chaotic sequence. The fifth chaotic sequence is then hashed, and the result is labeled as the first management key.

4. The method for managing access permissions of a storage device according to claim 3, characterized in that, Granting and adjusting access permissions for computers connected to removable storage devices based on access management passwords and access management tables includes the following sub-steps: Access permissions for mobile storage devices are divided into four levels: Level 1, Level 2, Level 3, and Level 4. Level 1 access permissions include reading and writing files in the unencrypted space; Level 2 access permissions include deleting and executing files in the unencrypted space, reading files in the weakly encrypted space, and Level 1 access permissions; Level 3 access permissions include writing, deleting, and executing files in the weakly encrypted space, and Level 2 access permissions; and Level 4 access permissions include reading, writing, deleting, and executing files in the strongly encrypted space, and Level 3 access permissions.

5. The method for managing permissions of a storage device according to claim 4, characterized in that, Granting and adjusting access permissions for computers connected to removable storage devices based on access management passwords and access management tables also includes the following sub-steps: When a mobile storage device is connected to a computer, the mobile storage device obtains the computer's UUID and performs key generation processing based on the UUID. The obtained key is compared with the keys in the first table and the second table. If it is completely consistent with the key in the first table, the computer is identified as a managed computer. If it is completely consistent with a key in the second table, the computer is identified as a trusted computer. Otherwise, the computer is identified as an unknown computer. If the removable storage device is connected to the management computer, level 3 access is granted. If the access management password is entered correctly, level 4 access is granted. If the removable storage device is connected to a trusted computer, then level two access permissions are granted. If the access management password is then entered correctly, then level three access permissions are granted. If the removable storage device is connected to an unknown computer, first-level access is granted. If the access management password is entered correctly, third-level access is granted. If the mobile storage device is granted level 4 access, the UUID of the non-management computer is input into the mobile storage device. The mobile storage device performs key generation processing based on the UUID and can write the obtained key into the second table.

6. The method for managing permissions of a storage device according to claim 5, characterized in that, Collecting daily usage records of mobile storage devices to obtain device usage data, and then predicting the usage of mobile storage devices based on this data to obtain predicted device usage data, also includes the following sub-steps: Based on the temporal convolutional network, the model is trained using the first and second usage data respectively. The model training hyperparameter settings include: the initial learning rate is set to e1, the number of training epochs is set to e2, the batch size is set to e3, and the learning rate is reduced by 10% after each e4 training epoch. After training is completed, the first temporal convolutional network trained with the first data is labeled as the first prediction model; the second temporal convolutional network trained with the second data is labeled as the second prediction model. Based on the first usage data, the first prediction model is used to predict the usage of the mobile storage device in the next first time period, and the first prediction data is obtained; based on the second usage data, the second prediction model is used to predict the usage of the mobile storage device in the next third time period, and the second prediction data is obtained; the third time period is T4, and T4>T0; The second predicted data is divided into a first time period and marked with a work cycle to obtain the second reference data. The first predicted data is then labeled based on the second reference data. If the first predicted data corresponds to a rest period within the second reference data, the label of the first predicted data is invalid; if the first predicted data corresponds to a work cycle within the second reference data, the label of the first predicted data is valid. The first reference data is then obtained. The first and second reference data are labeled as device predicted usage data.

7. The method for managing permissions of a storage device according to claim 6, characterized in that, Dynamically adjusting access permissions for mobile storage devices based on predicted device usage data includes the following sub-steps: If the label in the first reference data is valid, the permissions will be dynamically adjusted within the time period corresponding to "1" in the first reference data. Dynamic permission adjustments include: adjusting the first-level access permissions to read, write, delete, and execute files in the unencrypted space; adjusting the second-level access permissions to read, write, and execute files in the weakly encrypted space; and adjusting the first-level access permissions.

8. An electronic device, characterized in that, It includes a processor and a memory, the memory storing computer-readable instructions that, when executed by the processor, perform the steps of the method as described in any one of claims 1-7.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it performs the steps of the method as described in any one of claims 1-7.

Images