Intelligent pre-reading method and device for dynamic security policy, equipment and medium

Abstract

The invention discloses an intelligent pre-reading method and device for a dynamic security policy, equipment and a medium, and relates to the technical field of solid state disks, and the method comprises the following steps: in response to a storage access request, predicting a data range to be accessed subsequently, and reading corresponding pre-read data from a storage medium; performing content analysis on the pre-read data to judge the sensitivity level of the pre-read data; based on the sensitive level, corresponding security processing is executed on the pre-read data, and the security processing at least comprises selective decryption or selective encryption; and storing the pre-read data after security processing into a cache. According to the method, the cache data can be in a ready state, the performance bottleneck caused by separation of a pre-reading process and a decryption process of a traditional architecture is fundamentally eliminated, and nearly zero-delay data delivery is realized. Meanwhile, through accurate matching of the security policy and the data value, the effectiveness of data security protection is ensured while the system response speed and the cache utilization efficiency are remarkably improved, and finally collaborative optimization of security and performance is achieved.

Description

Technical Field

[0001] This invention relates to the field of solid-state drive technology, and in particular to an intelligent pre-read method, apparatus, device, and medium for dynamic security strategies. Background Technology

[0002] With the development of information technology, data security has become the cornerstone supporting the digital transformation of various industries. Among the many data storage and processing stages, the input / output performance of the storage system is crucial, directly affecting the response speed of upper-layer applications and user experience. To improve this performance, read-ahead technology is widely adopted as an effective optimization method. Its core idea is that the system analyzes current data access patterns, proactively predicts data that may be requested subsequently, and pre-loads it from the primary storage medium into a faster cache. In this way, when the host actually initiates the request, the data may already be in the cache, thus avoiding the latency of reading from slow storage media and significantly reducing system response time.

[0003] However, in today's increasingly stringent data security environment, simply pursuing access speed is far from sufficient. Most storage systems encrypt data during the writing process to ensure that the data stored internally is not leaked even if the storage medium is accessed without authorization. This introduces a crucial technical step: decryption. Currently, the common practice is that read-ahead and encryption / decryption are two independent and sequential processes. Specifically, the storage controller's read-ahead logic predicts data blocks and reads them from the storage medium, but the data read at this point is still encrypted ciphertext. This ciphertext data is then stored in an internal cache. When the host finally requests the data block, the controller retrieves the ciphertext data from the cache, calls the decryption engine to decrypt it, and finally sends the obtained plaintext data to the host.

[0004] This pre-reading and decryption separation working mode has gradually revealed its limitations in practice. First, the time delay caused by the decryption operation cannot be ignored. Even if the pre-reading mechanism accurately places the required data into the cache in advance, a complete decryption process is still necessary at the final moment of data delivery. For enterprise-level applications that are extremely sensitive to latency, such as database transaction processing and real-time financial trading systems, even hardware-accelerated decryption operations will still result in a fixed delay that becomes a bottleneck for the overall system performance, significantly reducing the performance benefits brought by pre-reading technology. Second, this mode leads to low utilization efficiency of cache space. Since the cache stores encrypted data that cannot be directly processed or verified by the controller, this data is essentially a "lazy" resource. Once the system cache space is tight, this data, which has consumed valuable storage medium bandwidth and system power consumption during pre-reading, may be prioritized for elimination because it cannot be used directly, resulting in a waste of the resources consumed by the previous pre-reading operation and ultimately reducing the overall system energy efficiency. Summary of the Invention

[0005] This invention provides an intelligent pre-reading method, apparatus, device, and medium for dynamic security strategies. The technical problem it aims to solve is: how to overcome the system response delay and low cache resource utilization efficiency caused by the independence of the pre-reading process and the decryption process, so as to truly unleash the full performance potential of the pre-reading technology while ensuring data security.

[0006] In a first aspect, embodiments of the present invention provide an intelligent pre-read method for dynamic security policies, comprising: In response to a storage access request, predict the range of data that will be accessed subsequently and read the corresponding pre-read data from the storage medium; The pre-read data is subjected to content analysis to determine its sensitivity level; Based on the sensitivity level, the pre-read data is subjected to corresponding security processing, which includes at least selective decryption or selective encryption. Store the pre-read data that has been safely processed into the cache.

[0007] A further technical solution is that the sensitivity level includes at least a high sensitivity level, a medium sensitivity level, and a low sensitivity level, and the corresponding security processing of the pre-read data based on the sensitivity level includes: If the pre-read data is of a high sensitivity level, then the pre-read data is decrypted or encrypted using a preset first strength key; If the pre-read data is of medium sensitivity level, then the pre-read data is decrypted or encrypted using a preset second strength key, where the second strength is lower than the first strength. If the pre-read data is of low sensitivity level, then the pre-read data is lightly obfuscated or not encrypted.

[0008] A further technical solution is that, after performing content analysis on the pre-read data to determine its sensitivity level, the method further includes: generating an encryption or decryption key corresponding to the sensitivity level.

[0009] A further technical solution is that storing the securely processed pre-read data into a cache includes: The processed pre-read data is associated with a key index and stored in a secure storage area isolated from the cache. The key index points to a key used to process the pre-read data.

[0010] A further technical solution is that the method further includes: When the pre-read data in the cache is evicted due to lack of access or exceeds a preset storage time, the destruction of the key corresponding to the key index is triggered.

[0011] A further technical solution is that the amount of pre-read data for high-sensitivity levels is lower than that for medium-sensitivity and low-sensitivity levels.

[0012] The further technical solution is that the pre-read granularity of high-sensitivity pre-read data is lower than that of medium-sensitivity and low-sensitivity pre-read granularity.

[0013] Secondly, embodiments of the present invention also provide an intelligent pre-reading device for dynamic security strategies, which includes a unit for performing the above-described method.

[0014] Thirdly, embodiments of the present invention also provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0015] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the above-described method.

[0016] This invention provides an intelligent pre-reading method, apparatus, device, and medium with dynamic security policies. The method includes: responding to a storage access request, predicting the range of data to be accessed subsequently, and reading corresponding pre-reading data from the storage medium; performing content analysis on the pre-reading data to determine its sensitivity level; performing corresponding security processing on the pre-reading data based on the sensitivity level, the security processing including at least selective decryption or selective encryption; and storing the security-processed pre-reading data in a cache. By predicting pre-reading, analyzing data sensitivity levels, performing selective decryption or encryption based on the levels, and storing the processed data in a cache, a dynamic and adaptive intelligent pre-reading system is constructed. This method keeps cached data in a ready state, fundamentally eliminating the performance bottleneck caused by the separation of pre-reading and decryption processes in traditional architectures, and achieving near-zero latency data delivery. Simultaneously, through precise matching of security policies and data value, it significantly improves system response speed and cache utilization efficiency while ensuring the effectiveness of data security protection, ultimately achieving synergistic optimization of security and performance. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating an intelligent pre-reading method for dynamic security strategies provided in an embodiment of the present invention; Figure 2 This is a schematic block diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0021] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0022] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0023] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."

[0024] Please see Figure 1 This invention provides an intelligent pre-read method for dynamic security policies, which includes the following steps: S1, in response to a storage access request, predicts the range of data to be accessed subsequently and reads the corresponding pre-read data from the storage medium.

[0025] In practice, the system responds to storage access requests and predicts the range of subsequent data, then reads the corresponding pre-read data from the storage medium. This initial step inherits the fundamental advantage of pre-read technology in improving input / output performance. By proactively loading potentially needed data, it avoids the inherent latency of reading from the main storage medium, laying a preliminary foundation for improved system performance.

[0026] S2, perform content analysis on the pre-read data to determine its sensitivity level.

[0027] In practice, the step of performing content analysis on the pre-read data to determine its sensitivity level introduces a key context-aware capability. This enables the system to go beyond the traditional simple processing mode of treating data as a binary stream, and instead intelligently identify the inherent security attributes and value differences of different data units, such as distinguishing between personal identification information, ordinary operation logs, or public information. This provides a crucial decision-making basis for the subsequent implementation of differentiated and refined management strategies.

[0028] In one embodiment, the pre-read data is first parsed and its features extracted. This process includes identifying the data's metadata, file format type, and parsing its internal data structure. For example, by analyzing the header information or the content of a specific offset of a data block, it can be identified whether it belongs to different types such as database transaction logs, user personal identification information fields, encryption certificates, or ordinary application logs.

[0029] Furthermore, based on a predefined set of security policy rules, the extracted features are matched and evaluated. The rule set includes multiple sensitivity determination rules; for example, if the data content conforms to a preset personal identity information pattern, it is marked as highly sensitive; if the data belongs to internal system operation logs and does not contain user data, it is marked as low sensitive; if the data is a commercial transaction record but has undergone partial anonymization, it is marked as moderately sensitive.

[0030] Furthermore, as another implementation method, the sensitivity analysis module can also integrate a machine learning model. This model, trained with training data, can dynamically output a sensitivity level score based on the semantic features, statistical patterns, and contextual information of the data content. This model can comprehensively consider multi-dimensional features such as word frequency, data source, and historical access patterns for a comprehensive judgment.

[0031] Finally, the sensitivity level labels of the pre-read data are output. These labels include at least three categories: high sensitivity, medium sensitivity, and low sensitivity, providing a basis for decision-making in subsequent dynamic security processing.

[0032] In some preferred embodiments, after the above step of "conducting content analysis on the pre-read data to determine its sensitivity level", the method further includes: generating an encryption or decryption key corresponding to the sensitivity level.

[0033] In practice, dynamically generating encryption or decryption keys corresponding to sensitivity levels greatly enhances the dynamism and uniqueness of key management, thereby significantly improving the overall security level of the system. Compared with using fixed, pre-set keys, the dynamic key generation mechanism tightly binds keys to specific batches or categories of pre-read data. This means that even if the system is attacked and one or more keys are cracked, the impact is strictly limited to the specific data set associated with them, without affecting pre-read data from other periods or other sensitivity levels in the system, achieving effective security isolation and risk containment. This mechanism is similar to generating a unique digital key for each important data pre-read session, rather than reusing the same master key, which fundamentally reduces the systemic risk caused by large-scale key leaks. In addition, dynamic key generation also provides a solid foundation for key lifecycle management, which can be easily connected with subsequent claims such as key destruction mechanisms to jointly build a more complete and proactive data security protection system.

[0034] In some preferred embodiments, the amount of pre-read data for high-sensitivity levels is lower than that for medium-sensitivity and low-sensitivity levels.

[0035] In practice, the amount of data to be pre-read is correlated with the data's sensitivity level. Specifically, the amount of pre-read data for high-sensitivity data is stipulated to be lower than that for medium-sensitivity and low-sensitivity data. This controls potential security risks at the source, achieving security goals by limiting the exposure of high-risk data. The initial intention of pre-read technology was to improve performance by loading data in advance, but this is essentially a risk trade-off, as it places data that "might" be accessed in the future "in advance" in the cache—a faster but potentially riskier area. For highly sensitive data, the losses caused by its leakage are enormous.

[0036] This invention does not employ a single, aggressive prefetch strategy. Instead, it wisely incorporates security considerations, adopting a more conservative prefetch strategy for highly sensitive data, namely reducing the amount of data read in a single prefetch. By doing so, even in the worst-case scenario, such as a malicious cache breach, the absolute amount of highly sensitive data leaked is controllable because the amount of data in the cache is actively limited, thus minimizing potential losses. This is a trade-off strategy that slightly sacrifices some prefetch hit potential for significant security gains.

[0037] Furthermore, the pre-read granularity of high-sensitivity pre-read data is lower than that of medium-sensitivity and low-sensitivity pre-read data.

[0038] In practice, a finer prefetch granularity is adopted for highly sensitive data, improving the accuracy of prefetch operations and achieving a better balance between security and efficiency. Prefetch granularity refers to the size of the data block acquired in each prefetch operation. Coarse granularity means reading a large amount of continuous data at once, which, while covering a wide range, may contain a lot of irrelevant information; fine granularity means reading only the small range of data with the most accurate predictions. For highly sensitive data, a finer prefetch granularity means that the system performs precise operations during prefetching, only acquiring specific data segments that are highly certain will be accessed immediately, rather than loading the entire large data block. This fine-grained operation first directly reduces unnecessary cache usage of highly sensitive data, lowering the potential leakage risk caused by its excessive presence in the cache. Second, it avoids the waste of storage bandwidth and computing resources caused by reading irrelevant highly sensitive data into the cache, resources that could have been used to prefetch more medium- and low-sensitivity data to improve the overall hit rate.

[0039] S3, based on the sensitivity level, perform corresponding security processing on the pre-read data, the security processing including at least selective decryption or selective encryption.

[0040] In practical implementation, corresponding security processing is performed on the pre-read data based on this level. This security processing is specifically defined as including at least selective decryption or selective encryption. This core step is key to achieving a technological breakthrough, fundamentally changing the traditional architecture where security processing and data pre-reading were independent. In traditional methods, pre-read data is typically cached in a uniform ciphertext format in the storage controller. When requested by the host, it still needs to undergo a complete decryption process, causing the time gains from pre-reading to be partially offset by the decryption delay in the final delivery stage. This method, however, performs intelligent preprocessing based on the security attributes of the data before it is stored in the cache. For example, highly sensitive data is subjected to high-strength encryption or its encryption state is maintained while the key is optimized; medium- and low-sensitivity data is subjected to fast decryption or lightweight encryption; and even non-sensitive data is cached directly in a plaintext-ready state, fundamentally changing the form of data in the cache. This selective processing strategy directly leads to significant technical effects: making the allocation of security resources more precise and efficient, avoiding the waste of computing resources caused by "one-size-fits-all" encryption, and removing delay obstacles for final data delivery.

[0041] In some preferred embodiments, the sensitivity level includes at least a high sensitivity level, a medium sensitivity level, and a low sensitivity level. The step "performing corresponding security processing on the pre-read data based on the sensitivity level" includes: if the pre-read data is of a high sensitivity level, then decrypting or encrypting the pre-read data using a preset first strength key; if the pre-read data is of a medium sensitivity level, then decrypting or encrypting the pre-read data using a preset second strength key, wherein the second strength is lower than the first strength; if the pre-read data is of a low sensitivity level, then performing light obfuscation processing or not encrypting the pre-read data.

[0042] In practice, the sensitivity level is specifically divided into three levels: high, medium, and low, with differentiated security processing strengths clearly defined for each level. This refined hierarchical processing mechanism achieves precise matching and dynamic adaptation between security protection resources and data value risks. In the field of data security, a core principle is that security costs should be commensurate with the value of the protected assets. This invention is based on this principle. For data deemed highly sensitive, such as personal identification information, trade secrets, or financial transaction records, a high-strength key (e.g., AES, RSA) of the highest strength is used for encryption or decryption. This ensures that core sensitive data enjoys the highest level of protection at any processing stage, greatly increasing the difficulty of unauthorized access. For moderately sensitive data, such as internal email communications or general operational data, a slightly lower-strength key of the second strength is used. This provides sufficient security while avoiding unnecessary computational overhead and delays caused by excessive encryption. For low-sensitivity data, such as public information or system logs, a strategy of lightweight obfuscation or even no processing is adopted. This almost eliminates the performance loss caused by security processing, allowing the system to concentrate its limited computing resources and time budget on the data that needs the most protection. Thus, the system performance is optimized without reducing the overall security level, avoiding the performance waste caused by the "one-size-fits-all" encryption strategy that imposes high security overhead on all data.

[0043] S4 stores the pre-read data after security processing into the cache.

[0044] In practice, the step of storing the securely processed pre-read data into the cache completes the entire intelligent pre-read process. At this point, the cache no longer stores inert, unusable ciphertext data blocks, but rather mostly data entities that are already in a "ready" state. When a host request arrives, the system no longer needs to initiate a complete and time-consuming decryption operation chain, achieving extremely low latency or even near-zero latency data delivery. This performance improvement is particularly significant for applications extremely sensitive to input / output latency, such as database transactions and real-time analysis systems. Simultaneously, because the cache space stores valid data that can be directly or quickly responded to, its space utilization efficiency is also substantially optimized. This avoids the waste of resources caused by discarding bandwidth-intensive pre-read ciphertext data due to cache space pressure, thereby improving the overall energy efficiency of the system.

[0045] In some preferred embodiments, the above step "store the securely processed pre-read data into the cache" specifically includes the following steps: storing the processed pre-read data in association with a key index, wherein the key index points to a key used to process the pre-read data, and the key is stored in a secure storage area isolated from the cache.

[0046] In practice, processed pre-read data is associated with keys stored in a secure storage area through key indexing. This design produces a dual technical effect: firstly, it optimizes the security and efficiency of cache management; secondly, it achieves physical or logical separation between the key and the data itself. The cache no longer stores the key itself, but merely an index identifier pointing to the key, which firstly reduces the strong dependence on the security of the cache itself. Even if the cache is accessed without authorization or data is leaked, attackers only obtain unusable data blocks and a bunch of meaningless index numbers, while the actual key assets are protected in another independent, higher-security storage area, thus building a defense-in-depth barrier. This key-data separation storage architecture conforms to the core principles of information security, greatly increasing the difficulty for attackers to obtain complete, usable plaintext. Secondly, this index association mechanism also improves the flexibility and efficiency of cache management. When processing cache data eviction, migration, or backup, the system no longer needs to cumbersomely handle the key data bound to it; it only needs to manage lightweight index information, simplifying the cache management logic. When data needs to be accessed, the system can quickly and accurately locate the corresponding key in the secure storage area through an index, ensuring a smooth and accurate data delivery process.

[0047] In some preferred embodiments, the method further includes the following step: when the pre-read data in the cache is evicted due to lack of access or exceeds a preset storage time, the destruction of the key corresponding to the key index is triggered.

[0048] In its implementation, a key destruction procedure is introduced, serving as a crucial supplement to the lifecycle management of dynamically generated keys. This achieves closed-loop management of data security protection and integrates security principles throughout the entire data lifecycle, including its end-of-life. In storage systems, cache space is limited. Pre-read data may be normally evicted due to inaccessibility or need to be cleaned up due to the expiration of its preset validity period. If the keys corresponding to this data persist in the system, a potential security risk arises: although the data is no longer in the available cache, the key to decrypt it still exists, leaving hidden dangers for subsequent data recovery and leakage. This invention explicitly sets the conditions for triggering key destruction: when pre-read data is evicted due to inaccessibility or expires, the system automatically triggers the destruction procedure for the associated key. This mechanism ensures that the lifecycle of the key is strictly synchronized with the lifecycle of the data it protects. Once data is logically deemed no longer needed or expired, its decryption possibility is logically severed, truly achieving "data dies, key disappears." This effectively prevents the risk of historical data leakage that may result from the residual discarded keys, complies with the principle of data minimization and the requirements of privacy protection regulations, greatly enhances the reliability and compliance of the system in processing sensitive data, and constitutes a complete and comprehensive security protection chain.

[0049] In some preferred embodiments, the method further includes the following steps: dynamically allocating computing resources to balance data security and pre-read performance through a preset intelligent scheduling algorithm, so as to ensure that data security and system access performance are balanced while ensuring security.

[0050] In practical implementation, a pre-defined intelligent scheduling algorithm is introduced to dynamically allocate computing resources, balancing data security and pre-read performance. This addresses a system-level resource competition and optimization problem, ensuring the system maintains stable and efficient overall operation under complex and variable workloads. In the intelligent pre-read method, data pre-reading, content analysis, and encryption / decryption operations are all computationally intensive tasks that compete for limited CPU cycles, memory bandwidth, and other resources. Especially in high-concurrency, high-load application scenarios, without a top-level coordination mechanism, resource conflicts may arise between these tasks, leading to system bottlenecks. For example, the simultaneous need for high-strength encryption of large amounts of data might exhaust computing resources, causing the pre-reading task itself to be blocked, thus reducing response speed; or necessary security processing might be sacrificed to ensure performance. The intelligent scheduling algorithm described in this embodiment acts as the intelligent traffic control center of the system. It can monitor the system's load status, task queue, and performance indicators in real time, and dynamically allocate computing resources to the pre-reading logic, sensitivity analysis module, or encryption / decryption engine. When security tasks are heavy, it ensures that security processing receives sufficient resources without becoming a bottleneck; when I / O performance becomes the primary requirement, it adjusts resource allocation in a timely manner to ensure smooth prefetching. Through this dynamic and adaptive resource allocation, the system can find an optimal balance between security and performance—two inherently competing goals—based on real-time conditions. This ensures that throughout the entire operational lifecycle, it meets stringent data security requirements while delivering excellent input / output performance, achieving system adaptability and robustness.

[0051] Specifically, the intelligent scheduling algorithm refers to a resource coordination mechanism embedded within the storage controller. Its core function is to dynamically allocate the system's limited computing resources to collaboratively execute data prefetching and security processing tasks. This algorithm monitors the system's operating status in real time, including parameters such as computing load, cache pressure, security task queue depth, and I / O request patterns. Based on this real-time data, it dynamically decides resource allocation strategies, for example, prioritizing the smoothness of the prefetching process during periods of high I / O load, while ensuring sufficient computing power for the encryption / decryption engine in security-sensitive scenarios. Through this adaptive resource scheduling, the algorithm effectively resolves the resource competition conflict between prefetching performance and security processing, thereby maximizing overall system performance and response efficiency while ensuring data security.

[0052] This invention proposes an intelligent pre-reading method with dynamic security policies, comprising: responding to a storage access request, predicting the range of data to be accessed subsequently, and reading the corresponding pre-reading data from the storage medium; performing content analysis on the pre-reading data to determine its sensitivity level; performing corresponding security processing on the pre-reading data based on the sensitivity level, the security processing including at least selective decryption or selective encryption; and storing the security-processed pre-reading data in a cache. By predicting pre-reading, analyzing data sensitivity levels, performing selective decryption or encryption based on the levels, and storing the processed data in a cache, a dynamic and adaptive intelligent pre-reading system is constructed. This method keeps cached data in a ready state, fundamentally eliminating the performance bottleneck caused by the separation of pre-reading and decryption processes in traditional architectures, and achieving near-zero latency data delivery. Simultaneously, through precise matching of security policies and data value, it significantly improves system response speed and cache utilization efficiency while ensuring the effectiveness of data security protection, ultimately achieving synergistic optimization of security and performance.

[0053] Corresponding to the above-described intelligent pre-reading method for dynamic security policies, the present invention also provides an intelligent pre-reading device for dynamic security policies. This intelligent pre-reading device for dynamic security policies includes a unit for executing the above-described intelligent pre-reading method for dynamic security policies, and can be configured in terminals such as desktop computers, tablet computers, and laptops. Specifically, the intelligent pre-reading device for dynamic security policies includes: The prefetch unit is used to predict the range of data to be accessed in response to a storage access request and read the corresponding prefetch data from the storage medium. The determination unit is used to perform content analysis on the pre-read data to determine its sensitivity level; A security processing unit is configured to perform corresponding security processing on the pre-read data based on the sensitivity level, wherein the security processing includes at least selective decryption or selective encryption; The cache unit is used to store the pre-read data that has been safely processed into the cache.

[0054] In some preferred embodiments, the sensitivity level includes at least a high sensitivity level, a medium sensitivity level, and a low sensitivity level, and the step of performing corresponding security processing on the pre-read data based on the sensitivity level includes: If the pre-read data is of a high sensitivity level, then the pre-read data is decrypted or encrypted using a preset first strength key; If the pre-read data is of medium sensitivity level, then the pre-read data is decrypted or encrypted using a preset second strength key, where the second strength is lower than the first strength. If the pre-read data is of low sensitivity level, then the pre-read data is lightly obfuscated or not encrypted.

[0055] In some preferred embodiments, it further includes: The generation unit is used to generate encryption or decryption keys corresponding to the sensitivity level.

[0056] In some preferred embodiments, storing the securely processed pre-read data into a cache includes: The processed pre-read data is associated with a key index and stored in a secure storage area isolated from the cache. The key index points to a key used to process the pre-read data.

[0057] In some preferred embodiments, it further includes: The destruction unit is used to trigger the destruction of the key corresponding to the key index when the pre-read data in the cache is evicted due to not being accessed or exceeds a preset storage time.

[0058] In some preferred embodiments, the amount of pre-read data for high-sensitivity levels is lower than that for medium-sensitivity and low-sensitivity levels.

[0059] In some preferred embodiments, the preread granularity of high-sensitivity preread data is lower than that of medium-sensitivity and low-sensitivity preread data.

[0060] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the intelligent pre-reading device and each unit of the above-mentioned dynamic security strategy can be referred to the corresponding description in the foregoing method embodiments. For the sake of convenience and brevity, it will not be repeated here.

[0061] The aforementioned intelligent pre-read device for dynamic security strategies can be implemented as a computer program, which can, for example... Figure 2 It runs on the computer device shown.

[0062] Please see Figure 2 , Figure 2 This is a schematic block diagram of a computer device provided in an embodiment of this application. The computer device 500 can be a terminal or a server. The terminal can be an electronic device with communication functions, such as a smartphone, tablet, laptop, desktop computer, personal digital assistant, or wearable device. The server can be a standalone server or a server cluster composed of multiple servers.

[0063] The computer device 500 includes a processor 502, a memory, and a network interface 505 connected via a system bus 501. The memory may include a non-volatile storage medium 503 and internal memory 504.

[0064] The non-volatile storage medium 503 may store an operating system 5031 and a computer program 5032. When the computer program 5032 is executed, it causes the processor 502 to execute an intelligent pre-read method for a dynamic security policy.

[0065] The processor 502 provides computing and control capabilities to support the operation of the entire computer device 500.

[0066] The internal memory 504 provides an environment for the execution of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute an intelligent pre-read method for a dynamic security strategy.

[0067] The network interface 505 is used for network communication with other devices. Those skilled in the art will understand that the above structure is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device 500 to which the present application is applied. A specific computer device 500 may include more or fewer components than shown in the figures, or combine certain components, or have different component arrangements.

[0068] The processor 502 is used to run a computer program 5032 stored in the memory to perform the following steps: In response to a storage access request, predict the range of data that will be accessed subsequently and read the corresponding pre-read data from the storage medium; The pre-read data is subjected to content analysis to determine its sensitivity level; Based on the sensitivity level, the pre-read data is subjected to corresponding security processing, which includes at least selective decryption or selective encryption. Store the pre-read data that has been safely processed into the cache.

[0069] In some preferred embodiments, the sensitivity level includes at least a high sensitivity level, a medium sensitivity level, and a low sensitivity level, and the step of performing corresponding security processing on the pre-read data based on the sensitivity level includes: If the pre-read data is of a high sensitivity level, then the pre-read data is decrypted or encrypted using a preset first strength key; If the pre-read data is of medium sensitivity level, then the pre-read data is decrypted or encrypted using a preset second strength key, where the second strength is lower than the first strength. If the pre-read data is of low sensitivity level, then the pre-read data is lightly obfuscated or not encrypted.

[0070] In some preferred embodiments, after performing content analysis on the pre-read data to determine its sensitivity level, the method further includes generating an encryption or decryption key corresponding to the sensitivity level.

[0071] In some preferred embodiments, storing the securely processed pre-read data into a cache includes: The processed pre-read data is associated with a key index and stored in a secure storage area isolated from the cache. The key index points to a key used to process the pre-read data.

[0072] In some preferred embodiments, the method further includes: When the pre-read data in the cache is evicted due to lack of access or exceeds a preset storage time, the destruction of the key corresponding to the key index is triggered.

[0073] In some preferred embodiments, the amount of pre-read data for high-sensitivity levels is lower than that for medium-sensitivity and low-sensitivity levels.

[0074] In some preferred embodiments, the preread granularity of high-sensitivity preread data is lower than that of medium-sensitivity and low-sensitivity preread data.

[0075] It should be understood that in the embodiments of this application, the processor 502 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0076] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program may be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0077] Therefore, the present invention also provides a storage medium. This storage medium can be a computer-readable storage medium. The storage medium stores a computer program. When executed by a processor, the computer program causes the processor to perform the following steps: In response to a storage access request, predict the range of data that will be accessed subsequently and read the corresponding pre-read data from the storage medium; The pre-read data is subjected to content analysis to determine its sensitivity level; Based on the sensitivity level, the pre-read data is subjected to corresponding security processing, which includes at least selective decryption or selective encryption. Store the pre-read data that has been safely processed into the cache.

[0078] In some preferred embodiments, the sensitivity level includes at least a high sensitivity level, a medium sensitivity level, and a low sensitivity level, and the step of performing corresponding security processing on the pre-read data based on the sensitivity level includes: If the pre-read data is of a high sensitivity level, then the pre-read data is decrypted or encrypted using a preset first strength key; If the pre-read data is of medium sensitivity level, then the pre-read data is decrypted or encrypted using a preset second strength key, where the second strength is lower than the first strength. If the pre-read data is of low sensitivity level, then the pre-read data is lightly obfuscated or not encrypted.

[0079] In some preferred embodiments, after performing content analysis on the pre-read data to determine its sensitivity level, the method further includes generating an encryption or decryption key corresponding to the sensitivity level.

[0080] In some preferred embodiments, storing the securely processed pre-read data into a cache includes: The processed pre-read data is associated with a key index and stored in a secure storage area isolated from the cache. The key index points to a key used to process the pre-read data.

[0081] In some preferred embodiments, the method further includes: When the pre-read data in the cache is evicted due to lack of access or exceeds a preset storage time, the destruction of the key corresponding to the key index is triggered.

[0082] In some preferred embodiments, the amount of pre-read data for high-sensitivity levels is lower than that for medium-sensitivity and low-sensitivity levels.

[0083] In some preferred embodiments, the preread granularity of high-sensitivity preread data is lower than that of medium-sensitivity and low-sensitivity preread data.

[0084] The storage medium is a physical, non-transient storage medium, such as a USB flash drive, external hard drive, read-only memory (ROM), magnetic disk, or optical disk, or any other physical storage medium capable of storing program code. The computer-readable storage medium can be non-volatile or volatile.

[0085] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0086] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0087] The steps in the method of this invention can be adjusted, merged, or reduced in order according to actual needs. The units in the device of this invention can be merged, divided, or reduced according to actual needs. Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0088] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0089] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0090] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Since these modifications and variations fall within the scope of the claims and their equivalents, this invention also intends to include these modifications and variations.

[0091] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An intelligent pre-reading method for dynamic security policies, characterized in that, include: In response to a storage access request, predict the range of data that will be accessed subsequently and read the corresponding pre-read data from the storage medium; The pre-read data is subjected to content analysis to determine its sensitivity level; Based on the sensitivity level, the pre-read data is subjected to corresponding security processing, which includes at least selective decryption or selective encryption. Store the pre-read data that has been securely processed into the cache.

2. The intelligent pre-read method for dynamic security policies according to claim 1, characterized in that, The sensitivity levels include at least high sensitivity, medium sensitivity, and low sensitivity, and the corresponding security processing of the pre-read data based on the sensitivity levels includes: If the pre-read data is of a high sensitivity level, then the pre-read data is decrypted or encrypted using a preset first strength key; If the pre-read data is of medium sensitivity level, then the pre-read data is decrypted or encrypted using a preset second strength key, where the second strength is lower than the first strength. If the pre-read data is of low sensitivity level, then the pre-read data is lightly obfuscated or not encrypted.

3. The intelligent pre-read method for dynamic security policies according to claim 1, characterized in that, After performing content analysis on the pre-read data to determine its sensitivity level, the method further includes generating an encryption or decryption key corresponding to the sensitivity level.

4. The intelligent pre-read method for dynamic security policies according to claim 3, characterized in that, The step of storing the pre-read data after security processing into the cache includes: The processed pre-read data is associated with a key index and stored in a secure storage area isolated from the cache. The key index points to a key used to process the pre-read data.

5. The intelligent pre-read method for dynamic security policies according to claim 4, characterized in that, The method further includes: When the pre-read data in the cache is evicted due to lack of access or exceeds a preset storage time, the destruction of the key corresponding to the key index is triggered.

6. The intelligent pre-read method for dynamic security policies according to claim 2, characterized in that, The amount of pre-read data for high-sensitivity levels is lower than that for medium-sensitivity and low-sensitivity levels.

7. The intelligent pre-read method for dynamic security policies according to claim 2, characterized in that, The pre-read granularity of high-sensitivity data is lower than that of medium-sensitivity and low-sensitivity data.

8. An intelligent pre-reading device for dynamic security strategies, characterized in that, Includes a unit for performing the method as described in any one of claims 1-7.

9. A computer device, characterized in that, The computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, can implement the method as described in any one of claims 1-7.

Images