CN107392062A - A kind of mthods, systems and devices for increasing data leak safeguard function for ordinary mobile storage - Google Patents

A kind of mthods, systems and devices for increasing data leak safeguard function for ordinary mobile storage Download PDF

Info

Publication number
CN107392062A
CN107392062A CN201710623489.1A CN201710623489A CN107392062A CN 107392062 A CN107392062 A CN 107392062A CN 201710623489 A CN201710623489 A CN 201710623489A CN 107392062 A CN107392062 A CN 107392062A
Authority
CN
China
Prior art keywords
storage device
user
secrecy
isolation
desktop
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201710623489.1A
Other languages
Chinese (zh)
Inventor
宣以政
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Individual
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Individual filed Critical Individual
Priority to CN201710623489.1A priority Critical patent/CN107392062A/en
Publication of CN107392062A publication Critical patent/CN107392062A/en
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication
    • G06F21/34User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/62Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6209Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2149Restricted operating environment

Abstract

The present invention provides a kind of mthods, systems and devices for increasing data leak safeguard function for ordinary mobile storage, one ordinary mobile storage can be fabricated to a secrecy movable storage device with data leak safeguard function, used technical scheme is on the basis of computer operating system, with Network Isolation, storage isolation, using the driving layer isolation technology such as isolation and peripheral hardware isolation, a safety desktop completely isolated with system desktop is constructed, for opening secrecy movable storage device.The beneficial effects of the present invention are:When using secrecy movable storage device in the computer of open environment, wherein data can be protected not leak.

Description

It is a kind of to increase the method for data leak safeguard function for ordinary mobile storage, be System and device
Technical field
The invention belongs to computer realm, is related to a kind of secrecy movable storage device for possessing data leak safeguard function.
Background technology
Currently, movable storage device use is very universal, and important documents caused by being lost due to movable storage device are leaked Too numerous to enumerate with the example of individual privacy leakage, this generates the demand of protection movable storage device data.
In existing solution, secrecy movable storage device is a kind of conventional movable storage device data protection means, Largely prevent information-leakage, but secrecy movable storage device is typically a kind of special movement storage device, can only Used in the environment of a credit, using above there is certain limitation;Though secrecy movable storage device possesses data encryption feature, But do not possess data leak safeguard function, legitimate user after data deciphering, just will can arbitrarily copy, separately deposit with outgoing, gently And the data for obtaining secrecy movable storage device are easily lifted, the requirement of Company Knowledge safeguarding of assets can not be met;In addition, secrecy movement Storage device once using, encrypt all over, and has some files to encrypt really by movable storage device.
The content of the invention
The invention aims to provide a kind of side for increasing data leak safeguard function for ordinary mobile storage Method, system and device, an ordinary mobile storage can be fabricated to a secrecy with data leak safeguard function Movable storage device, and take into account ordinary mobile storage and the facility of secrecy movable storage device, user can selectively by File is stored in original subregion or secrecy subregion, does not interfere with the use of original subregion;The ordinary mobile storage refers to It is connected to the various External memory equipments that computer equipment uses, including USB flash disk, mobile hard disk and various electronic memory cards etc..
Used technic relization scheme is the virtual of one encryption of establishment on an ordinary mobile storage subregion File is rolled up, a virtual volume equipment is further generated, for storing private data;On the basis of computer operating system, fortune With Network Isolation, storage isolation, using isolation and peripheral hardware isolate etc. driving layer isolation technology, construct one it is complete with system desktop The safety desktop isolated entirely, for opening the virtual volume equipment, the data in virtual volume equipment can not leak in a variety of ways Go out.
System includes initialization unit, user's sub-control unit, desktop switch unit, login control unit, safety desktop list Member, Network Isolation unit, store isolated location, be transparent using isolated location, peripheral hardware isolated location, virtual disk unit, disk Ciphering unit, file import and export unit.
Device includes a hardware Key and embedded system software forms.
In order to achieve the above object, the present invention is realized using following technological means:
1st, using described device Key, the tools software in Key is run, one is created on ordinary mobile storage subregion The virtual volume file of individual encryption is simultaneously formatted, and system software is implanted in the common subregion of movable storage device automatically, is made Complete the secrecy movable storage device for possessing data leak safeguard function;
2nd, initialization unit, for generating a virtual volume file on common movable storage device subregion, to virtual volume text Part is formatted, and inputs a password and the virtual volume file is encrypted;
3rd, user's sub-control unit, multiple user ciphers of different rights are set for secrecy movable storage device:Supervisor password, Audit user cipher, domestic consumer's password and read-only user password, power user are used for highest authority, and audit user pertains only to day Will, domestic consumer editing files, read-only user only browse file, without power user permit, audit user, domestic consumer and Read-only user can not obtain data from secrecy movable storage device;
4th, desktop switch unit, for being toggled between system desktop and safety desktop;
5th, control unit is logged in, for receiving the secrecy movable storage device password of user's input, if password authentification passes through loading The drive of the volume equipment is in system drive catalogue;
6th, safety desktop unit, the human-computer interaction interface for creating a safety is safety desktop, and is beaten with safety desktop Secrecy movable storage device is opened, completely isolated between safety desktop and system desktop, appearance form and the system table of safety desktop Face is the same;
7th, virtual disk unit, using virtual disk driver technology, by the virtual volume file on ordinary mobile storage subregion It is presented as rolling up equipment, the function of data storage is provided for secrecy movable storage device;
8th, disk transparent encryption unit, using full disk encryption technology, transparent encryption and decryption are realized to the data in virtual disk, The process of encryption and decryption is automatically performed, without user intervention;
9th, Network Isolation unit, using network communication bottom layer driving technology, network communication order is controlled, to network data Bag is filtered, and is realized that safety desktop is isolated with all-network, can not be let out the data of secrecy movable storage device by network Leak;
10th, isolated location is stored, using storage kernel-driven technology, realizes storage device between safety desktop and system desktop Isolation, in system desktop, local disk is visible read-write, and secrecy movable storage device is invisible and forbids accessing;In safety In desktop, secrecy movable storage device is visible read-write, and local disk is invisible and access is restricted;
11st, using isolated location, using process monitoring actuation techniques, process initiation, monitoring process behavior, with safety desktop are intercepted For mark, the process isolation between two desktops is realized, secrecy movable storage device can only be accessed by the process of safety desktop, be The process of system desktop can not access secrecy movable storage device;
12nd, peripheral hardware isolated location, using peripheral hardware actuation techniques, the peripheral hardware isolation between two desktops is realized, i.e., in safety desktop In, in addition to secrecy movable storage device, other external equipments are invisible without exception;
13rd, file imports and exports unit, and the secrecy movement storage for the data of system desktop to be imported into safety desktop is set Standby interior, the data in secrecy movable storage device export to system desktop.
After such scheme, possesses following good effect:
1st, can not be let out in a variety of ways in safety desktop by a variety of isolation technologies, the data of protection secrecy movable storage device Leak;
2nd, can be the mobile partition holding of secrecy to whole movable storage device partition initialization, can also be only by original subregion A part is initialized as the mobile partition holding that maintains secrecy;
3rd, no longer need that complicated use environment is installed in terminal, it is independent in the common subregion of movable storage device using only existing Program.
The present invention is described in detail below in conjunction with the accompanying drawings, wherein:
Fig. 1 is the system structure diagram of the present invention;
Fig. 2 is the secrecy movable storage device Making programme schematic diagram of the present invention;
Fig. 3 is the system flow schematic diagram of embodiments of the invention.
Embodiment
Embodiments of the present invention are described in detail below with reference to drawings and Examples, and how the present invention is applied whereby Technological means solves technical problem, and the implementation process for reaching technique effect can fully understand and implement according to this.Need to illustrate As long as not forming conflict, each embodiment in the present invention and each feature in each embodiment can be combined with each other, The technical scheme formed is within protection scope of the present invention.
Referring to Fig. 1, the present invention provides a kind of method, system for increasing data leak safeguard function for ordinary mobile storage And device, an ordinary mobile storage can be fabricated to a secrecy movement storage with data leak safeguard function Equipment, system include initialization unit, user's sub-control unit, desktop switch unit, log in control unit, safety desktop unit, Network Isolation unit, store isolated location, be transparent using isolated location, peripheral hardware isolated location, virtual disk driver unit, disk Ciphering unit, file import and export unit.
Specifically, a kind of mthods, systems and devices for increasing data leak safeguard function for ordinary mobile storage, Including:
First, the making of secrecy movable storage device, refers to Fig. 2:
Step A1, tools Key is connected on computer;
Step A2, it would be desirable to which the ordinary mobile storage of making is connected on computer, and the ordinary mobile storage is Finger is connected to the various External memory equipments that computer equipment uses, including USB flash disk, mobile hard disk and various electronic memory cards etc.;
Step A3, run tools software;
Step A4, movable storage device initialization is performed, a virtual volume text is generated on common movable storage device subregion Part, and input a password and the virtual volume file is encrypted;
Further, in step A4, virtual volume file size+system software size=movable storage device amount of capacity of generation, It is then that secrecy movable storage device is initialized as to whole movable storage device;
Further, in step A4, the virtual volume file of generation is less than+system software size<Movable storage device amount of capacity, A part for original subregion is only then initialized as the mobile partition holding that maintains secrecy;
Step A5, after the completion of initialization, system software is implanted in the common subregion of movable storage device automatically, system software For an exe file, operation is double-clicked, without installation, plug and play;
Step A6, secrecy movable storage device complete, and can be removed from computer.
2nd, the use of secrecy movable storage device, accompanying drawing 3 is referred to:
1st, the system software that operation is implanted in the common subregion of movable storage device is double-clicked, performs and logs in control unit S2, be used for The secrecy movable storage device password of user's input is received, if password authentification is by performing user's sub-control unit, differentiating user Attribute, different rights are assigned, into next step S3;If password authentification is not by EP (end of program).
2nd, each driver element S3 is loaded.Driver element includes networks filter driver unit, stored filter driver element, process Filtration drive unit, equipment filtration drive unit, virtual disk driver unit, disk transparent encryption driver element, file transparent Encrypt driver element etc..If the loading failure of certain driver element, shows drive control dysfunction, terminate simultaneously return system desktop S1;If each driver element all loads success, show that drive control function is normal, then into next step S4.
3rd, Network Isolation strategy S4 is implemented.Network communication is controlled, network packet is filtered, realizes safety Desktop is isolated with all-network, the data leak of secrecy movable storage device can not be gone out by network;If implement network every From strategy failure, then terminate simultaneously return system desktop;If implement the success of Network Isolation strategy, into next step S5.
4th, implement storage and isolate tactful S5.Isolating for storage device between safety desktop and system desktop is realized, in system In desktop, local disk is visible read-write, and secrecy movable storage device is invisible and forbids accessing;In safety desktop, secrecy Movable storage device is visible read-write, and local disk is invisible and access is restricted.If implementing storage isolation strategy failure, tie Beam and return system desktop;If implement storage isolation strategy success, into next step S6.
5th, the tactful S6 of isolation is practiced.Process initiation is intercepted, monitoring process behavior, using safety desktop as mark, is realized Process isolation between two desktops, secrecy movable storage device can only be accessed by the process of safety desktop, and system desktop is entered Cheng Buneng accesses secrecy movable storage device.If practicing isolation strategy failure, terminate simultaneously return system desktop;If implement Using isolation strategy success, then into next step S7.
6th, implement peripheral hardware and isolate tactful S7.The peripheral hardware isolation between two desktops is realized, i.e., in safety desktop, except protecting Outside close movable storage device, other external equipments are invisible without exception.If implement peripheral hardware isolation strategy failure, terminate and return be System desktop;If implement peripheral hardware isolation strategy success, into next step S8.
7th, carry secrecy movable storage device S8.The drive of the volume equipment is loaded in system drive catalogue.If carry Failure, then terminate simultaneously return system desktop;If carry success, shows with normal use secrecy movable storage device can then to enter Enter next step S9..
8th, safety desktop S9 is opened.In this safety desktop environment, all behaviour of the user to secrecy movable storage device All it is Guaranteed with corresponding security strategy.Local disk is invisible in safety desktop, and data can only deposit secrecy and move Local disk can not separately be deposited, replicate, paste, copy or are moved to dynamic storage device, file;Due to safety desktop be with outer net every From, therefore file can not be sent out outside;Because safety desktop is isolated with Intranet, thus file be can not by altogether Enjoy what is copied away;Because safety desktop is isolated with peripheral hardware, therefore file can not be output to external equipment;Due to safety Desktop is isolated with system desktop, even if content recordal is got off using record screen software or incited somebody to action with the operation for copying screen and screenshotss Content preserves, and can not also be gone out from safety desktop;It is achieved thereby that the function of data leak protection.
9th, desktop switches.It can easily toggle, system desktop, not limit between system desktop and safety desktop Function, can above outer net, for non-close work;Safety desktop, for secrecy movable storage device environment, isolate with outer net, be used for Security work.
10th, data importing/export.Because safety desktop is the environment of one " closing ", be with system desktop " completely every From ", therefore external data will imported into secrecy movable storage device, must be imported by special data according to and by mandate License;The data of secrecy movable storage device will export to outside, instrument must also be exported by special data and by authorizing License.
11st, safety desktop is exited.Exit before safety desktop, first have to do following processing:Revocation safety control strategy, unload Carry each driver element, remove caching and remaining file, closing secrecy movable storage device, finally turn off safety desktop, terminate And return system desktop S1.
In summary, it is of the invention a kind of to increase the method for data leak safeguard function for ordinary mobile storage, be System and device, there is provided a kind of means that ordinary mobile storage is made as to secrecy movable storage device;By isolating skill Art, the data of protection secrecy movable storage device can not let out in safety desktop in a variety of ways;No longer need at end The use environment of complexity is installed, using only program independent on movable storage device being present on end;Can be to whole mobile Storage device is initialized as secrecy movable storage device, a part for original subregion only can also be initialized as into secrecy movement and deposited Store up subregion.
Finally it should be noted that:The preferred embodiments of the present invention are the foregoing is only, are not intended to limit the invention, Although the present invention is described in detail with reference to the foregoing embodiments, for those skilled in the art, it still may be used To be modified to the technical scheme described in foregoing embodiments, or equivalent substitution is carried out to which part technical characteristic. Within the spirit and principles of the invention, any modification, equivalent substitution and improvements made etc., it should be included in the present invention's Within protection domain.

Claims (5)

  1. A kind of 1. method for increasing data leak safeguard function for ordinary mobile storage, it is characterised in that:It is common at one The virtual volume file of an encryption is created on movable storage device subregion, a virtual volume equipment is further generated, for storing Private data;On the basis of computer operating system, with Network Isolation, storage isolation, using isolation and peripheral hardware isolation etc. Layer isolation technology is driven, a safety desktop completely isolated with system desktop is constructed, for opening the virtual volume equipment.
  2. 2. a kind of method that data leak safeguard function is provided for ordinary mobile storage according to claim 1, its It is characterised by:The ordinary mobile storage refers to be connected to the various External memory equipments that computer equipment uses, including U Disk, mobile hard disk and various electronic memory cards etc..
  3. A kind of 3. system for increasing data leak safeguard function for ordinary mobile storage, it is characterised in that:The system bag Include initialization unit, user's sub-control unit, desktop switch unit, login control unit, safety desktop unit, Network Isolation list Member, store isolated location, using isolated location, peripheral hardware isolated location, virtual disk unit, disk transparent encryption unit, file Unit is imported and exported, system software is implanted in ordinary mobile storage, reaches and is made as ordinary mobile storage Possesses the purpose of the secrecy movable storage device of data leak safeguard function.
  4. 4. a kind of system that data leak safeguard function is provided for ordinary mobile storage according to claim 3, its It is characterised by:User's sub-control unit, multiple user ciphers of different rights are set for secrecy movable storage device:Power user is close Code, audit user cipher, domestic consumer's password and read-only user password, power user are used for highest authority, and audit user only relates to And daily record, domestic consumer editing files, read-only user only browse file, permit without power user, audit user, common use Family and read-only user can not obtain data from secrecy movable storage device.
  5. A kind of 5. device for increasing data leak safeguard function for ordinary mobile storage, it is characterised in that:Described device bag Include a hardware Key and embedded system software composition.
CN201710623489.1A 2017-07-28 2017-07-28 A kind of mthods, systems and devices for increasing data leak safeguard function for ordinary mobile storage Pending CN107392062A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201710623489.1A CN107392062A (en) 2017-07-28 2017-07-28 A kind of mthods, systems and devices for increasing data leak safeguard function for ordinary mobile storage

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201710623489.1A CN107392062A (en) 2017-07-28 2017-07-28 A kind of mthods, systems and devices for increasing data leak safeguard function for ordinary mobile storage

Publications (1)

Publication Number Publication Date
CN107392062A true CN107392062A (en) 2017-11-24

Family

ID=60341796

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201710623489.1A Pending CN107392062A (en) 2017-07-28 2017-07-28 A kind of mthods, systems and devices for increasing data leak safeguard function for ordinary mobile storage

Country Status (1)

Country Link
CN (1) CN107392062A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112199740A (en) * 2020-12-03 2021-01-08 飞天诚信科技股份有限公司 Encryption lock implementation method and encryption lock

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101072102A (en) * 2007-03-23 2007-11-14 南京联创网络科技有限公司 Information leakage preventing technology based on safety desktop for network environment
US20120144500A1 (en) * 2009-08-11 2012-06-07 Ahnlab., Inc. Method and apparatus for protecting data using a virtual environment
CN104077244A (en) * 2014-07-20 2014-10-01 湖南蓝途方鼎科技有限公司 Process isolation and encryption mechanism based security disc model and generation method thereof
CN104298472A (en) * 2014-10-12 2015-01-21 张维加 Layered computing virtualization implementing method and device

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101072102A (en) * 2007-03-23 2007-11-14 南京联创网络科技有限公司 Information leakage preventing technology based on safety desktop for network environment
US20120144500A1 (en) * 2009-08-11 2012-06-07 Ahnlab., Inc. Method and apparatus for protecting data using a virtual environment
CN104077244A (en) * 2014-07-20 2014-10-01 湖南蓝途方鼎科技有限公司 Process isolation and encryption mechanism based security disc model and generation method thereof
CN104298472A (en) * 2014-10-12 2015-01-21 张维加 Layered computing virtualization implementing method and device

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112199740A (en) * 2020-12-03 2021-01-08 飞天诚信科技股份有限公司 Encryption lock implementation method and encryption lock

Similar Documents

Publication Publication Date Title
CN100449561C (en) Divulging secrets prevention system of USB storage device date based on certificate and transparent encryption technology
CN102254124B (en) A kind of information of mobile terminal security protection system and method
CN103530570B (en) A kind of electronic document safety management system and method
CN100583036C (en) Computer safety control method based on USB flash memory disc
Hasan et al. Toward a threat model for storage systems
CN104123506B (en) Data access method, device, data encryption, storage and access method, device
CN104333545B (en) The method that cloud storage file data is encrypted
CN106462718A (en) Rapid data protection for storage devices
WO2006066604A8 (en) Method and system for access control and data protection in digital memories, related digital memory and computer program product therefor
CN110263524A (en) A kind of mobile device encryption U-shield
CN102955745A (en) Mobile storage terminal and data management method thereof
CN101938497A (en) Multistage security file structure as well as file access control and secret key management user terminal, service terminal, system and method thereof
CN102693399B (en) System and method for on-line separation and recovery of electronic documents
CN101827101A (en) Information asset protection method based on credible isolated operating environment
CN101271497A (en) Electric document anti-disclosure system and its implementing method
CN102053925A (en) Realization method of data encryption in hard disk
CN101594360A (en) LAN system and the method for safeguarding LAN information safety
CN103268456A (en) Method and device for file safety control
CN107358097A (en) A kind of method and system in open environment Computer protecting information safety
CN102790770B (en) Electronic document concentrated preservation and takeout safety management system and method
CN106033625A (en) Lockset, mobile terminal, lockset control method, and lockset control system
CN106845261A (en) A kind of method and device of destruction SSD hard disc datas
CN105279453B (en) It is a kind of to support the partitions of file for separating storage management to hide system and method
CN107392062A (en) A kind of mthods, systems and devices for increasing data leak safeguard function for ordinary mobile storage
CN202632281U (en) Electronic data privacy protection system and mobile storage device with privacy protection function

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
WD01 Invention patent application deemed withdrawn after publication

Application publication date: 20171124

WD01 Invention patent application deemed withdrawn after publication