WO2021027526A1

WO2021027526A1 - Data storage method, device, computer apparatus, and storage medium

Info

Publication number: WO2021027526A1
Application number: PCT/CN2020/104462
Authority: WO
Inventors: 竹贝芬; 李先强; 罗影; 王鹏; 曾伟; 周海涛
Original assignee: 江苏芯盛智能科技有限公司
Priority date: 2019-08-14
Filing date: 2020-07-24
Publication date: 2021-02-18
Also published as: CN110619237A; CN110619237B

Abstract

The present application relates to a data storage method, a device, a computer apparatus, and a storage medium. The method comprises: a server first acquiring a storage request, and searching for a Ukey corresponding to an encrypted storage apparatus; and sending an authorization key to the encrypted storage apparatus, and sending a storage message to the encrypted storage apparatus, wherein the storage message carries data to be stored and a storage instruction, and the storage instruction is used to control the encrypted storage apparatus to encrypt the data to be stored, and store the encrypted data in the encrypted storage apparatus or a non-encrypted storage apparatus. The data storage method of the present application encrypts data by controlling the encrypted storage apparatus, and then stores the data in the encrypted storage apparatus or a non-encrypted storage apparatus, thereby eliminating the need to use a new storage chip in an encryption storage process, reducing complexity of encrypted storage, and increasing storage efficiency of encrypted storage.

Description

Data storage method, device, computer equipment and storage medium

Technical field

This application relates to the field of computer technology, in particular to a data storage method, device, computer equipment, and storage medium.

Background technique

Storage refers to storing data on certain media in a reasonable, safe, and effective manner according to different application environments and ensuring effective access. Generally speaking, it can contain two meanings: on the one hand, it is temporary data Or a long-term physical medium; on the other hand, it is a way or behavior to ensure the complete and safe storage of data.

Storage can generally be realized through mobile storage devices. In the field of mobile storage devices, there are currently some encrypted mobile hard disks in the market and some SSD (Solid State Drive, solid state drive) disks.

At present, for non-encrypted mobile storage devices with encryption requirements, a dedicated encryption chip can be used for encryption, which additionally increases the complexity of the data storage process.

Summary of the invention

Based on this, it is necessary to use a dedicated encryption chip for encryption in the existing technology, which additionally increases the complexity of the data storage process, and provides a data storage method, device, computer equipment and storage that can reduce the complexity of the data encryption storage process medium.

A data storage method, the method includes:

Obtaining a storage request, the storage request including the requested storage device and the data to be stored, the storage device including an encrypted storage device or an encrypted storage device and a non-encrypted storage device;

Find the Ukey corresponding to the encrypted storage device;

Sending a permission key to the encrypted storage device, where the permission key is a permission key corresponding to the encrypted storage device generated by the Ukey;

Send a storage message to the encrypted storage device, the storage message carries the data to be stored and a storage instruction, the storage instruction is used to control the encrypted storage device to encrypt the data to be stored, and the encrypted storage The data to be stored is stored in the encrypted storage device or the non-encrypted storage device.

In one of the embodiments, sending the authorization key to the storage device of the encrypted storage device includes:

Determine the temporary key of the Ukey and the encrypted storage device, generate a random key through the Ukey, and generate an authority key according to the serial number of the encrypted storage device and the random key;

The authorization key is encrypted by the temporary key and sent to the encrypted storage device.

In one of the embodiments, before the searching the Ukey corresponding to the encrypted storage device, the method further includes:

Judging whether the encrypted storage device is bound to Ukey according to the electronic signature information of the encrypted storage device;

When the encrypted storage device is in a state bound to Ukey, randomly generate a temporary key, and send the temporary key to the Ukey bound to the encrypted storage device and the encrypted storage device;

When the encrypted storage device is not in the state of being bound to the Ukey, search for Ukey that is not in the bound state, and exchange the CA certificate of the encrypted storage device and the Ukey that is not in the bound state to encrypt the The storage device performs identity authentication with the Ukey that is not in the bound state, binds the encrypted storage device and the Ukey that is not in the bound state, generates a temporary key at random, and sends the temporary key to all Ukey bound to the encrypted storage device and the encrypted storage device.

In one of the embodiments, the sending a storage message to the encrypted storage device includes:

When receiving an authentication pass message fed back by the encrypted storage device, generate a storage instruction according to the requested storage device;

Generate a storage message according to the data to be stored and the storage instruction;

Send the storage message to the encrypted storage device.

A data storage method applied to an encrypted storage device, the method including:

Receiving the authority key sent by the server, where the authority key is generated by the corresponding Ukey;

Receiving a storage message sent by the server, the storage message carrying data to be stored and storage instructions;

Encrypt the data to be stored according to the storage instruction;

Store the encrypted data to be stored in the storage device specified by the storage instruction according to the storage instruction, and the storage device includes a current encrypted storage device or a non-encrypted storage device.

In one of the embodiments, before acquiring the storage message sent by the server, the method further includes:

Determine the temporary key corresponding to the current storage process;

The authorization key is decrypted by the temporary key, and when the serial number in the authorization key is the same as the stored serial number, the authentication is determined to be passed, and the authentication passed signal is fed back to the server.

In one of the embodiments, the encrypting the data to be stored according to the storage instruction includes:

When the storage device specified by the storage instruction is a currently encrypted storage device, encrypt the data to be stored by using a preset I/O key;

When the storage device specified by the storage instruction is a non-encrypted storage device, the data to be stored is encrypted by the authority key.

A data storage device, the device comprising:

A request obtaining module, configured to obtain a storage request, the storage request including the requested storage device and the data to be stored, the storage device including an encrypted storage device or an encrypted storage device and a non-encrypted storage device;

The device search module is used to search for the Ukey corresponding to the encrypted storage device;

A key sending module, configured to send a permission key to the encrypted storage device, where the permission key is a permission key corresponding to the encrypted storage device generated by the Ukey;

The data sending module is configured to send a storage message to the encrypted storage device, the storage message carries data to be stored and storage instructions, and the storage instruction is used to control the encrypted storage device to encrypt the data to be stored, and Storing the encrypted data to be stored in the encrypted storage device or the non-encrypted storage device.

A data storage device, the device comprising:

The key decryption module is used to receive the authority key sent by the server, and the authority key is generated by the corresponding Ukey;

A data receiving module, configured to receive a storage message sent by the server, the storage message carrying data to be stored and storage instructions;

A data encryption module, configured to encrypt the data to be stored according to the storage instruction;

The data storage module is configured to store the encrypted data to be stored in the storage device specified by the storage instruction according to the storage instruction, and the storage device includes a current encrypted storage device or a non-encrypted storage device.

A computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

Find the Ukey corresponding to the encrypted storage device;

Encrypt the data to be stored according to the storage instruction;

A computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

Find the Ukey corresponding to the encrypted storage device;

Encrypt the data to be stored according to the storage instruction;

For the above data storage methods, devices, computer equipment, and storage media, the server first obtains the storage request, and then finds the Ukey corresponding to the encrypted storage device; sends the authorization key to the encrypted storage device, and sends the storage message to the encrypted storage device. The storage data and the storage instruction are used to control the encrypted storage device to encrypt the data to be stored, and store the encrypted data to be stored in the encrypted storage device or the non-encrypted storage device. The data storage method of this application encrypts data by controlling an encrypted storage device, and then saves it to an encrypted storage device or a non-encrypted storage device. The encrypted storage process does not need to use a new storage chip, which can effectively reduce the complexity of encrypted storage and improve Storage efficiency of encrypted storage.

Description of the drawings

Figure 1 is an application environment diagram of a data storage method in an embodiment;

Figure 2 is a schematic flowchart of a data storage method in an embodiment;

FIG. 3 is a schematic diagram of a sub-flow of step S250 in FIG. 2 in an embodiment;

4 is a schematic flowchart of a data storage method in another embodiment;

Figure 5 is a structural block diagram of a data storage device in an embodiment;

Fig. 6 is an internal structure diagram of a computer device in an embodiment.

detailed description

In order to make the purpose, technical solutions, and advantages of this application clearer, the following further describes this application in detail with reference to the drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the application, and not used to limit the application.

The data storage method provided by this application can be applied to the application environment shown in FIG. 1, where the storage management server 104 communicates with the terminal 102 and multiple storage devices 106 through the network. The storage devices include encrypted storage devices and non- For encrypted storage devices, the storage management server 104 can receive the storage request including the data to be stored provided by the terminal 102, and find the Ukey corresponding to the encrypted storage device; then use the Ukey to generate a permission key corresponding to the storage device, and send the permission key to the encryption Storage device; then the storage management server 104 sends a storage message carrying the data to be stored and the storage instruction to the encrypted storage device; the encrypted storage device encrypts the data to be stored; and then stores the encrypted data to be stored according to the storage instruction to the storage device specified by the storage instruction , Storage devices include current encrypted storage devices or non-encrypted storage devices. The terminal 102 may be, but is not limited to, various personal computers, notebook computers, smart phones, and tablet computers.

As shown in Figure 2, in one of the embodiments, the data storage method of the present application is implemented by a storage management server, which specifically includes the following steps:

S210: Obtain a storage request. The storage request includes the requested storage device and the data to be stored. The storage device includes an encrypted storage device or an encrypted storage device and a non-encrypted storage device.

A storage request refers to a request to the storage management server to store the data to be stored in the designated target storage device. The storage request includes the requested storage device and the content that needs to be stored. In addition, this storage request also implies the encryption of the data. The requirement is to encrypt the data to be stored before saving it to the target storage device. The requested storage device includes an encrypted storage device or an encrypted storage device and a non-encrypted storage device. When the requested storage device only includes an encrypted storage device, it means that the storage request wishes to save the data to be stored in the encrypted storage device. When the requested storage device includes an encrypted storage device and a non-encrypted storage device, it means that the storage request hopes to encrypt the data to be stored by the encrypted storage device, and then save it to the non-encrypted storage device.

S230: Find the Ukey corresponding to the encrypted storage device.

Ukey is a small storage device that is directly connected to the computer via USB (Universal Serial Bus), has a password verification function, and is reliable and high-speed. Ukey is an extremely powerful supplement to the current network security system and is a network security product certified by the China Information Security Evaluation and Certification Center. Based on trusted computer and smart card technology, it brings ease of use, portability and the highest level of security to the use of Microsoft IE or Netscape Navigator for Web access, online transactions (shopping, payment), sending and receiving e-mails, online chats and friends and forms Users who perform operations such as signatures and file digital signatures ensure that the user's operations under ukey cannot be tampered with or denied. The biggest feature of ukey is high security, strong technical specification consistency, good operating system compatibility, and flexible carrying and use. Each encrypted storage device has a corresponding Ukey, and each Ukey is managed by the storage management server.

S250: Send the authority key to the encrypted storage device, where the authority key is the authority key corresponding to the encrypted storage device generated by Ukey.

The authorization key is used to activate the encrypted storage device. In addition, the authorization key can also perform operations such as authentication and encryption. The storage management server may generate a permission key for activating the storage device through the Ukey corresponding to the encrypted storage device, and then activate the encrypted storage device for encrypted storage by sending the permission key to the encrypted storage device. In one of the embodiments, when the encrypted storage device receives the authorization key sent by the storage management server, it will authenticate the authorization key. When it passes the authentication, it will feed back an authentication pass message to the storage management server, and the storage management server Through the authentication, the message is used to determine whether to perform subsequent actions.

S270: Send a storage message to an encrypted storage device, the storage message carries the data to be stored and a storage instruction, the storage instruction is used to control the encrypted storage device to encrypt the data to be stored, and store the encrypted data to be stored in the encrypted storage device or non-encrypted Storage device.

The storage instruction is generated according to the storage device corresponding to the storage request of the client. After the storage management server sends the authorization key, it will send a storage message containing the data to be stored and storage instructions to the encrypted storage device, and control the encrypted storage device through the storage instructions to encrypt and store the data to be stored. The storage process can be encrypted first. The storage device encrypts the data to be stored according to the storage instruction, and stores the encrypted data to be stored in an encrypted storage device or a non-encrypted storage device. The specific storage location is determined by the storage instruction. The encrypted storage device may be an SSD encrypted disk containing the remaining key space, and the non-encrypted storage device may be an SSD non-encrypted disk, and the storage management server manages it according to the serial number of each SSD disk.

In the above data storage method, the server first obtains the storage request, and then finds the Ukey corresponding to the encrypted storage device; sends the authorization key to the encrypted storage device, and sends the storage message to the encrypted storage device. The storage message carries the data to be stored and the storage instruction. The storage instruction It is used to control the encrypted storage device to encrypt the data to be stored, and store the encrypted data to be stored in the encrypted storage device or the non-encrypted storage device. The data storage method of this application encrypts data by controlling an encrypted storage device, and then saves it to an encrypted storage device or a non-encrypted storage device. The encrypted storage process does not need to use a new storage chip, which can effectively reduce the complexity of encrypted storage and improve Storage efficiency of encrypted storage.

As shown in FIG. 3, in one of the embodiments, step S250 includes:

S252: Determine the temporary key of the Ukey and the encrypted storage device, generate a random key through the Ukey, and generate an authority key according to the serial number and the random key of the encrypted storage device.

S254: The authorization key is encrypted by the temporary key and sent to the encrypted storage device.

The storage management server first determines the temporary key agreed upon between Ukey and the encrypted storage device during this storage process, and then generates a random key through Ukey, encrypts the serial number and random key of the storage device through the temporary key, and generates an encrypted The authorization key, in one of the embodiments, can store the serial number of the storage device in its corresponding Ukey. After the authorization key is generated, the encrypted authorization key can be sent to the encrypted storage device to activate the storage process of the storage device. The temporary key has timeliness and randomness. When the storage device is powered off, a new temporary key needs to be used for authentication. Ukey and the storage device can agree on a temporary key in advance to ensure the right key transmission process. Confidentiality and traceability.

In one of the embodiments, before S230, the method further includes:

Determine whether the encrypted storage device is bound to Ukey according to the electronic signature information of the encrypted storage device.

When the encrypted storage device is in a state bound to the Ukey, a temporary key is randomly generated, and the temporary key is sent to the Ukey bound to the encrypted storage device and the encrypted storage device.

When the encrypted storage device is not in the state of being bound with Ukey, find the Ukey that is not in the bound state, and exchange the CA certificate of the encrypted storage device and the Ukey that is not in the bound state to connect the encrypted storage device to the unbound state. Perform identity authentication, bind the encrypted storage device with the Ukey that is not in the bound state, randomly generate a temporary key, and send the temporary key to the encrypted storage device and the Ukey bound to the encrypted storage device.

First, it is necessary to determine whether the Ukey is bound to the encrypted storage device specified by the user. When there is a Ukey bound to the encrypted storage device, the authentication can be directly completed and a temporary key is generated. When it does not exist, the binding work needs to be completed first Then generate a temporary key. The binding process can be realized by exchanging the CA certificate. The encrypted storage device and Ukey each have the CA certificate applied to the CA organization, and identity authentication can be completed by exchanging their respective certificates; the authority key is generated and stored by Ukey and injected into the SSD In the transmission of the authorization key, the authorization key is encrypted with a key temporarily negotiated between SSD and Ukey and digitally signed. Improve the security of the data transmission process.

In one of the embodiments, S270 includes:

When receiving the authentication pass message fed back by the encrypted storage device, generate a storage instruction according to the requested storage device;

Generate storage messages according to the data to be stored and storage instructions;

Send storage messages to encrypted storage devices.

When the storage device receives the authorization key sent by the storage management server, it will authenticate the authorization key. When it passes the authentication, it will feed back an authentication pass message to the storage management server. When the storage management server receives the authentication pass message, The storage instruction can be generated according to the requested storage device, and then the storage message is generated according to the storage instruction and the data to be stored, and then the storage message is sent to the designated encrypted storage device. The encrypted storage device can parse the storage message to obtain the data to be stored and the storage instruction , And then the storage device can store the data to be stored according to the storage instruction. Through the authentication of the authority secret key, the security of the data encryption storage process can be improved.

As shown in Figure 4, the present application also provides a data storage method, which is applied to an encrypted storage device, and the method includes:

S410: Receive the authority key sent by the server, where the authority key is generated by the corresponding Ukey.

S430: Receive a storage message sent by the server, where the storage message carries data to be stored and a storage instruction.

S450: Encrypt the data to be stored according to the storage instruction.

S470: Store the encrypted data to be stored in the storage device specified by the storage instruction according to the storage instruction, where the storage device includes a current encrypted storage device or a non-encrypted storage device.

The encrypted storage area may be an SSD encrypted disk containing the remaining key space, and the non-encrypted storage area is an SSD non-encrypted disk, and the storage management server manages it according to the serial number of each SSD disk. The storage device has a corresponding relationship with each Ukey managed by the storage management server. The storage management server can generate a corresponding authority key through the corresponding Ukey, and activate the current encrypted storage device through the authority key. The encrypted storage device receives the authorization key sent by the storage management server, stores the authorization key in the encrypted storage area, then activates the encrypted storage process, and then obtains the storage message sent by the storage management server, and obtains storage instructions and data to be stored by parsing the storage message After obtaining the data to be stored, the storage device formulated according to the storage instruction encrypts the data to be stored, and then saves the encrypted data to be stored to the storage device specified by the storage instruction to complete the data encryption work.

In the above data storage method, the storage device first receives the authorization key sent by the server; receives the storage message sent by the server, the storage message carries the data to be stored and the storage instruction; encrypts the data to be stored according to the storage instruction; stores the encrypted data to be stored according to the storage instruction Data to the storage device specified by the storage instruction, the storage device includes the current encrypted storage device or the non-encrypted storage device. The data storage method of this application encrypts the data by encrypting the storage device, and then saves it to the encrypted storage device or non-encrypted storage area. The encrypted storage process does not need to use a new storage chip, which can effectively reduce the complexity of encrypted storage. Improve the storage efficiency of encrypted storage.

In one of the embodiments, S430 includes:

Determine the temporary key corresponding to the current storage process;

The authorization key is decrypted by the temporary key. When the serial number in the authorization key is the same as the stored serial number, the authentication is determined to be passed, and the authentication passed signal is fed back to the server.

During each storage process, Ukey and the storage device will pre-appoint a random temporary key. The key is generated by the storage management server and sent to Ukey and the storage device respectively. When the storage device is powered on and reactivated, the two parties need to negotiate again Generate a new temporary key. After the authorization key in Ukey is encrypted and transmitted to the storage device, the temporary key can be used to decrypt the encrypted and transmitted authorization key. If the decryption is successful and the storage device serial number carried in the authorization key is stored in the storage device If they are consistent, the encrypted storage function is activated and encrypted storage starts. Encrypting data with a temporary key can further ensure the security of the storage process.

In one of the embodiments, S450 includes:

When the storage device specified by the storage instruction is the current encrypted storage device, the data to be stored is encrypted by the preset I/O key;

When the storage device specified by the storage instruction is a non-encrypted storage device, the data to be stored is encrypted by the permission key.

The storage device specified by the user can be an encrypted storage device or a non-encrypted storage device. When the storage device specified by the user, that is, when the storage device specified by the storage instruction is the current encrypted storage device, the I/O secret inside the current encrypted storage device The key is used to encrypt the data to be stored, and then save it to the current encrypted storage device. When the storage device specified by the storage instruction is another non-encrypted storage device, the data to be stored can be encrypted by the permission key, and Save it to a non-encrypted storage device. To ensure the effectiveness of encrypted storage, while decrypting data, corresponding decryption can also be performed according to the corresponding key to improve the security of the data storage and retrieval process.

In one of the embodiments, the data storage method of the present application includes: obtaining a storage request. The storage request includes the requested storage device and the data to be stored. The storage device includes an encrypted storage device or an encrypted storage device and a non-encrypted storage device. Determine whether the encrypted storage device is bound to Ukey according to the electronic signature information of the encrypted storage device; when the encrypted storage device is in the state of binding with Ukey, a temporary key is randomly generated, and the temporary key is sent to the encrypted storage device and encrypted storage Ukey bound to the device; when the encrypted storage device is not in the state of being bound to the Ukey, find the Ukey that is not in the bound state, and exchange the CA certificate of the encrypted storage device and the Ukey that is not in the bound state to the encrypted storage device Perform identity authentication with the Ukey that is not in the bound state, bind the encrypted storage device and the Ukey that is not in the bound state, randomly generate a temporary key, and send the temporary key to the encrypted storage device and the Ukey bound to the encrypted storage device . Find the Ukey corresponding to the encrypted storage device; determine the temporary key between the Ukey and the encrypted storage device, generate a random key through Ukey, and generate the authorization key according to the serial number and random key of the encrypted storage device; use the temporary key to convert the authorization key After being encrypted, it is sent to the encrypted storage device. The encrypted storage device receives the authority key sent by the server. Determine the temporary key corresponding to the current storage process; decrypt the authorization key with the temporary key, and when the serial number in the authorization key is the same as the stored serial number, it is determined to pass the authentication, and the authentication pass signal is fed back to the server. The storage management server receives the authentication pass message fed back by the encrypted storage device, and sends the storage message to the encrypted storage device. The storage message carries the data to be stored and the storage instruction. The storage instruction is used to control the encrypted storage device to encrypt the data to be stored, and to encrypt the encrypted storage device. The data to be stored is stored in an encrypted storage device or a non-encrypted storage device. The encrypted storage device obtains the storage message sent by the server, and the storage message carries the data to be stored and the storage instruction; when the storage device specified by the storage instruction is the current encrypted storage device, the data to be stored is encrypted by the preset I/O key; when the storage instruction When the designated storage device is a non-encrypted storage device, the data to be stored is encrypted by the permission key. Store the encrypted data to be stored in the storage device specified by the storage instruction according to the storage instruction, and the storage device includes the current encrypted storage device or the non-encrypted storage device.

It should be understood that although the various steps in the flowcharts of FIGS. 2-4 are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless specifically stated in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least some of the steps in Figures 2-4 may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. These sub-steps or stages The execution order of is not necessarily performed sequentially, but may be performed alternately or alternately with at least a part of other steps or sub-steps or stages of other steps.

As shown in Figure 5, the present application also provides a data storage device, which includes:

The request obtaining module 210 is configured to obtain a storage request. The storage request includes the requested storage device and the data to be stored. The storage device includes an encrypted storage device or an encrypted storage device and a non-encrypted storage device;

The device search module 230 is used to search for the Ukey corresponding to the encrypted storage device;

The key sending module 250 is used to send the authority key to the encrypted storage device, and the authority key is the authority key corresponding to the encrypted storage device generated by Ukey;

The data sending module 270 is used to send a storage message to an encrypted storage device, the storage message carries the data to be stored and a storage instruction, and the storage instruction is used to control the encrypted storage device to encrypt the data to be stored, and store the encrypted data to be stored in the encryption Storage device or non-encrypted storage device.

In one of the embodiments, the key sending module 250 is used to determine the temporary key of the Ukey and the encrypted storage device, generate a random key through the Ukey, and generate the authorization key according to the serial number of the encrypted storage device and the random key; The temporary key encrypts the authority key and sends it to the encrypted storage device.

In one of the embodiments, it further includes a temporary key generation module, which is used to determine whether the encrypted storage device is bound to Ukey according to the electronic signature information of the encrypted storage device; when the encrypted storage device is in the state of being bound to Ukey, randomly generate Temporary key, and send the temporary key to the Ukey that is bound to the encrypted storage device and the encrypted storage device; when the encrypted storage device is not in the state of binding with the Ukey, find the Ukey that is not in the bound state, and exchange the encrypted storage The CA certificate of the device and the Ukey that is not in the bound state authenticates the encrypted storage device and the Ukey that is not in the bound state, binds the encrypted storage device and the Ukey that is not in the bound state, and randomly generates a temporary key, and Send the temporary key to the Ukey bound to the encrypted storage device and the encrypted storage device.

In one of the embodiments, the data sending module 270 is configured to generate a storage instruction according to the requested storage device when the authentication pass message fed back by the encrypted storage device is received; generate a storage message according to the data to be stored and the storage instruction; store the message Send to encrypted storage device.

This application also provides another data storage device, which includes:

The key decryption module is used to receive the authorization key sent by the server, and the authorization key is generated by the corresponding Ukey;

The data receiving module is used to receive the storage message sent by the server, and the storage message carries the data to be stored and storage instructions;

The data encryption module is used to encrypt the data to be stored according to the storage instruction;

The data storage module is used to store the encrypted data to be stored in the storage device specified by the storage instruction according to the storage instruction, and the storage device includes the current encrypted storage device or the non-encrypted storage device.

In one of the embodiments, the comparison authentication module is used to determine the temporary key corresponding to the current storage process; the authorization key is decrypted by the temporary key, and when the serial number in the authorization key is the same as the stored serial number, it is determined to pass Authentication, feedback the authentication pass signal to the server.

In one of the embodiments, the data encryption module is used to encrypt the data to be stored by the preset I/O key when the storage device specified by the storage instruction is the current encrypted storage device; when the storage device specified by the storage instruction is non-encrypted storage When the device is used, the data to be stored is encrypted by the permission key.

For the specific definition of the data storage device, please refer to the above definition of the data storage method, which will not be repeated here. Each module in the above-mentioned data storage device can be implemented in whole or in part by software, hardware, and a combination thereof. The foregoing modules may be embedded in the form of hardware or independent of the processor in the computer device, or may be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the foregoing modules.

In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. 6. The computer equipment includes a processor, a memory, and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide calculation and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. The computer program is executed by the processor to realize a data storage method.

Those skilled in the art can understand that the structure shown in FIG. 6 is only a block diagram of part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may Including more or less parts than shown in the figure, or combining some parts, or having a different part arrangement.

In one embodiment, a computer device is provided, including a memory and a processor, and a computer program is stored in the memory, and the processor implements the following steps when executing the computer program:

Obtain a storage request. The storage request includes the requested storage device and the data to be stored. The storage device includes an encrypted storage device or an encrypted storage device and a non-encrypted storage device;

Find the Ukey corresponding to the encrypted storage device;

Send the authorization key to the encrypted storage device, the authorization key is the authorization key corresponding to the encrypted storage device generated by Ukey;

Send a storage message to an encrypted storage device. The storage message carries the data to be stored and storage instructions. The storage instructions are used to control the encrypted storage device to encrypt the data to be stored and store the encrypted data to be stored in the encrypted storage device or non-encrypted storage device .

In one embodiment, the processor further implements the following steps when executing the computer program: determining the temporary key of the Ukey and the encrypted storage device, generating a random key through Ukey, and generating the authorization secret based on the serial number of the encrypted storage device and the random key. Key; the authorization key is encrypted by the temporary key and sent to the encrypted storage device.

In one embodiment, the processor further implements the following steps when executing the computer program: judging whether the encrypted storage device is bound to Ukey according to the electronic signature information of the encrypted storage device; when the encrypted storage device is in the state of being bound to Ukey, randomly generate Temporary key, and send the temporary key to the Ukey that is bound to the encrypted storage device and the encrypted storage device; when the encrypted storage device is not in the state of binding with the Ukey, find the Ukey that is not in the bound state, and exchange the encrypted storage The CA certificate of the device and the Ukey that is not in the bound state authenticates the encrypted storage device and the Ukey that is not in the bound state, binds the encrypted storage device and the Ukey that is not in the bound state, and randomly generates a temporary key, and Send the temporary key to the Ukey bound to the encrypted storage device and the encrypted storage device.

In an embodiment, the processor further implements the following steps when executing the computer program: when receiving the authentication pass message fed back by the encrypted storage device, generate a storage instruction according to the requested storage device;

According to the data to be stored and the storage instruction, a storage message is generated; the storage message is sent to the encrypted storage device.

Receive the authorization key sent by the server, the authorization key is generated by the corresponding Ukey;

Receive the storage message sent by the server, the storage message carries the data to be stored and the storage instruction;

Encrypt the data to be stored according to the storage instruction;

Store the encrypted data to be stored in the storage device specified by the storage instruction according to the storage instruction, and the storage device includes the current encrypted storage device or the non-encrypted storage device.

In one embodiment, the processor further implements the following steps when executing the computer program: determining the temporary key corresponding to the current storage process; decrypting the authorization key through the temporary key, when the serial number in the authorization key and the stored serial number At the same time, it is determined that the authentication is passed, and the authentication passed signal is returned to the server.

In one embodiment, the processor further implements the following steps when executing the computer program: when the storage device specified by the storage instruction is the current encrypted storage device, encrypt the data to be stored by the preset I/O key; when the storage specified by the storage instruction When the device is a non-encrypted storage device, the data to be stored is encrypted by the permission key.

In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

Find the Ukey corresponding to the encrypted storage device;

In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining the temporary key between Ukey and the encrypted storage device, generating a random key through Ukey, and according to the serial number and random password of the encrypted storage device stored in Ukey Key to generate the authorization key; the authorization key is encrypted by the temporary key and sent to the encrypted storage device.

In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determine whether the encrypted storage device is bound to Ukey according to the electronic signature information of the encrypted storage device; when the encrypted storage device is in the state of being bound to Ukey, randomly Generate a temporary key, and send the temporary key to the Ukey that is bound to the encrypted storage device and the encrypted storage device; when the encrypted storage device is not in the state of binding with the Ukey, find the Ukey that is not in the state of binding, and encrypt by exchange The CA certificate of the storage device and the Ukey that is not in the bound state authenticates the encrypted storage device and the Ukey that is not in the bound state, binds the encrypted storage device and the Ukey that is not in the bound state, and randomly generates a temporary key. And send the temporary key to the Ukey bound to the encrypted storage device and the encrypted storage device.

In one embodiment, when the computer program is executed by the processor, the following steps are further implemented: when the authentication pass message fed back by the encrypted storage device is received, a storage instruction is generated according to the requested storage device;

Encrypt the data to be stored according to the storage instruction;

In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: determining the temporary key corresponding to the current storage process; decrypting the authorization key by the temporary key, when the serial number in the authorization key is compared with the stored sequence When the number is the same, it is determined that the authentication is passed, and the authentication passed signal is fed back to the server.

In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when the storage device specified by the storage instruction is the current encrypted storage device, encrypt the data to be stored by the preset I/O key; when the storage instruction specifies When the storage device is a non-encrypted storage device, the data to be stored is encrypted by the permission key.

A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by a computer program instructing relevant hardware, and the computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it may include the processes of the above-mentioned method embodiments. Wherein, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and/or volatile memory. Non-volatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not a limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous chain Channel (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction between the combinations of these technical features, they should It is considered as the range described in this specification.

The above examples only express several implementation manners of the present application, and the description is relatively specific and detailed, but it should not be understood as a limitation on the scope of the invention patent. It should be pointed out that for those of ordinary skill in the art, without departing from the concept of this application, several modifications and improvements can be made, and these all fall within the protection scope of this application. Therefore, the scope of protection of the patent of this application shall be subject to the appended claims.

Claims

A data storage method, the method includes:

Obtaining a storage request, the storage request including the requested storage device and the data to be stored, the storage device including an encrypted storage device or an encrypted storage device and a non-encrypted storage device;

Find the Ukey corresponding to the encrypted storage device;

Sending a permission key to the encrypted storage device, where the permission key is a permission key corresponding to the encrypted storage device generated by the Ukey;

Send a storage message to the encrypted storage device, the storage message carries the data to be stored and a storage instruction, the storage instruction is used to control the encrypted storage device to encrypt the data to be stored, and the encrypted storage The data to be stored is stored in the encrypted storage device or the non-encrypted storage device.
The method according to claim 1, wherein before sending the authorization key to the encrypted storage device, it comprises:

Determine the temporary key of the Ukey and the encrypted storage device, generate a random key through the Ukey, and generate an authority key according to the serial number of the encrypted storage device and the random key;

The authorization key is encrypted by the temporary key and sent to the encrypted storage device.
The method according to claim 1, wherein before said searching the Ukey corresponding to the encrypted storage device, the method further comprises:

Judging whether the encrypted storage device is bound to Ukey according to the electronic signature information of the encrypted storage device;

When the encrypted storage device is in a state bound to Ukey, randomly generate a temporary key, and send the temporary key to the Ukey bound to the encrypted storage device and the encrypted storage device;

When the encrypted storage device is not in the state of being bound to the Ukey, search for Ukey that is not in the bound state, and exchange the CA certificate of the encrypted storage device and the Ukey that is not in the bound state to encrypt the The storage device performs identity authentication with the Ukey that is not in the bound state, binds the encrypted storage device and the Ukey that is not in the bound state, generates a temporary key at random, and sends the temporary key to all Ukey bound to the encrypted storage device and the encrypted storage device.
The method according to claim 1, wherein the sending a storage message to the encrypted storage device comprises:

When receiving an authentication pass message fed back by the encrypted storage device, generate a storage instruction according to the requested storage device;

Generate a storage message according to the data to be stored and the storage instruction;

Send the storage message to the encrypted storage device.
A data storage method applied to an encrypted storage device, the method including:

Receiving the authority key sent by the server, where the authority key is generated by the corresponding Ukey;

Receiving a storage message sent by the server, the storage message carrying data to be stored and storage instructions;

Encrypt the data to be stored according to the storage instruction;

Store the encrypted data to be stored in the storage device specified by the storage instruction according to the storage instruction, and the storage device includes a current encrypted storage device or a non-encrypted storage device.
The method according to claim 5, wherein before said obtaining the stored message sent by the server, the method further comprises:

Determine the temporary key corresponding to the current storage process;

The authorization key is decrypted by the temporary key, and when the serial number in the authorization key is the same as the stored serial number, the authentication is determined to be passed, and the authentication passed signal is fed back to the server.
The method according to claim 5, wherein the encrypting the data to be stored according to the storage instruction comprises:

When the storage device specified by the storage instruction is a currently encrypted storage device, encrypt the data to be stored by using a preset I/O key;

When the storage device specified by the storage instruction is a non-encrypted storage device, the data to be stored is encrypted by the authority key.
A data storage device, characterized in that the device comprises:

A request obtaining module, configured to obtain a storage request, the storage request including the requested storage device and the data to be stored, the storage device including an encrypted storage device or an encrypted storage device and a non-encrypted storage device;

The device search module is used to search for the Ukey corresponding to the encrypted storage device;

A key sending module, configured to send a permission key to the encrypted storage device, where the permission key is a permission key corresponding to the encrypted storage device generated by the Ukey;

The data sending module is configured to send a storage message to the encrypted storage device, the storage message carries data to be stored and storage instructions, and the storage instruction is used to control the encrypted storage device to encrypt the data to be stored, and Storing the encrypted data to be stored in the encrypted storage device or the non-encrypted storage device.
A data storage device, characterized in that the device comprises:

The key decryption module is used to receive the authority key sent by the server, and the authority key is generated by the corresponding Ukey;

A data receiving module, configured to receive a storage message sent by the server, the storage message carrying data to be stored and storage instructions;

A data encryption module, configured to encrypt the data to be stored according to the storage instruction;

The data storage module is configured to store the encrypted data to be stored in the storage device specified by the storage instruction according to the storage instruction, and the storage device includes a current encrypted storage device or a non-encrypted storage device.
A computer device, comprising a memory and a processor, the memory storing a computer program, wherein the processor implements the method of any one of claims 1 to 4 or 5 to 7 when the computer program is executed A step of.
A computer-readable storage medium with a computer program stored thereon, wherein the computer program implements the steps of the method according to any one of claims 1 to 4 or 5 to 7 when the computer program is executed by a processor.