CN105262834A

CN105262834A - Data storage method

Info

Publication number: CN105262834A
Application number: CN201510729071.XA
Authority: CN
Inventors: 陈建文
Original assignee: Nanjing Qinshe Mingshi Information Technology Co Ltd
Current assignee: Sichuan Starry Star Technology Co Ltd
Priority date: 2015-10-30
Filing date: 2015-10-30
Publication date: 2016-01-20

Abstract

The invention discloses a data storage method. The method is applied to a data storage system which comprises a server and at least one computer. The method comprises that the first computer divides a local encryption disk, which serves as an independent data storage space, according to user settings; data which is stored in the local encryption disk by a user at current time is encrypted to obtain first encryption data; the first encryption data is sent to the server; and the server stores the data in pre-divided encryption disks of at least one other computer in a synchronizing manner.

Description

Data storage method

Technical Field

The invention relates to the field of computers, in particular to a data storage method.

Background

The network disk is understood to be a hard disk or a U disk stored on a network, and therefore, the network disk is also called a network U disk or a network hard disk and is used for providing online file storage, access, backup, sharing and other file management functions for a user. Through the network disk, the user can manage files stored on line in the network disk through the mobile terminal no matter where the user is located as long as the user can connect to the Internet.

There are various existing storage modes for web disks, for example, a file uploading method for a network hard disk provided by an application document with application number 201210362185.1, and files are stored according to a file abstract; for another example, the network disk file storage method provided by the application document with the application number of 201280000563.X stores files according to file names.

The network disk is widely applied as an effective method for backing up local files, but the network disk can increase an administrator role and generate new security risks.

After the data are stored in the network disk, the user acquires the stored data through the password; if no password exists, the user cannot acquire the stored data, and the data security can be guaranteed to a certain extent. However, in the method for storing data in the network disk, a network disk administrator has the authority to manage data stored by a user, and the network disk administrator can query the data stored by the user, even delete the stored content or freeze the account number of the network disk, thereby affecting the data storage security.

Disclosure of Invention

The invention provides a data storage method which can enhance the safety of local data storage.

An embodiment of the present invention provides a data storage method,

a data storage method applied to a data storage system, the system comprising a server and at least one computer, the method comprising: the first computer divides a local encryption disk according to user settings, wherein the local encryption disk is an independent data storage space; encrypting the data stored to the local encryption disk by the user to obtain first encrypted data; sending the first encrypted data to a server; and the server synchronously stores the data to the encryption disks of at least one other computer, and the encryption disks of at least one other computer are divided in advance.

The data storage method provided by the invention divides the local encryption disks according to the user setting, encrypts the data stored in the local encryption disks by the user at this time to obtain encrypted data, and synchronously stores the encrypted data in the encryption disks of at least one other storage device, so that the data stored in the local encryption disks are encrypted and stored in the other storage devices, and the security of local data storage is enhanced.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and together with the description, serve to explain the principles of the invention.

FIG. 1 is a flow chart of an embodiment of a data storage method of the present invention;

FIG. 2 is a schematic structural diagram of a computer system according to an embodiment of the data storage method of the present invention;

FIG. 3 is a schematic diagram illustrating the usage of an encrypted disk storage space according to an embodiment of the data storage method of the present invention;

FIG. 4 is another flow chart of an embodiment of a data storage method of the present invention;

wherein,

s1 core storage device

S2 storage server

S3 computer

S4 moving the device.

Detailed Description

The embodiment of the invention provides a data storage method, which is applied to a data storage system, wherein the system comprises a server and at least one computer, and the method comprises the following steps:

step 101, a first computer divides a local encryption disk according to user settings, wherein the local encryption disk is an independent data storage space;

step 102, encrypting data stored in a local encryption disk by a user at this time to obtain first encrypted data;

step 103, sending the first encrypted data to a server;

and step 104, the server synchronously stores the data to the encryption disks of at least one other computer, and the encryption disks of at least one other computer are divided in advance.

In an embodiment, the method further comprises:

when the first computer receives a command for deleting data, the first computer inquires information of a computer storing the data from a server;

and when the number of the computers storing the data is less than the preset number, the server synchronously stores the data to at least one other computer.

In this embodiment, the local encryption disks are divided according to user settings, data stored in the local encryption disk by the user this time is encrypted to obtain encrypted data, and the encrypted data is synchronously stored in the encryption disks of the at least one other storage device, so that the data stored in the local encryption disks is encrypted and stored in the other storage devices, and thus the security of local data storage is enhanced. In addition, in this embodiment, when deleting data, once the number of computers storing the data is less than a preset number, the data is controlled to be backed up to other computers, so as to ensure data security.

In order to make the objects, technical solutions and advantages of the present embodiments more clear, the technical solutions in the present embodiments will be described clearly and completely with reference to the drawings in the present embodiments, and it is obvious that the described embodiments are some, but not all embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

The memory in this embodiment may be a device with a data storage function, specifically, the device with the data storage function may be a device including a memory chip and a storage hard disk, such as a computer, and the embodiment is not limited thereto.

Example 1

The data storage method of the embodiment is implemented by a device with a storage function, such as a computer. The data storage method is implemented by a computer, but the data storage method is not limited to a computer.

As shown in fig. 1, the data storage method includes:

step 11: and dividing the local encryption disk according to the user setting, wherein the local encryption disk is an independent data storage space.

In this embodiment, a part of the storage space is partitioned in the storage device of the computer according to the user setting, and is used as a local encryption disk for storing local encrypted data.

In order to ensure the security of the stored content actively by the encryption disk on the computer, the access password of the encryption disk can be set in the embodiment, and meanwhile, a secure login mechanism can be adopted, so that the user can access the local encryption disk only by logging in.

For example, when a user accesses a local encryption disk, the number of errors of inputting a password by the user is limited. After the number of times is exceeded, re-access is denied for a period of time, for example, hours later or a day later before access can be attempted again.

When networking, the method can send a short message to the reserved mobile phone number to remind the user of wrong password input.

When off-line, the encryption disk is locked to be inaccessible currently and for a period of time.

In order to avoid that the content of the local encryption disk cannot be opened without a network, the local account encryption code verification can be allowed. And if the continuous password authentication fails to reach the set times, requesting the user to perform networking authentication.

After the users are networked, the authentication frequency of the users can be controlled at the server side, and the condition that the user name and the password are cracked violently is avoided, so that the data safety is ensured.

Step 12: and encrypting the data stored to the local encryption disk by the user to obtain first encrypted data.

In this embodiment, multiple encryption manners may be adopted, and the embodiment does not limit a specific encryption manner.

The user encrypts the data stored to the local encryption disk to obtain first encrypted data. Data encryption can actively enhance the security of data when the data is transmitted on the Internet.

Step 13: and synchronously storing the first encrypted data to the encryption discs of at least one other storage device, wherein the encryption discs of at least one storage device are divided in advance.

It should be understood that the current available capacity of the pre-partitioned encrypted disk by any storage device is larger than the storage capacity required for the encrypted data.

In this embodiment, it may be determined in advance whether the current available capacity of the storage device encryption disk is greater than the storage capacity required by the encrypted data, and when it is determined that the current available capacity of the storage device encryption disk is sufficient, the storage device may be started to perform synchronous storage.

Thus, when writing a copy of encrypted data to the encryption disk, the encrypted data is synchronously stored to at least one storage device on the internet.

In this embodiment, the number of storage devices required for synchronously storing the first encrypted data may be preset according to different scenarios, and generally, the number of storage devices for synchronously storing the first encrypted data should be more than 2, and preferably, at least 10. Therefore, the user can be ensured to obtain the first encrypted data in time by increasing the redundant data backup quantity, the storage safety of the first encrypted data is ensured, and the data loss is prevented.

In the embodiment, the number of active storage devices for storing the current encrypted data can be automatically detected, and when the current number is smaller than the preset number, the server leads the current number to automatically encrypt the data in the storage space backup of the active user.

In this embodiment, when the first encrypted data is synchronously stored in at least one other storage device, the P2P technology is used for data transmission. A system server may be provided in this embodiment to assist in establishing the P2P link. Nearby storage devices that are active in the current link are first detected and a P2P connection is attempted. If the link establishment fails, another active data storage device is reselected to establish the P2P link.

To avoid having too few synchronous storage devices currently available, the present embodiment may also provide a sufficient number of common storage devices, e.g., at least 10, to ensure that the P2P link between the local storage device and the common server can be successfully established at any one time.

In this embodiment, in step 12, when the data stored in the local encryption disk by the user this time is encrypted to obtain the first encrypted data, a secret key may be randomly generated, and the data stored in the local encryption disk by the user this time is encrypted by the secret key to obtain the first encrypted data.

In this embodiment, when encrypting the data stored to the local encryption disk this time, the computer may randomly generate a secret key, where the secret key is uniquely determined by the data, and the encrypted data may be decrypted only by the secret key to obtain the data, so as to improve the security of data storage.

Preferably, the key may be stored on both the local side and the server side.

In this embodiment, after the step 13 of synchronously storing the encrypted data to the encryption disk of the at least one other storage device, the method further includes reading the first encrypted data from the at least one memory according to the key after the user identity is verified.

In this embodiment, the first encrypted data is already stored in the local encrypted disk and is synchronously stored in the other at least one storage device. After the user identity is verified, the first encrypted data stored in a storage device encryption disk which is currently accessible is opened through a key which is uniquely mapped with the first encrypted data.

The user identity may be verified in various manners, such as an account password manner, a dynamic password manner, and the like, which is not limited in this embodiment.

In this embodiment, a user may have encryption disks on multiple storage devices; different users can set their own encryption discs on the same equipment. In this embodiment, the password server may be configured to store all user information using the data storage method, where the user information may include a user name, a password, and other authentication information. Each user information is encrypted first, preferably resulting in an encrypted user information string that uniquely identifies the user. And then uploading the encrypted user information character string to a password server. Thus, at the password server side, the user information is not stored in the clear, and the user information is transparent to the password server. The information such as the password of the user can be decrypted only by the user himself using the user name, the password and other information, and the decryption is limited to the user login information verification. Therefore, the method and the device ensure that the password server cannot inquire the private information of the user, and avoid the information of the plaintext user from being leaked carelessly, thereby enhancing the privacy of data storage.

In this embodiment, the file server may be configured to store a file list of all users who use the data storage method. When a user modifies the data of the encryption disk on any storage device with a preset local encryption disk, the file list is updated synchronously, and other storage devices with the preset local encryption disk can be automatically synchronized when the other storage devices are connected with the Internet after logging in next time. When a user logs in an account number of the user on any storage device preset with a local encryption disk, the user can select to automatically retrieve data belonging to the user from the Internet to a new encryption disk.

In this embodiment, after dividing the local encryption disk according to the user setting in step 11, the method further includes the following steps:

receiving second encrypted data, wherein the second encrypted data is the first encrypted data synchronized from other storage equipment;

storing the second encrypted data to a local encryption disk;

when the second encrypted data stored in the local encrypted disk is deleted, the second encrypted data is transferred to the encrypted disk of at least one other storage device, and the encrypted disks of the other storage devices are divided in advance.

In this embodiment, the current active backup of each encrypted data file is dynamically counted, and whether to continue synchronous storage to other available storage devices is determined according to the current active backup count of each encrypted data file.

In this embodiment, when the second encrypted data stored in the local encrypted disk is deleted, the second encrypted data is transferred to the encrypted disk of the at least one other storage device. Therefore, if the encrypted data stored in one of the storage devices is deleted or lost, the encrypted data is transferred to the other storage devices, so that the encrypted data is not lost due to disappearance of the storage device storing the encrypted data, and the data storage safety is improved.

It should be noted that, in this embodiment, when the local encryption disk deletes the stored data thereof, the corresponding data on all the synchronous storage devices may be deleted at the same time or after a preset time, for example, 24 hours later. Therefore, the data is prevented from being deleted carelessly by misoperation of a user, and the data is convenient to restore.

In this embodiment, before the step 12 encrypts the data stored by the user to the local encryption disk this time to obtain the first encrypted data, the method further includes the following steps:

generating a corresponding hash value according to the data stored to the local encryption disk, wherein the hash value uniquely identifies the data stored to the local encryption disk;

requesting any other user to store a key generated when the data file same as the hash value is stored in a local encryption disk of the user;

receiving the key;

correspondingly, encrypting the data stored by the user to the local encryption disk this time to obtain first encrypted data comprises:

and encrypting the data stored to the local encryption disk by the user according to the key.

In this embodiment, when the encryption disk actively stores data, the hash value of the data stored to the local encryption disk at this time is weighed according to the file content and the file name of the data stored to the local encryption disk by the user. The hash value can be used as the unique identification information of the file, and whether the two files are the files with the same substantial content can be judged according to the hash values of the two files.

In the embodiment, the hash value of the data stored in the local encryption disk by the user is reported to the file management server; inquiring whether the hash value exists in a file list maintained by the file management server; if the hash value already exists, requesting any other user to store a key generated when the data file same as the hash value is stored in a local encryption disk of the other user; receiving a key of data stored to a local encryption disk by a user; and according to the received key, encrypting the data stored to the local encryption disk by the user at this time, and not actively and synchronously storing the data to other storage equipment.

If the user fails to contact other users successfully, a new secret key is automatically generated to encrypt the file locally, and the data is actively and synchronously stored to other at least more than 2 storage devices.

In this embodiment, after generating the key, the method further includes:

receiving a request of other storage equipment for obtaining the secret key, and sending the request when the data to be stored by the other storage equipment is the same as the data stored to the local encryption disk;

and sending the secret key to the other storage equipment according to the request for obtaining the secret key.

In the present embodiment, whether two files are files of the same substantive content is determined by the hash value in case that the files of the same substantive content are owned by a plurality of different network users. For substantially identical files, the present embodiment no longer generates a random key for the file locally, but rather by requesting the key of the file from other users already in possession of the file. And after receiving a request for obtaining the file key from other storage equipment, sending the key to the other storage equipment.

In the present embodiment, the terms "first" and "second" are merely considered to be divided for convenience of description, and do not limit the present embodiment.

According to the data storage method, the local encryption disks are divided according to user settings, the data stored to the local encryption disks by the user at this time are encrypted to obtain encrypted data, and the encrypted data are synchronously stored to the encryption disks of at least one other storage device, so that the data stored in the local encryption disks are encrypted and stored in the other storage devices, and the security of local data storage is enhanced.

Example 2

As shown in fig. 2, the present embodiment provides a computer system, to which the data storage method of the present embodiment can be applied.

The computer system comprises 4 types of devices which are interconnected through the Internet, namely a core storage device S1, a storage server S2, a computer S3 and a mobile device S4. The core storage device S1 is used to store user information, index information of user files, and the like, and also can assist in establishing the P2P link. Multiple core servers S1 are provided in the system to provide more powerful scheduling capability on the one hand and load balancing and disaster backup on the other hand.

The storage server S2 is reserved to avoid the situation that when the user synchronizes the stored data, there is not enough other active users on the current link to establish P2P connection with the user to synchronize the data, and its function and function are equivalent to a normal user account.

The computer S3 and the mobile device S4 are terminal devices usable by a general user of the computer system.

The local encryption disk of computer S3 stores both local data and backup data from other users in the network link. The backup data for these other users is transparent to the local user. The local user account can inquire the size of the storage capacity currently and actually available in the local encryption disk, but cannot access the backup data belonging to other users.

The encryption disc is not previously set on the mobile device S4. The user can access the data and management data through the application installed on the mobile device S4, and download the data backed up and stored on the network to the mobile terminal S4, but does not take the role of backing up the mobile terminal data to the network and backing up other user data.

It should be understood that fig. 2 is only an example of an application scenario and does not constitute a limitation on the present embodiment.

Example 3

The actual usage of the storage capacity of any local encryption disk in the data storage method of the present embodiment is shown in fig. 3. The storage space divided by the local user is defined as a local encryption disk. In the local encryption disk, the used space refers to a space in which a user can not write data any more, and the available space of the local user refers to the maximum capacity of the local user for writing data into the encryption disk. The used space comprises the encrypted data of the local user and the encrypted data synchronously stored by other users of the network. The synchronous storage of the encrypted data of other users is automatically operated in a background, can be transparent to the local user, and can also set a prompt for the local user.

Thus, the local encryption disk stores both local encrypted data and backup data from other users in the network link. Preferably, the backup data of the other users are transparent to the local user, and the local user account can inquire the size of the currently and actually available storage capacity in the local encryption disk, but cannot access the synchronous storage data belonging to the other users.

For example, the user allocates 1G of storage space as a local encryption disk, but the user currently uses only 500M of data, and the remaining 500M of space can store encrypted data synchronously stored from other storage devices.

Example 4

In the present embodiment, the data storage method of the present embodiment is described in detail by taking a computer with a storage function as an execution subject in combination with a specific scenario.

In this embodiment, the file and the data have the same meaning. As shown in fig. 4, the present embodiment provides a data storage method, including:

41 the computer divides the encryption disc according to the user operation;

42 the computer preparing to write the unencrypted file to the local encryption disk;

43 the computer determines the hash value of the unencrypted file and reports the hash value to the file management server;

44 the file management server judges whether the file is stored synchronously according to the hash value;

if the storage has been synchronized, execution 45; if the store has not been synchronized, execution 48;

45 requesting the key of the file from the user synchronously storing the file;

46 determining whether the key requesting the file was successful;

if successful, 47 is performed; if it fails, execution 48;

47 using the key to identify the local unencrypted file;

the key value for the file is randomly generated 48.

49 using the key value to encrypt the file and synchronously store the file in the encryption disk of other storage devices

This embodiment presents a method for sharing a key between files having the same hash value. This embodiment also provides a method for generating a new key to encrypt data when the request for key sharing fails. The same file is discriminated through the hash value, and the same file shares the secret key and the encrypted data, so that the storage pressure caused by repeated storage of the same file potentially in the multi-backup file storage method is reduced remarkably, idle storage resources on the internet are utilized, and data storage safety can be enhanced.

Having described embodiments of the present invention, the foregoing description is intended to be exemplary, not exhaustive, and not limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen in order to best explain the principles of the embodiments, the practical application, or improvements made to the technology in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This application is intended to cover any variations, uses, or adaptations of the disclosure following, in general, the principles of the disclosure and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains.

Claims

1. A data storage method applied to a data storage system, the system comprising a server and at least one computer, the method comprising:

the first computer divides a local encryption disk according to user settings, wherein the local encryption disk is an independent data storage space;

encrypting the data stored to the local encryption disk by the user to obtain first encrypted data;

sending the first encrypted data to a server;

and the server synchronously stores the data to the encryption disks of at least one other computer, and the encryption disks of at least one other computer are divided in advance.

2. The data storage method of claim 1,

3. The data storage method according to claim 1, wherein the encrypting the data stored by the user to the local encryption disk this time to obtain the first encrypted data comprises the following steps:

randomly generating a secret key;

and encrypting the data stored to the local encryption disk by the user according to the secret key to obtain the first encrypted data.

4. The data storage method according to claim 1, wherein after dividing the local encryption disk according to the user setting, further comprising the steps of:

receiving second encrypted data, wherein the second encrypted data comes from the first encrypted data synchronized by other storage equipment;

storing the second encrypted data to a local encryption disk;

when the second encrypted data stored in the local encrypted disk is deleted, the second encrypted data is transferred to the encrypted disk of at least one other storage device, and the encrypted disk of at least one other storage device is divided in advance.

5. The data storage method according to claim 3, wherein before encrypting the data stored by the user to the local encryption disk this time to obtain the first encrypted data, the method further comprises the following steps:

receiving the key;

and encrypting the data stored to the local encryption disk by the user according to the secret key.

6. The data storage method of claim 3, further comprising the steps of:

receiving a request for fetching the secret key by other storage equipment, wherein the request for fetching the secret key is sent when the data to be stored by the other storage equipment is the same as the data stored to the local encryption disk this time;

7. The data storage method according to claim 3, wherein after synchronously storing the encrypted data to the encrypted disks of the other at least one storage device, further comprising the following steps:

and after the user identity is verified, reading the first encrypted data from the at least one memory according to the secret key.