Background
In the field of device information security, a back door refers to a method of gaining access to a program or system by bypassing security control. The main purpose of the back door is to facilitate later confidential access or control of the system. The introduction of a back door clearly creates a significant safety risk. In the field of device design, many device manufacturers rely on commercial chips to design and produce devices. The chip can meet the requirement and has reliable quality, and the commercial chip which is verified by the market can greatly shorten the development period of the equipment, reduce the development time of the equipment and push out the product as soon as possible. This model of device development has matured very well.
The current mature cache physical devices are basically monopolized by products of some manufacturers, and when designing equipment, if the cache physical devices are needed, the products of the manufacturers are difficult to avoid. In some fields of application of equipment, the requirements for safety are high, and if a safety back door which may be buried in a physical device cannot be completely avoided, the immeasurable loss is caused. The safety back door of the physical cache device is triggered by writing data of a specific sequence into the cache, the sequence is very rare and cannot appear in a common application scene at all, but when a person mastering the back door needs to trigger the back door, the safety back door can be enabled to be effective only by manually manufacturing a corresponding trigger condition. For example, when the device is used as a data forwarding device, it may be triggered by sending only a specific series of messages to the device. Therefore, in order to ensure the operation safety of the equipment, the problem needs to be effectively solved.
Disclosure of Invention
Aiming at the defects in the prior art, the invention provides a method, a system and a device for harmless processing of storage device data, which can effectively avoid the safe backdoor possibly existing in the storage device from being consciously triggered when the device is applied, and ensure the data safety of the storage device.
In a first aspect, the invention provides a method for harmless treatment of storage device data, comprising the following steps:
acquiring original transmission data;
configuring redundant parameters in original transmission data, and marking the redundant parameters to obtain preprocessed data;
performing data conversion on the preprocessed data to obtain stored data;
the storage data is written into the storage device.
Based on the above invention, by performing redundancy parameter configuration and data conversion on the original transmission data, the form of the original transmission data can be effectively changed, so that even if the storage device has a safe back door, the storage data written in the storage device will not be the data expected by the safe back door master, and the safe back door master cannot freely control the triggering of the safe back door. When the original transmission data needs to be read out, the original transmission data can be obtained only by carrying out data conversion and the inverse operation of redundancy parameter configuration on the storage data.
In one possible design, the method further includes:
acquiring storage data in a storage device;
performing data inverse conversion on the stored data to obtain preprocessed data;
extracting marked redundant parameters from the preprocessed data to obtain original transmission data;
and outputting the original transmission data.
Based on the invention, the original transmission data can be obtained and output by performing corresponding data inverse conversion on the stored data to obtain the preprocessed data and extracting the marked redundant parameters from the preprocessed data, so that the output original transmission data can not be changed.
In one possible design, the configuring redundancy parameters in the original transmission data includes:
generating redundant parameters;
and inserting the redundancy parameters into the set positions in the original transmission data.
Based on the content of the invention, the uniform insertion position of the redundancy parameter can be set firstly, and then the generated redundancy parameter is inserted into the original transmission data, so that the uniform processing of the redundancy parameter is convenient.
In one possible design, the marking of the redundancy parameter includes:
acquiring the data bit number of the set position of the redundancy parameter in the original transmission data;
and associating and storing the data bit number with the redundancy parameter.
Based on the invention, by storing the data bit number of the redundancy parameter at the set position in the original transmission data in a correlation manner with the redundancy parameter, when the original transmission data needs to be output, the redundancy parameter can be quickly found from the preprocessed data according to the redundancy parameter and the correlated data bit number, and then the redundancy parameter is extracted.
In one possible design, the data converting the preprocessed data includes: and performing displacement operation on the preprocessed data by adopting a set data displacement operation method.
Based on the invention, the data form can be effectively changed by carrying out corresponding displacement operation on the preprocessed data, and certain malicious data which can trigger a security backdoor are prevented from being directly written into the storage device.
In one possible design, the data converting the preprocessed data includes: and carrying out secret key encryption on the preprocessed data by adopting a set encryption algorithm.
Based on the invention, the data form can be effectively changed by carrying out corresponding key encryption operation on the preprocessed data, and certain malicious data which can trigger a security backdoor are prevented from being directly written into the storage device.
In a second aspect, the present invention provides a system for harmless processing of data of a storage device, comprising:
a transmission unit for acquiring original transmission data or outputting the original transmission data;
the preprocessing unit is used for configuring redundant parameters in original transmission data and marking the redundant parameters to obtain preprocessed data; or extracting marked redundant parameters from the preprocessed data to obtain original transmission data;
the conversion unit is used for carrying out data conversion on the preprocessed data to obtain stored data; or performing data inverse conversion on the stored data to obtain preprocessed data;
a read-write unit for writing the storage data into the storage device; or to read stored data in the memory device.
In one possible design, the conversion unit includes a displacement subunit and an encryption subunit, where:
the displacement subunit is used for performing displacement operation on the preprocessed data by adopting a set data displacement operation method;
and the encryption subunit is used for carrying out key encryption operation on the preprocessed data by adopting a set encryption algorithm.
In a third aspect, the present invention provides a device for harmless processing of data in a memory device, comprising:
the read-write interface is used for receiving and transmitting original transmission data;
an instruction memory for storing instructions;
a processor configured to read the instructions stored in the instruction memory and execute the method according to any one of the first aspect.
In a fourth aspect, the present invention provides a computer-readable storage medium having stored thereon instructions which, when run on a computer, cause the computer to perform the method of any of the first aspects described above.
In a fifth aspect, the present invention provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the method of any of the first aspects above.
The invention has the beneficial effects that:
the invention can effectively change the form of the original transmission data by carrying out redundancy parameter configuration and data conversion on the original transmission data, so that even if a storage device has a safe back door, the storage data written in the storage device can not be the data expected by a safe back door master controller, and the safe back door master controller can not freely control the triggering of the safe back door. When the original transmission data needs to be read out, the original transmission data can be obtained only by carrying out data conversion and the inverse operation of redundancy parameter configuration on the storage data.
Detailed Description
The invention is further described with reference to the following figures and specific embodiments. It should be noted that the description of the embodiments is provided to help understanding of the present invention, but the present invention is not limited thereto. Specific structural and functional details disclosed herein are merely illustrative of example embodiments of the invention. This invention may, however, be embodied in many alternate forms and should not be construed as limited to the embodiments set forth herein.
It should be understood that the terms first, second, etc. are used merely for distinguishing between descriptions and are not intended to indicate or imply relative importance. Although the terms first, second, etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, a first element could be termed a second element, and, similarly, a second element could be termed a first element, without departing from the scope of example embodiments of the present invention.
It should be understood that the term "and/or" herein is merely one type of association relationship that describes an associated object, meaning that three relationships may exist, e.g., a and/or B may mean: a exists alone, B exists alone, and A and B exist at the same time, and the term "/and" is used herein to describe another association object relationship, which means that two relationships may exist, for example, A/and B, may mean: a alone, and both a and B alone, and further, the character "/" in this document generally means that the former and latter associated objects are in an "or" relationship.
It is to be understood that in the description of the present invention, the terms "upper", "vertical", "inside", "outside", and the like, refer to an orientation or positional relationship that is conventionally used for placing the product of the present invention, or that is conventionally understood by those skilled in the art, and are used merely for convenience in describing and simplifying the description, and do not indicate or imply that the device or element referred to must have a particular orientation, be constructed in a particular orientation, and be operated, and therefore should not be considered as limiting the present invention.
It will be understood that when an element is referred to as being "connected," "connected," or "coupled" to another element, it can be directly connected or coupled to the other element or intervening elements may be present. In contrast, when an element is referred to as being "directly adjacent" or "directly coupled" to another element, there are no intervening elements present. Other words used to describe the relationship between elements should be interpreted in a similar manner (e.g., "between … …" versus "directly between … …", "adjacent" versus "directly adjacent", etc.).
In the description of the present invention, it should also be noted that, unless otherwise explicitly specified or limited, the terms "disposed," "mounted," and "connected" are to be construed broadly, e.g., as meaning fixedly connected, detachably connected, or integrally connected; can be mechanically or electrically connected; they may be connected directly or indirectly through intervening media, or they may be interconnected between two elements. The specific meanings of the above terms in the present invention can be understood in specific cases to those skilled in the art.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments of the invention. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises," "comprising," "includes," and/or "including," when used herein, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, numbers, steps, operations, elements, components, and/or groups thereof.
It should also be noted that, in some alternative implementations, the functions/acts noted may occur out of the order noted in the figures. For example, two figures shown in succession may, in fact, be executed substantially concurrently, or the figures may sometimes be executed in the reverse order, depending upon the functionality/acts involved.
In the following description, specific details are provided to facilitate a thorough understanding of example embodiments. However, it will be understood by those of ordinary skill in the art that the example embodiments may be practiced without these specific details. For example, systems may be shown in block diagrams in order not to obscure the examples in unnecessary detail. In other instances, well-known processes, structures and techniques may be shown without unnecessary detail in order to avoid obscuring example embodiments.
Example 1:
the embodiment provides a method for harmless treatment of data of a storage device, as shown in fig. 1, comprising the following steps:
s101, acquiring original transmission data.
The original transmission data acquisition step can be acquired through a corresponding data read-write interface, and when the original transmission data is acquired, the original transmission data needs to be acquired in a cutting mode, so that the original transmission data is prevented from being directly written into a storage device without being processed to trigger a safety back door.
And S102, configuring redundancy parameters in the original transmission data, and marking the redundancy parameters to obtain the preprocessed data.
When configuring the redundancy parameters, the redundancy parameters are generated first, and then the redundancy parameters are inserted into a set position in the original transmission data, such as the front end, the tail end or a designated data bit in the original transmission data. For example, as shown in table one below:
original transmission data
|
Redundancy parameter
|
Set position
|
Preprocessing data
|
123456
|
789
|
Front end
|
789123456
|
123456
|
789
|
Fourth data bit
|
123789456
|
123456
|
789
|
End tip
|
123456789 |
Assuming that the original transmission data is 123456 and the redundancy parameter is 789, if the insertion setting position is the data front end, the obtained preprocessed data is 789123456, if the insertion setting position is the data end, the obtained preprocessed data is 123456789, and if the insertion setting position is the data bit designated in the data, the redundancy parameter 789 is inserted from the data bit.
After the redundant parameter is inserted, the data bit number of the set position of the redundant parameter in the original transmission data can be obtained, and the data bit number and the redundant parameter are stored in a correlation mode. As shown in table one, if the redundancy parameter 789 is inserted at the front end, the data bits are 1 st, 2 nd and 3 rd bits, and if the redundancy parameter 789 is inserted at the end, the data bits are 7 th, 8 th and 9 th bits, and by storing the data bits of the redundancy parameter at the set position in the original transmission data in association with the redundancy parameter, when the original transmission data needs to be output, the redundancy parameter can be quickly found from the preprocessed data according to the redundancy parameter and the associated data bits, and then extracted.
And S103, performing data conversion on the preprocessed data to obtain stored data.
The data conversion is performed on the preprocessed data, and a set data displacement operation method, such as a cyclic displacement operation, may be used to perform a displacement operation on the preprocessed data. The cyclic shift operation is an operation of changing a value into a binary value and then performing a cyclic shift, and a specific operation of the cyclic shift operation is illustrated as follows:
watch two
Assuming that a certain data byte is 10111110 after binary, if the data byte is circularly shifted left by two bits, the circularly shifted data becomes 11111010 after cyclic shift, if the data byte is circularly shifted right by two bits, the circularly shifted data becomes 10101111, and so on.
The preset encryption algorithm can be used for encrypting the key of the preprocessed data, the encryption algorithm can be but not limited to MD5 algorithm, SHA1 algorithm, HMAC algorithm, DES algorithm, 3DES algorithm, AES algorithm, RSA algorithm, ECC algorithm and the like, and if the corresponding encryption algorithm is used for processing the preprocessed data, the encrypted key can be used as a redundant parameter to be inserted into the original transmission data, so that the safety is further improved. Similarly, other operation modes, such as an exclusive or operation, may also be used to perform data transformation on the preprocessed data, and are not limited herein.
And S104, writing the storage data into the storage device.
At this time, the storage data written in the storage device is changed relative to the original transmission data, so that even if the storage device has a security back door, the storage data written in the storage device is not the data expected by the security back door owner, and the security back door owner cannot freely control the triggering of the security back door.
After writing the stored data into the memory device, if the original data needs to be read out from the memory device, the method can be completed by the following steps as shown in fig. 2:
s201, obtaining storage data in the storage device.
S202, performing data inverse conversion on the stored data to obtain preprocessed data. The step of performing data inverse conversion on the stored data is to perform the inverse operation of step S103 to obtain the preprocessed data.
And S203, extracting marked redundant parameters from the preprocessed data to obtain original transmission data. When the redundant parameters in the preprocessed data are extracted, the redundant parameters can be quickly found from the preprocessed data according to the redundant parameters and the associated data bits, and the original transmission data is obtained by extraction and reduction.
And S203, outputting original transmission data.
Example 2:
the present embodiment provides a system for harmless processing of data in a memory device, as shown in fig. 3, including:
a transmission unit for acquiring original transmission data or outputting the original transmission data;
the preprocessing unit is used for configuring redundant parameters in original transmission data and marking the redundant parameters to obtain preprocessed data; or extracting marked redundant parameters from the preprocessed data to obtain original transmission data;
the conversion unit is used for carrying out data conversion on the preprocessed data to obtain stored data; or performing data inverse conversion on the stored data to obtain preprocessed data;
a read-write unit for writing the storage data into the storage device; or to read stored data in the memory device.
Further, the conversion unit comprises a displacement subunit and an encryption subunit, wherein:
the displacement subunit is used for performing displacement operation on the preprocessed data by adopting a set data displacement operation method;
and the encryption subunit is used for encrypting the key of the preprocessed data by adopting a set encryption algorithm.
Example 3:
the present embodiment provides a device for harmless processing of data of a memory device, as shown in fig. 4, including:
in a third aspect, the present invention provides a device for harmless processing of data in a memory device, comprising:
the read-write interface is used for receiving and transmitting original transmission data;
an instruction memory for storing instructions;
and the processor is used for reading the instructions stored in the instruction memory and executing the storage device data harmless treatment method in the embodiment 1 according to the instructions.
The instruction Memory may include, but is not limited to, a Random Access Memory (RAM), a Read Only Memory (ROM), a Flash Memory (Flash Memory), a First In First Out (FIFO), a First In Last Out (FILO), and/or the like; the processor may include, but is not limited to, a single chip, an ARM processor, and the like.
Example 4:
the present embodiment provides a computer-readable storage medium having stored thereon instructions that, when executed on a computer, cause the computer to execute the storage device data hazard reduction method described in embodiment 1. The computer-readable storage medium refers to a carrier for storing data, and may include, but is not limited to, floppy disks, optical disks, hard disks, flash memories, flash disks and/or Memory sticks (Memory sticks), etc., and the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
Example 5:
the present embodiment provides a computer program product containing instructions that, when executed on a computer, cause the computer to execute the storage device data hazard reduction method described in embodiment 1. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable devices.
Those of ordinary skill in the art will understand that: all or part of the steps for implementing the embodiments of the method may be implemented by hardware related to program instructions, the program may be stored in a computer-readable storage medium, and when executed, the program performs the steps including the embodiments of the method, and the storage medium includes: various media that can store program codes, such as ROM, RAM, magnetic or optical disks. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, systems, apparatus, and computer program products of embodiments. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The present invention is not limited to the above-described alternative embodiments, and various other forms of products can be obtained by anyone in light of the present invention. The above detailed description should not be taken as limiting the scope of the invention, which is defined in the claims, and which the description is intended to be interpreted accordingly.