CN103051608B - A kind of method and apparatus of movable equipment access monitoring - Google Patents

Abstract

The invention discloses a mobile device access monitoring method and device, wherein the method includes: presetting a list of legal mobile device information in a security control server; the security control server is used to control the For the security of the client, the list of legal mobile device information includes the unique identification of the mobile device that is allowed to access; when the client monitors the access of the mobile device, the unique identification of the mobile device is calculated Identification; the unique identification is sent to the security control server, and the security control server judges whether the unique identification exists in the list of legal mobile device information, and if so, allows the access of the mobile device ; If not, reject the access of the mobile device. The invention can accurately track the source and whereabouts of data, prevent virus infection, improve the safety of mobile devices, and ensure the safety of network information.

Description

Method and device for access monitoring of mobile equipment

technical field

The present invention relates to the technical field of information security, in particular to a method for access monitoring of a mobile device, and a device for access monitoring of a mobile device.

Background technique

At present, with the popularization of mobile devices and the convenience of data transmission and portability, mobile devices are widely used in daily life and work. However, in enterprises, the problem of file leakage is often encountered. One of the main leakage channels is Removable devices are a very big threat to enterprises that cannot afford data loss and leakage.

In order to protect important data within the enterprise, some enterprises use security management software within the enterprise to force automatic encryption when files are created and edited, so that files can only be used within the enterprise; For mobile devices, for example, some companies use closed USB ports to prevent the use of removable devices to prevent data leakage, but these practices have brought a lot of inconvenience and cannot meet the needs of companies for normal information exchange.

Therefore, the urgent technical problem to be solved by those skilled in the art is to provide a method and device for access monitoring of mobile devices, which can accurately track the source and whereabouts of data, prevent virus infection, and improve the security of mobile devices. , to ensure the security of network information, especially intranet network information.

Contents of the invention

In view of the above problems, the present invention is proposed to provide a mobile device access monitoring method and a corresponding mobile device access monitoring device that overcome the above problems or at least partially solve the above problems.

According to one aspect of the present invention, a mobile device access monitoring method is provided, including:

A list of legal removable device information is preset in the security control server; the security control server is used to control the security of the client connected to it, and the list of legal removable device information includes the unique identification mark;

When the client monitors the access of the mobile device, calculate the unique identification of the mobile device;

Send the unique identification to the security control server, and the security control server judges whether the unique identification exists in the list of legal mobile device information, and if so, allows the access of the mobile device; if If not, reject the access of the mobile device.

Optionally, when the client monitors the access of the mobile device, the step of calculating the unique identification of the mobile device includes:

Obtain hardware attribute information of the removable device;

judging whether the mobile device has a feature identifier;

If so, then extract the feature identifier from the removable device;

If not, then calculate the signature according to the hardware attribute information, and write the signature into the removable device;

The unique identifier of the movable device is calculated according to the hardware attribute information and the characteristic identifier of the movable device.

Optionally, the method also includes:

If the operation of writing the feature identifier into the removable device fails, sending information about the failure of the writing operation to the security control server;

The security control server rejects the access of the removable device according to the information that the writing operation fails.

Optionally, the security control server is preset with a time interval for mobile devices to allow access, and the method further includes:

judging whether the mobile device accesses within the allowed access time interval;

If the mobile device is accessed within the allowed access time interval, the security control server allows the mobile device to access;

If the mobile device does not access within the allowed access time interval, the security control server rejects the mobile device's access.

Optionally, the method also includes:

When the access of the removable device is allowed, monitor the write operation of the removable device;

Send the information of the writing operation to the security control server.

Optionally, the hardware attribute information includes a mobile device identifier, and/or, manufacturer information of the mobile device, and/or, a space size of the mobile device.

Optionally, the step of calculating the signature according to the hardware attribute information, and writing the signature into the removable device includes:

Combining the removable device identifier and hardware attribute information into a first character string;

Calculate the feature identifier of the mobile device by using the message digest algorithm MD5 according to the first character string;

Writing the feature identifier of the movable device into the movable device.

Optionally, the step of calculating the unique identification of the mobile device according to the hardware attribute information and feature identifier of the mobile device includes:

Combining the feature identifier of the removable device and the hardware attribute information into a second character string;

The unique identification of the mobile device is calculated by using the message digest algorithm MD5 according to the second character string.

Optionally, the access of the movable device is monitored by a preset driver in the client.

Optionally, the access includes readable access, writable access, and non-readable and writable access.

According to another aspect of the present invention, an access monitoring device for a mobile device is provided, including:

The preset legal list module is located in the security control server and is used to control the security of the client connected to it, and the list of legal mobile device information includes the unique identification of the mobile device that is allowed to access;

The unique identification calculation module is located at the client end and is used to calculate the unique identification of the mobile device when monitoring the access of the mobile device;

The unique identification identification sending module is located at the client end and is used to send the unique identification identification to the security control server;

The unique identification identification judging module is located in the security control server, and is used to determine whether the unique identification identification exists in the list of legal mobile device information, if yes, call the release module, and if not, call the rejection module;

a release module, configured to allow the access of the mobile device;

A rejecting module, configured to reject the access of the mobile device.

Optionally, the unique identification calculation module includes:

A hardware attribute information acquisition submodule, configured to acquire hardware attribute information of the removable device;

The feature identification judging submodule is used to judge whether there is a feature identification in the mobile device; if so, then call the feature identification extraction submodule, if not, then call the feature identification calculation submodule;

A feature identifier extraction submodule, configured to extract a feature identifier from the mobile device;

A signature calculation submodule, configured to calculate a signature according to the hardware attribute information, and write the signature into the removable device;

The unique identifier calculation submodule is configured to calculate the unique identifier of the movable device according to the hardware attribute information and feature identifier of the movable device.

Optionally, the device also includes:

The writing failure information sending module is located at the client, and is used to send the information of the writing operation failure to the security control server if the operation of writing the feature identifier into the removable device fails;

The access denying module is located in the security control server, and is used for denying the access of the removable device according to the information that the writing operation fails.

Optionally, the security control server is preset with a time interval for mobile devices to allow access, and the device further includes:

The time interval judging module is located in the security control server and is used to judge whether the mobile device is accessed within the time interval of the allowed access; if so, call the access allowed module in the time interval, if not, call the time interval The module for denying access within the time interval; the module for allowing access within the time interval, located in the security control server, is used to allow the mobile device to access;

The module for denying access within the time interval is located in the security control server, and is configured to deny the access of the mobile device if the access of the mobile device is not within the time interval for allowing access.

Optionally, the device also includes:

An access monitoring module, located on the client side, is configured to monitor the write operation of the removable device when the access of the removable device is allowed;

The writing information sending module is located at the client and is used to send the information of the writing operation to the security control server.

Optionally, the hardware attribute information includes a mobile device identifier, and/or, manufacturer information of the mobile device, and/or, a space size of the mobile device.

Optionally, the feature identification calculation submodule includes:

A first character string combination unit, configured to combine the mobile device identifier and hardware attribute information into a first character string;

The second calculation unit is used to calculate the feature identifier of the mobile device by using the message digest algorithm MD5 according to the first character string;

The feature identifier writing unit is configured to write the feature identifier of the removable device into the removable device.

Optionally, the unique identification identification calculation submodule includes:

A second character string combination unit, configured to combine the feature identifier of the removable device and the hardware attribute information into a second character string;

The second calculation unit is configured to calculate the unique identifier of the mobile device by using the message digest algorithm MD5 according to the second character string.

Optionally, the access of the movable device is monitored by a preset driver in the client.

Optionally, the access includes readable access, writable access, and non-readable and writable access.

According to a method and device for monitoring access of a mobile device according to the present invention, it can be judged whether the access of the mobile device is allowed by checking whether the unique identifier of the mobile device exists in the list of legal mobile device information preset by the security control server. Input, when the removable device is allowed to access, monitor the write operation of the removable device, thereby solving the problem of leaking of the removable device that enterprises often encounter, achieving the ability to accurately track the source and whereabouts of data, and prevent virus infection , improve the safety of mobile devices, and ensure the safety of network information, especially intranet network information.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to designate the same components. In the attached picture:

FIG. 1 shows a flow chart of steps of a method embodiment of access monitoring of a mobile device according to an embodiment of the present invention;

Fig. 2 shows a structural block diagram of an embodiment of an apparatus for monitoring access of a mobile device according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

One of the core concepts of the embodiments of the present invention is to determine whether to allow the access of the mobile device by checking whether the unique identifier of the mobile device exists in the list of legal mobile device information preset by the security control server. The write operation of the removable device is monitored during access, so that the source and destination of the data can be accurately tracked, the security of the use of the removable device is improved, and the security of network information, especially intranet network information, is ensured.

Referring to FIG. 1 , it shows a flow chart of steps of a method embodiment of a mobile device access monitoring method according to the present invention, which may specifically include the following steps:

Step 101, preset a list of legal removable device information in the security control server; the security control server is used to control the security of the client connected to it, and the list of legal removable device information includes removable The unique identification of the device;

Taking the application of the present invention on a PC (PersonalComputer, personal computer) installed with a private cloud client as an example, the PC installed with a private cloud client can monitor files to prevent infection by viruses, and will interact with the corresponding security control server at the same time. Some information of the local computer is sent to the security control server. The PC can also monitor whether a new device is connected, the type of the connected device, whether it is a removable device, etc.

It should be noted that, in the embodiment of the present invention, the security control server and the client form a master-controlled relationship, and the security control server is used to control the security of the client connected to it, for example, the server in the local area network and the client.

In a specific implementation, it is necessary to preset a list of legal mobile device information in the security control server. The list of legal mobile device information includes the unique identification of the mobile device that is allowed to be accessed, and is used for comparison and judgment. The unique identifiers of the accessed mobile devices are consistent, so as to determine whether the access of the mobile device is legal.

Step 102, when the client monitors the access of the mobile device, calculate the unique identification of the mobile device;

In a preferred embodiment of the present invention, the access of the mobile device can be monitored by a preset driver in the client.

By installing a preset driver on the client, use the driver to monitor all write operations on the removable device. When the driver monitors the access of a removable device, it throws the relevant information to the application layer. After the application layer obtains the information, it sends information to the security control server to inquire whether it can be accessed.

In a preferred example of the embodiment of the present invention, since the private cloud client is resident, the access and exit of the mobile device can be monitored through the message function WMDEVICECHANGE, or can be monitored using a driver. Preferably, if the security control server query times out, the removable device can also be ejected to avoid resource occupation. In a preferred embodiment of the present invention, the step 102 may include the following sub-steps:

Sub-step S11, acquiring hardware attribute information of the removable device;

Sub-step S12, judging whether there is a characteristic identifier in the mobile device; if so, execute sub-step S13, if not, execute sub-step S14;

Sub-step S13, if yes, extract the feature identifier from the mobile device;

Sub-step S14, if not, calculate the signature according to the hardware attribute information, and write the signature into the removable device;

Sub-step S15, calculating the unique identifier of the movable device according to the hardware attribute information and feature identifier of the movable device.

When the mobile device is connected to the PC installed with the private cloud client, the hardware attribute information and feature identification of the mobile device connected to the client are obtained, wherein the hardware attribute information may include the inherent hardware attributes of the mobile device , and, the hardware attribute that the removable device will add later. The feature identifier of the removable device is calculated based on the hardware attribute information of the removable device. The feature identifier can further mark the removable device on the hardware attribute information of the removable device, and the unique identification is based on the Even if the hardware attribute information of the mobile device is the same as calculated by the hardware attribute information and feature identifier of the device, the removable device may not be allowed to be connected to ensure the security of network information, especially enterprise intranet information.

In a preferred embodiment of the present invention, the hardware attribute information may include the identifier of the mobile device, and/or the manufacturer information of the mobile device, and/or the space size of the mobile device.

In a preferred embodiment of the present invention, the steps of the sub-step S14 may include the following sub-steps:

Sub-step S21, combining the mobile device identifier and hardware attribute information into a first character string;

Sub-step S22, calculating the characteristic identifier of the mobile device by using the message digest algorithm MD5 according to the first character string;

Sub-step S23, writing the feature identifier of the movable device into the movable device.

In the specific implementation, when the client monitors the access of a removable device, it obtains the identifier of the removable device, the manufacturer information of the removable device, and the space size of the removable device and combines them into a set of strings, and then uses MD5 The algorithm calculates the characteristic identifier of the mobile device based on this. As is well known, MD5 (Message Digest Algorithm, fifth edition of Message Digest Algorithm) is a hash function widely used in the field of computer security, which operates data into another fixed-length value and compresses information into a confidential format.

For example, the identifier of the removable device is 5001, the manufacturer information of the removable device is Patriot, and the space size of the removable device is 1000000K, which can be combined into a set of strings: 5001 Patriot 1000000, and the string uses the MD5 algorithm The 32-bit unique characteristic identifier of the removable device that can be calculated is: B64D19F84EEEF997453CDD25738C082C, and then the calculated characteristic identifier is written into the removable device.

In a preferred embodiment of the present invention, the step 102 may also include the following sub-steps:

If the operation of writing the feature identifier into the removable device fails, sending information about the failure of the writing operation to the security control server;

The security control server rejects the access of the removable device according to the information that the writing operation fails.

Preferably, if the operation of writing the calculated feature identifier to the removable device fails, the client can send the information of the failure of the writing operation to the security control server, and the security control server can reject the removable device according to the information of the operation failure. The access further guarantees the security of network information, especially intranet network information.

In a preferred embodiment of the present invention, the steps of the sub-step S15 may include the following sub-steps:

Sub-step S31, combining the feature identifier of the removable device and the hardware attribute information into a second character string;

Sub-step S32, calculating the unique identifier of the mobile device by using the message digest algorithm MD5 according to the second character string.

For example, the identifier of the removable device is 5001, the manufacturer information of the removable device is Patriot, the space size of the removable device is 1000000K, and the characteristic identifier of the removable device is B64D19F84EEEF997453CDD25738C082C, which can be combined into a set of strings: B64D19F84EEEF997453CDD25738C082C5001 Patriot 1000000, the string can be calculated using the MD5 algorithm to obtain the unique identification of the 32-bit mobile device: 45B51AE3C3445170E39801CA9ACD564D.

Of course, in practical applications, it is not limited to the MD5 algorithm, and those skilled in the art can also use the MD5 algorithm as a principle to select other appropriate algorithms to generate the characteristic identifier and unique identification identifier of the mobile device, which is not limited by the present invention.

Step 103: Send the unique identifier to the security control server, and the security control server judges whether the unique identifier exists in the list of legal mobile device information; if yes, execute step 104; if not, then Execute step 105;

Step 104, allowing access of the mobile device;

Step 105, rejecting the access of the mobile device.

In the embodiment of the present invention, the association relationship between the client and the security control server is used to manage the mobile device that accesses the client. If the unique identifier of the mobile device accessing the client exists in the list of legal mobile device information in the security control server, it means that the access of the mobile device is legal, and the security control server allows the mobile device access. If the unique identifier of the mobile device accessing the client does not exist in the list of legal mobile device information of the security control server, it means that the access of the mobile device is illegal, and the security control server rejects the access of the mobile device. access.

In a preferred embodiment of the present invention, the security control server can also preset a time interval for the mobile device to allow access. In this case, the method can also include the following steps:

judging whether the mobile device accesses within the allowed access time interval;

If the mobile device is accessed within the allowed access time interval, the security control server allows the mobile device to access;

If the mobile device does not access within the allowed access time interval, the security control server rejects the mobile device's access.

By setting the access-allowed time interval for the mobile device that is allowed to access, the mobile device can only access and run on the client within the allowed time interval, and outside the allowed access time interval Then reject the access of the mobile device, so as to further ensure the security of network information, especially intranet network information. In practice, an identification name can also be set for the removable device that is allowed to be accessed, so as to facilitate the administrator's identification and subsequent management.

In a specific implementation, the removable device that is allowed to be accessed can be set as an access with a readable permission, an access with a writable permission, or an access with a non-readable and writable permission. The corresponding permissions run in the client.

In a preferred embodiment of the present invention, the method may also include the following steps:

When the access of the removable device is allowed, monitor the write operation of the removable device;

Send the information of the writing operation to the security control server.

Preferably, when the removable device is allowed to be used normally, the security control server monitors the writing operation of the removable device, and sends each write operation to the removable device to the security control server. The writing operation includes the operation of saving files to removable devices and from removable devices to local disks. As long as the source path or target path is a removable device, it will be recorded and sent to the security control server, so that the data can be accurately tracked The source and whereabouts of the mobile device can be prevented from being infected by viruses, and the security of mobile devices can be improved.

When the relevant operations of the removable device in the client are completed and the removable device needs to be exited, it can be uninstalled through SetupDiDestroyDeviceInfoList, destroy the removable device information collection, and release all associated memory, in ring3 (CPU lowest privilege level ) to pop up the removable device, and you can also use the driver to uninstall.

It should be noted that, for the method embodiment, for the sake of simple description, it is expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action order, because according to this According to the invention, certain steps may be performed in other order or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification belong to preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

Referring to Fig. 2, it shows a structural block diagram of an embodiment of an apparatus for access monitoring of a mobile device according to the present invention, which may specifically include the following modules:

The preset legal list module 201 is located in the security control server and is used to control the security of the client connected to it, and the list of legal mobile device information includes the unique identification of the mobile device that is allowed to access;

The unique identification calculation module 202, located at the client, is used to calculate the unique identification of the mobile device when monitoring the access of the mobile device;

In a preferred embodiment of the present invention, the access of the mobile device can be monitored by a preset driver in the client.

In a preferred embodiment of the present invention, the unique identification mark calculation module 202 may include the following submodules:

A hardware attribute information acquisition submodule, configured to acquire hardware attribute information of the removable device;

The feature identification judging submodule is used to judge whether there is a feature identification in the mobile device; if so, then call the feature identification extraction submodule, if not, then call the feature identification calculation submodule;

A feature identifier extraction submodule, configured to extract a feature identifier from the mobile device;

A signature calculation submodule, configured to calculate a signature according to the hardware attribute information, and write the signature into the removable device;

The unique identifier calculation submodule is configured to calculate the unique identifier of the movable device according to the hardware attribute information and feature identifier of the movable device.

In a preferred embodiment of the present invention, the device may also include the following modules:

The writing failure information sending module is located at the client, and is used to send the information of the writing operation failure to the security control server if the operation of writing the feature identifier into the removable device fails;

The access denying module is located in the security control server, and is used for denying the access of the removable device according to the information that the writing operation fails.

In a preferred embodiment of the present invention, the security control server is preset with a time interval for mobile devices to allow access, and the device may also include the following modules:

The time interval judging module is located in the security control server and is used to judge whether the mobile device is accessed within the time interval of the allowed access; if so, call the access allowed module in the time interval, if not, call the time interval Refuse to access the module within the interval;

The module for allowing access within the time interval, located in the security control server, is used to allow the access of the mobile device if the access of the mobile device is within the time interval for allowing access;

The module for denying access within the time interval is located in the security control server, and is configured to deny the access of the mobile device if the access of the mobile device is not within the time interval for allowing access.

In a preferred embodiment of the present invention, the hardware attribute information may include the identifier of the mobile device, and/or the manufacturer information of the mobile device, and/or the space size of the mobile device.

In a preferred embodiment of the present invention, the feature identification calculation submodule may include the following units:

A first character string combination unit, configured to combine the mobile device identifier and hardware attribute information into a first character string;

The second calculation unit is used to calculate the feature identifier of the mobile device by using the message digest algorithm MD5 according to the first character string;

The feature identifier writing unit is configured to write the feature identifier of the removable device into the removable device.

In a preferred embodiment of the present invention, the unique identification identification calculation submodule may include the following units:

A second character string combination unit, configured to combine the feature identifier of the removable device and the hardware attribute information into a second character string;

The second calculation unit is configured to calculate the unique identifier of the mobile device by using the message digest algorithm MD5 according to the second character string.

The unique identifier sending module 203, located at the client, is used to send the unique identifier to the security control server;

The unique identification identification judging module 204 is located in the security control server, and is used to determine whether the unique identification identification exists in the list of the legal mobile device information, if yes, then call the release module 205, if not, then call the rejection module 206 ;

A pass module 205, configured to allow access of the mobile device;

A rejecting module 206, configured to reject the access of the mobile device.

In a preferred embodiment of the present invention, the access may include readable access, writable access, and non-readable and writable access.

In a preferred embodiment of the present invention, the device may also include the following modules:

An access monitoring module, located on the client side, is configured to monitor the write operation of the removable device when the access of the removable device is allowed;

The writing information sending module is located at the client and is used to send the information of the writing operation to the security control server.

As for the device embodiment in FIG. 2 , since it is basically similar to the method embodiment in FIG. 1 , the description is relatively simple, and for relevant parts, please refer to the part of the description of the method embodiment.

The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other device. Various generic systems can also be used with the teachings based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not specific to any particular programming language. It should be understood that various programming languages can be used to implement the content of the present invention described herein, and the above description of specific languages is for disclosing the best mode of the present invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline this disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method or method so disclosed may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) can be used in practice to implement some or all of the components in a mobile device access monitoring device according to an embodiment of the present invention Or full functionality. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

Claims (16)

1. A method for access monitoring of a mobile device, comprising: A list of legal removable device information is preset in the security control server; the security control server is used to control the security of the client connected to it, and the list of legal removable device information includes the unique identification mark; When the client monitors the access of the mobile device, calculate the unique identification of the mobile device; Send the unique identification to the security control server, and the security control server judges whether the unique identification exists in the list of legal mobile device information, and if so, allows the access of the mobile device; if If not, reject the access of the mobile device; When the client monitors the access of the mobile device, the step of calculating the unique identification of the mobile device includes: Obtain hardware attribute information of the removable device; judging whether the mobile device has a feature identifier; If so, then extract the feature identifier from the removable device; If not, then calculate the signature according to the hardware attribute information, and write the signature into the removable device; The unique identifier of the movable device is calculated according to the hardware attribute information and the characteristic identifier of the movable device. 2. The method of claim 1, further comprising: If the operation of writing the feature identifier into the removable device fails, sending information about the failure of the writing operation to the security control server; The security control server rejects the access of the removable device according to the information that the writing operation fails. 3. The method according to claim 1, wherein the security control server is preset with a time interval during which the mobile device is allowed to access, and the method further comprises: judging whether the mobile device accesses within the allowed access time interval; If the mobile device is accessed within the allowed access time interval, the security control server allows the mobile device to access; If the mobile device does not access within the allowed access time interval, the security control server rejects the mobile device's access. 4. The method of claim 1, further comprising: When the access of the removable device is allowed, monitor the write operation of the removable device; Send the information of the writing operation to the security control server. 5. The method according to claim 1, wherein the hardware attribute information includes a mobile device identifier, and/or, manufacturer information of the mobile device, and/or, a space size of the mobile device. 6. The method according to claim 1 or 5, said calculating the signature according to the hardware attribute information, and writing the signature into the removable device comprises: Combining the removable device identifier and hardware attribute information into a first character string; Calculate the feature identifier of the mobile device by using the message digest algorithm MD5 according to the first character string; Writing the feature identifier of the movable device into the movable device. 7. The method according to claim 1 or 5, wherein the step of calculating the unique identification of the removable device according to the hardware attribute information and the characteristic identifier of the removable device comprises: Combining the feature identifier of the removable device and the hardware attribute information into a second character string; The unique identification of the mobile device is calculated by using the message digest algorithm MD5 according to the second character string. 8. The method of claim 1, the access of the removable device is monitored by a preset driver in the client. 9. The method according to claim 1, the access includes readable access, writable access and non-readable and writable access. 10. An access monitoring device for a mobile device, comprising: The preset legal list module is located in the security control server and is used to control the security of the client connected to it, and the list of legal mobile device information includes the unique identification of the mobile device that is allowed to access; The unique identification calculation module is located at the client end and is used to calculate the unique identification of the mobile device when monitoring the access of the mobile device; The unique identification identification sending module is located at the client end and is used to send the unique identification identification to the security control server; The unique identification identification judging module is located in the security control server, and is used to determine whether the unique identification identification exists in the list of legal mobile device information, if yes, call the release module, and if not, call the rejection module; a release module, configured to allow the access of the mobile device; a rejecting module, configured to reject the access of the mobile device; The unique identification identification calculation module includes: A hardware attribute information acquisition submodule, configured to acquire hardware attribute information of the removable device; The feature identification judging submodule is used to judge whether there is a feature identification in the mobile device; if so, then call the feature identification extraction submodule, if not, then call the feature identification calculation submodule; A feature identifier extraction submodule, configured to extract a feature identifier from the mobile device; A signature calculation submodule, configured to calculate a signature according to the hardware attribute information, and write the signature into the removable device; The unique identifier calculation submodule is configured to calculate the unique identifier of the movable device according to the hardware attribute information and feature identifier of the movable device. 11. The apparatus of claim 10, further comprising: The writing failure information sending module is located at the client, and is used to send the information of the writing operation failure to the security control server if the operation of writing the feature identifier into the removable device fails; The access denying module is located in the security control server, and is used for denying the access of the removable device according to the information that the writing operation fails. 12. The device according to claim 10, wherein the security control server is preset with a time interval during which the mobile device is allowed to access, and the device further comprises: The time interval judging module is located in the security control server and is used to judge whether the mobile device is accessed within the time interval of the allowed access; if so, call the access allowed module in the time interval, if not, call the time interval Refuse to access the module within the interval; The module for allowing access within the time interval, located in the security control server, is used to allow the access of the mobile device if the access of the mobile device is within the time interval for allowing access; The module for denying access within the time interval is located in the security control server, and is configured to deny the access of the mobile device if the access of the mobile device is not within the time interval for allowing access. 13. The apparatus of claim 10, further comprising: An access monitoring module, located on the client side, is configured to monitor the write operation of the removable device when the access of the removable device is allowed; The writing information sending module is located at the client and is used to send the information of the writing operation to the security control server. 14. The apparatus according to claim 10, wherein the hardware attribute information comprises a removable device identifier, and/or, manufacturer information of the movable device, and/or, a space size of the movable device. 15. The device according to claim 10 or 14, said signature calculation submodule comprising: a first character string combination unit, configured to combine the mobile device identifier and hardware attribute information into a first character string; The second calculation unit is used to calculate the feature identifier of the mobile device by using the message digest algorithm MD5 according to the first character string; The feature identifier writing unit is configured to write the feature identifier of the removable device into the removable device. 16. The device according to claim 10 or 14, said unique identification identification calculation submodule comprising: A second character string combination unit, configured to combine the feature identifier of the removable device and the hardware attribute information into a second character string; The second calculation unit is configured to calculate the unique identifier of the mobile device by using the message digest algorithm MD5 according to the second character string.