[go: up one dir, main page]

CN119378033A - A method and device for securely accessing a USB device - Google Patents

A method and device for securely accessing a USB device Download PDF

Info

Publication number
CN119378033A
CN119378033A CN202411943507.0A CN202411943507A CN119378033A CN 119378033 A CN119378033 A CN 119378033A CN 202411943507 A CN202411943507 A CN 202411943507A CN 119378033 A CN119378033 A CN 119378033A
Authority
CN
China
Prior art keywords
usb
host
usb device
access
interface
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202411943507.0A
Other languages
Chinese (zh)
Inventor
吴中华
吴国华
丁聪霜
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Gctech Technology Co ltd
Original Assignee
Beijing Gctech Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Gctech Technology Co ltd filed Critical Beijing Gctech Technology Co ltd
Priority to CN202411943507.0A priority Critical patent/CN119378033A/en
Publication of CN119378033A publication Critical patent/CN119378033A/en
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/82Protecting input, output or interconnection devices
    • G06F21/85Protecting input, output or interconnection devices interconnection devices, e.g. bus-connected or in-line devices

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种安全接入USB设备的方法及装置,该方法包括:对USB设备对应的ukey进行认证;在USB设备对应的ukey认证通过的情况下,接收用户对第一USB接口的选择输入;响应于选择输入,确定主机上的目标第一USB接口,并控制USB设备接入目标第一USB接口,以使USB设备安全接入所述主机;其中,所述目标第一USB接口为所述USB设备期望接入的第一USB接口。本申请通过对期望接入的USB设备进行ukey认证,在USB设备认证通过的情况下,方可允许USB设备接入主机,避免未经允许的USB设备接入主机,不会完全禁用主机的USB接口避免了对主机操作系统性能的影响。

The present application discloses a method and apparatus for securely accessing a USB device, the method comprising: authenticating a ukey corresponding to a USB device; receiving a user's selection input for a first USB interface when the ukey corresponding to the USB device passes the authentication; in response to the selection input, determining a target first USB interface on a host, and controlling the USB device to access the target first USB interface, so that the USB device can securely access the host; wherein the target first USB interface is the first USB interface that the USB device expects to access. The present application performs ukey authentication on the USB device that is expected to access, and only allows the USB device to access the host when the USB device passes the authentication, thereby preventing unauthorized USB devices from accessing the host, and does not completely disable the USB interface of the host, thereby avoiding the impact on the performance of the host operating system.

Description

Method and device for safely accessing USB (universal serial bus) equipment
Technical Field
The present application relates to the field of information security technologies, and in particular, to a method and an apparatus for securely accessing a USB device.
Background
In some occasions with higher safety requirements, in order to prevent data leakage, virus transmission or unauthorized equipment access, measures for blocking the USB interface are taken, so that the safety of a system and data can be effectively protected, and potential safety risks are prevented. In addition, in some commercial environments, plugging the USB interface can also help enterprises manage and monitor the equipment use of staff, and ensure information security and confidentiality of enterprise data.
In the prior art, a management method of a commonly used USB interface mainly comprises the steps of firstly hiding a partition, namely entering a registry through equipment, hiding the partition through modifying key values, so that when a USB flash disk is inserted, the USB flash disk equipment cannot be seen in a personal computer, secondly disabling the USB port, namely realizing hiding of a USB flash disk character through changing a Registry (REGEDIT) sub key if a user has used a USB storage device, thirdly disabling disk permission, namely configuring a management template in a group policy (running: gpedit.msc) computer, enabling a system to access in a movable storage mode, disabling various permission of the movable disk, fourthly modifying the BIOS, namely directly encrypting the USB Disable in a main board BIOS, then encrypting the BIOS according to the BIOS version, and thirdly protecting the safety of data by encrypting the USB data, wherein only authorized users can decrypt and access the data.
However, in the existing management method of the USB interface, the method of hiding the partition is just to hide the USB disk, the effect of true shielding cannot be achieved, the method of disabling the USB interface is only to shield used equipment, new equipment can be plugged in and can be used, the method of disabling the disk permission cannot completely filter all equipment, the method of modifying the Bios can completely disable the USB interface, so that the USB mouse and the keyboard cannot work normally, the method of plugging an encryption layer needs to encrypt and decrypt in the data transmission process, and the system performance can be reduced.
Disclosure of Invention
The application provides a USB interface plugging device, which aims to solve the problems in the background technology.
In a first aspect, a method for safely accessing a USB device is provided, where first USB interfaces on a host are all connected to the same USB management device through connection lines with physical locks, so that the first USB interfaces connected to the USB management device are all in a blocking state;
the USB management equipment externally provides a plurality of second USB interfaces, and the second USB interfaces are used for the USB equipment to access;
The method for safely accessing the USB equipment comprises the following steps:
Authenticating ukey corresponding to the USB equipment;
receiving selection input of a user to a first USB interface under the condition that ukey authentication corresponding to the USB equipment passes;
And responding to the selection input, determining a target first USB interface on the host, and controlling the USB equipment to access the target first USB interface so as to ensure that the USB equipment is safely accessed to the host, wherein the target first USB interface is a first USB interface which the USB equipment expects to access.
In the above solution, optionally, after the authenticating ukey corresponding to the USB device, the method includes:
And rejecting the USB equipment to access the USB management equipment under the condition that ukey authentication corresponding to the USB equipment is not passed, so that the USB equipment cannot access the host.
In the above aspect, optionally, after the USB device is securely connected to the host, the method further includes:
Monitoring and recording the data read-write operation of the USB equipment to obtain a log file of the USB equipment;
Judging the data read-write operation of the USB equipment based on a sensitivity rule for any data read-write operation of the USB equipment;
And under the condition that the data read-write operation belongs to sensitive operation, recording the sensitive operation to obtain a sensitive file of the USB equipment.
In the above solution, optionally, after the monitoring and recording the data read-write operation of the USB device to obtain the log file of the USB device, the method further includes:
analyzing the log files to obtain high-risk log files and low-risk log files, and storing the high-risk log files and the low-risk log files in a classified mode.
In a second aspect, there is provided an apparatus for securely accessing a USB device, the apparatus comprising:
The authentication module is used for authenticating ukey corresponding to the USB equipment;
The receiving module is used for receiving the selection input of the user to the first USB interface under the condition that ukey authentication corresponding to the USB equipment passes;
the control module is used for responding to the selection input, determining a target first USB interface on the host, and controlling the USB equipment to access the target first USB interface so as to enable the USB equipment to safely access the host, wherein the target first USB interface is a first USB interface which the USB equipment expects to access.
In the above solution, optionally, the apparatus further includes:
and the rejecting access module is used for rejecting the USB equipment to access the USB management equipment under the condition that ukey authentication corresponding to the USB equipment is not passed, so that the USB equipment cannot access the host.
In the above solution, optionally, the apparatus further includes:
The monitoring and recording module is used for monitoring and recording the data read-write operation of the USB equipment to obtain a log file of the USB equipment;
The judging module is used for judging the data read-write operation of the USB equipment based on the sensitivity rule for any data read-write operation of the USB equipment;
And the recording module is used for recording the sensitive operation under the condition that the data read-write operation belongs to the sensitive operation, so as to obtain the sensitive file of the USB equipment.
In the above solution, optionally, the apparatus further includes:
the storage module is used for analyzing the log files to obtain high-risk log files and low-risk log files, and storing the high-risk log files and the low-risk log files in a classified mode.
In a third aspect, an apparatus for securely accessing a USB device is provided, wherein the apparatus includes a USB management device and at least one connection line with a physical latch;
The number of the connecting wires with the physical lock catches is equal to the number of the first USB interfaces on the host computer and corresponds to the number of the first USB interfaces one by one, one end of the connecting wires with the physical lock catches is connected with the corresponding first USB interfaces, and the other end of the connecting wires with the physical lock catches is connected with the USB management equipment;
The USB management device provides a plurality of second USB interfaces for the outside, and the second USB interfaces are used for the USB device to access.
In the above scheme, optionally, the USB management device includes a USB plug, a USB socket, and a USB unlocking key;
Locking grooves are symmetrically formed in two sides of the USB female seat, and elastic sheets integrally formed with the USB female seat are arranged in the locking grooves;
grooves are symmetrically formed in two sides of the front end of the USB unlocking key, and the grooves are symmetrical to the elastic pieces in position;
the USB plug and the device are inserted into the USB female seat, and the USB unlocking key is positioned at the top of the USB plug;
the bayonet is integrally formed and connected with two sides of the front end of the top of the USB plug, and the bayonet is symmetrical to the elastic sheet in position.
Compared with the prior art, the application has at least the following beneficial effects:
Based on further analysis and research on the prior art, the application realizes that the prior USB interface management method can not achieve the effect of truly shielding the USB flash disk or can completely disable the USB interface or even cause the problem of reduced system performance, and the method for safely accessing the USB equipment provided by the application comprises the steps of authenticating ukey corresponding to the USB equipment, receiving selection input of a user on a first USB interface under the condition that ukey corresponding to the USB equipment passes authentication, determining a target first USB interface on a host in response to the selection input, and controlling the USB equipment to access the target first USB interface so as to enable the USB equipment to safely access the host, wherein the target first USB interface is the first USB interface which the USB equipment expects to access. By carrying out ukey authentication on the USB equipment which is expected to be accessed, the USB equipment can be allowed to be accessed to the host under the condition that the authentication of the USB equipment is passed, the host is prevented from being accessed by the unauthorized USB equipment, the USB interface of the host is not completely disabled, and the influence on the performance of the host operating system is avoided.
Drawings
Fig. 1 is a flowchart of a method for securely accessing a USB device according to an embodiment of the present application.
Detailed Description
The present application will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present application more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the application.
In the description of the present application, unless otherwise indicated, the meaning of "a plurality" is two or more. The terms "first," "second," "third," and the like in this disclosure are intended to distinguish between the referenced objects without a special meaning in terms of technical connotation (e.g., should not be construed as emphasis on the degree of importance or order, etc.). The expressions "comprising", "including", "having", etc. also mean "not limited to" (certain units, components, materials, steps, etc.).
In one embodiment, as shown in fig. 1, a method for securely accessing a USB device is provided, where first USB interfaces on a host are all connected to a same USB management device through connection lines with physical latches, so that the first USB interfaces connected to the USB management device are all in a blocking state;
the USB management equipment externally provides a plurality of second USB interfaces, and the second USB interfaces are used for the USB equipment to access;
The method for safely accessing the USB equipment comprises the following steps:
Authenticating ukey corresponding to the USB equipment;
receiving selection input of a user to a first USB interface under the condition that ukey authentication corresponding to the USB equipment passes;
And responding to the selection input, determining a target first USB interface on the host, and controlling the USB equipment to access the target first USB interface so as to ensure that the USB equipment is safely accessed to the host, wherein the target first USB interface is a first USB interface which the USB equipment expects to access.
In this embodiment, after the authentication of ukey corresponding to the USB device, the method includes:
And rejecting the USB equipment to access the USB management equipment under the condition that ukey authentication corresponding to the USB equipment is not passed, so that the USB equipment cannot access the host.
In this embodiment, after the USB device securely accesses the host, the method further includes:
Monitoring and recording the data read-write operation of the USB equipment to obtain a log file of the USB equipment;
Judging the data read-write operation of the USB equipment based on a sensitivity rule for any data read-write operation of the USB equipment;
And under the condition that the data read-write operation belongs to sensitive operation, recording the sensitive operation to obtain a sensitive file of the USB equipment.
In this embodiment, after the monitoring and recording the data read-write operation of the USB device to obtain the log file of the USB device, the method further includes:
analyzing the log files to obtain high-risk log files and low-risk log files, and storing the high-risk log files and the low-risk log files in a classified mode.
In one embodiment, there is provided an apparatus for securely accessing a USB device, the apparatus comprising:
The authentication module is used for authenticating ukey corresponding to the USB equipment;
The receiving module is used for receiving the selection input of the user to the first USB interface under the condition that ukey authentication corresponding to the USB equipment passes;
the control module is used for responding to the selection input, determining a target first USB interface on the host, and controlling the USB equipment to access the target first USB interface so as to enable the USB equipment to safely access the host, wherein the target first USB interface is a first USB interface which the USB equipment expects to access.
In this embodiment, the apparatus further includes:
and the rejecting access module is used for rejecting the USB equipment to access the USB management equipment under the condition that ukey authentication corresponding to the USB equipment is not passed, so that the USB equipment cannot access the host.
In this embodiment, the apparatus further includes:
The monitoring and recording module is used for monitoring and recording the data read-write operation of the USB equipment to obtain a log file of the USB equipment;
The judging module is used for judging the data read-write operation of the USB equipment based on the sensitivity rule for any data read-write operation of the USB equipment;
And the recording module is used for recording the sensitive operation under the condition that the data read-write operation belongs to the sensitive operation, so as to obtain the sensitive file of the USB equipment.
In this embodiment, the apparatus further includes:
the storage module is used for analyzing the log files to obtain high-risk log files and low-risk log files, and storing the high-risk log files and the low-risk log files in a classified mode.
In one embodiment, an apparatus for securely accessing a USB device is provided, wherein the apparatus includes a USB management device and at least one connection line with a physical latch;
The number of the connecting wires with the physical lock catches is equal to the number of the first USB interfaces on the host computer and corresponds to the number of the first USB interfaces one by one, one end of the connecting wires with the physical lock catches is connected with the corresponding first USB interfaces, and the other end of the connecting wires with the physical lock catches is connected with the USB management equipment;
The USB management device provides a plurality of second USB interfaces for the outside, and the second USB interfaces are used for the USB device to access.
In this embodiment, the USB management device includes a USB plug, a USB female socket, and a USB unlocking key;
Locking grooves are symmetrically formed in two sides of the USB female seat, and elastic sheets integrally formed with the USB female seat are arranged in the locking grooves;
grooves are symmetrically formed in two sides of the front end of the USB unlocking key, and the grooves are symmetrical to the elastic pieces in position;
the USB plug and the device are inserted into the USB female seat, and the USB unlocking key is positioned at the top of the USB plug;
the bayonet is integrally formed and connected with two sides of the front end of the top of the USB plug, and the bayonet is symmetrical to the elastic sheet in position.
In one embodiment, a USB interface plugging device is provided, where the device includes a housing, a plurality of USB plugging units and a plurality of USB sockets disposed on the housing, and an electronic circuit board disposed in the housing, where the USB plugging units are used for plugging a USB interface of a device to be plugged, and the USB sockets are used for inserting a USB device;
The USB plugging unit comprises a connecting wire and a USB plugging device, one end of the connecting wire is connected with the electronic circuit board, the other end of the connecting wire is connected with the USB plugging device in a magnetic attraction manner, and the USB plugging device is in plug connection fit with a USB interface of equipment to be plugged;
The USB plugging device comprises a USB plug, a USB female seat and a USB unlocking key;
Locking grooves are symmetrically formed in two sides of the USB female seat, and elastic sheets integrally formed with the USB female seat are arranged in the locking grooves;
the USB plug and the device are inserted into the USB female seat, and the USB unlocking key is positioned at the top of the USB plug.
In this embodiment, two sides of the front end of the top of the USB plug are integrally formed and connected with bayonets, and the bayonets are symmetrical to the positions of the spring plates.
In this embodiment, grooves are symmetrically formed on two sides of the front end of the USB unlocking key, and the positions of the grooves and the elastic pieces are symmetrical.
In this embodiment, the USB socket is provided with an identifier, and the identifier on the USB socket is different.
In this embodiment, the electronic circuit board is integrated with a controller and a verification module connected to the controller, where the verification module is used to verify the USB device inserted into the USB socket.
In this embodiment, the verification module is ukey verification modules;
When the USB device is connected to the device, the device is connected to ukey of the device, and then the USB device is connected to ukey.
In this embodiment, a storage module is further integrated on the electronic circuit board, and the storage module is connected to the controller.
In this embodiment, a read chip is disposed on the USB socket, and the read chip is connected to the controller, and is configured to read data read-write operations performed by the USB device inserted into the USB socket, and store the read data read-write operations to the storage module.
The USB interface plugging device comprises a shell, a plurality of USB plugging units and a plurality of USB sockets which are arranged on the shell, and an electronic circuit board which is arranged in the shell, wherein the USB plugging units are used for plugging a USB interface of equipment to be plugged, the USB sockets are used for allowing the USB equipment to be plugged, each USB plugging unit comprises a connecting wire and a USB plugging device, one end of the connecting wire is connected with the electronic circuit board, the other end of the connecting wire is magnetically connected with the USB plugging device, the USB plugging device is in plug connection with the USB interface of the equipment to be plugged, each USB plugging device comprises a USB plug, a USB female seat and a USB unlocking key, locking grooves are symmetrically formed in two sides of the USB female seat, elastic sheets which are integrally formed with the USB female seat are arranged in the locking grooves, each USB plug and each device are inserted into the USB female seat, and the USB unlocking key is positioned at the top of the USB plug. The USB plug is locked through the matching of the bayonet and the elastic sheet which are integrally formed on two sides of the front end of the top of the USB plug, and the USB unlocking key is inserted into the USB female seat, so that the elastic sheet is driven to rebound through the USB unlocking key, the USB plug is unlocked, the plugging reliability of the USB interface is effectively improved, the USB interface is thoroughly shielded when the USB disk is required to be shielded, the USB interface is not completely disabled, and meanwhile, the influence on the system performance is avoided.
In one embodiment, a plugging device for a USB interface is provided, which is improved by combining the problems existing in the prior art, and adopts physical layer plugging, software layer monitoring, and implementation of hardware isolation and identity verification of USB devices. The possible harm brought by the USB equipment is isolated from the aspect of hardware, if a USB port is needed, a special USB interface is needed, the USB port is needed to be detected, and when the USB equipment is accessed, a special ukey is needed, ukey is needed to be inserted first, then the USB equipment is inserted to start verification, and the USB equipment can be accessed to the host after the verification is completed. When the device is used, all USB ports of a host are connected to the USB plugging device, and the data line interface adopts a magnetic attraction and clamping manner, so that if the device is forcibly pulled out, a lock head can still be left inside, and the possibility of directly connecting the host is physically reduced.
In the embodiment, in terms of hardware, the USB plugging data line adopts a magnetic attraction and clamping design, and a mechanical device is added on the connector, so that the connector can be pulled out of the port only by pressing a specific button, thereby preventing accidental pulling out and preventing forced pulling out. A buzzing alarm device is arranged in the device, and an alarm is generated to remind if incorrect operation exists or unsafe equipment is detected. And using ukey to verify that when the USB plugging device is used for accessing other USB devices, ukey is required to be accessed first, and then other USB devices such as a mouse, a keyboard, a USB flash disk and the like are required to be accessed.
In this embodiment, in terms of software, if there is an error operation, a log may be generated, a serious error operation, such as a buzzer alarm may be generated by plugging the device, different log storage may be performed according to different logs, the log storage may be stored on the local USB plugging device, an administrator may check through logging in to the background address of the device, and if the company needs, we also provide a special log storage server for centrally managing the status of the device and log records. In addition, a special detection mechanism is arranged at the USB interface, and handshake negotiation is carried out between the USB device and the host to determine the requirement of the device on power supply and the power supply condition provided by the host. This ensures that the device is able to safely obtain the required power and avoids damaging the device or host. The USB interface will detect the data packets sent by the connected device to confirm the identity and type of the device. This helps determine whether the device complies with the USB specification, as well as the data transfer rate required by the device. The USB device is internally provided with an authentication chip for communicating with a host and verifying compliance of the device. This helps to prevent connection of illegal devices and ensures security and compatibility of the devices. This may help to prevent connection of illegal devices. The device is used for detecting whether the inserted device is compliant, and after the detection is finished, a selection button on the device selects which USB interface corresponding to the host is connected to, so that the invasion of illegal devices can be effectively avoided. Aiming at a special USB flash disk interface of the USB flash disk, an intrusion detection system is built in the USB flash disk, and malicious codes or Trojan programs can be detected.
When the USB plug plugging device is used, all USB ports on a host are required to be connected to USB plugging equipment, external equipment is required to be connected to the host, special sockets are reserved for the USB plug plugging equipment, after the USB plug plugging equipment passes the layer-by-layer authentication, a user manually selects which port of the host is connected to by using a key on the USB plug equipment after the USB plug equipment passes the authentication, and finally the device can be connected to the host.
If the host computer is illegally pulled out to be connected to the wire on the usb plugging device, the wire is magnetically attracted, and the lock head cannot be pulled out due to the buckle design adopted by the lock head, and the lock head still remains in the device after the wire is pulled out, so that other devices cannot be inserted, and a special key is required to be used for pulling out the device.
The lock head is provided with a chip function, the corresponding and authorized relation between the U port and the cable is authorized, and the system can not be identified due to the disturbance of the circuit is prevented;
And (3) carrying out detailed recording on the contents such as host operation, USB flash disk reading and writing, execution results and the like, and monitoring and recording an operation track and an operation log. The file copy-out and copy-in are divided into two areas, the copy-out being a writable area. The copy-in is read-only, and both the copy-out and the copy-in files need to pass the audit.
The AI is adopted to carry out log analysis, the high-risk and medium-low-risk logs are classified and stored, different alarms are adopted, and the system is independently developed, so that other people are prevented from easily finding out the system loopholes.
The embodiment can completely stop directly accessing equipment such as a USB flash disk and the like to a host from the physical aspect, and the usb is plugged by using a special lock head and a magnetic attraction wire, so that the possibility of directly and forcedly accessing the equipment to the host is greatly reduced. Each interface has unique identification to prevent data disorder caused by line disorder.
Ukey verification needs to be carried out when equipment is accessed, each USB plugging equipment is configured with a unique ukey, ukey needs to be accessed firstly when equipment is accessed, and then the equipment is accessed, so that other illegal personnel can be prevented from using a USB flash disk to carry out data read-write operation. Each USB device is provided with a unique ukey, the ukey is an encryption chip, when a user wants to access the USB device, ukey is inserted and verified, matching verification with ukey is achieved through a background code, once ukey verification is successful, the system can identify the USB device corresponding to ukey, the user is allowed to normally access the device to perform data read-write operation, if the user does not pass the correct ukey verification, the system can reject the access of the unverified USB device, and therefore illegal personnel can be effectively prevented from using the USB flash disk to perform data read-write operation.
The USB flash disk port is provided with a special chip which can record the data read-write operation of a user by using the USB flash disk, and alarm or log record is carried out according to the sensitivity of the operation. A special embedded chip is embedded in a circuit board of the USB flash disk and is used for monitoring and recording data read-write operation. This chip has a processor, memory and associated interface circuitry. The chip can judge whether each operation is sensitive according to the set sensitivity rule. For example, the judgment may be made by setting keywords of the sensitive file, a specific file path or file type, or the like. The chip records all read-write operations into the internal memory to form a log file. This log file may be read as needed for auditing or tracking data operations.
The design of the magnetic attraction and the buckle is utilized in the embodiment, so that the equipment can be connected to the host more safely, and the possibility of unauthorized connection is avoided. The design mode not only provides physical protection, but also improves the overall safety of the host, and ensures that the connection between the equipment and the host is safe and reliable.
The unique identification at the interface of the embodiment ensures the accuracy of data transmission and avoids the possibility of data confusion and erroneous connection. The design enhances the efficiency and the effectiveness of the business process, and ensures the integrity and the accuracy of data transmission.
In the embodiment, the ukey verification mode is adopted to verify the identity of the operator, so that illegal personnel are prevented from operating the equipment. The design further enhances the security in the physical aspect, ensures that only authorized personnel can operate the equipment, and reduces the risk of illegal access and attack of the equipment.
The USB flash disk in the embodiment performs strict recording, and adopts a partition mode to strictly verify the uploaded and downloaded data, so that the integrity and the safety of the data are ensured. The design further protects the safety of the equipment from the aspect of software, prevents the data from being tampered or damaged, and ensures the stability and the reliability of the equipment.
The technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.

Claims (10)

1.一种安全接入USB设备的方法,其特征在于,主机上的第一USB接口均通过带有物理锁扣的连接线分别连接在同一USB管理设备上,使得与所述USB管理设备连接的所述第一USB接口均处于封堵状态;其中,所述主机上的USB接口均为所述第一USB接口;1. A method for securely accessing a USB device, characterized in that the first USB interfaces on a host are all connected to the same USB management device through connection cables with physical locks, so that the first USB interfaces connected to the USB management device are all in a blocked state; wherein the USB interfaces on the host are all the first USB interfaces; 所述USB管理设备对外提供多个第二USB接口,所述第二USB接口用于供USB设备接入;The USB management device provides a plurality of second USB interfaces to the outside, and the second USB interfaces are used for accessing USB devices; 所述安全接入USB设备的方法包括:The method for securely accessing a USB device comprises: 对所述USB设备对应的ukey进行认证;Authenticate the ukey corresponding to the USB device; 在所述USB设备对应的ukey认证通过的情况下,接收用户对第一USB接口的选择输入;When the ukey authentication corresponding to the USB device passes, receiving a user's selection input for the first USB interface; 响应于所述选择输入,确定所述主机上的目标第一USB接口,并控制所述USB设备接入所述目标第一USB接口,以使所述USB设备安全接入所述主机;其中,所述目标第一USB接口为所述USB设备期望接入的第一USB接口。In response to the selection input, a target first USB interface on the host is determined, and the USB device is controlled to access the target first USB interface so that the USB device can safely access the host; wherein the target first USB interface is the first USB interface that the USB device expects to access. 2.根据权利要求1所述的方法,其特征在于,在所述对所述USB设备对应的ukey进行认证之后,所述方法包括:2. The method according to claim 1, characterized in that after authenticating the ukey corresponding to the USB device, the method comprises: 在所述USB设备对应的ukey认证未通过的情况下,拒绝所述USB设备接入所述USB管理设备,以使所述USB设备无法接入所述主机。In the case that the ukey authentication corresponding to the USB device fails, the USB device is denied access to the USB management device, so that the USB device cannot access the host. 3.根据权利要求1所述的方法,其特征在于,在所述USB设备安全接入所述主机之后,所述方法还包括:3. The method according to claim 1, characterized in that after the USB device is securely connected to the host, the method further comprises: 对所述USB设备的数据读写操作进行监控和记录,得到所述USB设备的日志文件;Monitor and record the data read and write operations of the USB device to obtain a log file of the USB device; 对于所述USB设备的任一数据读写操作,基于敏感性规则,对所述USB设备的数据读写操作进行判断;For any data read and write operation of the USB device, judging the data read and write operation of the USB device based on the sensitivity rule; 在所述数据读写操作属于敏感操作的情况下,对所述敏感操作进行记录,得到所述USB设备的敏感文件。In the case where the data reading and writing operation is a sensitive operation, the sensitive operation is recorded to obtain a sensitive file of the USB device. 4.根据权利要求3所述的方法,其特征在于,在所述对所述USB设备的数据读写操作进行监控和记录,得到所述USB设备的日志文件之后,所述方法还包括:4. The method according to claim 3, characterized in that after monitoring and recording the data read and write operations of the USB device to obtain the log file of the USB device, the method further comprises: 对所述日志文件进行分析,得到高危日志文件和低危日志文件,并对所述高危日志文件和所述低危日志文件进行分类存储。The log files are analyzed to obtain high-risk log files and low-risk log files, and the high-risk log files and the low-risk log files are classified and stored. 5.一种安全接入USB设备的装置,其特征在于,所述装置包括:5. A device for securely accessing a USB device, characterized in that the device comprises: 认证模块,用于对USB设备对应的ukey进行认证;Authentication module, used to authenticate the ukey corresponding to the USB device; 接收模块,用于在所述USB设备对应的ukey认证通过的情况下,接收用户对第一USB接口的选择输入;A receiving module, configured to receive a user's selection input for a first USB interface when the ukey authentication corresponding to the USB device passes; 控制模块,用于响应于所述选择输入,确定主机上的目标第一USB接口,并控制所述USB设备接入所述目标第一USB接口,以使所述USB设备安全接入所述主机;其中,所述目标第一USB接口为所述USB设备期望接入的第一USB接口。A control module is used to determine a target first USB interface on a host in response to the selection input, and control the USB device to access the target first USB interface so that the USB device can safely access the host; wherein the target first USB interface is the first USB interface that the USB device expects to access. 6.根据权利要求5所述的装置,其特征在于,所述装置还包括:6. The device according to claim 5, characterized in that the device further comprises: 拒绝接入模块,用于在所述USB设备对应的ukey认证未通过的情况下,拒绝所述USB设备接入USB管理设备,以使所述USB设备无法接入所述主机。The access rejection module is used to reject the USB device from accessing the USB management device when the ukey authentication corresponding to the USB device fails, so that the USB device cannot access the host. 7.根据权利要求5所述的装置,其特征在于,所述装置还包括:7. The device according to claim 5, characterized in that the device further comprises: 监控记录模块,用于对所述USB设备的数据读写操作进行监控和记录,得到所述USB设备的日志文件;A monitoring and recording module, used for monitoring and recording the data reading and writing operations of the USB device, and obtaining a log file of the USB device; 判断模块,用于对于所述USB设备的任一数据读写操作,基于敏感性规则,对所述USB设备的数据读写操作进行判断;A judgment module, configured to judge the data read and write operation of the USB device based on a sensitivity rule for any data read and write operation of the USB device; 记录模块,用于在所述数据读写操作属于敏感操作的情况下,对所述敏感操作进行记录,得到所述USB设备的敏感文件。The recording module is used to record the sensitive operation when the data reading and writing operation is a sensitive operation, so as to obtain the sensitive file of the USB device. 8.根据权利要求5所述的装置,其特征在于,所述装置还包括:8. The device according to claim 5, characterized in that the device further comprises: 存储模块,用于对日志文件进行分析,得到高危日志文件和低危日志文件,并对所述高危日志文件和所述低危日志文件进行分类存储。The storage module is used to analyze the log files to obtain high-risk log files and low-risk log files, and classify and store the high-risk log files and the low-risk log files. 9.一种安全接入USB设备的装置,其特征在于,所述装置包括USB管理设备和至少一个带有物理锁扣的连接线;9. A device for securely accessing a USB device, characterized in that the device comprises a USB management device and at least one connecting line with a physical lock; 所述带有物理锁扣的连接线的数量与主机上的第一USB接口的数量相等且一一对应,所述带有物理锁扣的连接线的一端与其对应的所述第一USB接口连接,所述带有物理锁扣的连接线的另一端与所述USB管理设备连接;The number of the connection lines with the physical lock buckle is equal to the number of the first USB interfaces on the host and corresponds one to one, one end of the connection line with the physical lock buckle is connected to the first USB interface corresponding to the first USB interface, and the other end of the connection line with the physical lock buckle is connected to the USB management device; 所述USB管理设备对外提供多个第二USB接口,所述第二USB接口用于供USB设备接入。The USB management device provides a plurality of second USB interfaces externally, and the second USB interfaces are used for accessing USB devices. 10.根据权利要求9所述的装置,其特征在于,所述USB管理设备包括USB插头、USB母座和USB解锁钥匙;10. The device according to claim 9, characterized in that the USB management device comprises a USB plug, a USB female socket and a USB unlocking key; 所述USB母座两侧对称开设有锁槽,所述锁槽内设置有与所述USB母座一体成型的弹片;The USB socket is symmetrically provided with locking grooves on both sides, and the locking grooves are provided with spring pieces integrally formed with the USB socket; 所述USB解锁钥匙前端两侧对称开设有凹槽,所述凹槽与弹片的位置相对称;The front end of the USB unlocking key is symmetrically provided with grooves on both sides, and the positions of the grooves and the spring pieces are symmetrical; 所述USB插头和所述装置均插入所述USB母座内,且所述USB解锁钥匙位于所述USB插头顶部;The USB plug and the device are both inserted into the USB socket, and the USB unlocking key is located on the top of the USB plug; 所述USB插头的顶部前端两侧一体成型连接有卡口,所述卡口与弹片的位置相对称。Both sides of the top front end of the USB plug are integrally formed with bayonet holes, and the bayonet holes are symmetrically positioned with the spring pieces.
CN202411943507.0A 2024-12-27 2024-12-27 A method and device for securely accessing a USB device Pending CN119378033A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202411943507.0A CN119378033A (en) 2024-12-27 2024-12-27 A method and device for securely accessing a USB device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202411943507.0A CN119378033A (en) 2024-12-27 2024-12-27 A method and device for securely accessing a USB device

Publications (1)

Publication Number Publication Date
CN119378033A true CN119378033A (en) 2025-01-28

Family

ID=94326945

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202411943507.0A Pending CN119378033A (en) 2024-12-27 2024-12-27 A method and device for securely accessing a USB device

Country Status (1)

Country Link
CN (1) CN119378033A (en)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102902635A (en) * 2012-09-29 2013-01-30 无锡华御信息技术有限公司 Safety U disk system for enterprises
CN204066101U (en) * 2014-07-22 2014-12-31 国家电网公司 A kind of USB interface of computer control device
CN111859453A (en) * 2020-07-28 2020-10-30 北京中科麒麟信息工程有限责任公司 File security protection method of external protective equipment and external protective equipment
CN112491800A (en) * 2020-10-28 2021-03-12 深圳市东方聚成科技有限公司 Real-time authentication method for encrypted USB flash disk
WO2024045909A1 (en) * 2022-08-30 2024-03-07 武汉攀升鼎承科技有限公司 Storage device with built-in independent data
CN117951761A (en) * 2023-12-05 2024-04-30 国网江西省电力有限公司电力科学研究院 USB flash disk safe access method based on storage data block management and control

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102902635A (en) * 2012-09-29 2013-01-30 无锡华御信息技术有限公司 Safety U disk system for enterprises
CN204066101U (en) * 2014-07-22 2014-12-31 国家电网公司 A kind of USB interface of computer control device
CN111859453A (en) * 2020-07-28 2020-10-30 北京中科麒麟信息工程有限责任公司 File security protection method of external protective equipment and external protective equipment
CN112491800A (en) * 2020-10-28 2021-03-12 深圳市东方聚成科技有限公司 Real-time authentication method for encrypted USB flash disk
WO2024045909A1 (en) * 2022-08-30 2024-03-07 武汉攀升鼎承科技有限公司 Storage device with built-in independent data
CN117951761A (en) * 2023-12-05 2024-04-30 国网江西省电力有限公司电力科学研究院 USB flash disk safe access method based on storage data block management and control

Similar Documents

Publication Publication Date Title
RU2321055C2 (en) Device for protecting information from unsanctioned access for computers of informational and computing systems
US8869308B2 (en) Computer motherboard having peripheral security functions
US8281388B1 (en) Hardware secured portable storage
CN103065102B (en) Data encryption mobile storage management method based on virtual disk
CN102063583B (en) Data exchange method for mobile storage medium and device thereof
CN107679421A (en) A kind of movable memory apparatus monitoring means of defence and system
CN109684866B (en) Safe USB flash disk system supporting multi-user data protection
CN205681457U (en) A kind of data safety network gateway equipment with inherently safe defense function
CN109190389A (en) A kind of solid state hard disk data guard method based on USB flash disk authentication
CN112434270B (en) Method and system for enhancing data security of computer system
CN111539042B (en) Safe operation method based on trusted storage of core data files
CN104361298B (en) The method and apparatus of Information Security
RU2263950C2 (en) Device for preventing unsanctioned access to information, stored on personal computer
CN1165002C (en) Data encryption/decryption device for portable box of computer
CN104794071A (en) Method and system for unfreezing and adding coded lock on computer SATA hard disk based on USB flash disk
EP4006758B1 (en) Data storage apparatus with variable computer file system
CN119378033A (en) A method and device for securely accessing a USB device
Hars Discryption: Internal hard-disk encryption for secure storage
US6516999B1 (en) Method of protecting data stored in the memory device of a computer system and equipment to carry out this method
TWI835134B (en) Card reader and controller thereof, and method for permission management
CN106874802A (en) A kind of industrial control equipment virus protection system based on drive control
CN114329376A (en) Computer starting-up identity authentication system
RU119910U1 (en) BUILT-IN TSM SECURITY MODULE
KR100847659B1 (en) Method and device for data leakage prevention using ID verification method of key lock board and security USB memory
JP2007323644A (en) Data protection system at entry point for data control management

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination