Safety protection USB hub for storage device and authorization method

Abstract

The invention discloses a safety protection USB hub for a storage device and an authorization method, and relates to the field of data transmission safety, and the USB hub comprises a USB hub main body which is used for connecting a plurality of USB storage devices; the safety protection system comprises a main control module used for carrying out authorization authentication on management software to obtain a white list and receiving a configuration instruction sent by the management software to carry out permission configuration on accessed USB storage equipment, and a storage module used for storing equipment descriptor information and permission configuration information of the USB storage equipment; the operation module is used for performing hash operation and signature on the white list; and the management software is used for carrying out white list management on the USB concentrator, carrying out permission setting on the USB storage equipment and generating a configuration instruction. According to the invention, one-to-one or one-to-many authority authentication between the USB hub and the USB storage device can be realized, the access security of the USB storage device is improved, and the information security of the host is guaranteed.

Description

Technical Field

[0001] The present application relates to the field of security authentication technology, and more specifically, to a security protection USB hub for storage devices and an authorization method. Background Art

[0002] In layman's terms, a USB hub is a device used to expand the number of USB ports and manage them intensively within a certain distance. USB hubs can expand more USB ports. USB hubs are divided into wired hubs and wireless hubs. A wired USB hub is a hub with a USB interface that can be directly plugged into a computer's USB port, while a wireless USB hub is connected to a terminal device via a USB data cable.

[0003] At present, based on the hub products, the most used ones in the market are still the wired USB hubs, which are plugged into the USB port of the client through the USB interface to expand the USB port. The hub itself does not have management functions, and any USB device can be mounted on the computer through the USB interface. Solutions of existing technologies: The first is protection at the operating system level, such as installing anti-virus software, firewall and other security software on the computer. The administrator can configure the operating system or security software to only allow devices with specific VID and PID to connect, and other devices not in the whitelist will be denied access. The operating system can also force the driver of the USB device to undergo signature verification to ensure that only trusted devices are allowed to connect. If an unsigned or mismatched device is found, the operating system can prevent the loading of the device. The second is protection at the firmware level. Data storage devices use write-protected areas or hardware security modules (HSMs) to prevent tampering with the VID and PID in the firmware. Some storage devices will also encrypt the firmware.

[0004] However, these existing technologies have the following problems: a. Security issues: First, the access rights of security software are generally only protected by simple passwords, which are easy to be cracked. After cracking, the whitelist can be tampered with at will; although there are some anti-tampering measures for the firmware of data storage devices, it is easy to be read and copied.

[0005] b. Compatibility issues: Security software relies on the computer operating system for permission control. Different operating systems may have different security policies and permission control mechanisms, which will cause system compatibility issues. Different storage device manufacturers have different ways of protecting firmware, and the computer cannot verify or decrypt it.

[0006] In addition, since the interface of the USB hub is a USB male head, the USB hub can be used unlimited times, and the same USB port on the computer can be connected to multiple USB hubs (if supported), so the devices connected to the USB hub still have the following problems:

[0007] 1) Lack of management, easy access to illegal or unsafe USB storage devices, causing the risk of computer attacks or data theft, such as malicious USB flash drives, counterfeit USB flash drives, phishing USB flash drives, USB flash drives with viruses or Trojan programs, removable disks, etc.;

[0008] 2) Lack of permission restrictions, illegal access to computers through USB hub devices, bypassing security monitoring, and unauthorized access to data. For example, important data can be copied to the USB hub storage device, resulting in serious consequences of security data leakage.

[0009] 3) Currently, USB hubs are protected through the device whitelist of the device manufacturer. The whitelist management uses the blacklist technology managed on the computer, which can filter some viruses and malicious attacks to a certain extent, but the security prevention capability is still weak.

[0010] 4) The management software of the USB hub is complex to use, and each hub needs the user to log in, configure, maintain and manage it separately. Summary of the invention

[0011] In response to at least one defect or improvement need in the prior art, the present invention provides a security protection USB hub and authorization method for storage devices, wherein the USB hub performs encrypted communication with a host computer to achieve the security of the hub through encrypted communication.

[0012] To achieve the above-mentioned object, according to a first aspect of the present invention, there is provided a security protection USB hub for storage devices, comprising: a USB hub body and a security protection system, wherein the USB hub body is used to connect multiple USB storage devices; the security protection system comprises: a main control module, which is used to perform authorization authentication on management software, and receive configuration instructions sent by the management software to perform permission configuration on the connected USB storage devices to obtain a whitelist;

[0013] A storage module, used to store device descriptor information and permission configuration information of the USB storage device; wherein the permission configuration information includes whitelist information and a CRC value calculated when each storage device is authorized;

[0014] The calculation module is used to perform hash calculation and signature on the whitelist;

[0015] The management software is applied to a host computer connected to the USB hub body, and is used to perform whitelist management on the USB hub, set permissions on the USB storage device, and generate configuration instructions.

[0016] Optionally, it also includes user software, which is applied to a host computer connected to the USB hub body and is used to manage storage devices connected to the USB hub; the user software is connected to the USB hub through a USB bus, and the user software is licensed software after successful authorization authentication.

[0017] Optionally, the operation module includes:

[0018] A hash operation unit, used for performing hash operations on the whitelist hash value, the device descriptor information and the identity information;

[0019] The signature unit is used to sign the hash value, use the asymmetric encryption and decryption private key of the asymmetric encryption and decryption certificate to sign the whitelist hash value and generate a signature value.

[0020] Optionally, the whitelist management includes:

[0021] Whitelist initialization:

[0022] The USB hub is connected to the USB storage device, and the main control module is connected to the first USB storage device to establish a connection with the first USB storage device;

[0023] When the signature verification of the first USB storage device succeeds, the main control module enumerates the descriptors of all endpoints of the first USB storage device for verification to obtain a first CRC value, and adds the first USB storage device to the whitelist based on the first CRC value;

[0024] The operation module calculates the hash value based on the whitelist, uses the signature verification private key to sign the whitelist hash value to obtain a signature value, and stores the whitelist hash value and the signature value in the storage module;

[0025] Optionally, the whitelist management further includes:

[0026] Whitelist additions, deletions and modifications:

[0027] The USB hub is connected to the second USB storage device, the main control module is connected to the second USB storage device, and a connection with the second USB storage device is established; when the signature verification of the second USB storage device is successful, the descriptors of all endpoints of the second USB storage device are enumerated for verification to obtain a second CRC value, and the whitelist is added, deleted or modified based on the second CRC value.

[0028] Optionally, the whitelist management further includes:

[0029] Whitelist export: The USB hub is connected to a third USB storage device, and the storage module is connected to the third USB storage device to establish a connection with the third USB storage device; when the signature verification of the third USB storage device is successful, the storage module exports the whitelist;

[0030] Whitelist import: the USB hub is connected to the fourth USB storage device, and the computing module is connected to the fourth USB storage device; when the signature verification of the fourth USB storage device is successful, the computing module calculates the whitelist hash value based on the whitelist hash value, calculates the signature value based on the whitelist hash value, and writes the signature value and hash value of the fourth USB storage device to the storage module.

[0031] Optionally, before the management software initializes the whitelist, it also includes:

[0032] The whitelist signature value of the first USB storage device is verified. If the signature value is correct, whitelist initialization is performed; if the verification fails, whitelist initialization is not performed.

[0033] According to a second aspect of the present invention, there is also provided a method for authorizing a security protection USB hub for a storage device, which is used for authorizing any of the above-mentioned USB hubs, and the authorization method comprises:

[0034] The USB hub sends the signature verification certificate and asymmetric encryption and decryption certificate to the management software, and receives the hash value ciphertext fed back by the management software;

[0035] The USB hub decrypts the hash value ciphertext and verifies the certificate based on the signature Regarding the said The hash value is signed to obtain the signature value of the hash value and send it to the management software;

[0036] The management software verifies the signature value based on the signature verification public key in the signature verification certificate and compares the hash value, generates a first verification result and sends it to the USB hub; the first verification result is used to confirm the identity of the USB storage device connected to the USB hub;

[0037] The USB hub reads the corresponding whitelist signature value based on the first signature verification result, and sends it to the management software;

[0038] The management software verifies the whitelist signature value based on the signature verification public key in the signature verification certificate, generates a second verification result and sends it to the USB hub, and the second verification result is used to determine the authorization result of the USB hub.

[0039] Optionally, before the USB hub sends the signature verification certificate and the asymmetric encryption and decryption certificate to the management software and receives the hash value ciphertext fed back by the management software, the following steps are included:

[0040] The USB hub generates a public-private key pair and applies for a digital certificate from a certificate authority to obtain a signature verification certificate and an asymmetric encryption and decryption certificate.

[0041] Optionally, the step of obtaining the hash value ciphertext includes:

[0042] The management software receives the signature verification certificate and the asymmetric encryption and decryption certificate;

[0043] The management software generates a random number and calculates a hash value of the random number;

[0044] The management software encrypts the hash value based on the asymmetric encryption and decryption public key in the asymmetric encryption and decryption certificate to obtain a ciphertext of the hash value.

[0045] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects compared with the prior art:

[0046] (1) The present invention provides a security protection USB hub for storage devices. By implementing whitelist management in the management software, the main control module restricts the permissions of the connected USB storage devices according to the configuration instructions sent by the management software, thereby ensuring the security of the data in the USB storage device. The USB hub and the management software ensure the data security between the management software and the USB hub through asymmetric encryption and decryption means and a secure authentication communication protocol. At the same time, the USB hub verifies the identity information of the descriptor through the CRC value. The computer management software must authenticate the USB hub before use, and the whitelist is signed to prevent the whitelist from being tampered with. All descriptors of each USB storage device are CRCed and added to the whitelist to prevent the device firmware information from being tampered with, thereby improving the authentication security. By maintaining the whitelist in the USB hub, it is not dependent on the computer operating system for permission control, thus avoiding compatibility issues. In addition, this solution can connect more USB devices through an extended interface, thereby improving the scalability and flexibility of the system.

[0047] (2) Computer users do not need to set permissions for each USB device. Administrators only need to configure the USB hub through the management software, and can implement batch management of multiple USB hubs through import and export, and then hand it over to the user of the user software for use, which improves the usability and maintainability of the system. In addition, whitelist signature algorithm and hash value are used for whitelist management. Through the security authentication protocol, the whitelist is encrypted and verified to ensure the security of the whitelist. In addition, through whitelist management, unauthorized storage devices are intercepted, and the CRC value of the enumerated device is verified through identity recognition technology to ensure that the storage devices are trusted devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 A schematic diagram of the structure of an optional security protection USB hub for storage devices provided in an embodiment of the present application;

[0050] Figure 2 One of the schematic diagrams of an optional authorization method for a security protection USB hub for storage devices provided in an embodiment of the present application;

[0051] Figure 3 A second schematic diagram of an optional authorization method for a security protection USB hub for storage devices provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0053] The terms "first", "second", "third", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0054] According to one aspect of the embodiments of the present application, a security protection USB hub for storage devices is provided. Figure 1 A secure USB hub for storage devices provided in an embodiment of the present application is described.

[0055] Figure 1 It is a schematic structural diagram of an optional security protection USB hub for storage devices provided in an embodiment of the present application. The security protection USB hub for storage devices includes a USB hub body for connecting multiple USB storage devices.

[0056] The USB hub body includes a USB hub, a USB interface, a USB power supply, a reset button, etc., to realize the hardware function of the USB hub security protection system. The USB hub body can be made of ABS plastic, a USB cable is used to connect to a computer and power supply, and multiple USB interfaces are set for connecting different USB devices.

[0057] And a security protection system arranged in a USB hub, the security protection system comprises a main control module, which is used to authenticate the management software and receive the configuration instructions sent by the management software to configure the permissions of the connected USB storage device to obtain a white list. A storage module, which is used to store the device descriptor information and permission configuration information of the USB storage device. A calculation module, which is used to perform hash calculation and signature on the white list.

[0058] And management software, applied to a host computer connected to the USB hub body, is used to perform whitelist management on the USB hub and to set permissions on the USB storage device and generate configuration instructions.

[0059] In this embodiment, the control module is used to centrally manage the USB hub, including initiating an identity authentication process to the management software or user, accepting software instructions and responses, reading USB storage device descriptors, and controlling the permissions of USB storage devices connected to the host. Operation module: The user is called by the main control module to use multiple operation modes, including hash value operation, CRC operation, signature verification, and asymmetric encryption and decryption operations. Storage module: used to store whitelists and signature values, which can be read and written by the main control module.

[0060] The management software is installed on the administrator's computer and is mainly used to authenticate the USB hub and configure the USB hub, including initializing, adding, deleting, modifying, importing and exporting the whitelist.

[0061] The USB hub communicates with the PC through the USB interface, and the USB storage device is identified and authorized by the USB hub's security protection system to achieve security protection.

[0062] In a preferred embodiment, the security protection USB hub for storage devices also includes user software, which is applied to a host computer connected to the USB hub body and is used to manage the storage devices connected to the USB hub; the user software is connected to the USB hub through a USB bus, and the user software is licensed software after successful authorization authentication.

[0063] Specifically, a user can use a USB hub by installing user software on the user's computer, connecting the USB hub, authenticating the USB hub's identity, and then using the USB hub to connect a storage device, after which the storage device's permissions are controlled by the USB hub.

[0064] In a preferred embodiment, the computing module includes:

[0065] A hash operation unit, used for performing hash operations on the whitelist hash value, the device descriptor information and the identity information;

[0066] The signature unit is used to sign the hash value, use the asymmetric encryption and decryption private key of the asymmetric encryption and decryption certificate to sign the whitelist hash value and generate a signature value.

[0067] Figure 2 One of the schematic diagrams of an optional authorization method for a security protection USB hub for storage devices provided in an embodiment of the present application is as follows: Figure 2 As shown, an embodiment of the present invention provides an authorization method for a security protection USB hub for a storage device, and the authorization method includes:

[0068] S1. The USB hub sends the signature verification certificate and asymmetric encryption and decryption certificate to the management software, and receives the hash value ciphertext fed back by the management software.

[0069] The USB hub generates a pair of public and private keys, and applies for a digital certificate from a certificate authority to obtain a signature verification certificate and an asymmetric encryption and decryption certificate, in which the public key is used as the signature verification public key and the private key is used as the signature verification private key.

[0070] The steps for obtaining the hash value ciphertext include:

[0071] S11, the USB hub receives the signature verification certificate and the asymmetric encryption and decryption certificate;

[0072] S12, the management software receives the signature verification certificate and the asymmetric encryption and decryption certificate;

[0073] S13, the management software generates a random number and calculates a hash value of the random number;

[0074] S14. Encrypt the hash value based on the public key in the asymmetric encryption and decryption certificate to obtain a hash value ciphertext.

[0075] S2. The USB hub decrypts the hash value ciphertext and signs the hash value based on the signature verification certificate, obtains the signature value of the hash value and sends it to the management software.

[0076] S3. The management software verifies the signature value based on the signature verification public key in the signature verification certificate and compares the hash value, generates a first verification result and sends it to the USB hub, where the first verification result is used to confirm the identity of the USB storage device connected to the USB hub.

[0077] S4. The USB hub reads the corresponding whitelist signature value based on the first signature verification result and sends it to the management software.

[0078] S5. The management software verifies the whitelist signature value based on the signature verification public key in the signature verification certificate, generates a second verification result and sends it to the USB hub, where the second verification result is used to determine the authorization result of the USB hub.

[0079] Among them, before S1, it also includes S0, the main control module initializes the connected USB hub, calculates the verification code of the device descriptor and compares it with the verification code stored in the storage module. If the verification codes are the same, the USB hub is initialized, and if the verification codes are different, failure is reported.

[0080] S1 specifically includes: the USB hub is connected to the host computer through the USB bus, and sends a signature verification certificate and an asymmetric encryption and decryption certificate to the host computer. The signature verification certificate is the signature verification public key. If the host computer does not verify, the whitelist initialization is terminated.

[0081] S2 specifically includes: the host computer receives the signature verification certificate and the asymmetric encryption and decryption certificate, and extracts the signature verification public key in the signature verification certificate; the USB hub reads the CRC code of the stored device descriptor from the storage module, and calculates the check code of the device descriptor, and then sends the calculated check code of the device descriptor and the read value of the check code of the stored device descriptor to the host computer, which compares them. If the values ​​are the same, the hash value of the random number is calculated; if the values ​​are different, the report fails.

[0082] S3 specifically includes: the host computer sends the calculated hash value ciphertext and signature verification message to the USB hub, and the USB hub performs a hash operation on the random number based on the signature verification message; the hash value is compared with the value in the storage module. If they are inconsistent, the report fails. If they are consistent, the hash value is signed and verified using the private key in the asymmetric encryption and decryption certificate, and then sent to the host computer. At the same time, the hash value authentication is reported successfully.

[0083] S4 specifically includes: the USB hub sends the whitelist and the signature message of the whitelist to the host computer, and reports that the whitelist authentication is successful.

[0084] S5 specifically includes: the upper computer extracts the whitelist signature value information according to the signature message of the whitelist, and obtains the signature verification public key from the signature verification certificate for verification; if the value is correct, it will display that the whitelist authorization is successful, if the value is incorrect, the whitelist authorization fails.

[0085] Preferably, the whitelist management process includes:

[0086] The management software implements whitelist management, can read the whitelist, calculate the whitelist hash value; perform HASH operation on the newly added device whitelist, calculate the CRC value, write the whitelist HASH value into the storage module, and calculate the signature value to implement whitelist initialization; add, delete, modify, import and export the whitelist.

[0087] In a preferred embodiment, Figure 3 The second schematic diagram of the authorization method of an optional USB hub for storage device security protection provided in the embodiment of the present application is that when the USB hub is connected to the administrator computer or the user computer, an identity authentication application must first be sent to the management software or the user software. Only after the authentication is successful can the USB hub be configured or used. The specific steps of identity authentication are as follows: Figure 3 shown.

[0088] ①The USB hub generates a signature verification public-private key pair and an asymmetric encryption and decryption public-private key pair, and applies for a digital certificate from a trusted certificate authority (CA). The CA will verify the identity of the applicant, and then use the CA's private key to sign the applicant's signature verification public key and asymmetric encryption and decryption public key to generate a signature verification certificate and an asymmetric encryption and decryption certificate. The certificate contains the applicant's public key, identity information, certificate validity period, issuer information, etc.

[0089] ② The computer is connected to the USB hub, and the USB hub sends an identity authentication request to the management software or user software, along with its own two digital certificates. At this point, the identity information of the USB hub is passed to the server through the certificate.

[0090] The management software verifies the validity of the USB hub certificate using a trusted CA list, including checking the certificate's signature, certificate chain, validity period, etc.

[0091] ③ The management software or user software generates a random number, calculates the hash value of the random number, encrypts the hash value with the asymmetric encryption and decryption public key in the asymmetric encryption and decryption certificate of the USB hub, and sends the ciphertext to the USB hub.

[0092] ④The USB hub asymmetric encryption and decryption private key decrypts the hash value, signs the hash value with the signature verification private key, and sends the signature value to the management software or user software.

[0093] ⑤ The management software or user software uses the signature verification public key in the signature verification certificate to verify the signature. After the verification is successful, it is compared with the hash value of the random number. If the comparison is successful, the identity of the USB hub can be confirmed.

[0094] The management software or user software reads the whitelist signature value and verifies the signature. After the verification is successful, the content stored in the USB hub can be trusted.

[0095] Whitelist management includes whitelist initialization:

[0096] The USB hub is connected to the USB storage device, and the main control module is connected to the first USB storage device to establish a connection with the first USB storage device. When the signature verification of the first USB storage device is successful, the main control module enumerates the descriptors of all endpoints of the first USB storage device for verification, obtains a first CRC value, and adds the first USB storage device to the whitelist based on the first CRC value. The operation module calculates the whitelist hash value based on the whitelist, uses the signature verification private key to sign the whitelist hash value, and stores the whitelist hash value and the signature value in the storage module.

[0097] Furthermore, it also includes adding, deleting and modifying the whitelist:

[0098] The USB hub is connected to the second USB storage device, the main control module is connected to the second USB storage device, and a connection with the second USB storage device is established; when the signature verification of the second USB storage device is successful, the descriptors of all endpoints of the second USB storage device are enumerated for verification to obtain a second CRC value, and the whitelist is added, deleted or modified based on the second CRC value.

[0099] Furthermore, it also includes whitelist export:

[0100] The USB hub is connected to the third USB storage device, and the storage module is connected to the third USB storage device to establish a connection with the third USB storage device; when the signature verification of the third USB storage device is successful, the storage module exports the whitelist.

[0101] Furthermore, it also includes whitelist import:

[0102] The USB hub is connected to the fourth USB storage device, and the computing module is connected to the fourth USB storage device; when the signature verification of the fourth USB storage device is successful, the computing module calculates the whitelist hash value, calculates the signature value, and writes the signature value and hash value of the fourth USB storage device to the storage module.

[0103] In an optional embodiment, the whitelist management includes: ① whitelist initialization: the computer is connected to a USB hub, the USB hub is connected to a USB storage device,

[0104] The device will first send its device descriptors through the USB bus. These descriptors include the device's vendor ID (VID), product ID (PID), device category, subcategory, protocol version, etc.

[0105] On the management software interface, an authorization instruction is sent to the USB hub for the USB storage device. The USB hub calculates CRC for all descriptors of the USB storage device. The USB hub adds CRC, VID and PID to the whitelist, calculates a hash value for the whitelist, calculates a signature value for the hash value using a signature verification private key, and stores it in the USB hub.

[0106] ② Addition, deletion and modification of whitelist: The USB hub is connected to another USB storage device, and the USB hub and management software are operated on the interface to send the USB storage device an instruction to add authorization. The USB hub and management software verify the signature value of the whitelist. After the verification is successful, the USB hub calculates CRC for all descriptors of the USB storage device, and the USB hub adds CRC, VID and PID to the whitelist, calculates the hash value of the whitelist again, and calculates the signature value of the hash value with the signature verification private key, and stores it in the USB hub. The deletion and modification of USB storage devices are the same.

[0107] ③ Whitelist export and import: The management software verifies the signature value of a USB hub whitelist. After the verification is successful, the whitelist export command is sent, and the USB hub exports the whitelist.

[0108] The management software imports the whitelist into another USB hub, which calculates a hash value for the whitelist, calculates a signature value for the hash value using its own signature verification private key, and stores the signature value.

[0109] Before the management software performs whitelist initialization, it also includes: verifying the signature verification public key in the signature verification certificate, if the verification is successful, executing whitelist initialization, if the verification fails, not executing whitelist initialization.

[0110] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0111] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0112] In the several embodiments provided in the present application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of the units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0113] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0114] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0115] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned memory includes: U disk, read-only memory (ROM), random access memory (RAM), mobile hard disk, disk or optical disk and other media that can store program code.

[0116] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable memory, which can include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0117] The above is only an exemplary embodiment of the present disclosure, and the scope of the present disclosure cannot be limited thereto. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the specification and practicing the disclosure here, those skilled in the art will easily think of the implementation scheme of the present disclosure. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the technical field not recorded in the present disclosure. The description and examples are regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

[0118] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0119] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A security protection USB hub for storage devices, characterized in that: include: A USB hub body and a safety protection system, wherein the USB hub body is used to connect multiple USB storage devices; The security protection system includes: a main control module, which is used to perform authorization authentication on the management software, and receive the configuration instructions sent by the management software to perform permission configuration on the connected USB storage device to obtain a whitelist; A storage module, used to store device descriptor information and permission configuration information of the USB storage device; wherein the permission configuration information includes whitelist information and a CRC value calculated when each storage device is authorized; The calculation module is used to perform hash calculation and signature on the whitelist; The management software is applied to a host computer connected to the USB hub body, and is used to perform whitelist management on the USB hub, set permissions on the USB storage device, and generate configuration instructions.

2. The secure USB hub for storage devices according to claim 1, characterized in that: It also includes user software, which is applied to a host computer connected to the USB hub body and is used to manage storage devices connected to the USB hub; the user software is connected to the USB hub through a USB bus, and the user software is licensed software after successful authorization authentication.

3. The secure USB hub for storage devices according to claim 1, characterized in that: The operation module comprises: A hash operation unit, used for performing hash operations on the whitelist hash value, the device descriptor information and the identity information; The signature unit is used to sign the hash value, use the asymmetric encryption and decryption private key of the asymmetric encryption and decryption certificate to sign the whitelist hash value and generate a signature value.

4. The secure USB hub for storage devices according to claim 1, wherein: The whitelist management includes: Whitelist initialization: The USB hub is connected to the USB storage device, and the main control module is connected to the first USB storage device to establish a connection with the first USB storage device; When the signature verification of the first USB storage device succeeds, the main control module enumerates the descriptors of all endpoints of the first USB storage device for verification to obtain a first CRC value, and adds the first USB storage device to the whitelist based on the first CRC value; The operation module calculates the hash value based on the whitelist, uses the signature verification private key to sign the whitelist hash value to obtain a signature value, and stores the whitelist hash value and the signature value in the storage module.

5. The secure USB hub for storage devices according to claim 4, characterized in that: The whitelist management also includes: Whitelist additions, deletions and modifications: The USB hub is connected to the second USB storage device, the main control module is connected to the second USB storage device, and a connection with the second USB storage device is established; when the signature verification of the second USB storage device is successful, the descriptors of all endpoints of the second USB storage device are enumerated for verification to obtain a second CRC value, and the whitelist is added, deleted or modified based on the second CRC value.

6. The secure USB hub for storage devices according to claim 4, characterized in that: The whitelist management also includes: Whitelist export: The USB hub is connected to a third USB storage device, and the storage module is connected to the third USB storage device to establish a connection with the third USB storage device; when the signature verification of the third USB storage device is successful, the storage module exports the whitelist; Whitelist import: the USB hub is connected to the fourth USB storage device, and the computing module is connected to the fourth USB storage device; when the signature verification of the fourth USB storage device is successful, the computing module calculates the whitelist hash value based on the whitelist hash value, calculates the signature value based on the whitelist hash value, and writes the signature value and hash value of the fourth USB storage device to the storage module.

7. The secure USB hub for storage devices according to claim 4, characterized in that: Before the management software initializes the whitelist, it also includes: The whitelist signature value of the first USB storage device is verified. If the signature value is correct, whitelist initialization is performed; if the verification fails, whitelist initialization is not performed.

8. A method for authorizing a secure USB hub for storage devices, characterized in that: For authorization of a USB hub according to any one of claims 1 to 7, the authorization method comprising: The USB hub sends the signature verification certificate and asymmetric encryption and decryption certificate to the management software, and receives the hash value ciphertext fed back by the management software; The USB hub decrypts the hash value ciphertext and signs the hash value based on the signature verification certificate, obtains the signature value of the hash value and sends it to the management software; The management software verifies the signature value based on the signature verification public key in the signature verification certificate and compares the hash value, generates a first verification result and sends it to the USB hub; the first verification result is used to confirm the identity of the USB storage device connected to the USB hub; The USB hub reads the corresponding whitelist signature value based on the first signature verification result, and sends it to the management software; The management software verifies the whitelist signature value based on the signature verification public key in the signature verification certificate, generates a second verification result and sends it to the USB hub, and the second verification result is used to determine the authorization result of the USB hub.

9. The authorization method for a secure USB hub for storage devices according to claim 8, characterized in that: The USB hub sends the signature verification certificate and the asymmetric encryption and decryption certificate to the management software, and receives the hash value ciphertext fed back by the management software, including: The USB hub generates a public-private key pair and applies for a digital certificate from a certificate authority to obtain a signature verification certificate and an asymmetric encryption and decryption certificate.

10. The authorization method for a secure USB hub for storage devices according to claim 8, characterized in that: The step of obtaining the hash value ciphertext includes: The management software receives the signature verification certificate and the asymmetric encryption and decryption certificate; The management software generates a random number and calculates a hash value of the random number; The management software encrypts the hash value based on the asymmetric encryption and decryption public key in the asymmetric encryption and decryption certificate to obtain a ciphertext of the hash value.

Images