Security identification method and device of mobile storage device and application

Abstract

The invention provides a security identification method and device of a mobile storage device and application, and relates to the technical field of computers, the method comprises the following steps: obtaining reserved sector information and a current device serial number of the mobile storage device; decrypting the reserved sector information to obtain decryption information including a hash value, a decryption equipment serial number and a security mark; determining a security identification result of the mobile storage device according to the current device serial number and the decryption information; wherein if the security identification result is that the mobile storage device is not secure, virus searching and killing are carried out on the mobile storage device. According to the security identification method for the mobile storage device provided by the scheme, the mobile storage device is subjected to virus searching and killing while security identification is performed on the mobile storage device, so that the security of the mobile storage device is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, in particular to the field of data security technology, and in particular to a method, device and application for secure identification of a mobile storage device. Background Art

[0002] With the continuous development of existing storage technologies, mobile storage devices have brought great convenience to people in data storage and exchange. For example, common USB flash drives have strong compatibility, large storage capacity, reliable performance, plug-and-play, and are easy to carry. However, it is precisely because of these characteristics that USB flash drives are prone to loss, virus infection, and information leakage, which in turn affects computer system security and data security. If viruses cannot be detected and killed in a timely and effective manner and mobile storage devices cannot be managed and controlled at the terminal, infected files can be easily opened on computers within the unit, which can easily spread the virus to the unit's intranet and affect the operation of computers within the unit. Therefore, a method, device, and application for secure identification of mobile storage devices are needed. Summary of the invention

[0003] In order to solve the above problems, the embodiments of the present invention provide a method, apparatus and application for securely identifying a mobile storage device. The method can perform secure identification on the mobile storage device and simultaneously detect and kill viruses on the mobile storage device, thereby improving the security of the mobile storage device.

[0004] In a first aspect, an embodiment of the present invention provides a method for securely identifying a mobile storage device, comprising:

[0005] Get the reserved sector information and current device serial number of the mobile storage device;

[0006] Decrypting the reserved sector information to obtain decrypted information including a hash value, a decryption device serial number, and a security mark;

[0007] The security identification result of the mobile storage device is determined according to the current device serial number and the decryption information; if the security identification result is unsafe, the mobile storage device is checked for viruses.

[0008] In a second aspect, an embodiment of the present invention further provides an application of a security identification method based on a mobile storage device, characterized in that it is applied to a terminal device and includes:

[0009] After detecting that a mobile storage device is inserted, obtaining reserved sector information and a current device serial number of the mobile storage device;

[0010] Decrypting the reserved sector information to obtain decrypted information including a hash value, a decryption device serial number, and a security mark;

[0011] The security identification result of the mobile storage device is determined according to the current device serial number and the decryption information; if the security identification result is unsafe, the use of the mobile storage device is prohibited; if the security identification result is safe, the use of the mobile storage device is allowed.

[0012] In a third aspect, an embodiment of the present invention further provides a security identification device for a mobile storage device, comprising:

[0013] An acquisition module is used to obtain the reserved sector information and current device serial number of the mobile storage device;

[0014] A decryption module, used to decrypt the reserved sector information to obtain decrypted information including a hash value, a decryption device serial number and a security mark;

[0015] The identification module is used to determine the security identification result of the mobile storage device according to the current device serial number and the decryption information; if the security identification result is unsafe, the mobile storage device is checked for viruses.

[0016] In a fourth aspect, an embodiment of the present invention further provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method for securely identifying a mobile storage device as described in any one of the above items is implemented.

[0017] In a fifth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute any of the above-mentioned methods for securely identifying a mobile storage device.

[0018] In a sixth aspect, an embodiment of the present invention further provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of the method described in any first aspect of this specification.

[0019] The embodiment of the present invention provides a method, device and application for secure identification of a mobile storage device. The method obtains the reserved sector information and the current device serial number of the mobile storage device, and then decrypts the reserved sector information to obtain decryption information including a hash value, a decrypted device serial number and a security mark, so as to obtain a secure identification result of the mobile storage device according to the current device serial number and the decryption information, and performs virus detection on the mobile storage device when the secure identification result is unsafe. In this way, before using the mobile storage device, the method can not only perform secure identification of the mobile storage device according to the hash value, the device serial number and the security mark, but also perform virus detection when the mobile storage device is unsafe, thereby ensuring the safe availability of the mobile storage device during use, avoiding the occurrence of security problems such as data leakage caused by directly using an unsafe mobile storage device, and thus improving the security of the mobile storage device. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 is a flow chart of a method for securely identifying a mobile storage device provided by an embodiment of the present invention;

[0022] Figure 2 is a hardware architecture diagram of a computing device provided by an embodiment of the present invention;

[0023] Figure 3 It is a structural diagram of a security identification device for a mobile storage device provided by an embodiment of the present invention;

[0024] Figure 4 The present invention is a flowchart of a method for securely identifying a mobile storage device provided by an embodiment of the present invention and applied to a terminal device. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0026] The following is the concept of the present invention: Figure 1 As shown, an embodiment of the present invention provides a method for securely identifying a mobile storage device, the method comprising:

[0027] Step 100, obtaining the reserved sector information and current device serial number of the mobile storage device;

[0028] Step 102, decrypt the reserved sector information to obtain decrypted information including a hash value, a decryption device serial number and a security mark;

[0029] Step 104, determining the security identification result of the mobile storage device according to the current device serial number and the decryption information; wherein, if the security identification result is unsafe, performing virus detection and elimination on the mobile storage device.

[0030] In an embodiment of the present invention, by obtaining the reserved sector information and the current device serial number of the mobile storage device, and then decrypting the reserved sector information, decryption information including a hash value, a decrypted device serial number and a security mark is obtained, so as to obtain a security identification result of the mobile storage device according to the current device serial number and the decryption information, and when the security identification result is unsafe, the mobile storage device is checked for viruses. In this way, before using the mobile storage device, the method of the present invention can not only perform security identification on the mobile storage device according to the hash value, the device serial number and the security mark, but also perform virus detection when the mobile storage device is unsafe, thereby ensuring the safe availability of the mobile storage device during use, avoiding the occurrence of security issues such as data leakage caused by directly using an unsafe mobile storage device, and thus improving the security of the mobile storage device. At the same time, the method supports various types of mobile storage devices and has stronger versatility.

[0031] It should be noted that mobile storage devices include explicitly storable external mobile devices and implicitly storable external mobile devices. Explicitly storable external mobile devices include but are not limited to USB flash drives, mobile hard drives and SD cards (Secure Digital Memory Cards). Implicitly storable external mobile devices can be secure USB flash drives.

[0032] Described below Figure 1 How the various steps are performed.

[0033] In step 100, for example, reserved sector information of the mobile storage device is obtained through IOCTL_DISK_GET_DRI VE_GEOMETRY of DeviceIoControl, and the current device serial number is obtained through IOCTL_STORAGE_GET_DEVICE_NUMBER of DeviceIoControl.

[0034] In step 102, the reserved sector information stores the hash value, device serial number and security mark of the mobile storage device when it was last used. It should be noted that the hash value is obtained by performing hash calculation on the files stored by the mobile storage device when the mobile storage device was last used. The security mark is obtained by calculating the disk information of the mobile storage device when the mobile storage device was last used. The disk information includes information such as geometry information of the physical disk, the physical disk, and the logical disk.

[0035] In step 104, the security identification result of the mobile storage device is determined according to the current device serial number and the decryption information, including:

[0036] Get the current file of the mobile storage device;

[0037] Perform hash calculation on the current file to obtain the current hash value;

[0038] Determine whether the current hash value is the same as the hash value in the decrypted information;

[0039] Determine whether the current device serial number is consistent with the decryption device serial number;

[0040] Determine whether there is a security mark in the partition of the mobile storage device;

[0041] If the judgment results are all yes, then the security identification result is determined to be safe;

[0042] If the judgment result is no, then the security identification result is determined to be unsafe.

[0043] In the present invention, when the current hash value is the same as the hash value in the decrypted information, the current device serial number is consistent with the decrypted device serial number, and it is determined that there is a security mark in the partition of the mobile storage device, the security identification result of the mobile storage device is determined to be safe. In this way, the hash value is used to determine whether the reserved sector is complete, and multiple verifications are used to ensure that the content of the mobile storage device has not been tampered with, thereby improving the security of the mobile storage device.

[0044] In a preferred embodiment, the decrypted information includes a security tag for each partition in the mobile storage device;

[0045] Step 104 determines the security identification result of the mobile storage device according to the current device serial number and the decryption information, including:

[0046] Get the current file of the mobile storage device;

[0047] Perform hash calculation on the current file to obtain the current hash value;

[0048] Determine whether the current hash value is the same as the hash value in the decrypted information;

[0049] Determine whether the current device serial number is consistent with the decryption device serial number;

[0050] Determine whether there is a security mark in the partition of the mobile storage device;

[0051] If the judgment results are all yes, the security identification result of the partition of the mobile storage device with the security mark is determined to be safe;

[0052] If the first judgment result is no or the second judgment result is no, determining that the security identification result of the mobile storage device is unsafe;

[0053] If the first judgment result is yes, the second judgment result is yes, and the third judgment result is no, the security identification result of the partition of the mobile storage device without the security mark is determined to be unsafe.

[0054] In the present invention, in order to meet the different uses of multiple partitions in a mobile storage device, only one partition or multiple partitions can be marked, so that the partitions with a security identification result of being safe can be used freely, and the partitions with a security identification result of being unsafe can be prohibited from being used. In this way, when it is judged that the current hash value is different from the hash value in the decryption information, the judgment is directly ended, and the mobile storage device is considered to be unsafe. When the first judgment result is yes, and the current device serial number is inconsistent with the decryption device serial number, the judgment is directly ended, and the mobile storage device is considered to be unsafe. When the first judgment result is yes, the second judgment result is yes only, and the third judgment result is no, the partition is determined to be unsafe and the partition is prohibited from being used, but the partitions that are safe can still be used. Therefore, the present invention improves the utilization rate of the mobile storage device by performing security identification through partitions, while ensuring the safety during use.

[0055] In a preferred embodiment, after determining the security identification result of the partition of the mobile storage device with the security mark as safe, the method further includes:

[0056] Get the current disk information of the mobile storage device;

[0057] According to the current disk information corresponding to the partition with the security mark, the real-time security mark of the partition is obtained;

[0058] For each partition with a security tag, execute:

[0059] Determining whether the real-time security mark of the partition is the same as the security mark of the partition in the decrypted information;

[0060] If the judgment result is yes, the partition is determined to be a safe partition; wherein the status of the safe partition is usable.

[0061] In the present invention, in order to ensure the validity of the security mark, the real-time security mark calculated from the current disk information and the security mark in the decrypted information are further compared. When the two are the same, it can be determined that the security mark of the partition is valid, and the state of the security partition can be set to be usable, further ensuring the security and reliability of the partition. If the real-time security mark of the partition is different from the security mark of the partition in the decrypted information, the partition is checked for viruses.

[0062] After the mobile storage device is checked for viruses in step 104, the method further includes:

[0063] Determine whether the updated disk information of the mobile storage device after virus killing is performed is the same as the disk information of the mobile storage device before virus killing is performed;

[0064] If the judgment result is yes, an updated security mark is obtained according to the disk information, and the updated security mark is stored in a reserved sector.

[0065] Specifically, after step 104, if the security identification result is safe or the virus detection is completed, it also includes encrypting the current device serial number, security mark, hash value and other information of the mobile storage device and writing them into the device reserved sector, and displaying that the mobile storage device is safe.

[0066] In the present invention, when determining whether the real-time security mark of the partition is the same as the security mark of the partition in the decrypted information to confirm the validity of the security mark, the disk information of the mobile storage device before virus detection is also cached, so that after the virus detection is completed, the disk information before and after the virus detection can be compared to see if there is any change. If there is no change, the disk information in the cache is directly used to update the security mark, and the reserved sector information is updated at the same time.

[0067] In a preferred embodiment, after performing virus detection on the mobile storage device in step 104 and determining the security identification result of the partition of the mobile storage device with the security mark as safe, the following is further included:

[0068] Get the total number of security mark identifications performed on mobile storage devices;

[0069] For each partition whose security identification result is safe, execute the following:

[0070] Count the total number of virus checks performed on the partition, as well as the time and result of each virus check. The virus check result includes virus type, virus quantity and check time.

[0071] Determine the number of overtime killing times whose killing duration is greater than the preset killing duration in the total number of killing times;

[0072] Determine the risk level of different virus types from a preset risk level table; wherein the preset risk level table stores the risk levels of various virus types;

[0073] Determine the risk score of the partition based on the total number of times, the total number of times of virus detection and killing, the number of timeout virus detection and killing, the virus detection and killing result of the partition in the total number of times of virus detection and killing, and the risk level;

[0074] According to the risk score of each partition whose security identification result is safe, the use priority order of the partition whose security identification result is safe is determined.

[0075] In a preferred embodiment, the risk score is determined by the following formula:

[0076]

[0077] Among them, M is used to represent the risk score of the partition; N z Used to represent the total number of times; N c Used to represent the total number of kills; N c1 It is used to represent the number of timeout detection and killing times; n represents the number of virus types infected by the partition in the total number of detection and killing times; c i Used to characterize the risk level of the i-th virus type; m i Used to characterize the number of the i-th virus type; α1 and α2 are weight coefficients respectively.

[0078] It should be noted that the higher the risk level, the more hidden the virus type is in terms of transmission, the more destructive it is, and the more likely it is to be transmitted. i ≥1. Specifically, the risk level can be set by the administrator of the computer equipment according to the propagation mode and destructive power of the virus type. α1+α2=1. The higher the risk score of the partition, the greater the risk of virus infection, and the lower the priority order. The virus detection results can be obtained through the antivirus report or log.

[0079] In the present invention, since different types of viruses have different destructive power on mobile storage devices, the risk level of the virus type is used as one of the risk factors. Moreover, the more times the mobile storage device is checked for viruses during the security mark identification process, the higher the risk of virus infection; at the same time, if the checking time is too long, the security risk will be further increased. Therefore, the total number of times, the total number of times of checking and killing, the number of times of timeout checking and killing, the virus checking and killing result of the partition in the total number of times of checking and killing, and the risk level can accurately and scientifically characterize the risk score of the partition.

[0080] In an embodiment of the present invention, the risk scores of the security partitions are sorted from low to high to obtain a usage priority order for the partitions whose security identification results are safe. The partitions that are sorted first are used first, which can further improve the security of the mobile storage device during use. At the same time, users can flexibly perform different operations in different security partitions according to usage requirements, further improving the user experience.

[0081] In a preferred embodiment, the method further comprises:

[0082] The virus detection database is updated in real time, and the mobile storage device is checked for viruses based on the updated virus detection database.

[0083] In the present invention, by updating the virus detection library in real time, the detection accuracy of virus detection and killing on the mobile storage device is improved, the effectiveness of virus detection and killing is improved, and it is ensured that the mobile storage device will not carry viruses to infect other terminals.

[0084] like Figure 2 , Figure 3 As shown, an embodiment of the present invention provides a secure identification device for a mobile storage device. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 2 As shown, it is a hardware architecture diagram of a computing device where a security identification device of a mobile storage device provided by an embodiment of the present invention is located, except Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown in the figure, the computing device in which the device is located in the embodiment may also generally include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a device in a logical sense, the CPU of the computing device in which it is located reads the corresponding computer program in the non-volatile memory into the memory and runs it. This embodiment provides a security identification device for a mobile storage device, including:

[0085] In some specific implementations, the acquisition module 300 may be used to execute the above step 100 , the decryption module 302 may be used to execute the above step 102 , and the identification module 304 may be used to execute the above step 104 .

[0086] In some specific implementations, the identification module 304 is further configured to perform the following operations:

[0087] Get the current file of the mobile storage device;

[0088] Perform hash calculation on the current file to obtain the current hash value;

[0089] Determine whether the current hash value is the same as the hash value in the decrypted information;

[0090] Determine whether the current device serial number is consistent with the decryption device serial number;

[0091] Determine whether there is a security mark in the partition of the mobile storage device;

[0092] If the judgment results are all yes, then the security identification result is determined to be safe;

[0093] If the judgment result is no, then the security identification result is determined to be unsafe.

[0094] In some specific implementations, the decrypted information includes a security tag for each partition in the mobile storage device, and the identification module 304 is further configured to perform the following operations:

[0095] Get the current file of the mobile storage device;

[0096] Perform hash calculation on the current file to obtain the current hash value;

[0097] Determine whether the current hash value is the same as the hash value in the decrypted information;

[0098] Determine whether the current device serial number is consistent with the decryption device serial number;

[0099] Determine whether there is a security mark in the partition of the mobile storage device;

[0100] If the judgment results are all yes, the security identification result of the partition of the mobile storage device with the security mark is determined to be safe;

[0101] If the first judgment result is no or the second judgment result is no, determining that the security identification result of the mobile storage device is unsafe;

[0102] If the first judgment result is yes, the second judgment result is yes, and the third judgment result is no, the security identification result of the partition of the mobile storage device without the security mark is determined to be unsafe.

[0103] In some specific implementations, after determining that the security identification result of the partition of the mobile storage device with the security mark is safe, the identification module 304 is further configured to perform the following operations:

[0104] Get the current disk information of the mobile storage device;

[0105] According to the current disk information corresponding to the partition with the security mark, the real-time security mark of the partition is obtained;

[0106] For each partition with a security tag, execute:

[0107] Determining whether the real-time security mark of the partition is the same as the security mark of the partition in the decrypted information;

[0108] If the judgment result is yes, the partition is determined to be a safe partition; wherein the status of the safe partition is usable.

[0109] In some specific implementations, after the mobile storage device is virus-checked, the identification module 304 is further configured to perform the following operations:

[0110] Determine whether the updated disk information of the mobile storage device after virus killing is performed is the same as the disk information of the mobile storage device before virus killing is performed;

[0111] If the judgment result is yes, an updated security mark is obtained according to the disk information, and the updated security mark is stored in a reserved sector.

[0112] In some specific implementations, after determining that the security identification result of the partition of the mobile storage device with the security mark is safe, the identification module 304 is further configured to perform the following operations:

[0113] Get the total number of security mark identifications performed on mobile storage devices;

[0114] For each partition whose security identification result is safe, execute the following:

[0115] Count the total number of virus checks performed on the partition, as well as the time and result of each virus check. The virus check result includes virus type, virus quantity and check time.

[0116] Determine the number of overtime killing times whose killing duration is greater than the preset killing duration in the total number of killing times;

[0117] Determine the risk level of different virus types from a preset risk level table; wherein the preset risk level table stores the risk levels of various virus types;

[0118] The risk score of the partition is determined based on the total number of times, the total number of detections and killings, the timeout number of detections and killings, the virus detection and killing results of the partition in the total number of detections and killings, and the risk level. The risk score is determined by the following formula:

[0119]

[0120] Among them, M is used to represent the risk score of the partition; N z Used to represent the total number of times; N c Used to represent the total number of kills; N c1 It is used to represent the number of timeout detection and killing times; n represents the number of virus types infected by the partition in the total number of detection and killing times; c iUsed to characterize the risk level of the i-th virus type; m i Used to characterize the number of the i-th virus type; α1 and α2 are weight coefficients respectively;

[0121] The priority order of use of the partitions identified as safe according to the security identification results is determined according to the risk scores of the partitions identified as safe according to the security identification results.

[0122] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on a security identification device for a mobile storage device. In other embodiments of the present invention, a security identification device for a mobile storage device may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0123] The information interaction, execution process and other contents between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For the specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.

[0124] An embodiment of the present invention further provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a method for securely identifying a mobile storage device in any embodiment of the present invention is implemented.

[0125] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes a method for securely identifying a mobile storage device in any embodiment of the present invention.

[0126] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes a method for securely identifying a mobile storage device as described in any of the above embodiments.

[0127] like Figure 4 As shown, the embodiment of the present invention also provides an application of a secure identification method of a mobile storage device in a terminal device, including:

[0128] Step 400, after detecting that a mobile storage device is inserted, obtaining the reserved sector information and the current device serial number of the mobile storage device;

[0129] Step 402, decrypt the reserved sector information to obtain decrypted information including a hash value, a decryption device serial number and a security mark;

[0130] Step 404, determining the security identification result of the mobile storage device according to the current device serial number and the decryption information; if the security identification result is unsafe, the use of the mobile storage device is prohibited; if the security identification result is safe, the use of the mobile storage device is allowed.

[0131] It should be noted that the terminal device can be a computer, a host, or any computer system that can be plugged into a mobile storage device.

[0132] In the present invention, the terminal device only needs to install a lightweight peripheral driver, which is used to implement the above-mentioned mobile storage device security identification method, that is, only the mobile storage device is managed and controlled, which can not only greatly reduce the impact of complex drivers on the system, but also ensure the stability of the system. The terminal service checks the data in the reserved sectors of the mobile storage device, such as the device serial number, hash value, security mark and other information, and allows or prohibits the use of the device partition. The allowed devices are read and written according to the policy, thereby ensuring that the mobile storage device will not carry viruses to infect the office and production environment.

[0133] With respect to step 404, the security identification result of the mobile storage device is determined according to the current device serial number and the decryption information, including:

[0134] Get the current file of the mobile storage device;

[0135] Perform hash calculation on the current file to obtain the current hash value;

[0136] Determine whether the current hash value is the same as the hash value in the decrypted information;

[0137] Determine whether the current device serial number is consistent with the decryption device serial number;

[0138] Determine whether there is a security mark in the partition of the mobile storage device;

[0139] If the judgment results are all yes, then the security identification result is determined to be safe;

[0140] If the judgment result is no, then the security identification result is determined to be unsafe.

[0141] With respect to step 404, the security identification result of the mobile storage device is determined according to the current device serial number and the decryption information, including:

[0142] Get the current file of the mobile storage device;

[0143] Perform hash calculation on the current file to obtain the current hash value;

[0144] Determine whether the current hash value is the same as the hash value in the decrypted information;

[0145] Determine whether the current device serial number is consistent with the decryption device serial number;

[0146] Determine whether there is a security mark in the partition of the mobile storage device;

[0147] If the judgment results are all yes, the security identification result of the partition of the mobile storage device with the security mark is determined to be safe, and the use of the partition is allowed;

[0148] If the first judgment result is no or the second judgment result is no, determining that the security identification result of the mobile storage device is unsafe, and prohibiting the use of the mobile storage device;

[0149] If the first judgment result is yes, the second judgment result is yes, and the third judgment result is no, the security identification result of the partition of the mobile storage device without the security mark is determined to be unsafe, and the use of the partition is prohibited.

[0150] After step 404, the method further includes:

[0151] When the security identification result is safe, obtaining the usage priority order of the partitions obtained by the peripheral device driver before the mobile storage device is inserted;

[0152] The partitions used are selected according to the order of usage priority.

[0153] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0154] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0155] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0156] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, system, or device.

[0157] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0158] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0159] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0160] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0161] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.

[0162] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0163] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for securely identifying a mobile storage device, characterized in that: include: Get the reserved sector information and current device serial number of the mobile storage device; Decrypting the reserved sector information to obtain decrypted information including a hash value, a decryption device serial number, and a security mark; The security identification result of the mobile storage device is determined according to the current device serial number and the decryption information; if the security identification result is unsafe, the mobile storage device is checked for viruses.

2. The method according to claim 1, characterized in that The step of determining the security identification result of the mobile storage device according to the current device serial number and the decryption information includes: Obtaining the current file of the mobile storage device; Performing hash calculation on the current file to obtain a current hash value; Determine whether the current hash value is the same as the hash value in the decrypted information; Determine whether the current device serial number is consistent with the decryption device serial number; Determining whether there is a security mark in the partition of the mobile storage device; If the judgment results are all yes, then the security identification result is determined to be safe; If the judgment result is no, then the security identification result is determined to be unsafe.

3. The method according to claim 2, characterized in that The decrypted information includes a security mark of each partition in the mobile storage device; After determining whether there is a security mark in the partition of the mobile storage device, the method further includes: If the judgment results are all yes, then the security identification result of the partition of the mobile storage device having the security mark is determined to be safe; If the first judgment result is no or the second judgment result is no, determining that the security identification result of the mobile storage device is unsafe; If the first judgment result is yes, the second judgment result is yes, and the third judgment result is no, the security identification result of the partition of the mobile storage device without the security mark is determined to be unsafe.

4. The method according to claim 3, characterized in that After determining the security identification result of the partition of the mobile storage device having the security mark as safe, the method further includes: Acquire current disk information of the mobile storage device; Obtaining the real-time security mark of the partition according to the current disk information corresponding to the partition having the security mark; For each partition having the security mark, execute: Determining whether the real-time security mark of the partition is the same as the security mark of the partition in the decrypted information; If the judgment result is yes, the partition is determined to be a safe partition; wherein the status of the safe partition is usable.

5. The method according to any one of claims 1 to 4, characterized in that: After the mobile storage device is virus checked and killed, the method further includes: Determine whether the updated disk information of the mobile storage device after virus detection is performed is the same as the disk information of the mobile storage device before virus detection is performed; If the judgment result is yes, an updated security mark is obtained according to the disk information, and the updated security mark is stored in the reserved sector.

6. The method according to claim 3, characterized in that After determining the security identification result of the partition of the mobile storage device having the security mark as safe, the method further includes: Obtaining the total number of security mark identifications performed on the mobile storage device; For each partition whose security identification result is safe, execute: Counting the total number of virus checks performed on the partition in the total number of times, as well as the virus check time and virus check result of each virus check; wherein the virus check result includes virus type, virus quantity and check time; Determine the number of overtime killing times in which the killing time is longer than the preset killing time from the total number of killing times; Determining the risk levels of different virus types from a preset risk level table; wherein the preset risk level table stores the risk levels of various virus types; Determine the risk score of the partition according to the total number of times, the total number of virus detections, the timeout number of virus detections, the virus detection result of the partition in the total number of virus detections, and the risk level; The priority order of use of the partitions whose security identification result is safe is determined according to the risk scores of the partitions whose security identification result is safe.

7. An application based on the method according to any one of claims 1 to 6, characterized in that: Applied in terminal equipment, including: After detecting that a mobile storage device is inserted, obtaining reserved sector information and a current device serial number of the mobile storage device; Decrypting the reserved sector information to obtain decrypted information including a hash value, a decryption device serial number, and a security mark; The security identification result of the mobile storage device is determined according to the current device serial number and the decryption information; if the security identification result is unsafe, the use of the mobile storage device is prohibited; if the security identification result is safe, the use of the mobile storage device is allowed.

8. A security identification device for a mobile storage device, characterized in that: include: An acquisition module is used to obtain the reserved sector information and current device serial number of the mobile storage device; A decryption module, used to decrypt the reserved sector information to obtain decrypted information including a hash value, a decryption device serial number and a security mark; The identification module is used to determine the security identification result of the mobile storage device according to the current device serial number and the decryption information; if the security identification result is unsafe, the mobile storage device is checked for viruses.

9. A computing device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 6.

Images