A USB mass storage device security isolation system and method of use thereof

Abstract

The present application belongs to the technical field of protecting computer hardware and data security, and more particularly to a USB mass storage device security isolation system and a use method thereof. The system comprises: a device interface unit for device management and enumeration, metadata analysis and processing, and data interaction control; a host interface unit for access control policy execution and virtual view planning, standard USB mass storage device simulation, and host request protocol conversion; a mapping unit for constructing and maintaining a virtual-real address mapping table, completing conversion of virtual logical allocation unit numbers to device logical allocation unit numbers, and performing dynamic allocation and management of storage space according to an idle virtual logical allocation unit bitmap and an idle device logical allocation unit bitmap; and an isolation scheduling unit responsible for issuing operation instructions and delivering messages between the units. The present application constructs a pure virtual disk view presented to the host, thereby shielding the host from perceiving restricted files.

Description

Technical Field

[0001] This invention belongs to the technical field of protecting computer hardware and data security, and more specifically, relates to a security isolation system for USB mass storage devices and its usage method. Background Technology

[0002] USB mass storage devices have become a primary medium for data exchange and the spread of malicious code. Existing technical solutions are mostly "passive interception" methods, meaning that after the host identifies the actual structure of the USB mass storage device, it then intercepts it through file filtering or virus scanning. Such solutions cannot completely prevent the host from detecting hidden files within the physical storage structure, and their security depends to some extent on the host environment.

[0003] Chinese patent document CN117951761A discloses a secure USB flash drive access method based on storage data block control. This method maps a virtual USB storage device created by a dedicated USB protection device to a connected target host via OTG, allowing the target host to display a storage device-like interface. After a USB flash drive with a security tag is connected to the dedicated USB protection device, the device scans the flash drive for viruses and records the data blocks containing virus files. This completes the virus scanning and file marking, binding the USB flash drive with the security tag to the virtual USB storage device. The target host can then access the data in the connected USB flash drive with the security tag. Access is prohibited when a problematic data block is encountered. This invention achieves control over inserted USB flash drives by using a virtual USB storage device. By marking the physical storage data blocks of virus files within the USB flash drive, and thus restricting the reading and writing of problematic data blocks, it achieves isolated access to virus files.

[0004] Chinese patent document CN115809487A discloses a method for secure isolation of USB mobile storage media. This method includes deploying at least one system device in the current network environment; powering on the USB isolation box to obtain the vendor ID, product ID, and other device information of the mobile storage media; establishing a file whitelist filtering function for the USB isolation box; performing virus detection on files in non-whitelist formats obtained through whitelist filtering; and authorizing access operations, allowing PC hosts in the intranet environment to simultaneously access the file content in the storage media via FTP / WEB. By filtering files on external mobile storage media, scanning for viruses, controlling authorization for accessing and downloading internal files, and updating the virus detection database in real time, this invention meets the needs of an ever-changing network environment. Furthermore, through multiple security strategies, it achieves secure isolation of mobile storage files, thus providing the advantages of convenient management and authorization by allowing for easy access to the isolation box's operating status and operation records.

[0005] These methods all have shortcomings.

[0006] Chinese patent document CN115809487A changed the usage process of USB mobile storage media. Users cannot directly browse and operate it like ordinary USB mobile storage media, which brings a great learning cost to users. In addition, directly deleting files that are considered to be viruses may pose a risk of accidental file deletion.

[0007] Chinese patent document CN117951761A overcomes the above-mentioned shortcomings of Chinese patent document CN115809487A. However, the solution still has defects: (1) It exposes the complete directory structure of the USB flash drive to the host operating system. The virus file still exists in the file list visible to the host, and the host can still initiate access requests to the virus file. Its security mechanism only marks and intercepts the "data block where the virus is located" itself, rather than "all data blocks of the file containing the virus". In practical applications, the data of a file is usually distributed in multiple discrete data blocks. When the virus only infects a part of the file, the solution will intercept access to the infected data block and not intercept access to the uninfected data block of the file. This will result in the host obtaining an incomplete and damaged file.

[0008] In view of this, the present invention designs a secure isolation system and method for USB mass storage devices to solve the problems existing in the prior art. Summary of the Invention

[0009] The present invention aims to overcome at least one of the defects of the prior art and provide a USB mass storage device security isolation system. The system parses the metadata of the USB mass storage device and constructs a clean virtual disk view based on the security policy to present to the host, thereby shielding the host from the perception of restricted files.

[0010] This invention also discloses a method for using a USB mass storage device security isolation system.

[0011] The technical terms related to this invention are explained as follows:

[0012] File Identifier (FID): A unique internal identifier assigned by the device interface unit to each file in the USB mass storage device when generating the device file list. This identifier is used to uniquely refer to a file in all subsequent processes within the system.

[0013] Device File List: An internal unified data structure generated by the device interface unit to describe file information in USB mass storage devices; its specific content is gradually improved as the system initialization phase progresses.

[0014] Initial device file list: The device file list generated in the first stage of initialization contains basic information that can be obtained by preliminary parsing of device metadata, including file name, file path, file size, file attributes, timestamp and file signature;

[0015] Final Device File List: The device file list generated in the second phase of initialization contains basic information about visible files after policy filtering and storage layout information obtained through further in-depth parsing. If a file is stored contiguously, its storage space is considered as a single contiguous physical storage segment; if a file is stored non-contiguously, its storage space is considered as multiple contiguous physical storage segments. The storage layout information of each physical storage segment is defined by the starting device logical allocation unit number and its quantity.

[0016] Idle Device Logical Allocation Unit Bitmap: An internal data structure generated by the device interface unit in the second phase of initialization, where each bit represents the state of a device logical allocation unit, with '0' indicating idle and '1' indicating occupied.

[0017] Idle Virtual Logical Allocation Unit Bitmap: Each bit represents the state of a virtual logical allocation unit, '0' indicates idle, and '1' indicates occupied.

[0018] Access control policies: These are pre-installed in the firmware of the host interface unit and can be updated through the security interface of the host interface unit; they include file attribute rules, file type rules, file timestamp rules, file directory structure rules, and file digital signature rules.

[0019] Virtual layout strategy: generated by the host interface unit, it defines the virtual disk layout visible to the host, records the FID, virtual logical allocation unit starting number and virtual logical allocation unit number of each visible file; at the same time, it determines the virtual disk type and size, and the total capacity of the virtual disk should not exceed the actual usable capacity of the USB mass storage device.

[0020] Metadata: Data that describes the attributes of a file or file system itself, such as filename, size, creation time, storage location, etc., rather than the actual content of the file.

[0021] Device metadata: Metadata stored on a USB mass storage device that describes its own file system structure and file attributes, such as the Master Boot Record, File Allocation Table, directory entries, etc.

[0022] Virtual metadata: A data structure built and maintained by the host interface unit in its memory buffer to present a virtual disk view to the host; it fully conforms to the simulated file system type specification and strictly follows the virtual layout strategy; this metadata contains necessary information such as the file allocation table and directory entries, enabling the host interface unit to determine the file to which any virtual logical allocation unit number belongs and its corresponding FID.

[0023] Logical Allocation Unit (LAU): The smallest unit for space management in a file system, consisting of multiple consecutive sectors, corresponding to clusters or blocks; the size of the logical allocation unit is a key parameter used to convert logical block addresses to logical allocation unit numbers.

[0024] Device Logical Allocation Unit (DLAU): refers to the logical allocation unit in the file system of the USB mass storage device.

[0025] Virtual Logical Allocation Unit (VLAU): refers to the logical allocation unit defined in the virtual disk space created by the host.

[0026] Logical Allocation Unit Number (LAUN): The linear number of a logical allocation unit.

[0027] Device Logical Allocation Unit Number (DLAUN): A linear number for the device logical allocation unit, used to identify its location in the physical space of the USB mass storage device.

[0028] Virtual Logical Allocation Unit Number (VLAUN): A linear number for a virtual logical allocation unit, used to identify its location in the virtual disk space.

[0029] Logical Block Address (LBA): Linear addressing for a single sector in disk access; read and write requests from the device interface unit to USB mass storage devices and read and write requests from the host to its own system are all based on LBA.

[0030] Device Logical Block Address (DLBA): After system translation, the logical block address used in the read / write commands ultimately sent to the USB mass storage device.

[0031] Virtual Logical Block Address (VLBA): The logical block address used in read and write commands issued by the host to the virtual disk.

[0032] Virtual-to-physical address mapping table: A data structure maintained by the mapping unit to store and manage the mapping relationship between virtual logical allocation unit numbers and device logical allocation unit numbers.

[0033] Virtual disk: A simulated disk device enumerated by the host interface unit to the host operating system; its type is no different from that of the USB mass storage device connected to the device interface unit, but its metadata has been filtered and reconstructed by security policies.

[0034] Virtual disk view: The presentation of virtual disk content that conforms to security policies, as shown by the host interface unit to the host operating system.

[0035] The detailed technical solution of this invention is as follows:

[0036] A secure isolation system for USB mass storage devices, the system comprising: a device interface unit, a host interface unit, an isolation scheduling unit, and a mapping unit, wherein...

[0037] The device interface unit connects to an external USB mass storage device via a USB interface. Internally, it has an independent processor and memory buffer, serving as the sole interface between the system and the USB mass storage device, and undertaking the following core responsibilities:

[0038] (1) Equipment Management and Enumeration

[0039] The device insertion event is detected, and the USB mass storage device is enumerated to identify its basic parameters;

[0040] (2) Metadata parsing and processing

[0041] The file system metadata of USB mass storage devices is parsed in stages. First, an initial device file list is generated. After receiving the visible file list, the visible files are parsed in depth to generate the final device file list and a bitmap of idle device logical allocation units.

[0042] (3) Data interaction control

[0043] It is responsible for data interaction with USB mass storage devices and executing host instructions that have been collaboratively converted by the host interface unit and the mapping unit.

[0044] The host interface unit, connected to the host via a USB interface, has an independent processor and memory buffer inside. Serving as the sole interface between the system and the host, it undertakes the following core responsibilities:

[0045] (1) Enforcement of access control policies and planning of virtual views

[0046] Receive the initial device file list from the device interface unit, filter it according to the preset access control policy, and generate a visible file list;

[0047] By combining the received final device file list with the idle device logical allocation unit bitmap, the layout of all visible files in the virtual disk is planned, and a virtual layout strategy defining the virtual address space allocation is generated.

[0048] (2) Simulation of standard USB mass storage devices

[0049] Simulates a standard device that conforms to the USB Mass Storage Device Class specification, responding to all enumeration requests and SCSI commands from the host;

[0050] Based on the aforementioned virtual layout strategy, a complete set of logically consistent virtual metadata that conforms to standard file system specifications is dynamically constructed and maintained in its memory buffer, thereby presenting the host with a virtual disk view whose content strictly conforms to the security policy.

[0051] (3) Host request protocol conversion

[0052] The system parses read and write requests based on logical block addresses issued by the host, converts the obtained logical allocation unit size parameters into virtual logical allocation unit numbers and offsets within the units, and works with the mapping unit to complete the conversion from virtual logical allocation unit numbers to device logical allocation unit numbers.

[0053] The mapping unit is implemented by programmable logic circuits and their memory buffers. Its core responsibilities are: to build and maintain a virtual-physical address mapping table; to respond to query requests and complete the conversion from virtual logical allocation unit number to device logical allocation unit number; and to perform dynamic allocation and management of storage space based on the idle virtual logical allocation unit bitmap and the idle device logical allocation unit bitmap.

[0054] The isolation scheduling unit, implemented by programmable logic circuits, undertakes the following core responsibilities: controlling the DMA controller in a hardware arbitration manner, performing data transfer between the independent buffers of the device interface unit and the host interface unit, and being responsible for issuing operation instructions and transmitting messages between the units.

[0055] The device interface unit, host interface unit, mapping unit, and isolation scheduling unit cooperate with each other to complete metadata parsing, policy filtering, virtual disk view construction, and address mapping table establishment during the device enumeration initialization phase. Finally, the host interface unit presents a virtual disk that conforms to the security policy to the host enumeration.

[0056] According to a preferred embodiment of the present invention, the USB mass storage device security isolation system further includes a hardware acceleration unit, which may be an FPGA, a processor, or a dedicated chip. This unit is externally connected to or integrated with the device interface unit and the host interface unit, respectively, and is used to offload the corresponding computing load, thereby effectively reducing the system initialization time.

[0057] According to a preferred embodiment of the present invention, the virtual-physical address mapping table adopts a multi-level index structure, the structure of which is as follows:

[0058] The first-level mapping table is integrated in the block memory (BRAM) inside the mapping unit programmable logic device. The table uses the hash value of the file number (FID) as the address of the table entry, and each table entry contains one or more addresses of the second-level mapping table.

[0059] The second-level mapping table resides in the memory buffer of the mapping unit programmable logic device, or preferably is integrated into the block memory (BRAM) inside the programmable logic device to improve access efficiency. Each entry records the storage information of a contiguous mapping block of the file, and its fields include: the base address of the mapping block (pointing to the starting address of the first mapping block), the starting VLAUN, and the number of logical allocation units occupied (defining the file virtual address range).

[0060] The third-level mapping table is stored in the memory buffer of the mapping unit programmable logic device. The table entries are mapping pairs. Each entry stores the FID, the valid mapping pair indicator bit, and the mapping pair. Each bit in the valid mapping pair indicator bit indicates whether a mapping pair is valid. Mapping pairs with different FIDs will not be stored in the same entry.

[0061] If a file's mapping pairs are stored contiguously in the third-level mapping table, then the file corresponds to only one contiguous mapping block, resulting in only one entry in the second-level mapping table. The entry for the file in the first-level mapping table points to an address in the second-level mapping table. If a file's mapping pairs are not contiguous in the third-level mapping table, then the file corresponds to multiple contiguous mapping pairs, resulting in multiple entries in the second-level mapping table. The entries for the file in the first-level mapping table point to multiple addresses in the second-level mapping table.

[0062] In another aspect of the present invention, a method for using a secure isolation system for a USB mass storage device is provided, the method comprising: a system initialization process, a system read process, a system write process, a virtual-physical address mapping table establishment process, a virtual-physical address mapping table query process, and a virtual-physical address mapping table update process, wherein,

[0063] The system initialization process is divided into three stages: rapid metadata pre-screening, parallel parsing and virtualization, and mapping construction and view rendering; the latter two stages can be executed in parallel.

[0064] When a host requests to read a file, the system read process is triggered, including: host request reception and parsing, conversion of virtual logical block address to virtual logical allocation unit number, virtual-physical address conversion, device logical block address reconstruction and instruction forwarding, and physical data reading and return;

[0065] When a host requests to write to a file, the system write process is triggered, including: host data reception and temporary storage, conversion of virtual logical block address to virtual logical allocation unit number, virtual-physical address conversion, device logical block address reconstruction and instruction forwarding, physical data writing and metadata update;

[0066] The virtual-physical address mapping table establishment process includes: data reception, allocation of mapping block space, and filling of mapping pairs;

[0067] The virtual-to-physical address mapping table query process includes: data reception, parameter acquisition, mapping pair location and reading;

[0068] The virtual-to-physical address mapping table update process includes: data reception, mapping pair location and reading, and mapping pair update.

[0069] According to a preferred embodiment of the present invention, the system initialization process is as follows:

[0070] S1.1, Rapid pre-screening stage of metadata;

[0071] S1.1.1 The device interface unit detects the insertion event of an external USB mass storage device, enumerates the USB mass storage devices, identifies their mass storage device file system type and total capacity, reads the basic metadata of the device file system, parses out the name, size, attributes, timestamp and path information of the files and directories, and generates an initial device file list.

[0072] S1.1.2 The device interface unit sends the initial device file list, file system type identifier, and total capacity to the host interface unit through the isolation scheduling unit;

[0073] S1.1.3 The host interface unit quickly filters the initial device file list according to the preset access control policy, determines the file items that are visible to the host, generates a visible file list, and sends the visible file list back to the device interface unit through the isolation scheduling unit.

[0074] S1.2, Parallel parsing and virtualization stage;

[0075] S1.2.1 After receiving the list of visible files, the device interface unit reads and parses the detailed metadata of these visible files in the file system of the USB mass storage device to obtain their accurate starting device logical allocation unit number and the number of device logical allocation units they occupy. Simultaneously, it parses the free space management metadata of the USB mass storage device's file system to generate a free device logical allocation unit bitmap. Finally, the device interface unit generates a final device file list, which contains the visible files and their complete device logical allocation unit location information, along with the free device logical allocation unit bitmap. Figure 1 It is sent to the host interface unit through the isolation scheduling unit;

[0076] S1.2.2 The host interface unit uses a parallel pipeline architecture to process the received data: the data receiving thread continuously receives the final device file list and the idle device logical allocation unit bitmap from the device interface unit; the data processing thread plans a virtual disk layout for each visible file based on the final device file list and the idle device logical allocation unit bitmap, assigns a virtual starting logical allocation unit number, and generates a virtual layout strategy; the data sending thread sends the generated virtual layout strategy and its corresponding final device file list and idle device logical allocation unit bitmap to the mapping unit.

[0077] S1.3, Mapping Construction and View Rendering Stage;

[0078] S1.3.1 After the host interface unit finishes processing each visible file, it sends a complete mapping data packet to the mapping unit. The format of the data packet is: {File Number (FID), Starting Device Logical Allocation Unit Number, Starting Virtual Logical Allocation Unit Number, Number of Logical Allocation Units Occupied};

[0079] S1.3.2 The mapping unit receives the complete mapping data packet from the host interface unit and creates a mapping record for the file in the virtual and physical address mapping table;

[0080] S1.3.3 When the mapping relationship of the first file is established, the host interface unit generates a virtual device descriptor according to the determined file system type and virtual capacity, and responds to the host enumeration request;

[0081] S1.3.4 The host operating system loads the driver and mounts the virtual disk volume. At this time, the virtual disk only contains the files that have been processed.

[0082] S1.3.5 The host interface unit continuously generates and sends mapping data packets for subsequent files. The mapping unit continuously receives and constructs mapping relationships. After the virtual and physical address mapping relationships of all visible files are completely established, the host interface unit presents the final and complete secure virtual disk view to the host at once, thereby fundamentally eliminating the risk of the host accessing unverified files during the initialization phase.

[0083] According to a preferred embodiment of the present invention, the system reading process specifically includes:

[0084] S2.1 Host Request Reception and Parsing: The host interface unit parses and caches the read command issued by the host, and extracts the starting virtual logical block address and transmission length pointed to by the request;

[0085] S2.2, Conversion from virtual logical block address to virtual logical allocation unit number:

[0086] The host interface unit converts the starting virtual logical block address and its transmission length into one or more operation requests for the virtual logical allocation unit according to the size of the virtual logical allocation unit. If the request spans multiple virtual logical allocation units, it is split into multiple independent sub-requests. For each sub-request, the host interface unit calculates the corresponding target virtual logical allocation unit number and the sector offset within that unit.

[0087] S2.3, Virtual-to-physical address translation:

[0088] The host interface unit queries the virtual metadata maintained by the virtual logical allocation unit number to determine the file to which the unit belongs and its file number FID. Then, it sends an operation request to the mapping unit with the content {FID, virtual logical allocation unit number VLAUN, operation type}, where the operation type is read.

[0089] The mapping unit queries its maintained virtual and physical address mapping table and returns the obtained device logical allocation unit number to the host interface unit;

[0090] S2.4 Device Logic Block Address Reconstruction and Command Forwarding:

[0091] The host interface unit calculates the precise device logical block address based on the received device logical allocation unit number and the sector offset calculated in S2.2, replaces the virtual logical block address parameter in the original host read command with the calculated device logical block address, generates a read command pointing to the physical address of the USB mass storage device, and forwards the read command to the device interface unit through the isolation scheduling unit.

[0092] S2.5 Physical Data Reading and Return:

[0093] The device interface unit sends the read command to the USB mass storage device, reads the data and caches it, and returns the read data to the host interface unit through the isolation scheduling unit;

[0094] The host interface unit encapsulates the received data into a format conforming to the USB Mass Storage Device Class Protocol and sends it to the host. If the original request is split into multiple sub-requests, the host interface unit is responsible for concatenating all the received data in the correct order and returning it to the host all at once.

[0095] According to a preferred embodiment of the present invention, the system writing process specifically includes:

[0096] S3.1 Host Data Reception and Temporary Storage:

[0097] The host interface unit parses and caches the write command issued by the host, extracting the starting virtual logical block address and transmission length pointed to by the request; if the host has written file data before sending the write command, the data is cached.

[0098] S3.2, Virtual logical block address to virtual logical allocation unit conversion:

[0099] The host interface unit converts the starting virtual logical block address and its transmission length into one or more operation requests for the virtual logical allocation unit according to the size of the virtual logical allocation unit. If the request spans multiple virtual logical allocation units, it is split into multiple independent sub-requests. For each sub-request, the host interface unit calculates its target virtual logical allocation unit number and the sector offset within that unit.

[0100] S3.3, Virtual-to-physical address translation:

[0101] The host interface unit queries the virtual metadata maintained by the virtual logical allocation unit number to determine the file to which the unit belongs and its file number FID. Then, it sends an operation request to the mapping unit with the content {FID, virtual logical allocation unit number, operation type}, where the operation type is write.

[0102] The mapping unit queries its maintained virtual and physical address mapping table and returns the obtained device logical allocation unit number to the host interface unit;

[0103] If the mapping unit finds that the virtual logical allocation unit has not yet been mapped, it queries the idle device logical allocation unit bitmap to allocate a new device logical allocation unit for it, queries the idle virtual logical allocation unit bitmap to allocate a new virtual logical allocation unit for it, and updates the virtual and physical address mapping table; the mapping unit returns the final device logical allocation unit number to the host interface unit.

[0104] S3.4 Device Logic Block Address Reconstruction and Command Forwarding:

[0105] The host interface unit calculates the precise device logical block address based on the received device logical allocation unit number and the previously calculated sector offset. It then replaces the virtual logical block address parameter in the original host write command with the calculated device logical block address, generating a write command pointing to the physical address of the USB mass storage device.

[0106] The isolation scheduling unit initiates DMA, forwarding the data to be written temporarily stored in the host interface unit's cache and the newly generated write command to the device interface unit.

[0107] S3.5, Physical data writing and metadata update:

[0108] The device interface unit sends write commands and data to the USB mass storage device to perform a physical write. After the physical write is completed, it returns an acknowledgment signal to the host interface unit. The host interface unit then updates the virtual metadata it maintains and returns a status indicating that the write operation is complete to the host.

[0109] According to a preferred embodiment of the present invention, the virtual-physical address mapping table establishment process specifically includes:

[0110] S4.1 Data Reception:

[0111] The mapping unit receives the final device file list, the idle device logical allocation unit bitmap, and the virtual layout strategy from the host interface unit, and generates an idle virtual logical allocation unit bitmap according to the virtual layout strategy.

[0112] Receive mapping data packets from the host interface unit;

[0113] S4.2, Allocate mapping block space:

[0114] The mapping unit allocates a contiguous block of unused storage space in the third-level mapping table for the current file based on the number of logical allocation units occupied in the mapping data packet. The starting address of this storage space is used as the base address of the mapping block. The base address of the mapping block, the starting VLAUN in the mapping data packet, and the number of logical allocation units occupied are used as entries in the second-level mapping table and written to a free address in the second-level mapping table. The address of the second-level mapping table is written to the address corresponding to the hash value of the FID in the first-level mapping table.

[0115] S4.3, Filling Mapping Pairs:

[0116] For each mapping pair (DLAUN, VLAUN) in this file, the target address of its filling position is the j-th mapping pair position in the table entry address i, and the corresponding mapping pair valid indicator bit is marked as valid, where:

[0117] Entry address i = Mapped block base address + (VLAUN - starting VLAUN) / number of mapping pairs per entry;

[0118] Mapping pair number j = (VLAUN - starting VLAUN) % Number of mapping pairs for each entry.

[0119] According to a preferred embodiment of the present invention, the virtual-to-physical address mapping table lookup process specifically includes:

[0120] S5.1 Data Reception:

[0121] The mapping unit receives an operation request {FID, Virtual Logical Allocation Unit Number VLAUN, Operation Type} from the host interface unit;

[0122] S5.2 Parameter Acquisition:

[0123] The first-level mapping table is read using the hash value of the FID as the address. The table entry contains the address of the second-level mapping table, where the number of addresses in the second-level mapping table is the same as the number of mapping blocks corresponding to the FID.

[0124] Read the second-level mapping table based on the address obtained, and obtain the corresponding mapping block base address, starting VLAUN, and number of logical allocation units occupied;

[0125] S5.3 Mapping Pair Location and Reading:

[0126] First, the calculation formula in S4.3 is used to calculate the entry address i and mapping pair number j of the target mapping pair. Then, the entry address i of the third-level mapping table is read from the memory buffer of the programmable logic device. If the FID in the read entry content is consistent with the target FID, and the mapping pair validity indicator bit corresponding to the mapping pair number j is valid, then the j-th mapping pair in the entry address i is the target mapping pair, and the device logic allocation unit number DLAUN in the mapping pair is returned to the host interface unit as the result; otherwise, a mapping missing error is returned.

[0127] According to a preferred embodiment of the present invention, the virtual-physical address mapping table update process specifically includes:

[0128] S6.1 Data Reception:

[0129] The mapping unit receives an operation request {FID, Virtual Logical Allocation Unit Number VLAUN, Operation Type} from the host interface unit;

[0130] S6.2 Mapping Pair Location and Reading:

[0131] Based on the virtual logical allocation unit number VLAUN that needs to be updated, execute steps S5.1 to S5.3 of the virtual-physical address mapping table lookup process to accurately locate its corresponding table entry address i and mapping pair number j, and read the target mapping pair; if the target mapping pair does not exist, perform the mapping pair update operation.

[0132] S6.3 Mapping Pair Update:

[0133] The system queries the idle device logical allocation unit bitmap to allocate a new device logical allocation unit, queries the idle virtual logical allocation unit bitmap to allocate a new virtual logical allocation unit, and writes the new mapping pair into the third-level mapping table. If the newly added mapping pair exists in a new mapping block, the new mapping block information is updated in the second-level mapping table and the first-level mapping table. The mapping unit returns the final device logical allocation unit number to the host interface unit.

[0134] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0135] (1) The present invention isolates and resolves the complex and heterogeneous file system parsing problem within an independent hardware security domain through the device interface unit, generating a device file list independent of the file system type. Then, the host interface unit processes the above device file list according to the preset access control policy, makes decisions, and generates a virtual layout policy for the host, achieving "pre - hiding" rather than "post - intercepting" for restricted files, eliminating the possibility for the host operating system to perceive or access restricted files. At the same time, for non - restricted files, the original directory structure on the USB mass storage device is also hidden by reconstructing the device view, further reducing the information exposure surface, thus constituting a deep defense.

[0136] (3) When interacting with the host, the present invention emulates as a standard USB mass storage device, without the need to install any drivers or software on the host, and the user experience is the same as that of a common USB mass storage device. Brief Description of the Drawings

[0137] Figure 1 It is the structural diagram of the USB mass storage device security isolation system described in the present invention. Detailed Embodiments

[0138] The technical contribution of the present invention mainly lies in proposing a pre - isolation and virtualization method at the hardware architecture level, and its key lies in the realization through the following collaborative processes:

[0139] 1. Isolation parsing and data abstraction: Isolate and resolve the complex and heterogeneous file system parsing problem within an independent hardware security domain through the device interface unit, generating a physical file list independent of the file system type.

[0140] 2. Policy decision - making and virtual disk view generation: The host interface unit processes the above list according to the preset access control policy, makes decisions, and generates a virtual layout policy for the host, achieving pre - isolation rather than post - intercepting.

[0141] 3. Virtual - to - physical address mapping and view presentation: The mapping unit constructs and maintains a virtual - to - physical address mapping table based on the physical list and the virtual policy, making the virtual disk content recognized by the host strictly conform to the security policy, and achieving transparent redirection of access requests.

[0142] 4. Parallel processing and pipeline initialization: Adopt a phased, parallel - processing and pipeline - type mapping construction initialization process, effectively balancing security and initialization efficiency;

[0143] The following further describes the present disclosure in conjunction with the drawings and embodiments.

[0144] Embodiment 1

[0145] Refer Figure 1This embodiment provides a secure isolation system for USB mass storage devices, the system comprising:

[0146] The device interface unit, host interface unit, isolation scheduling unit, and mapping unit are included.

[0147] The device interface unit connects to an external USB mass storage device via a USB interface. Internally, it has an independent processor and memory buffer, serving as the sole interface between the system and the USB mass storage device, and undertaking the following core responsibilities:

[0148] (1) Equipment Management and Enumeration

[0149] The device insertion event is detected, and the USB mass storage device is enumerated to identify its basic parameters;

[0150] (2) Metadata parsing and processing

[0151] The file system metadata of USB mass storage devices is parsed in stages. First, an initial device file list is generated. After receiving the visible file list, the visible files are parsed in depth to generate the final device file list and a bitmap of idle device logical allocation units.

[0152] (3) Data interaction control

[0153] It is responsible for data interaction with USB mass storage devices and executing host instructions that have been collaboratively converted by the host interface unit and the mapping unit.

[0154] The host interface unit, connected to the host via a USB interface, has an independent processor and memory buffer inside. Serving as the sole interface between the system and the host, it undertakes the following core responsibilities:

[0155] (1) Enforcement of access control policies and planning of virtual views

[0156] Receive the initial device file list from the device interface unit, filter it according to the preset access control policy, and generate a visible file list;

[0157] By combining the received final device file list with the idle device logical allocation unit bitmap, the layout of all visible files in the virtual disk is planned, and a virtual layout strategy defining the virtual address space allocation is generated.

[0158] (2) Simulation of standard USB mass storage devices

[0159] Simulates a standard device that conforms to the USB Mass Storage Device Class specification, responding to all enumeration requests and SCSI commands from the host;

[0160] Based on the aforementioned virtual layout strategy, a complete set of logically consistent virtual metadata that conforms to standard file system specifications is dynamically constructed and maintained in its memory buffer, thereby presenting the host with a virtual disk view whose content strictly conforms to the security policy.

[0161] (3) Host request protocol conversion

[0162] The system parses read and write requests based on logical block addresses issued by the host, converts the obtained logical allocation unit size parameters into virtual logical allocation unit numbers and offsets within the units, and works with the mapping unit to complete the conversion from virtual logical allocation unit numbers to device logical allocation unit numbers.

[0163] The mapping unit is implemented by programmable logic circuits and their memory buffers. Its core responsibilities are: to build and maintain a virtual-physical address mapping table; to respond to query requests and complete the conversion from virtual logical allocation unit number to device logical allocation unit number; and to perform dynamic allocation and management of storage space based on the idle virtual logical allocation unit bitmap and the idle device logical allocation unit bitmap.

[0164] The isolation scheduling unit, implemented by programmable logic circuits, undertakes the following core responsibilities: controlling the DMA controller in a hardware arbitration manner, performing data transfer between the independent buffers of the device interface unit and the host interface unit, and being responsible for issuing operation instructions and transmitting messages between the units.

[0165] The device interface unit, host interface unit, mapping unit, and isolation scheduling unit cooperate with each other to complete metadata parsing, policy filtering, virtual disk view construction, and address mapping table establishment during the device enumeration initialization phase. Finally, the host interface unit presents a virtual disk that conforms to the security policy to the host enumeration.

[0166] Optionally, to cope with complex metadata parsing and policy execution calculations and further improve system efficiency, the USB mass storage device security isolation system also includes a hardware acceleration unit, which may be an FPGA, a processor, or a dedicated chip. This unit is externally connected to or integrated with the device interface unit and the host interface unit, respectively, to offload the corresponding computing load, thereby effectively reducing the system initialization time.

[0167] Optionally, the access control policy in the host interface unit can be dynamically updated through a secure interface, such as a combination of physical buttons, a dedicated configuration port, or via a one-time secure authentication channel of the host, to adapt to ever-changing security requirements.

[0168] The virtual-to-physical address mapping table adopts a structure that combines multi-level indexes and hash linked lists, and its structure is as follows:

[0169] The first-level mapping table is integrated in the block memory (BRAM) inside the mapping unit programmable logic device. The table uses the hash value of the file number FID as the address of the table entry, and each table entry contains one or more addresses of the second-level mapping table.

[0170] The second-level mapping table typically resides in the memory buffer of the mapping unit programmable logic device, or preferably is integrated into the block RAM (BRAM) inside the programmable logic device to improve access efficiency. Each entry records the storage information of a contiguous mapping block of the file, and its fields include: the base address of the mapping block (pointing to the starting address of the first mapping block), the starting VLAUN, and the number of logical allocation units occupied (defining the file virtual address range).

[0171] The third-level mapping table is stored in the memory buffer of the mapping unit programmable logic device. The table entries are mapping pairs. Each entry stores the FID, a valid mapping pair indicator bit, and multiple mapping pairs. Each bit in the valid mapping pair indicator bit indicates whether a mapping pair is valid. Mapping pairs with different FIDs will not be stored in the same entry.

[0172] If a file's mapping pairs are stored contiguously in the third-level mapping table, then the file corresponds to only one contiguous mapping block, resulting in only one entry in the second-level mapping table. The entry for the file in the first-level mapping table points to an address in the second-level mapping table. If a file's mapping pairs are not contiguous in the third-level mapping table, then the file corresponds to multiple contiguous mapping pairs, resulting in multiple entries in the second-level mapping table. The entries for the file in the first-level mapping table point to multiple addresses in the second-level mapping table.

[0173] In this embodiment, the system is powered by an external independent power supply, independent of the host's USB port power supply capability. This design effectively avoids the impact of host power fluctuations on system stability, fundamentally ensuring the reliability of the system as independent security hardware, and is an important guarantee that its security is independent of the host environment.

[0174] The system supports hot-swapping of USB mass storage devices with the host interface. When any connection is detected to be disconnected, the system immediately triggers an automatic reset procedure to clear all temporary data in the device interface unit, host interface unit, and mapping unit, including device file lists, virtual layout strategies, virtual and physical address mapping tables, virtual metadata, and idle device logical allocation unit bitmaps. This ensures that the next connection can be initialized from a completely new and consistent secure state, completely eliminating the possibility of information leakage or logical errors caused by residual states.

[0175] Example 2

[0176] This embodiment provides a method for using a secure isolation system for USB mass storage devices. The method includes: a system initialization process, a system read process, a system write process, a virtual-physical address mapping table establishment process, a virtual-physical address mapping table query process, and a virtual-physical address mapping table update process, wherein:

[0177] The system initialization process is as follows:

[0178] The initialization of the system is divided into three stages: rapid pre-screening of metadata, parallel parsing and virtualization, and mapping construction and view rendering; the latter two stages can be executed in parallel.

[0179] S1.1, Rapid pre-screening stage of metadata;

[0180] S1.1.1 The device interface unit detects the insertion event of an external USB mass storage device, enumerates the USB mass storage devices, identifies their mass storage device file system type and total capacity, reads the basic metadata of the device file system, parses out the name, size, attributes, timestamp and path information of the files and directories, and generates an initial device file list.

[0181] S1.1.2 The device interface unit sends the initial device file list, file system type identifier, and total capacity to the host interface unit through the isolation scheduling unit;

[0182] S1.1.3 The host interface unit quickly filters the initial device file list according to the preset access control policy, determines the file items that are visible to the host, generates a visible file list, and sends the visible file list back to the device interface unit through the isolation scheduling unit.

[0183] S1.2, Parallel parsing and virtualization stage;

[0184] S1.2.1 After receiving the list of visible files, the device interface unit reads and parses the detailed metadata of these visible files in the file system of the USB mass storage device to obtain their accurate starting device logical allocation unit number and the number of device logical allocation units they occupy. Simultaneously, it parses the free space management metadata of the USB mass storage device's file system to generate a free device logical allocation unit bitmap. Finally, the device interface unit generates a final device file list, which contains the visible files and their complete device logical allocation unit location information, along with the free device logical allocation unit bitmap. Figure 1 It is sent to the host interface unit through the isolation scheduling unit;

[0185] S1.2.2 The host interface unit uses a parallel pipeline architecture to process the received data: the data receiving thread continuously receives the final device file list and the idle device logical allocation unit bitmap from the device interface unit; the data processing thread plans a virtual disk layout for each visible file based on the final device file list and the idle device logical allocation unit bitmap, assigns a virtual starting logical allocation unit number, and generates a virtual layout strategy; the data sending thread sends the generated virtual layout strategy and its corresponding final device file list and idle device logical allocation unit bitmap to the mapping unit.

[0186] S1.3, Mapping Construction and View Rendering Stage;

[0187] S1.3.1 After the host interface unit finishes processing each visible file, it sends a complete mapping data packet to the mapping unit. The format of the data packet is: {File Number (FID), Starting Device Logical Allocation Unit Number, Starting Virtual Logical Allocation Unit Number, Number of Logical Allocation Units Occupied};

[0188] S1.3.2 The mapping unit receives the complete mapping data packet from the host interface unit and creates a mapping record for the file in the virtual and physical address mapping table;

[0189] S1.3.3 When the mapping relationship of the first file is established, the host interface unit generates a virtual device descriptor according to the determined file system type and virtual capacity, and responds to the host enumeration request;

[0190] S1.3.4 The host operating system loads the driver and mounts the virtual disk volume. At this time, the virtual disk only contains the files that have been processed.

[0191] S1.3.5 The host interface unit continuously generates and sends mapping data packets for subsequent files. The mapping unit continuously receives and constructs mapping relationships. After the virtual and physical address mapping relationships of all visible files are completely established, the host interface unit presents the final and complete secure virtual disk view to the host at once, thereby fundamentally eliminating the risk of the host accessing unverified files during the initialization phase.

[0192] S1.3.6 The system initialization process is completed and enters the ready state, waiting to process the host's data read and write requests.

[0193] The system reading process is as follows:

[0194] The system is characterized in that when a host requests to read a file, the system performs the following steps:

[0195] S2.1 Host Request Reception and Parsing: The host interface unit parses and caches the read command issued by the host, and extracts the starting virtual logical block address and transmission length pointed to by the request;

[0196] S2.2, Conversion from virtual logical block address to virtual logical allocation unit number:

[0197] The host interface unit converts the starting virtual logical block address and its transmission length into one or more operation requests for the virtual logical allocation unit according to the size of the virtual logical allocation unit. If the request spans multiple virtual logical allocation units, it is split into multiple independent sub-requests. For each sub-request, the host interface unit calculates the corresponding target virtual logical allocation unit number and the sector offset within that unit.

[0198] S2.3, Virtual-to-physical address translation:

[0199] The host interface unit queries the virtual metadata maintained by the virtual logical allocation unit number to determine the file to which the unit belongs and its file number FID. Then, it sends an operation request to the mapping unit with the content {FID, virtual logical allocation unit number, operation type}, where the operation type is read.

[0200] The mapping unit queries its maintained virtual and physical address mapping table and returns the obtained device logical allocation unit number to the host interface unit;

[0201] S2.4 Device Logic Block Address Reconstruction and Command Forwarding:

[0202] The host interface unit calculates the precise device logical block address based on the received device logical allocation unit number and the sector offset calculated in S2.2, replaces the virtual logical block address parameter in the original host read command with the calculated device logical block address, generates a read command pointing to the physical address of the USB mass storage device, and forwards the read command to the device interface unit through the isolation scheduling unit.

[0203] S2.5 Physical Data Reading and Return:

[0204] The device interface unit sends the read command to the USB mass storage device, reads the data and caches it, and returns the read data to the host interface unit through the isolation scheduling unit;

[0205] The host interface unit encapsulates the received data into a format conforming to the USB Mass Storage Device Class Protocol and sends it to the host. If the original request is split into multiple sub-requests, the host interface unit is responsible for concatenating all the received data in the correct order and returning it to the host all at once.

[0206] The system write process is as follows:

[0207] The system is characterized in that when a host requests to write to a file, the system performs the following steps:

[0208] S3.1 Host Data Reception and Temporary Storage:

[0209] The host interface unit parses and caches the write command issued by the host, extracting the starting virtual logical block address and transmission length pointed to by the request; if the host has written file data before sending the write command, the data is cached.

[0210] S3.2, Virtual logical block address to virtual logical allocation unit conversion:

[0211] The host interface unit converts the starting virtual logical block address and its transmission length into one or more operation requests for the virtual logical allocation unit according to the size of the virtual logical allocation unit. If the request spans multiple virtual logical allocation units, it is split into multiple independent sub-requests. For each sub-request, the host interface unit calculates its target virtual logical allocation unit number and the sector offset within that unit.

[0212] S3.3, Virtual-to-physical address translation:

[0213] The host interface unit queries the virtual metadata maintained by the virtual logical allocation unit number to determine the file to which the unit belongs and its file number FID. Then, it sends an operation request to the mapping unit with the content {FID, virtual logical allocation unit number, operation type}, where the operation type is write.

[0214] The mapping unit queries its maintained virtual and physical address mapping table and returns the obtained device logical allocation unit number to the host interface unit;

[0215] If the mapping unit finds that the virtual logical allocation unit has not yet been mapped, it queries the idle device logical allocation unit bitmap to allocate a new device logical allocation unit for it, queries the idle virtual logical allocation unit bitmap to allocate a new virtual logical allocation unit for it, and updates the virtual and physical address mapping table; the mapping unit returns the final device logical allocation unit number to the host interface unit.

[0216] S3.4 Device Logic Block Address Reconstruction and Command Forwarding:

[0217] The host interface unit calculates the precise device logical block address based on the received device logical allocation unit number and the previously calculated sector offset. It then replaces the virtual logical block address parameter in the original host write command with the calculated device logical block address, generating a write command pointing to the physical address of the USB mass storage device.

[0218] The isolation scheduling unit initiates DMA, forwarding the data to be written temporarily stored in the host interface unit's cache and the newly generated write command to the device interface unit.

[0219] S3.5, Physical data writing and metadata update:

[0220] The device interface unit sends write commands and data to the USB mass storage device to perform a physical write. After the physical write is completed, it returns an acknowledgment signal to the host interface unit. The host interface unit then updates the virtual metadata it maintains and returns a status indicating that the write operation is complete to the host.

[0221] The process for establishing the virtual-to-physical address mapping table is as follows:

[0222] The system is characterized in that, when the virtual and physical address mapping table is established, the system executes the following steps:

[0223] S4.1 Data Reception:

[0224] The mapping unit receives the final device file list, the idle device logical allocation unit bitmap, and the virtual layout strategy from the host interface unit, and generates an idle virtual logical allocation unit bitmap according to the virtual layout strategy.

[0225] Receive mapping data packets from the host interface unit;

[0226] S4.2, Allocate mapping block space:

[0227] The mapping unit allocates a contiguous unused storage space in the third-level mapping table for the current file based on the number of logical allocation units occupied in the mapping data packet, and uses the starting address of this storage space as the base address of the mapping block; the base address of the mapping block, the starting VLAUN in the mapping data packet, and the number of logical allocation units occupied are used as entries in the second-level mapping table and written to a free address in the second-level mapping table; the address of the second-level mapping table is written to the address corresponding to the hash value of the FID in the first-level mapping table;

[0228] S4.3, Filling Mapping Pairs:

[0229] For each mapping pair (DLAUN, VLAUN) in this file, the target address of its filling position is the j-th mapping pair position in the table entry address i, and the corresponding mapping pair valid indicator bit is marked as valid, where:

[0230] Entry address i = Mapped block base address + (VLAUN - starting VLAUN) / number of mapping pairs per entry;

[0231] Mapping pair number j = (VLAUN - starting VLAUN) % Number of mapping pairs for each entry.

[0232] The virtual-to-physical address mapping table lookup process is as follows:

[0233] The system is characterized in that, when querying the virtual-physical address mapping table, the system executes the following steps:

[0234] S5.1 Data Reception:

[0235] The mapping unit receives operation requests (FID, virtual logical allocation unit number, operation type) from the host interface unit;

[0236] S5.2 Parameter Acquisition:

[0237] The first-level mapping table is read using the hash value of the FID as the address. The table entry contains the address of the second-level mapping table, where the number of addresses in the second-level mapping table is the same as the number of mapping blocks corresponding to the FID.

[0238] Read the second-level mapping table based on the address obtained, and obtain the corresponding mapping block base address, starting VLAUN, and number of logical allocation units occupied;

[0239] S5.3 Mapping Pair Location and Reading:

[0240] First, the calculation formula in S4.3 is used to calculate the entry address i and mapping pair number j of the target mapping pair. Then, the entry address i of the third-level mapping table is read from the memory buffer of the programmable logic device. If the FID in the read entry content is consistent with the target FID, and the mapping pair validity indicator bit corresponding to the mapping pair number j is valid, then the j-th mapping pair in the entry address i is the target mapping pair, and the device logic allocation unit number DLAUN in the mapping pair is returned to the host interface unit as the result; otherwise, a mapping missing error is returned.

[0241] The virtual-to-physical address mapping table update process is as follows:

[0242] The system is characterized in that, when the virtual-physical address mapping table is updated, the system executes the following steps:

[0243] S6.1 Data Reception:

[0244] The mapping unit receives an operation request (FID, Virtual Logical Allocation Unit Number, Operation Type) from the host interface unit;

[0245] S6.2 Mapping Pair Location and Reading:

[0246] Based on the virtual logical allocation unit number VLAUN that needs to be updated, execute steps S5.1 to S5.3 of the virtual-physical address mapping table lookup process to accurately locate its corresponding table entry address i and mapping pair number j, and read the target mapping pair; if the target mapping pair does not exist, perform the mapping pair update operation.

[0247] S6.3 Mapping Pair Update:

[0248] The system queries the idle device logical allocation unit bitmap to allocate a new device logical allocation unit, queries the idle virtual logical allocation unit bitmap to allocate a new virtual logical allocation unit, and writes the new mapping pair into the third-level mapping table. If the newly added mapping pair exists in a new mapping block, the new mapping block information is updated in the second-level mapping table and the first-level mapping table. The mapping unit returns the final device logical allocation unit number to the host interface unit.

[0249] It is important to note that the "virtual disk view" and related "virtualization" terms used in this invention are fundamentally different from existing virtualization technologies. Existing virtualization technologies, such as compute virtualization (e.g., VMware vSphere, SmartX ELF), network virtualization (e.g., SDN, VLAN), and storage virtualization (e.g., traditional hardware pooling solutions like IBM SVC, software-defined storage like Ceph), share the core principle of "resource reuse and efficiency improvement." They aim to improve resource utilization, achieve flexible expansion, and reduce costs by pooling physical resources (compute, network, storage) and then abstracting and dynamically allocating them.

[0250] This invention, however, adopts a significantly different technical approach, with its core objective shifting to hardware-level security isolation. The system parses the metadata of USB mass storage devices and constructs a clean virtual disk view for the host based on security policies, thereby shielding the host from awareness of restricted files.

[0251] This technical solution for achieving secure isolation contrasts sharply with existing virtualization technologies in terms of both objectives and pathways: the former focuses on building a one-way security boundary to hide information, while the latter focuses on building a shared resource pool to reuse resources. This shift in technical path from "resource reuse" to "secure isolation" makes its specific technical solutions non-obvious to those skilled in the art.

[0252] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the technical solutions of the present invention, and are not intended to limit the specific implementation of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present invention should be included within the protection scope of the claims of the present invention.

Claims

1. A secure isolation system for USB mass storage devices, characterized in that, The system includes: a device interface unit, a host interface unit, an isolation scheduling unit, and a mapping unit, wherein, The device interface unit connects to an external USB mass storage device via a USB interface. Internally, it has an independent processor and memory buffer, serving as the sole interface between the system and the USB mass storage device, and undertaking the following core responsibilities: The device insertion event is detected, and the USB mass storage device is enumerated to identify its basic parameters; The file system metadata of USB mass storage devices is parsed in stages. First, an initial device file list is generated. After receiving the visible file list, the visible files are parsed in depth to generate the final device file list and a bitmap of idle device logical allocation units. It is responsible for data interaction with USB mass storage devices and executing host instructions that have been collaboratively converted by the host interface unit and the mapping unit. The host interface unit, connected to the host via a USB interface, has an independent processor and memory buffer inside. Serving as the sole interface between the system and the host, it undertakes the following core responsibilities: Receive the initial device file list from the device interface unit, filter it according to the preset access control policy, and generate a visible file list; By combining the received final device file list with the idle device logical allocation unit bitmap, the layout of all visible files in the virtual disk is planned, and a virtual layout strategy defining the virtual address space allocation is generated. Simulates a standard device that conforms to the USB Mass Storage Device Class specification, responding to all enumeration requests and SCSI commands from the host; Based on the aforementioned virtual layout strategy, a complete set of logically consistent virtual metadata that conforms to standard file system specifications is dynamically constructed and maintained in its memory buffer, thereby presenting the host with a virtual disk view whose content strictly conforms to the security policy. The system parses read and write requests based on logical block addresses issued by the host, converts the obtained logical allocation unit size parameters into virtual logical allocation unit numbers and offsets within the units, and works with the mapping unit to complete the conversion from virtual logical allocation unit numbers to device logical allocation unit numbers. The mapping unit is implemented by programmable logic circuits and their memory buffers. Its core responsibilities are: to build and maintain a virtual-physical address mapping table; to respond to query requests and complete the conversion from virtual logical allocation unit number to device logical allocation unit number; and to perform dynamic allocation and management of storage space based on the idle virtual logical allocation unit bitmap and the idle device logical allocation unit bitmap. The isolation scheduling unit, implemented by programmable logic circuits, undertakes the following core responsibilities: controlling the DMA controller in a hardware arbitration manner, performing data transfer between the independent buffers of the device interface unit and the host interface unit, and being responsible for issuing operation instructions and transmitting messages between the units.

2. The USB mass storage device security isolation system according to claim 1, characterized in that, The USB mass storage device security isolation system also includes a hardware acceleration unit, which is externally connected to or integrated with the device interface unit and the host interface unit, respectively, to offload the corresponding computing load.

3. The USB mass storage device security isolation system according to claim 1, characterized in that, The virtual-to-physical address mapping table adopts a multi-level index structure, the structure of which is as follows: The first-level mapping table is integrated into the block memory inside the mapping unit programmable logic device. The table uses the hash value of the file number FID as the address of the table entry, and each table entry contains one or more addresses of the second-level mapping table. The second-level mapping table resides in the memory buffer of the mapping unit programmable logic device or is integrated into the block memory inside the programmable logic device. Each entry records the storage information of a contiguous mapping block of the file, and its fields include: the base address of the mapping block, the starting VLAUN, and the number of logic allocation units occupied. The third-level mapping table is stored in the memory buffer of the mapping unit programmable logic device. The table entries are mapping pairs. Each entry stores the FID, the valid mapping pair indicator bit, and the mapping pair. Each bit in the valid mapping pair indicator bit indicates whether a mapping pair is valid. Mapping pairs with different FIDs will not be stored in the same entry. If a file's mapping pairs are stored contiguously in the third-level mapping table, then the file corresponds to only one contiguous mapping block, resulting in only one entry in the second-level mapping table. The entry for the file in the first-level mapping table points to an address in the second-level mapping table. If a file's mapping pairs are not contiguous in the third-level mapping table, then the file corresponds to multiple contiguous mapping pairs, resulting in multiple entries in the second-level mapping table. The entries for the file in the first-level mapping table point to multiple addresses in the second-level mapping table.

4. A method of using the USB mass storage device security isolation system as described in any one of claims 1 to 3, characterized in that, The method includes: a system initialization process, a system read process, a system write process, a virtual-physical address mapping table establishment process, a virtual-physical address mapping table query process, and a virtual-physical address mapping table update process, wherein... The system initialization process is divided into three stages: rapid metadata pre-screening, parallel parsing and virtualization, and mapping construction and view rendering; the latter two stages can be executed in parallel. When a host requests to read a file, the system read process is triggered, including: host request reception and parsing, conversion of virtual logical block address to virtual logical allocation unit number, virtual-physical address conversion, device logical block address reconstruction and instruction forwarding, and physical data reading and return; When a host requests to write to a file, the system write process is triggered, including: host data reception and temporary storage, conversion of virtual logical block address to virtual logical allocation unit number, virtual-physical address conversion, device logical block address reconstruction and instruction forwarding, physical data writing and metadata update; The virtual-physical address mapping table establishment process includes: data reception, allocation of mapping block space, and filling of mapping pairs; The virtual-to-physical address mapping table query process includes: data reception, parameter acquisition, mapping pair location and reading; The virtual-to-physical address mapping table update process includes: data reception, mapping pair location and reading, and mapping pair update.

5. The method of using the USB mass storage device security isolation system according to claim 4, characterized in that, The system initialization process is as follows: S1.1, Rapid pre-screening stage of metadata; S1.1.1 The device interface unit detects the insertion event of an external USB mass storage device, enumerates the USB mass storage devices, identifies their mass storage device file system type and total capacity, reads the basic metadata of the device file system, parses out the name, size, attributes, timestamp and path information of the files and directories, and generates an initial device file list. S1.1.2 The device interface unit sends the initial device file list, file system type and total capacity to the host interface unit through the isolation scheduling unit; S1.1.3 The host interface unit quickly filters the initial device file list according to the preset access control policy, determines the file items that are visible to the host, generates a visible file list, and sends the visible file list back to the device interface unit through the isolation scheduling unit. S1.2, Parallel parsing and virtualization stage; S1.2.1 After receiving the list of visible files, the device interface unit reads and parses the detailed metadata of these visible files in the file system of the USB mass storage device to obtain their accurate starting device logical allocation unit number and the number of device logical allocation units they occupy. At the same time, it parses the free space management metadata of the file system of the USB mass storage device to generate a free device logical allocation unit bitmap. Finally, the device interface unit generates a final device file list, which contains the visible files and their complete device logical allocation unit location information, and sends them to the host interface unit through the isolation scheduling unit along with the idle device logical allocation unit bitmap. S1.2.2 The host interface unit uses a parallel pipeline architecture to process the received data: it continuously receives the final device file list and idle device logical allocation unit bitmap from the device interface unit through the data receiving thread; The data processing thread plans a virtual disk layout for each visible file based on the final device file list and the idle device logical allocation unit bitmap, assigns a virtual starting logical allocation unit number, and generates a virtual layout strategy; the data sending thread sends the generated virtual layout strategy and its corresponding final device file list and idle device logical allocation unit bitmap to the mapping unit. S1.3, Mapping Construction and View Rendering Stage; S1.3.1 After the host interface unit finishes processing each visible file, it sends a complete mapping data packet to the mapping unit. The format of the data packet is: {file number FID, starting device logical allocation unit number, starting virtual logical allocation unit number, number of logical allocation units occupied}. S1.3.2 The mapping unit receives the complete mapping data packet from the host interface unit and creates a mapping record for the file in the virtual and physical address mapping table; S1.3.3 When the mapping relationship of the first file is established, the host interface unit generates a virtual device descriptor according to the determined file system type and virtual capacity, and responds to the host enumeration request; S1.3.4 The host operating system loads the driver and mounts the virtual disk volume. At this time, the virtual disk only contains the files that have been processed. S1.3.5 The host interface unit continuously generates and sends mapping data packets for subsequent files. The mapping unit continuously receives and constructs mapping relationships. After the virtual and physical address mapping relationships of all visible files are completely established, the host interface unit presents the final and complete secure virtual disk view to the host at once.

6. The method of using the USB mass storage device security isolation system according to claim 4, characterized in that, The system reading process specifically includes: S2.1 Host Request Reception and Parsing: The host interface unit parses and caches the read command issued by the host, and extracts the starting virtual logical block address and transmission length pointed to by the request; S2.2, Conversion from virtual logical block address to virtual logical allocation unit number: The host interface unit converts the starting virtual logical block address and its transmission length into one or more operation requests for the virtual logical allocation unit according to the size of the virtual logical allocation unit. If the request spans multiple virtual logical allocation units, it is split into multiple independent sub-requests. For each sub-request, the host interface unit calculates the corresponding target virtual logical allocation unit number and the sector offset within that unit. S2.3, Virtual-to-physical address translation: The host interface unit queries the virtual metadata maintained by the virtual logical allocation unit number to determine the file to which the unit belongs and its file number FID. Then, it sends an operation request to the mapping unit with the content {FID, virtual logical allocation unit number VLAUN, operation type}, where the operation type is read. The mapping unit queries its maintained virtual and physical address mapping table and returns the obtained device logical allocation unit number to the host interface unit; S2.4 Device Logic Block Address Reconstruction and Command Forwarding: The host interface unit calculates the device logical block address based on the received device logical allocation unit number and the sector offset calculated in S2.2, replaces the virtual logical block address parameter in the original host read command with the calculated device logical block address, generates a read command pointing to the physical address of the USB mass storage device, and forwards the read command to the device interface unit through the isolation scheduling unit. S2.5 Physical Data Reading and Return: The device interface unit sends the read command to the USB mass storage device, reads the data and caches it, and returns the read data to the host interface unit through the isolation scheduling unit; The host interface unit encapsulates the received data into a format conforming to the USB Mass Storage Device Class Protocol and sends it to the host. If the original request is split into multiple sub-requests, the host interface unit is responsible for concatenating all the received data in the correct order and returning it to the host all at once.

7. The method of using the USB mass storage device security isolation system according to claim 4, characterized in that, The system write process specifically includes: S3.1 Host Data Reception and Temporary Storage: The host interface unit parses and caches the write command issued by the host, extracting the starting virtual logical block address and transmission length pointed to by the request; if the host has written file data before sending the write command, the data is cached. S3.2, Virtual logical block address to virtual logical allocation unit conversion: The host interface unit converts the starting virtual logical block address and its transmission length into one or more operation requests for the virtual logical allocation unit according to the size of the virtual logical allocation unit. If the request spans multiple virtual logical allocation units, it is split into multiple independent sub-requests. For each sub-request, the host interface unit calculates its target virtual logical allocation unit number and the sector offset within that unit. S3.3, Virtual-to-physical address translation: The host interface unit queries the virtual metadata maintained by the virtual logical allocation unit number to determine the file to which the unit belongs and its file number FID. Then, it sends an operation request to the mapping unit with the content {FID, virtual logical allocation unit number VLAUN, operation type}, where the operation type is write. The mapping unit queries its maintained virtual and physical address mapping table and returns the obtained device logical allocation unit number to the host interface unit; If the mapping unit finds that the virtual logical allocation unit has not yet been mapped, it queries the idle device logical allocation unit bitmap to allocate a new device logical allocation unit for it, queries the idle virtual logical allocation unit bitmap to allocate a new virtual logical allocation unit for it, and updates the virtual and physical address mapping table; the mapping unit returns the final device logical allocation unit number to the host interface unit. S3.4 Device Logic Block Address Reconstruction and Command Forwarding: The host interface unit calculates the precise device logical block address based on the received device logical allocation unit number and the previously calculated sector offset. It then replaces the virtual logical block address parameter in the original host write command with the calculated device logical block address, generating a write command pointing to the physical address of the USB mass storage device. The isolation scheduling unit initiates DMA, forwarding the data to be written temporarily stored in the host interface unit's cache and the newly generated write command to the device interface unit. S3.5, Physical data writing and metadata update: The device interface unit sends write commands and data to the USB mass storage device to perform a physical write. After the physical write is completed, it returns an acknowledgment signal to the host interface unit. The host interface unit then updates the virtual metadata it maintains and returns a status indicating that the write operation is complete to the host.

8. The method of using the USB mass storage device security isolation system according to claim 7, characterized in that, The virtual-to-physical address mapping table establishment process specifically includes: S4.1 Data Reception: The mapping unit receives the final device file list, the idle device logical allocation unit bitmap, and the virtual layout strategy from the host interface unit, and generates an idle virtual logical allocation unit bitmap according to the virtual layout strategy. Receive mapping data packets from the host interface unit; S4.2, Allocate mapping block space: The mapping unit allocates a contiguous block of unused storage space in the third-level mapping table for the current file based on the number of logical allocation units occupied in the mapping data packet. The starting address of this storage space is used as the base address of the mapping block. The base address of the mapping block, the starting VLAUN in the mapping data packet, and the number of logical allocation units occupied are used as entries in the second-level mapping table and written to a free address in the second-level mapping table. The address of the second-level mapping table is written to the address corresponding to the hash value of the FID in the first-level mapping table. S4.3, Filling Mapping Pairs: For each mapping pair (DLAUN, VLAUN) in this file, the target address of its filling position is the j-th mapping pair position in the table entry address i, and the corresponding mapping pair valid indicator bit is marked as valid, where: Entry address i = Mapped block base address + (VLAUN - starting VLAUN) / number of mapping pairs per entry; Mapping pair number j = (VLAUN - starting VLAUN) % Number of mapping pairs for each entry.

9. The method of using the USB mass storage device security isolation system according to claim 8, characterized in that, The virtual-to-physical address mapping table lookup process specifically includes: S5.1 Data Reception: The mapping unit receives an operation request {FID, Virtual Logical Allocation Unit Number VLAUN, Operation Type} from the host interface unit; S5.2 Parameter Acquisition: The first-level mapping table is read using the hash value of the FID as the address. The table entry contains the address of the second-level mapping table, where the number of addresses in the second-level mapping table is the same as the number of mapping blocks corresponding to the FID. Read the second-level mapping table based on the address obtained, and obtain the corresponding mapping block base address, starting VLAUN, and number of logical allocation units occupied; S5.3 Mapping Pair Location and Reading: First, the calculation formula in S4.3 is used to calculate the entry address i and mapping pair number j of the target mapping pair. Then, the entry address i of the third-level mapping table is read from the memory buffer of the programmable logic device. If the FID in the read entry content is consistent with the target FID, and the mapping pair validity indicator bit corresponding to the mapping pair number j is valid, then the j-th mapping pair in the entry address i is the target mapping pair, and the device logic allocation unit number DLAUN in the mapping pair is returned to the host interface unit as the result; otherwise, a mapping missing error is returned.

10. The method of using the USB mass storage device security isolation system according to claim 9, characterized in that, The virtual-physical address mapping table update process specifically includes: S6.1 Data Reception: The mapping unit receives an operation request {FID, Virtual Logical Allocation Unit Number VLAUN, Operation Type} from the host interface unit; S6.2 Mapping Pair Location and Reading: Based on the virtual logical allocation unit number VLAUN that needs to be updated, execute steps S5.1 to S5.3 of the virtual-physical address mapping table lookup process to accurately locate its corresponding table entry address i, mapping pair number j, and read the target mapping pair; if the target mapping pair does not exist, perform the mapping pair update operation. S6.3 Mapping Pair Update: The system queries the idle device logical allocation unit bitmap to allocate a new device logical allocation unit, queries the idle virtual logical allocation unit bitmap to allocate a new virtual logical allocation unit, and writes the new mapping pair into the third-level mapping table. If the newly added mapping pair exists in a new mapping block, the new mapping block information is updated in the second-level mapping table and the first-level mapping table. The mapping unit returns the final device logical allocation unit number to the host interface unit.

Images