Computer interface control method, device and electronic equipment

Abstract

The present invention discloses a computer interface control method, device and electronic device, the method comprising: starting the computer, controlling the target interface through BIOS, and releasing the filter driver and registering the registration table through the filter driver registration program and filter driver file embedded in the BIOS; after entering the operating system and the filter driver is started, notifying the BIOS to interrupt the control authority of the target interface, and enabling the filter driver to control the target interface. The technical solution provided by the present invention can improve the flexibility of managing the computer interface under the premise of ensuring the security of computer interface control.

Description

Technical Field

[0001] The present invention relates to the field of computer drive design, and in particular to a computer interface control method, device and electronic equipment. Background Art

[0002] With the popularization of informatization, personal computers (PCs) have brought us convenience in production and life, but have also caused countless security incidents, including network attacks, data leakage, viruses and Trojans. Network security and data security are not only related to individuals and enterprises, but also to national security. Computer interfaces such as USB are usually effective channels for computer virus transmission. More and more enterprises and individuals restrict access to the interfaces (referring to hardware interfaces) of internal computers. The technologies for restricting interfaces usually include BIOS control and filter driver control. The advantage of BIOS control is that no matter what operating system is installed on the PC, interface device access control can be performed, and it is difficult to exploit loopholes. The disadvantage is that the control is relatively strong. For similar devices, either all are controlled or all are released, which is not convenient for configuring control strategies. Filter driver is a special device driver that works at the upper or lower layer of the function driver, intercepts requests sent to or returned from the device, and is used for access control or device enhancement without modifying the device function driver. It can also configure a variety of control strategies, such as the mode of only releasing keyboards and mice, the mode of only intercepting the write operation of USB storage devices, and the mode of intercepting USB devices of specified models. However, users can make the filter driver invalid by deleting the registry entry in the operating system. Therefore, how to improve the flexibility of managing computer interfaces while ensuring the security of computer interface control is an urgent problem to be solved. Summary of the invention

[0003] In view of this, the embodiments of the present invention provide a computer interface control method, device and electronic device, thereby improving the flexibility of managing the computer interface while ensuring the security of computer interface control.

[0004] According to a first aspect, the present invention provides a computer interface control method, the method comprising: starting the computer, controlling the target interface through BIOS, and releasing the filter driver and registering the registry through the filter driver registration program and filter driver file embedded in the BIOS; after entering the operating system and the filter driver is started, notifying the BIOS to interrupt the control authority of the target interface, and enabling the filter driver to control the target interface.

[0005] Optionally, the method further includes: after entering the operating system and the filter driver is started, monitoring the registry entry of the filter driver by calling a registry callback function in the system kernel; if the registry entry is changed, restoring the registry entry to an initial state through the registry callback function.

[0006] Optionally, the filter driver is released and registered in the registry through the filter driver registration program and filter driver file embedded in the BIOS, including: releasing the filter driver registration program embedded in the BIOS to a first preset path and starting it through the Windows platform binary table; releasing the filter driver file embedded in the BIOS to a second preset path through the filter driver registration program, and registering the registration item of the filter driver file in the registry.

[0007] Optionally, the notifying BIOS to interrupt the control authority of the target interface and enabling the filter driver to control the target interface includes: sending an interrupt message to the BIOS through a system management interrupt interface so that the BIOS verifies the interrupt message and interrupts the control authority of the target interface when the interrupt message verification passes; attempting to control the target interface at a preset frequency through the filter driver so that the filter driver takes over the control authority of the target interface when the control authority of the BIOS is interrupted.

[0008] Optionally, controlling the target interface through BIOS includes: when the external device connected to the target interface is a storage device, intercepting the communication connection between the external device and the computer through BIOS.

[0009] Optionally, enabling the filter driver to control the target interface includes: allowing the external device to communicate with the computer, and monitoring the operation type of the external device, and when the operation type performed by the external device on the computer is a write operation, intercepting the write operation of the external device.

[0010] Optionally, enabling the filter driver to control the target interface further includes: when the device ID of the external device is a trusted ID preset by the filter driver, allowing a write operation of the external device.

[0011] According to a second aspect, the present invention provides a computer interface control device, which includes: a BIOS control module, which is used to start the computer, control the target interface through the BIOS, and release the filter driver and register the registry through the filter driver registration program and filter driver file embedded in the BIOS; a filter driver control module, which is used to notify the BIOS to interrupt the control authority of the target interface after the filter driver is started, and enable the filter driver to control the target interface.

[0012] According to the third aspect, an embodiment of the present invention provides an electronic device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the method described in the first aspect or any optional implementation manner of the first aspect by executing the computer instructions.

[0013] According to a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the method described in the first aspect or any optional implementation manner of the first aspect.

[0014] The technical solution provided by this application has the following advantages:

[0015] The technical solution provided by the present application is to firstly perform strong control on the target interface through BIOS when the computer is turned on, restrict the target interface to use only the mouse and keyboard or only allow external devices to perform read operations and other strategies; when entering the operating system and the filter driver is started, the BIOS is notified to interrupt the control authority of the target interface, and the filter driver is used to control the target interface, thereby realizing multiple control strategy configurations for the target interface and improving the flexibility of managing the target interface; in order to prevent the registry entries of the filter driver from being removed from the registry by outsiders, the registration program of the filter driver and the filter driver file are embedded in the BIOS; before each boot and entering the operating system, the filter driver registration program embedded in the BIOS is automatically run, the filter driver file is released and the registry entries of the filter driver are added to the registry to complete the registration of the registry, thereby increasing the difficulty for outsiders to remove the filter driver registry entries; outsiders need to modify the registration program and filter driver file embedded in the BIOS at the kernel level, which is quite difficult to operate; thereby, the flexibility of managing the computer interface is improved while ensuring the security of computer interface control.

[0016] In addition, in one embodiment of the present invention, after entering the operating system, the registry items of the filter driver are monitored by calling the registry callback function in the system kernel. If the registry items are changed, the registry items are restored to the initial state through the registry callback function. Through the above operation, even if an outsider removes the registry items at the user layer of the operating system, the callback function will be restored immediately, making the removal by the outsider fail. If the outsider wants to close the callback function, it needs to be modified at the kernel layer, which is quite difficult to operate, thereby further improving the security of computer interface control. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The features and advantages of the present invention will be more clearly understood by referring to the accompanying drawings, which are schematic and should not be construed as limiting the present invention in any way. In the accompanying drawings:

[0018] Figure 1 A schematic diagram showing the steps of a computer interface control method in one embodiment of the present invention is shown;

[0019] Figure 2 An exemplary diagram of a computer interface control method in one embodiment of the present invention is shown;

[0020] Figure 3 A schematic flow chart of a computer interface control method in one embodiment of the present invention is shown;

[0021] Figure 4 A schematic diagram of the structure of a computer interface control device in one embodiment of the present invention is shown;

[0022] Figure 5 A schematic structural diagram of an electronic device in one embodiment of the present invention is shown. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0024] See also Figure 1 and Figure 2 In one embodiment, a computer interface control method comprises the following steps:

[0025] Step S101: Start the computer, control the target interface through BIOS, and release the filter driver and register the registration table through the filter driver registration program and filter driver file embedded in the BIOS.

[0026] Step S102: After entering the operating system and the filter driver is started, the BIOS is notified to interrupt the control authority of the target interface, and the filter driver is enabled to control the target interface.

[0027] Specifically, before the computer is turned on and enters the operating system, the target interface is first strongly controlled by the BIOS, for example: restricting the target interface to only use the mouse and keyboard or only allowing external devices to perform read operations and other strategies. Since the control method is set in the BIOS interface, the embodiment of the present invention will also set an access password for the BIOS to prevent malicious tampering. After entering the operating system and the filter driver is started, the BIOS is notified to interrupt the BIOS's control authority over the target interface, and the filter driver is used to control the target interface, thereby realizing the configuration of multiple control strategies for the target interface and improving the flexibility of managing the target interface. Taking the USB interface as an example, there are usually two opportunities for the filter driver to start. The first is the first registration of the filter driver, such as reinstalling the system, resetting the system, etc. Before restarting, the first USB device needs to be inserted to start. Once started, it will not stop; the second is that the filter driver has been registered. In the initial boot stage of the system startup, due to the existence of the built-in USB controller (also a USB device), the filter driver will start early with the USB controller (earlier than the filter driver registration program).

[0028] The computer operating system used by the outsider belongs to the win32 subsystem, which belongs to the user level. The outsider can find the registry item of the filter driver in the registry and remove the registry item to make the filter driver invalid. In this embodiment, in order to prevent the registry item of the filter driver from being removed from the registry by the outsider, the registration program of the filter driver and the filter driver file are embedded in the BIOS. Before each boot and entering the operating system, the filter driver registration program embedded in the BIOS will be automatically run, the filter driver file will be released, and the registry item of the filter driver will be added to the registry to complete the registration of the registry, thereby increasing the difficulty of removing the filter driver registry item by the outsider and improving the security of computer interface management.

[0029] In this embodiment, the specific steps of step S101 are as follows:

[0030] Step 1: Release the filter driver registration program embedded in the BIOS to the first preset path through the Windows platform binary table and start it.

[0031] Step 2: Release the filter driver file embedded in the BIOS to the second preset path through the filter driver registration program, and register the registration item of the filter driver file in the registry.

[0032] Specifically, in this embodiment, computer interface management is applied to a computer environment of a windows operating system. In this environment, the driver file of the filter driver and the NativeApp (local application, i.e., filter driver registration program) responsible for registering the filter driver are first embedded in the BIOS. After the operating system is started, the NativeApp is automatically released and executed through the WPBT (Windows Platform Binary Table, windows platform binary table) technology. The NativeApp will read and release the driver file stored in the BIOS to the hard disk, and register the filter driver. WPBT is a component that comes with most windows computers and can be configured through the BIOS. The main function of WPBT is to allow key software to continue to exist, even if the operating system has been changed or reinstalled with a "clean" configuration. The WPBT function provides some software with the ability to be reinstalled into the operating system and continue to work as expected. The embodiment of the present invention uses the characteristics of WPBT to embed the registration program and driver file of the filter driver in the BIOS, so that each time the computer is turned on, regardless of whether the filter driver exists in the computer, the filter driver will be reinstalled and registered through the WPBT technology. Even if the registry entry is removed in the WinPE environment, it will be registered again after the system is started. Improve the difficulty of removing the filter driver registry entry by outsiders. Under Windows, first add the driver service entry, then in the registry interface installation class item (such as the USB installation class item), add the driver service name to the UpperFilters key value to complete the registration of the filter driver. When the user inserts the external device corresponding to the target interface, the filter driver will be automatically loaded.

[0033] like Figure 3 As shown, in this embodiment, the specific operation steps of the above step S102 are as follows:

[0034] Step 3: Send an interrupt message to the BIOS through the system management interrupt interface, so that the BIOS verifies the interrupt message and interrupts the control authority of the target interface when the interrupt message verification passes.

[0035] Step 4: Attempt to control the target interface at a preset frequency through the filter driver, so that the filter driver takes over the control authority of the target interface when the control authority of the BIOS is interrupted.

[0036] Specifically, in this embodiment, after the operating system is started and the filter driver is started, it will actively communicate with the BIOS to inform the BIOS whether the filter driver is enabled. If it is not enabled, it is controlled by the BIOS. If it is enabled, it is controlled by the filter driver. The specific communication method is that the filter driver writes data to the I / O port of SMI (System Management Interrupts, a function interface in the kernel system) to generate an SMI interrupt message (usually a string code). After the BIOS receives the interrupt message, the BIOS verifies the interrupt message, for example, to determine whether the string code is incorrect. If it is correct, the verification passes, and the BIOS stops controlling the target interface. Since the control authority of the target interface has been occupied by the BIOS before, the filter driver tries to control but fails. When the BIOS stops controlling, the filter driver takes over the control of the target interface and completes the switching of control authority.

[0037] Specifically, in one embodiment, a computer interface control method further includes the following steps:

[0038] Step 5: After entering the operating system and the filter driver is started, the registry entries of the filter driver are monitored by calling the registry callback function in the system kernel.

[0039] Step 6: If the registry key is changed, restore the registry key to its initial state through the registry callback function.

[0040] Specifically, since the registration of the filter driver is realized by adding a registry entry and a key value, the user can manually delete the registry entry in the operating system so that the driver is no longer controlled after inserting a USB device, so this embodiment performs self-protection of the filter driver, that is, registry protection. By adding a callback function mechanism to the filter driver, registering the "registry callback function" (calling the kernel function ObRegisterCallbacks) in the ObjectHook mode, monitoring the computer USB and other interfaces to install the class UpperFilters key value and the filter driver service item, once the registry entry is detected to be modified, it is immediately repaired. Since the filter driver works at the kernel level and does not belong to the same subsystem as the user layer (win32 subsystem) used by external personnel, external personnel cannot directly remove this registry protection at the user layer, and the registry operation of the user layer will be intercepted, thereby realizing self-protection. If an external personnel wants to intercept the operation of the callback function, it is necessary to write another driver at the kernel layer to intercept the work of the filter driver, which is quite difficult to operate. Therefore, based on the above steps, the computer interface control method provided by the present invention uses the dual protection of WPBT technology and registry protection, so that the removal of the filter driver before and after the system is started can be resolved or intercepted, ensuring the normal operation of the filter driver and improving the security of the computer management interface.

[0041] Specifically, in one embodiment, a method for managing a computer interface by cooperating between a BIOS and a filter driver includes the following steps:

[0042] Step 7: When the BIOS manages the target interface, if the external device connected to the target interface is a storage device, the communication connection between the external device and the computer is intercepted by the BIOS.

[0043] Step 8: When the filter driver manages the target interface, the communication connection between the external device and the computer is allowed, and the operation type of the external device is monitored. When the operation type performed by the external device on the computer is a write operation, the write operation of the external device is intercepted.

[0044] Specifically, in this embodiment, when the BIOS manages the target interface, when it is determined that the external device connected to the target interface is a storage device, that is, it is determined that the device has the risk of inputting virus programs into the computer through the target interface, the communication connection between the external device and the computer is intercepted to ensure the security of the computer. At this time, only devices without storage and output transmission such as mice and keyboards are allowed to connect. After entering the operating system, the task of managing the target interface is switched to the filter driver for execution. The filter driver allows external devices including storage devices to be connected, but the external device cannot write to the computer, but can only read, to prevent virus programs from entering the computer through the target interface. Under the premise of ensuring the security of the interface, the flexibility of target interface management is improved.

[0045] Furthermore, in another embodiment, managing the target interface through the filter driver further includes the following steps:

[0046] Step 9: When the device ID of the external device is a trusted ID preset by the filter driver, the write operation of the external device is allowed. Specifically, compared with BIOS control, the filter driver can receive application layer policies, such as serial number, model and other policy controls to meet customization requirements. In this embodiment, the filter driver is set to add the device ID of the external device as the information ID. When the device ID of a certain external device successfully matches the information ID, the device can be allowed to perform a write operation, thereby further improving the flexibility of computer interface management.

[0047] Through the above steps, the technical solution provided by the present application performs strong control on the target interface through BIOS before the computer is turned on and enters the operating system, restricts the target interface to use only the mouse and keyboard or only allows external devices to perform read operations and other strategies. When entering the operating system and the filter driver is started, the BIOS is notified to interrupt the control authority of the target interface, and the filter driver is used to control the target interface, thereby realizing multiple control strategy configurations for the target interface and improving the flexibility of managing the target interface. In order to prevent the registry entries of the filter driver from being removed from the registry by outsiders, the registration program of the filter driver and the filter driver file are embedded in the BIOS. Before each boot-up and entering the operating system, the filter driver registration program embedded in the BIOS will be automatically run, the filter driver file will be released, and the registry entries of the filter driver will be added to the registry to complete the registration of the registry, thereby increasing the difficulty for outsiders to remove the filter driver registry entries. The modification of the registration program and filter driver file embedded in the BIOS by outsiders needs to be implemented at the kernel level, and the operation difficulty is quite large. Therefore, under the premise of ensuring the security of computer interface control, the flexibility of managing computer interfaces is improved.

[0048] In addition, in one embodiment of the present invention, after entering the operating system, the registry items of the filter driver are monitored by calling the registry callback function in the system kernel. If the registry items are changed, the registry items are restored to the initial state through the registry callback function. Through the above operation, even if an outsider removes the registry items at the user layer of the operating system, the callback function will be restored immediately, making the removal by the outsider fail. If the outsider wants to close the callback function, it needs to be modified at the kernel layer, which is quite difficult to operate, thereby further improving the security of computer interface control.

[0049] like Figure 4 As shown, this embodiment also provides a computer interface control device, the device comprising:

[0050] The BIOS control module 101 is used to start the computer, control the target interface through the BIOS, and release the filter driver and register the registration table through the filter driver registration program and filter driver file embedded in the BIOS. For details, please refer to the relevant description of step S101 in the above method embodiment, which will not be repeated here.

[0051] The filter driver control module 102 is used to notify the BIOS to interrupt the control authority of the target interface and enable the filter driver to control the target interface after entering the operating system and starting the filter driver. For details, please refer to the relevant description of step S102 in the above method embodiment, which will not be repeated here.

[0052] A computer interface control device provided in an embodiment of the present invention is used to execute a computer interface control method provided in the above embodiment. Its implementation method and principle are the same. For details, please refer to the relevant description of the above method embodiment and will not be repeated here.

[0053] Through the collaboration of the above components,

[0054] The technical solution provided by the present application is to strongly control the target interface through BIOS before the computer is turned on and enters the operating system, restrict the target interface to use only the mouse and keyboard or only allow external devices to perform read operations and other strategies. When entering the operating system and the filter driver is started, the BIOS is notified to interrupt the control authority of the target interface, and the filter driver is used to control the target interface, thereby realizing multiple control strategy configurations for the target interface and improving the flexibility of managing the target interface. In order to prevent the registry entries of the filter driver from being removed from the registry by outsiders, the registration program of the filter driver and the filter driver file are embedded in the BIOS. Before each boot and entering the operating system, the filter driver registration program embedded in the BIOS will be automatically run, the filter driver file will be released and the registry entries of the filter driver will be added to the registry to complete the registration of the registry, thereby increasing the difficulty for outsiders to remove the filter driver registry entries. The modification of the registration program and filter driver file embedded in the BIOS by outsiders needs to be implemented at the kernel level, and the operation is quite difficult. Therefore, under the premise of ensuring the security of computer interface control, the flexibility of managing computer interfaces is improved.

[0055] In addition, in one embodiment of the present invention, after entering the operating system, the registry items of the filter driver are monitored by calling the registry callback function in the system kernel. If the registry items are changed, the registry items are restored to the initial state through the registry callback function. Through the above operation, even if an outsider removes the registry items at the user layer of the operating system, the callback function will be restored immediately, making the removal by the outsider fail. If the outsider wants to close the callback function, it needs to be modified at the kernel layer, which is quite difficult to operate, thereby further improving the security of computer interface control.

[0056] Figure 5 An electronic device according to an embodiment of the present invention is shown, the device includes a processor 901 and a memory 902, which can be connected via a bus or other means. Figure 5 The example of connecting through bus is taken in the following.

[0057] The processor 901 may be a central processing unit (CPU). The processor 901 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0058] The memory 902 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the methods in the above method embodiments. The processor 901 executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory 902, that is, implementing the methods in the above method embodiments.

[0059] The memory 902 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required by at least one function; the data storage area may store data created by the processor 901, etc. In addition, the memory 902 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 902 may optionally include a memory remotely arranged relative to the processor 901, and these remote memories may be connected to the processor 901 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0060] One or more modules are stored in the memory 902 , and when executed by the processor 901 , the method in the above method embodiment is executed.

[0061] The specific details of the above electronic device can be understood by referring to the corresponding descriptions and effects in the above method embodiments, and will not be repeated here.

[0062] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the implemented program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0063] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A computer interface control method, characterized in that: The method comprises: Start the computer, control the target interface through BIOS, and release the filter driver and register the registry through the filter driver registration program and filter driver file embedded in BIOS; After entering the operating system and starting the filter driver, the BIOS is notified to interrupt the control authority of the target interface and enable the filter driver to control the target interface.

2. The method according to claim 1, characterized in that The method further comprises: After entering the operating system and the filter driver is started, monitoring the registry entries of the filter driver by calling a registry callback function in the system kernel; If the registry entry is changed, the registry entry is restored to an initial state through the registry callback function.

3. The method according to claim 1, characterized in that The method of releasing the filter driver and registering the registration table through the filter driver registration program and the filter driver file embedded in the BIOS includes: Release the filter driver registration program embedded in the BIOS to a first preset path through the Windows platform binary table and start it; The filter driver file embedded in the BIOS is released to the second preset path through the filter driver registration program, and the registration item of the filter driver file is registered in the registration table.

4. The method according to claim 1, characterized in that: The notifying BIOS to interrupt the control authority of the target interface and enabling the filter driver to control the target interface includes: Sending an interrupt message to the BIOS through the system management interrupt interface, so that the BIOS verifies the interrupt message, and when the interrupt message passes the verification, interrupting the control authority of the target interface; The filter driver attempts to control the target interface at a preset frequency, so that the filter driver takes over the control authority of the target interface when the control authority of the BIOS is interrupted.

5. The method according to claim 1, characterized in that: The controlling the target interface through BIOS includes: When the external device connected to the target interface is a storage device, the communication connection between the external device and the computer is intercepted by BIOS.

6. The method according to claim 5, characterized in that The enabling of the filter driver to control the target interface includes: The external device is allowed to communicate with the computer, and the operation type of the external device is monitored. When the operation type performed by the external device on the computer is a write operation, the write operation of the external device is intercepted.

7. The method according to claim 6, characterized in that The enabling of the filter driver to control the target interface further includes: When the device ID of the external device is a trusted ID preset by the filter driver, a write operation of the external device is allowed.

8. A computer interface control device, characterized in that: The device comprises: The BIOS control module is used to start the computer, control the target interface through the BIOS, and release the filter driver and register the registry through the filter driver registration program and filter driver file embedded in the BIOS; The filter driver control module is used to notify the BIOS to interrupt the control authority of the target interface and enable the filter driver to control the target interface after entering the operating system and starting the filter driver.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the method according to any one of claims 1 to 7.

Images