A method, device and storage medium for secure mounting and unmounting of a USB device

Abstract

The application provides a USB device safe mounting and unloading method, device and storage medium, wherein the method comprises the following steps: obtaining an API request for mounting a specified mounting USB device; if the specified mounting USB device is in a USB device list, obtaining all parameters and access passwords of the specified mounting USB device; if all parameters and access passwords of the specified mounting USB device are correct, calling a bottom virtualization capability to mount the specified mounting USB device; obtaining an API request for unloading a specified unloading USB device; if the specified unloading USB device is in the USB device list, obtaining all parameters and access passwords of the specified unloading USB device; if all parameters and access passwords of the specified unloading USB device are correct, calling a bottom virtualization capability to unload the specified unloading USB device. The application protects USB devices of a user from being mounted and unloaded by virtual machines of other users and protects data safety of the USB devices.

Description

Technical Field

[0001] This invention belongs to the field of USB physical device management technology, and particularly relates to a method, device and storage medium for securely mounting and unmounting USB devices. Background Technology

[0002] OpenStack is an open-source cloud computing management platform project, a collection of open-source software projects. OpenStack provides scalable and elastic cloud computing services for private and public clouds. The project aims to provide a simple-to-implement, scalable, feature-rich, and standardized cloud computing management platform. As a cloud operating system at the IaaS layer, OpenStack provides and manages three main categories of resources for virtual machines: compute, storage, and networking. Key services include Nova (compute service), Cinder (storage service), Neutron (network service), Glance (image service), and Keystone (authentication and access control service).

[0003] Nova is the core service of OpenStack, primarily responsible for maintaining and managing computing resources in the cloud environment. Nova's architecture is relatively complex, comprising many components. These components run as sub-services (background daemon processes) and can be categorized as follows:

[0004] 1) nova-api is the portal for the entire nova component, receiving and responding to client API calls. All requests to Nova are first processed by nova-api. nova-api exposes several HTTP REST API interfaces to the outside world.

[0005] 2) nova-scheduler virtual machine scheduling service, which is responsible for deciding on which compute node to run the virtual machine.

[0006] 3) nova-conductor acts as an intermediary layer when the compute node accesses the database, responsible for querying and updating the database. For security and scalability reasons, nova-compute does not directly access the database, but delegates the creation, modification, and querying of database information to the nova-conductor service.

[0007] 4) nova-compute is the core service for managing virtual machines, running on compute nodes. It manages the lifecycle of instances on the nodes by calling the Hypervisor API. Ultimately, all OpenStack operations on virtual machines are handled by nova-compute. nova-compute, together with the Hypervisor, implements OpenStack's management of the virtual machine lifecycle.

[0008] Libvirt is currently the most widely used application programming interface (API) for managing KVM virtual machines. As an open-source API, daemon, and management tool for managing virtualization platforms, it can be used to manage KVM, Xen, VMware ESX, QEMU, and other virtualization technologies. Taking QEMU-KVM as a hypervisor as an example, by calling the Libvirt API, one can query the USB devices inserted into the compute node and mount the specified USB devices to the virtual machine in real time, implementing basic functions such as USB device mounting and unmounting.

[0009] For virtual machines running on cloud platforms, there are often requirements such as needing to insert a dongle for authentication or needing to transfer confidential data via USB devices or external hard drives. Due to these issues, OpenStack-based cloud platforms currently do not support dynamic mounting and unmounting of USB devices. Furthermore, when multiple users mount USB devices simultaneously, there is no guarantee that the user's USB device will not be maliciously mounted by other users, thus posing a significant risk of data leakage to the user's USB device data. There is also a security risk that the user's USB device may be maliciously unmounted by other users. Summary of the Invention

[0010] This invention addresses the shortcomings of existing technologies by providing a method, apparatus, and storage medium for securely mounting and unmounting USB devices.

[0011] In a first aspect, the present invention provides a method for securely mounting and unmounting a USB device, comprising:

[0012] Get the API request to query the list of USB devices;

[0013] Get the API request to mount the specified USB device;

[0014] If the requested USB device is in the USB device list, then retrieve all parameters and access password for the requested USB device.

[0015] If all parameters and access passwords for the specified USB device are correct, the underlying virtualization capabilities are invoked to mount the specified USB device.

[0016] Get the API request to uninstall the specified USB device;

[0017] If the requested uninstallation USB device is in the USB device list, then obtain all parameters and access password for the requested uninstallation USB device;

[0018] If all parameters and access passwords for the specified USB device to be uninstalled are correct, the underlying virtualization capabilities are invoked to uninstall the specified USB device.

[0019] Furthermore, the API request to obtain the list of USB devices includes:

[0020] Get the ID of the host machine where the virtual machine is located;

[0021] Call the API interface for querying the list of USB devices;

[0022] When the server receives a user request, it verifies the validity of the input parameters;

[0023] The nova-api side sends requests to the nova-compute service component for processing via synchronous calls and prepares to receive the processed results.

[0024] Upon receiving a synchronization request, the nova-compute service component retrieves USB device information from the current host by invoking the underlying virtualization capabilities. This USB device information includes: dev_id, bus, device, product_id, and vendor_id.

[0025] If the USB device information is obtained, the nova-compute service component synchronously returns a success message and information about all USB devices on the host machine to the API service component;

[0026] If the USB device information is not obtained, the nova-compute service component synchronously returns failure information and a description of the failure reason to the API service component.

[0027] Furthermore, if all parameters and access password of the specified mounted USB device are correct, then invoking the underlying virtualization capabilities to mount the specified mounted USB device includes:

[0028] Retrieve the specified action; the specified action is attach_usb_devices;

[0029] Specify the parameters for mounting the USB device in the request body; the parameters for mounting the USB device include: dev_id, bus, device, product_id, and vendor_id;

[0030] Call the API interface for mounting USB devices;

[0031] When the server receives a user request, it verifies the validity of the input parameters;

[0032] The nova-api side updates the virtual machine's task status to "mounting USB device" and sends the request to the nova-conduct service component for processing via synchronous calls, and is ready to receive the processed result.

[0033] Upon receiving a request for a synchronization call, the nova-conduct service component verifies the owner of the specified mounted USB device.

[0034] If USB device parameters are specified, the access password for the specified mounted USB device is verified.

[0035] If the access password is correct, a verification successful message will be returned;

[0036] The nova-conductor service component sends requests to the nova-compute service component for processing via synchronous remote calls, and prepares to receive the processed results.

[0037] Upon receiving the synchronous remote call request, the nova-compute service component will send a notification to the message queue and mount the specified USB device by invoking the underlying virtualization capabilities.

[0038] Furthermore, if no USB device parameters are specified, then

[0039] Acquire a host lock to ensure that only one user is allowed to mount a newly inserted USB device at a time;

[0040] The user is prompted to insert the USB device into the host machine's USB port;

[0041] Detect new USB devices;

[0042] Set the new USB device to use a password;

[0043] Release the host machine lock and return a verification successful message.

[0044] Furthermore, if the host machine lock is not acquired, the user is notified that other virtual machines on the host machine are performing USB mounting operations, and the USB mounting operation is re-performed after the target time.

[0045] Furthermore, if the specified USB device is successfully mounted, the nova-compute service component will synchronously return success information and information about the mounted USB device.

[0046] If the specified USB device fails to mount, the nova-compute service component will synchronously return failure information and the reason for failure.

[0047] Furthermore, if all parameters and access password for the specified USB device to be unloaded are correct, then the underlying virtualization capabilities are invoked to unload the specified USB device, including:

[0048] Retrieve the specified action; the specified action is detach_usb_devices;

[0049] Specify the parameters for unloading the USB device in the request body; the parameters for unloading the USB device include: dev_id, bus, device, product_id, and vendor_id;

[0050] Call the API interface for unloading the USB device;

[0051] When the server receives a user request, it verifies the validity of the input parameters;

[0052] The nova-api side updates the virtual machine's task status to "Unmounting USB device" and sends the request to the nova-conduct service component for processing via synchronous calls, and is ready to receive the processed result.

[0053] Upon receiving a request for a synchronization call, the nova-conduct service component verifies the owner of the specified unmounted USB device.

[0054] If the access password for the USB device exists and passes verification, a verification success message will be returned.

[0055] If no access password is specified or the password verification fails, a verification failure message will be returned.

[0056] The nova-conductor service component sends requests to the nova-compute service component for processing via synchronous calls and prepares to receive the processed results.

[0057] Upon receiving a synchronization call request, the nova-compute service component will send a notification to the message queue and unload the specified USB device by invoking the underlying virtualization capabilities.

[0058] Furthermore, if the specified uninstalled USB device is successfully uninstalled, the nova-compute service component synchronously returns success information and information about the uninstalled USB device;

[0059] If the specified uninstallation of the USB device fails, the nova-compute service component will synchronously return failure information and the reason for failure.

[0060] In a second aspect, the present invention provides a computer device including a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the steps of the method for securely mounting and unmounting a USB device as described in any one of claims 1-8.

[0061] Thirdly, the present invention provides a computer-readable storage medium for storing a computer program; when executed by a processor, the computer program implements the steps of the method for securely mounting and unmounting a USB device as described in any one of claims 1-8.

[0062] This invention provides a method, apparatus, and storage medium for securely mounting and unmounting USB devices. The method includes: obtaining an API request to query a list of USB devices; obtaining an API request to mount a specified USB device; if the specified USB device is in the list, obtaining all parameters and access password of the specified USB device; if all parameters and access password of the specified USB device are correct, invoking the underlying virtualization capabilities to mount the specified USB device; obtaining an API request to unmount a specified USB device; if the specified USB device is in the list, obtaining all parameters and access password of the specified USB device; if all parameters and access password of the specified USB device are correct, invoking the underlying virtualization capabilities to unmount the specified USB device. This invention protects a user's USB device from being mounted by other users' virtual machines when multiple users mount USB devices simultaneously; protects a user's USB device from being maliciously unmounted by other users when the user is using the USB device; and protects the data security of the user's USB device when it is in an unmounted state but is not promptly unplugged from the interface. Attached Figure Description

[0063] To more clearly illustrate the technical solution of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0064] Figure 1 A flowchart illustrating a method for securely mounting and unmounting a USB device, provided in an embodiment of the present invention;

[0065] Figure 2 A flowchart for securely mounting a USB device provided in an embodiment of the present invention;

[0066] Figure 3 A flowchart for securely unloading a USB device provided in an embodiment of the present invention. Detailed Implementation

[0067] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] In one embodiment, such as Figure 1 As shown, this embodiment of the invention provides a method for securely mounting and unmounting a USB device, including:

[0069] Step 101: Obtain the API request to query the list of USB devices.

[0070] In this step, when calling the API interface to query the list of USB devices, the user needs to specify the ID of the host to be queried, that is, the ID of the host machine where the virtual machine is located.

[0071] When the server receives a user request, it verifies the validity of the input parameters.

[0072] The nova-api side sends requests to the nova-compute service component for processing via synchronous calls and prepares to receive the processed results.

[0073] Upon receiving a synchronization request, the nova-compute service component retrieves USB device information from the current host by invoking the underlying virtualization capabilities. This USB device information includes: dev_id, bus, device, product_id, and vendor_id.

[0074] If USB device information is obtained, the nova-compute service component synchronously returns a success message and all USB device information of the host machine to the API service component, indicating that the query for USB device information was successful.

[0075] If the USB device information is not obtained, the nova-compute service component synchronously returns a failure message and a description of the reason for failure to the API service component, indicating that the query for USB device information failed.

[0076] Step 102: Obtain the API request to mount the specified USB device.

[0077] Step 103: If the requested USB device is in the USB device list, then obtain all parameters and access password of the requested USB device.

[0078] Step 104: If all parameters and access password of the specified mounted USB device are correct, then invoke the underlying virtualization capabilities to mount the specified mounted USB device.

[0079] In this step, such as Figure 2 As shown, when calling the API interface to mount a USB device, the user needs to specify the action as `attach_usb_devices`; the parameters of the USB device to be mounted must be specified in the request body, including: `dev_id`, `bus`, `device`, `product_id`, and `vendor_id`. These parameters can be obtained by querying the USB device list via the API. If no parameters are specified for mounting the USB device, it means that the USB device has not yet been inserted into the host; if some parameters of the USB device are missing, the mounting operation cannot be completed. Additionally, if USB device parameters are specified, the access password for the USB device must also be specified in the request body to ensure that the USB device is securely mounted; specifically...

[0080] Get the specified action; the specified action is attach_usb_devices.

[0081] Specify the parameters for mounting the USB device in the request body; the parameters for mounting the USB device include: dev_id, bus, device, product_id, and vendor_id.

[0082] Call the API interface for mounting USB devices.

[0083] When the server receives a user request, it verifies the validity of the input parameters.

[0084] The nova-api side updates the virtual machine's task status by mounting a USB device and sends the request to the nova-conduct service component for processing via synchronous calls, and is ready to receive the processed result.

[0085] Upon receiving a request for a synchronization call, the nova-conduct service component verifies the owner of the specified mounted USB device.

[0086] If USB device parameters are specified, the access password for the specified mounted USB device is verified.

[0087] If the access password is correct, a verification successful message will be returned.

[0088] If no USB device parameters are specified, a host lock is acquired to ensure that only one user can mount a newly inserted USB device at a time. The host lock has a valid holding time; it will be automatically released and the mounting process canceled after the valid holding period expires.

[0089] The user is prompted to insert the USB device into the host machine's USB port.

[0090] Detect new USB devices.

[0091] Set the new USB device to use a password.

[0092] Release the host machine lock and return a verification successful message.

[0093] If the host machine lock is not acquired, the user is notified that another virtual machine on the host machine is performing a USB mounting operation, and the USB mounting operation is re-performed after a target time (e.g., 60 seconds).

[0094] The nova-conductor service component sends requests to the nova-compute service component for processing via synchronous remote calls and prepares to receive the processed results.

[0095] Upon receiving the synchronous remote call request, the nova-compute service component will send a notification to the message queue, indicating that the USB device mounting operation has begun. By calling the underlying virtualization capabilities, the specified USB device is mounted, thereby achieving the mounting of the USB device.

[0096] Meanwhile, the nova-compute service component continuously monitors the mount status of USB devices:

[0097] If the specified USB device is successfully mounted, the nova-compute service component will synchronously return a success message and information about the mounted USB device.

[0098] If the specified USB device fails to mount, the nova-compute service component will synchronously return failure information and the reason for failure.

[0099] Step 105: Obtain the API request to uninstall the specified USB device.

[0100] Step 106: If the requested uninstallation USB device is in the USB device list, then obtain all parameters and access password of the requested uninstallation USB device.

[0101] Step 107: If all parameters and access passwords for the specified uninstall USB device are correct, then invoke the underlying virtualization capabilities to uninstall the specified uninstall USB device.

[0102] In this step, such as Figure 3 As shown, when calling the API interface to unload a USB device, the user needs to specify the action as detach_usb_devices and specify the parameters of the USB device to be unloaded in the request body, including dev_id, bus, device, product_id and vendor_id. These parameters can be obtained by querying the list of USB devices in the virtual machine.

[0103] If some parameters of the USB device to be unloaded are missing, the unloading operation cannot be completed. Additionally, the access password for the USB device must be specified in the request body to ensure the USB device is securely unloaded. Specifically,

[0104] Get the specified action; the specified action is detach_usb_devices.

[0105] Specify the parameters for unloading the USB device in the request body; the parameters for unloading the USB device include: dev_id, bus, device, product_id, and vendor_id.

[0106] Call the API interface for unloading USB devices.

[0107] When the server receives a user request, it verifies the validity of the input parameters.

[0108] The nova-api side updates the virtual machine's task status as "Unmounting USB device" and sends the request to the nova-conduct service component for processing via synchronous calls, and is ready to receive the processed result.

[0109] Upon receiving a request for a synchronization call, the nova-conduct service component verifies the owner of the specified unmounted USB device.

[0110] If the access password for the USB device exists and passes verification, a verification success message will be returned.

[0111] If no access password is specified or the password verification fails, a verification failure message will be returned.

[0112] The nova-conductor service component sends requests to the nova-compute service component for processing via synchronous calls and prepares to receive the processed results.

[0113] Upon receiving a synchronization call request, the nova-compute service component will send a notification to the message queue, indicating that the USB device unloading operation has begun. This is done by invoking the underlying virtualization capabilities to unload the specified USB device.

[0114] Meanwhile, the nova-compute service component continuously monitors the unmounting status of USB devices:

[0115] If the specified USB device is successfully uninstalled, the nova-compute service component will synchronously return a success message and information about the uninstalled USB device, indicating that the USB device was successfully uninstalled.

[0116] If the specified uninstallation of the USB device fails, the nova-compute service component will synchronously return failure information and failure reason information, indicating that the USB device uninstallation has failed.

[0117] In another embodiment, the present invention also provides a computer device including a processor and a memory; wherein the processor executes a computer program stored in the memory to implement the method for securely mounting and unmounting a USB device disclosed in the foregoing embodiments.

[0118] For a more detailed explanation of the above method, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0119] In another embodiment, the present invention also provides a computer-readable storage medium for storing a computer program; when the computer program is executed by a processor, it implements the aforementioned method for securely mounting and unmounting a USB device.

[0120] For a more detailed explanation of the above method, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0121] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the devices and storage media disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0122] Those skilled in the art will clearly understand that the techniques in the embodiments of the present invention can be implemented using software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions in the embodiments of the present invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or certain parts of the embodiments of the present invention.

[0123] The present invention has been described in detail above with reference to specific embodiments and exemplary examples; however, these descriptions should not be construed as limiting the present invention. Those skilled in the art will understand that various equivalent substitutions, modifications, or improvements can be made to the technical solutions and embodiments of the present invention without departing from the spirit and scope of the invention, and all such modifications and improvements fall within the scope of the present invention. The scope of protection of the present invention is defined by the appended claims.

Claims

1. A method for securely mounting and unmounting a USB device, characterized in that, include: Get the API request to query the list of USB devices; Get the API request to mount the specified USB device; If the requested USB device is in the USB device list, then retrieve all parameters and access password for the requested USB device. If all parameters and access passwords for the specified USB device are correct, the underlying virtualization capabilities are invoked to mount the specified USB device. Get the API request to uninstall the specified USB device; If the requested uninstallation USB device is in the USB device list, then obtain all parameters and access password for the requested uninstallation USB device; If all parameters and access passwords specified for unloading the USB device are correct, the underlying virtualization capabilities are invoked to unload the specified USB device, specifically including: Retrieve the specified action; the specified action is detach_usb_devices; Specify the parameters for unloading the USB device in the request body; the parameters for unloading the USB device include: dev_id, bus, device, product_id, and vendor_id; Call the API interface for unloading the USB device; When the server receives a user request, it verifies the validity of the input parameters; The nova-api side updates the virtual machine's task status to "Unmounting USB device" and sends the request to the nova-conductor service component for processing via synchronous calls, and prepares to receive the processed result. Upon receiving a request for a synchronization call, the nova-conductor service component verifies the owner of the specified unmounted USB device. If the access password for the USB device exists and passes verification, a verification success message will be returned. If no access password is specified or the password verification fails, a verification failure message will be returned. The nova-conductor service component sends requests to the nova-compute service component for processing via synchronous calls and prepares to receive the processed results. Upon receiving a synchronization call request, the nova-compute service component will send a notification to the message queue and unload the specified USB device by invoking the underlying virtualization capabilities.

2. The method for securely mounting and unmounting a USB device according to claim 1, characterized in that, The API request to retrieve the list of USB devices includes: Get the ID of the host machine where the virtual machine is located; Call the API interface for querying the list of USB devices; When the server receives a user request, it verifies the validity of the input parameters; The nova-api side sends requests to the nova-compute service component for processing via synchronous calls and prepares to receive the processed results. Upon receiving a synchronization request, the nova-compute service component retrieves USB device information from the current host by invoking the underlying virtualization capabilities. This USB device information includes: dev_id, bus, device, product_id, and vendor_id. If the USB device information is obtained, the nova-compute service component synchronously returns a success message and information about all USB devices on the host machine to the API service component; If the USB device information is not obtained, the nova-compute service component synchronously returns failure information and a description of the failure reason to the API service component.

3. The method for securely mounting and unmounting a USB device according to claim 1, characterized in that, If all parameters and access password for the specified USB device are correct, then the underlying virtualization capabilities are invoked to mount the specified USB device, including: Retrieve the specified action; the specified action is attach_usb_devices; Specify the parameters for mounting the USB device in the request body; the parameters for mounting the USB device include: dev_id, bus, device, product_id, and vendor_id; Call the API interface for mounting USB devices; When the server receives a user request, it verifies the validity of the input parameters; The nova-api side updates the virtual machine's task status to "mounting USB device" and sends the request to the nova-conductor service component for processing via synchronous calls, and prepares to receive the processed result. Upon receiving a request for a synchronization call, the nova-conductor service component verifies the owner of the specified mounted USB device. If USB device parameters are specified, the access password for the specified mounted USB device is verified. If the access password is correct, a verification successful message will be returned; The nova-conductor service component sends requests to the nova-compute service component for processing via synchronous remote calls, and prepares to receive the processed results. Upon receiving the synchronous remote call request, the nova-compute service component will send a notification to the message queue and mount the specified USB device by invoking the underlying virtualization capabilities.

4. The method for securely mounting and unmounting a USB device according to claim 3, characterized in that, If no USB device parameter is specified, then Acquire a host lock to ensure that only one user is allowed to mount a newly inserted USB device at a time; The user is prompted to insert the USB device into the host machine's USB port; Detect new USB devices; Set the new USB device to use a password; Release the host machine lock and return a verification successful message.

5. The method for securely mounting and unmounting a USB device according to claim 4, characterized in that, If the host machine lock is not acquired, the user will be notified that other virtual machines on the host machine are performing USB mounting operations, and the USB mounting operation will be re-performed after the target time.

6. The method for securely mounting and unmounting a USB device according to claim 5, characterized in that, If the specified USB device is successfully mounted, the nova-compute service component will synchronously return a success message and information about the mounted USB device. If the specified USB device fails to mount, the nova-compute service component will synchronously return failure information and the reason for failure.

7. The method for securely mounting and unmounting a USB device according to claim 1, characterized in that, If the specified uninstalled USB device is successfully uninstalled, the nova-compute service component will synchronously return a success message and information about the uninstalled USB device. If the specified uninstallation of the USB device fails, the nova-compute service component will synchronously return failure information and the reason for failure.

8. A computer device, characterized in that, It includes a processor and a memory; wherein, when the processor executes a computer program stored in the memory, it implements the steps of the method for securely mounting and unmounting a USB device as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, Used to store computer programs; when executed by a processor, the computer programs implement the steps of the method for securely mounting and unmounting a USB device as described in any one of claims 1-7.

Images