A USB device identification and authentication method based on transmission delay characteristics

Abstract

The present invention provides a USB device identification and authentication method based on transmission delay characteristics. By monitoring the communication transmission data packets after the USB device is connected to the host, the time of all communication transmissions between the USB device and the host is measured. The device identity authentication is performed before and after the USB device enumeration is completed. Different types of USB devices can be discovered and distinguished before the enumeration is completed, thereby improving the timeliness of authentication. The present invention takes into account the impact of file storage on reading time, solves the defect that Time-Print requires hardware device support, and provides a solution for dynamically updating identity information, thereby reducing costs. The present invention does not require modifying the underlying code of the operating system, but instead uses a tool to measure the time of all communication transmissions between the USB device and the host. The USB timing monitoring based on software increases the portability of the present invention and is suitable for engineering practice.

Description

Technical Field

[0001] The present invention belongs to the technical field of device authentication, and in particular relates to a USB device identification and authentication method based on transmission delay characteristics. Background Art

[0002] USB device identification and authentication based on transmission delay characteristics is a new device authentication method based on time signatures, suitable for USB devices such as USB flash drives, external hard drives, keyboards, and mice. When a USB device is connected to a host, the host detects the insertion of the new device and performs device enumeration to determine the device type, functions, and specifications. Once device enumeration is complete, data transmission between the host and the USB device can occur, including reading and writing data. During the USB device enumeration phase, the timing characteristics of device enumeration vary due to the hardware properties of different USB devices, such as manufacturer and device model. During the USB data transmission phase, read operations on USB devices also exhibit corresponding timing characteristics due to differences in the physical properties and file storage structures of USB devices. Using tools to measure the transmission time of all communications between a USB device and the host can form a unique fingerprint for a specific USB device, thereby enabling USB device identification and authentication.

[0003] Many authentication methods for USB devices currently exist, but existing technologies have shortcomings due to factors such as security, cost, convenience, and complexity. Username and password-based authentication requires users to enter a username and password when connecting a USB device. However, usernames and passwords can be easily leaked or obtained through technical means, making them less secure and hindering the ease of use of USB devices. Biometric authentication leverages the uniqueness of human biometrics, such as fingerprints and veins. However, biometric authentication for USB devices is less explored, the technology is immature, and implementation is expensive. Device-based authentication utilizes inherent USB device information, such as its product ID and serial number, for authentication. This method relies on device-specific information, which can be forged or tampered with, making it less secure. Advanced hardware-based authentication utilizes new, advanced hardware, such as hardware encryption modules and security chips, to ensure USB device authentication and security. This hardware provides a higher level of security, but also increases cost and complexity.

[0004] In the above methods, the authentication of USB devices either utilizes the active interaction of the user, which affects the convenience of using the USB device, or utilizes the hardware characteristics of the device itself, or utilizes expensive and complex advanced hardware and biometric technology, which cannot simultaneously ensure security and reduce costs.

[0005] Of course, there is currently a solution to identify and authenticate USB devices from a time dimension. The implementation details of the specific solution are as follows:

[0006] Design and Implementation of Time-Print: Time-Print extends the USB driver by generating many additional read operations on randomly selected blocks on the USB device via SCSI commands, and then measures the timing information of these read operations. The Time-Print process consists of four steps: 1. Performing precise timing measurements; 2. Calculating the timing profile of the USB flash drive; 3. Preprocessing the timing profile; and 4. Classifying the device based on the timing profile for device acceptance / rejection.

[0007] Specifically, Time-Print extends the USB driver. The usb_store_msg_common function is used to send command messages and receive status messages, while the usb_stor_bulk_transfer_sglist function receives the actual data sent by the device. To perform precise timing measurements of these transactions, Time-Print leverages a low-overhead and high-granularity timing source, the CPU Time Stamp Counter (TSC). The built-in kernel function rdtsc() is used before and after each transaction to record the precise time required for each communication. With this collected timing information, Time-Print further integrates a low-overhead storage and reporting component for this timing information. This component modifies the USB driver to maintain a continuous flow of timing information from the drive, adding the us_data structure in the USB storage header to contain an array that tracks the command opcode, size, address, and TSC value of each transaction. Furthermore, to transmit and record the timing values, Time-Print implements a character device in the USB storage driver to transfer the timing information to user space for further processing. Using timing information grouped by size and offset, machine learning is used to create a fingerprint for each device. Based on the trained fingerprint, Time-Print can reject or accept the device, completing the device identification and authentication.

[0008] Current methods for identifying USB devices based on time are still in the theoretical and experimental stages and have some shortcomings:

[0009] (1) Insufficient timeliness: After the USB device is enumerated, Time-Print completes the identity creation by reading different block addresses of the device in the driver. This authentication process can be completed in 2-3 seconds, which is already highly efficient. However, once the USB device is enumerated, it can transmit data with the host, which may lead to attacks on the host. Time-Print's authentication discovery is still not timely enough, and it is necessary to consider authentication at an earlier connection stage.

[0010] (2) High production cost: When the block address used by Time-Print for authentication is written, its fingerprint will be affected. To address this, Time-Print's solution is to use LBA reservation or manufacturer support to prevent the address used for authentication from being written. However, this solution requires modifying or restricting the hardware properties of the USB device, which is costly.

[0011] (3) Poor portability and inability to be widely used: Time-Print collects fingerprints in the kernel by extending the USB driver, which involves modifying the kernel source code of the operating system. The operation is relatively complex and the deployment efficiency is low. It has poor portability, is inconvenient to update and debug, and cannot be widely deployed. Summary of the Invention

[0012] In order to solve the above problems existing in the prior art, the present invention provides a USB device identification and authentication method based on transmission delay characteristics. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0013] The present invention provides a USB device identification and authentication method based on transmission delay characteristics, comprising:

[0014] S100, obtaining a communication data packet generated when any USB device is connected;

[0015] S200, extracting an enumeration time series and a reading time series from the communication data packet respectively;

[0016] S300, constructing the identity information of the enumeration time series and the identity information of the reading time series respectively;

[0017] S400, performing identity authentication on the identity information of the enumeration time series and the identity information of the reading time series respectively. If the authentication is successful, no operation is performed on the USB device. If the authentication fails, the USB device is ejected.

[0018] Beneficial effects:

[0019] (1) More timely: The present invention's USB device authentication consists of two phases: an enumeration phase and a read phase. In the enumeration phase, different USB device models can be distinguished using the enumeration time sequence. For USB devices of the same model, the second phase proceeds to the read time sequence for authentication. When the USB devices are different, the present invention authenticates the USB identity more promptly. When the USB devices are the same model, the present invention's authentication speed is similar to that of existing Time-Print.

[0020] (2) Lower cost: This invention considers the impact of file storage conditions on the stability of USB device fingerprint reading, and addresses the hardware attribute limitations of Time-Print. Time-Print achieves fingerprint stability through LBA reservations or manufacturer support, which requires adjustments to the hardware attributes of the USB device. However, this invention takes into account the dynamic changes in file storage and can update device identity information by reconnecting the USB device without modifying the hardware, significantly saving costs.

[0021] (3) Stronger portability and suitability for engineering practice: This method collects time information by monitoring data packets transmitted between the USB device and the host. Compared to Time-Print, this method modifies the USB device driver, making its implementation more convenient and reducing deployment and debugging time costs. Furthermore, compared to Time-Print, this software-based USB authentication method is more portable and suitable for widespread adoption.

[0022] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a schematic diagram of a USB device identity authentication scenario provided by the present invention;

[0024] Figure 2 This is a flow chart of a USB device identification and authentication method based on transmission delay characteristics provided by the present invention;

[0025] Figure 3 This is a flow chart of USB device identification provided by the present invention;

[0026] Figure 4 This is a schematic diagram of a USB enumeration phase data packet provided by the present invention;

[0027] Figure 5 This is a schematic diagram of the READ command with a LEN value of 1 provided by the present invention

[0028] Figure 6This is a schematic diagram of USB reading time for different LEN values ​​provided by the present invention;

[0029] Figure 7 This is a line chart of the reading time series of four identical USB flash drives with a LEN value of 1 provided by the present invention. DETAILED DESCRIPTION

[0030] The present invention will be further described in detail below with reference to specific examples, but the embodiments of the present invention are not limited thereto.

[0031] Before introducing the present invention, a brief introduction to the technical contents involved in the present invention is first given.

[0032] The enumeration process for a USB device is as follows: 1. The device is powered on; 2. The hub detects voltage changes and reports them to the host; 3. The host learns about connected devices; 4. The host detects whether the inserted device is full-speed or low-speed; 5. The host resets the device through the hub; 6. The host further detects whether the full-speed device supports high-speed mode; 7. An information channel is established between the host and the device through the hub; 8. The host obtains the maximum packet length of the default control pipe; 9. The host requests the hub to reset the device again; 10. The host assigns a new address to the device; 11. The host obtains and parses the device descriptor information; 12. The host obtains the string descriptor; 13. The host obtains the standard configuration descriptor; 14. The host obtains the configuration descriptor set; 15. The host mounts the driver for the device and selects a configuration. Once the above operations are completed, the USB device enumeration process is complete.

[0033] The USB mass storage driver and USB SCSI command sequence control the communication commands and data transactions between the host and the peripheral. The host-peripheral communication mechanism consists of three parts. For example, the read process: 1. The host issues a read command to the device: The host sends a read request to the peripheral using a USB SCSI command, specifying the size and location of the data to be read, telling the peripheral where to read and how much data to read. 2. The peripheral responds with the requested data: After receiving the read command from the host, the peripheral reads the data according to the specified location and size and sends the data back to the host. The peripheral then transmits the requested data to the host in response to the read request. 3. The peripheral responds with a status packet: After completing the data transfer, the peripheral responds with a status packet to the host, indicating the transfer status (success or failure). This status packet informs the host of the data transfer outcome, allowing the host to take further action as needed. This data communication process is managed and controlled by the USB mass storage driver and USB SCSI command sequence, ensuring efficient and reliable data transfer between the host and the peripheral. This communication mechanism plays a crucial role in USB device read and write processes, ensuring the correct transmission and processing of data.

[0034] During USB device enumeration, the time signatures for device enumeration vary due to the varying hardware properties of different USB devices. During USB data transfer, the time it takes for each device to complete a communication transfer also varies due to differences in the physical properties and file storage structures of the devices. By collecting this time information, a unique fingerprint can be customized for each USB device from a new dimension—the time dimension—for USB device identification and authentication.

[0035] The technical concept of the present invention is briefly introduced in detail below.

[0036] refer to Figure 1 The present invention applies the USB device identification method to actual scene modeling to construct a USB device identity authentication scene. Figure 1 As shown in the figure, the above scenario includes nodes such as host, USB device, host database, USB timing acquisition module, and classification algorithm. Figure 2 When a USB device is connected to a host, a series of communication data packets are generated between the host and the device. Wireshark monitoring is started, and these data packets are captured by the timing acquisition module on the host, which has already started Wireshark monitoring, and saved as files on the host. The host imports the data packet file into a pre-written classification algorithm, which extracts the enumeration and reading timing in the data packet to form the identity information of the USB device. The host sends a registration or authentication request to the database and compares the identity information with the information stored in the database. If the match is successful, no operation is performed. If the match fails, the USB device is ejected.

[0037] The present invention monitors the communication transmission data packets after the USB device is connected to the host, measures the time of all communication transmissions between the USB device and the host, and performs device identity authentication before and after the USB device is enumerated. Different types of USB devices can be discovered and distinguished before the enumeration is completed, thereby improving the timeliness of authentication. The present invention considers the impact of file storage on reading time, solves the defect that Time-Print requires hardware device support, and provides a solution for dynamically updating identity information, thereby reducing costs. The present invention does not require modifying the underlying code of the operating system, but instead uses tools to measure the time of all communication transmissions between the USB device and the host. The USB timing monitoring based on software increases the portability of the present invention and is suitable for engineering practice.

[0038] The technical solution details of the present invention are described in detail below.

[0039] Combine Figure 1-Figure 3 The present invention provides a USB device identification and authentication method based on transmission delay characteristics, including:

[0040] S100, obtaining a communication data packet generated when any USB device is connected;

[0041] The present invention authenticates any current USB device, and of course this current USB device can be all USB devices.

[0042] S200, extracting an enumeration time series and a reading time series from the communication data packet respectively;

[0043] In this step, a data classification algorithm may be used to classify the communication data packets to extract the enumeration time series and the reading time series.

[0044] The present invention uses a USB packet capture tool or other tools that can achieve similar purposes to obtain the time of each USB device and host communication command, and finds the stable timing information hidden in these time data to construct the USB device identity and perform USB device identity authentication.

[0045] S300, constructing the identity information of the enumeration time series and the identity information of the reading time series respectively;

[0046] The identity information of the enumerated time series includes the time when the host obtains the electrical properties of the USB device and the time when the host obtains the device information of the USB device.

[0047] Based on the entire USB device enumeration process, the present invention divides the time series during USB enumeration into three parts: the time it takes for the USB device to be inserted into the host and obtain its electrical properties, the time it takes for the host to obtain the USB device's electrical properties, and the time it takes for the host to obtain the USB device's device information. The time for the latter two stages can be extracted. The present invention parses the meaning of each data packet in the data packet file, filters out the start and end commands of the two stages, obtains the time required for the two stages to complete, and returns this time as the USB device enumeration time identity to the host. Figure 4 This is a schematic diagram of data packets collected during the enumeration phase for a USB device. As shown in Table 1 below, we used five USB flash drives of two different models and calculated the time required for device enumeration. Experiments show that different USB device models can complete identity authentication during the device enumeration phase.

[0048] Table 1 USB enumeration phase timing table

[0049] equipment Kingston1 Kingston2 Kingston3 Kingston4 Kingston5 Electrical property acquisition / s 0.175898 0.175951 0.176115 0.176506 0.175838 Enumeration completed / s 0.264614 0.264391 0.263425 0.264615 0.264438 equipment SanDisk1 SanDisk2 SanDisk3 SanDisk4 SanDisk5 Electrical property acquisition / s 0.175967 0.175951 0.176129 0.175864 0.176123 Enumeration completed / s 0.258034 0.257776 0.257566 0.257584 0.257378

[0050] This invention constructs USB device identity information, allowing the host to use this identity information as a unique identifier for each USB device, to identify connected USB devices. This identity information consists of two main components: identity information constructed during enumeration and identity information constructed during readout. Because the data packets obtained by the time-series acquisition module are raw data packets from communication between the host and the USB device and cannot be directly used for identity authentication, the invention extracts and organizes the information from these data packets, dividing them into enumeration time series and readout time series, and then performs data processing and identity creation on each of these components.

[0051] S400, performing identity authentication on the identity information of the enumeration time series and the identity information of the reading time series respectively. If the authentication is successful, no operation is performed on the USB device. If the authentication fails, the USB device is ejected.

[0052] In the USB enumeration time sequence scheme of the present invention, if the connection between the host and the USB device is different from the hardware connection during registration, such as a USB dock, the USB device enumeration time will be affected. Therefore, the present invention creates enumeration time sequence identity information for each USB device using a specific connection method, thereby providing more comprehensive protection for host security.

[0053] In a specific embodiment of the present invention, constructing the identity information of the reading time series in S300 includes:

[0054] S310, issuing multiple read commands of different lengths to different address blocks of the USB device;

[0055] The present invention divides the read commands of the USB device according to the read length, constructs a time data set for the read commands of each length, and uses a machine learning method to perform pattern recognition on the data for identity authentication.

[0056] S320, dividing the multiple read commands into different parts of length 1, 4, 8, 16, 32, 64, 128, and 256;

[0057] Of course, the present invention can also be used in other lengths, which is not limited here.

[0058] S330, calculating the read time required to complete all read commands under each length, and grouping the read times into a set;

[0059] S340, selecting the top three sets in terms of the number of read times, and saving all the read times in the three sets in the form of key-value pairs;

[0060] S350 , using the length of the set as an index and the set composed of the reading times as a value, as identity information of the reading time series.

[0061] When a USB device is connected to a host, the host will spontaneously issue a series of read commands of varying lengths to different block addresses of the USB device. The present invention uses the length of the read commands as a characteristic and divides all read commands into sections with lengths of 1, 4, 8, 16, 32, 64, 128, and 256. For each characteristic, all read commands that meet the read length characteristic are extracted, and the time required to complete each read command is calculated. Figure 5 This is a schematic diagram of a READ instruction with a LEN value of 1. After completing the above operations, if Figure 6 As shown, for each length value, a set of reading times is obtained. The present invention selects the three length values ​​with the largest amount of data in the set, and saves all the time data in these three sets in the form of key-value pairs, with the length value as the index and the time set as the value, which is used as the identity information of the reading time series. Figure 7 As shown, the present invention uses four USB flash drives of the same model, stores the same 10GB file content, and collects data, graphically displaying the time information when the LEN value is 1. Experiments show that different devices exhibit different timing characteristics, and this solution can be used to more accurately distinguish different USB devices.

[0062] In a specific embodiment of the present invention, S400 includes:

[0063] The identity information of the enumerated time series is matched with the identity information in the database. If the match is successful, the identity information of the read time series is matched with the identity information in the database. If the match is successful, it indicates that the authentication is successful and no operation is performed on the USB device. If the match fails, it indicates that the authentication fails and the USB is ejected.

[0064] In this step, the time when the host obtains the electrical properties of the USB device and the time when the host obtains the device information of the USB device, which are included in the identity information of the enumerated time series, are identified and matched one by one with the corresponding time intervals in the database. If a match is found, the identity information of the read time series is matched with the database using a machine learning algorithm. If the match is successful, it indicates that the authentication is successful and no operation is performed on the USB device. If the identity information of the enumerated time series does not match, it indicates that the authentication has failed and the USB device is ejected.

[0065] For each acquisition of identity information, there will be some differences in the extracted time information, while the identity information of the same device itself should be relatively stable, and the differences are within a controllable range. To this end, the present invention needs to use a certain machine learning algorithm in the device authentication process to identify and match the enumerated identity information and the read time information in the database. For the enumeration time, the present invention specifies the time interval of each enumeration stage for identity authentication; for the read time, the present invention uses a machine learning method to learn patterns for the time set corresponding to each LEN value, collects data multiple times, and completes identity creation.

[0066] As an optional embodiment of the present invention, the present invention can register any USB device when needed. The registration process includes:

[0067] A query is made in the database as to whether the identity information of the enumerated time sequence and the identity information of the read time sequence exist. If so, it indicates that the USB device has been registered before. If not, the USB device is registered using the identity information of the enumerated time sequence and the identity information of the read time sequence.

[0068] This step queries the database to see whether the identity information of the enumerated time sequence and the identity information of the read time sequence exist. If so, it means that the USB device has been registered before; if not, the USB device is registered using the identity information of the enumerated time sequence and the identity information of the read time sequence.

[0069] It is worth noting that in the USB reading time series scheme, when the file information of the USB storage device changes, its reading time series may change. It is necessary to re-register its identity every time the file storage of the USB storage device changes and update the device identity information in the database.

[0070] In a specific embodiment of the present invention, before S400, the USB device identification and authentication method based on transmission delay characteristics further includes:

[0071] determining a communication delay of the communication data packet and constructing identity information of the communication delay;

[0072] The identity information of the enumeration time series and the identity information of the reading time series are replaced by the identity information of the communication delay.

[0073] The present invention uses a tool to measure the time of all communication transmissions between a USB device and a host for identity authentication. In addition to constructing identity information by enumerating time sequences and reading time sequences, it should also include constructing identity information by utilizing other data packet communication delays (writing, polling operations, etc.) for identity authentication.

[0074] In a specific embodiment of the present invention, a write or test command is determined from the communication data packet, and identity information of the write or test command is constructed;

[0075] The identity information of the enumeration time sequence and the identity information of the read time sequence are replaced by the identity information of the write or test command.

[0076] Of course, there are many other commands, such as write and test, used in USB device-host communication. The present invention can also use the time sequence of these commands to construct identity information, and then use this identity information for verification. These authentication schemes also belong to the present invention's USB device identification and authentication scheme based on transmission delay characteristics.

[0077] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature identified as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, "plurality" means two or more, unless otherwise specifically defined.

[0078] Although the present application is described herein with reference to various embodiments, those skilled in the art will be able to understand and implement other variations of the disclosed embodiments in practicing the claimed application by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality.

[0079] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A USB device identification and authentication method based on transmission delay characteristics, characterized in that: include: S100, obtaining a communication data packet generated when any USB device is connected; S200, extracting an enumeration time series and a reading time series from the communication data packet respectively; S300, constructing the identity information of the enumeration time series and the identity information of the reading time series respectively; constructing the identity information of the reading time series in S300 includes: the identity information of the enumeration time series includes the time when the host obtains the electrical properties of the USB device and the time when the host obtains the device information of the USB device; S310, issuing multiple read commands of different lengths to different address blocks of the USB device; S320, dividing the multiple read commands into different parts of length 1, 4, 8, 16, 32, 64, 128, and 256; S330, calculating the read time required to complete all read commands under each length, and grouping the read times into a set; S340, selecting the top three sets in terms of the number of read times, and saving all the read times in the three sets in the form of key-value pairs; S350, using the length of the set as an index and the set consisting of the reading times as a value, as identity information of the reading time series; S400, performing identity authentication on the identity information of the enumeration time series and the identity information of the reading time series respectively. If the authentication succeeds, no operation is performed on the USB device; if the authentication fails, the USB device is ejected; S400 includes: Matching the identity information of the enumerated time series with the identity information in the database, if the match is successful, then matching the identity information of the read time series with the identity information in the database, if the match is successful, it means that the authentication is successful, and no operation is performed on the USB device; if the match fails, it means that the authentication fails, and the USB device is ejected; The identity information of the enumerated time series is matched with the identity information in the database. If the match is successful, the identity information of the read time series is matched with the identity information in the database. If the match is successful, it indicates that the authentication is successful and no operation is performed on the USB device. If the match fails, it indicates that the authentication fails and the USB device is ejected. The following steps are performed: The time when the host obtains the electrical properties of the USB device and the time when the host obtains the device information of the USB device, which are included in the identity information of the enumerated time series, are identified and matched one by one with the corresponding time intervals in the database. If a match is found, the identity information of the read time series is matched in the database using a machine learning algorithm. If the match is successful, it indicates that the authentication is successful and no operation is performed on the USB device. If the identity information of the enumerated time series does not match, it indicates that the authentication has failed and the USB device is ejected.

2. The USB device identification and authentication method based on transmission delay characteristics according to claim 1, characterized in that: S200 includes: A data classification algorithm is used to classify the communication data packets to extract the enumeration time series and the reading time series.

3. The USB device identification and authentication method based on transmission delay characteristics according to claim 1, characterized in that: Before S400, the USB device identification and authentication method based on transmission delay characteristics further includes: A query is made in the database as to whether the identity information of the enumerated time sequence and the identity information of the read time sequence exist. If so, it indicates that the USB device has been registered before. If not, the USB device is registered using the identity information of the enumerated time sequence and the identity information of the read time sequence.

4. The USB device identification and authentication method based on transmission delay characteristics according to claim 1, characterized in that: Before S400, the USB device identification and authentication method based on transmission delay characteristics further includes: determining a communication delay of the communication data packet and constructing identity information of the communication delay; The identity information of the enumeration time series and the identity information of the reading time series are replaced by the identity information of the communication delay.

5. The USB device identification and authentication method based on transmission delay characteristics according to claim 1, characterized in that: Before S400, the USB device identification and authentication method based on transmission delay characteristics further includes: Determining a write or test command from the communication data packet and constructing identity information of the write or test command; The identity information of the enumeration time sequence and the identity information of the read time sequence are replaced by the identity information of the write or test command.

Images