Safe use method and system of USB (Universal Serial Bus) equipment

Abstract

The invention discloses a USB (Universal Serial Bus) equipment safety use method and system, and the method comprises the steps: obtaining examination information and configuration information through an examination and authentication signature center before USB equipment is plugged into a protected machine, generating a unique ID encrypted by a private key, and writing the unique ID into the USB equipment; the auditing authentication signature center sends the auditing information, the configuration information, the unique ID and the public key to the management center; and when the USB equipment is plugged into the protected machine, through communication interaction between the management center and the protected machine, the management center judges whether the protected machine is allowed to use the USB equipment or not through the unique ID and time, and the protected machine uses the USB equipment based on the configuration information after further authentication by using the unique ID. In the invention, the USB equipment safety use system is composed of an auditing, authenticating and signing center, a management center and a protected machine. The method has the advantages of refined control granularity, comprehensive examination and centralized and unified management and protection.

Description

Technical Field

[0001] The present invention relates to the field of USB device security protection, and in particular to a USB device security use method and system. Background Art

[0002] When USB devices such as USB flash drives and USB mice are plugged into a machine with a USB interface, there is a problem of data leakage caused by attacking the system through the USB interface. The existing security protection technology for USB devices generally protects by controlling the read, write, and execute permissions of USB devices, which has the following problems:

[0003] 1. Few control factors and coarse granularity. Only read, write, and execute permissions are controlled, without controlling other factors such as time, location, subject, and object.

[0004] 2. Failure to conduct security review of USB devices and the files on them.

[0005] 3. There is no centralized and unified management and control of USB devices and the files on them. Summary of the invention

[0006] The present invention provides a USB device safe use method and system to solve the problems of less control factors, lack of security review and no centralized and unified management in the existing USB device security protection technology.

[0007] In order to achieve the above object, the technical solution adopted by the present invention is:

[0008] How to use USB devices safely:

[0009] Before the USB device is plugged into the protected machine, the audit and authentication signature center first conducts a security audit on the USB device to obtain the audit information, and configures the USB device to obtain the configuration information. Then, the audit and authentication signature center conducts a legality authentication on the audit information and configuration information. If the legality authentication passes, the audit and authentication signature center generates a unique ID and writes it into the USB device. After the audit and authentication signature center generates a key, it uses the private key in the key to sign the unique ID written into the USB device. Finally, the audit and authentication signature center sends the audit information, configuration information, unique ID and public key in the key corresponding to the USB device to the management center.

[0010] When a USB device is plugged into a protected machine, the protected machine first intercepts the insertion event, obtains the USB device's unique ID signed by the private key and the USB device plug-in time, and transmits them to the management center; the management center uses the public key to decrypt the unique ID, and then determines whether the unique ID is correct and whether the plug-in time is within the set time range. If the unique ID is correct and the plug-in time is within the set time range, the management center sends the configuration information and public key corresponding to the USB device to the protected machine;

[0011] After the protected machine receives the configuration information and public key, it uses the public key to sign and authenticate the unique ID of the USB device. If the signature authentication passes, the protected machine will remove the interception and drive and match the USB device and set permissions according to the configuration information to start using the USB device.

[0012] Furthermore, the audit and authentication signature center generates a unique ID based on the review information and configuration information.

[0013] Furthermore, the audit information obtained by the audit authentication signature center includes information of the USB device itself.

[0014] Furthermore, the audit information obtained by the audit authentication signature center includes file information in the USB device.

[0015] Furthermore, the configuration information obtained by the audit and authentication signature center from configuring the USB device includes operation machine information, operation time information, operation program information on the operation machine, operation identity information of the operation program, and specific operation information.

[0016] A USB device installation and use system includes an audit and authentication signature center and a management center. The audit and authentication signature center, the management center and a protected machine cooperate to implement the above-mentioned USB device safe use method.

[0017] Compared with the prior art, the present invention has the following advantages:

[0018] (1) Before the USB device is plugged into the protected machine, the audit and certification signature center will conduct security review and configuration, and authenticate the review information and configuration information. When the USB device is plugged into the protected machine, multiple control factors such as unique ID and plug-in time are added to achieve security protection. This can refine the control granularity and improve the security protection effect.

[0019] (2) Before the USB device is plugged into the protected machine, a comprehensive security review is conducted through the Audit and Certification Signature Center, which improves the security protection effect.

[0020] (3) All USB devices are centrally managed by the management center to ensure secure connection with the protected machines. The management center also controls the USB devices and the files on them, further improving the security protection effect.

[0021] (4) The main operations are implemented in the kernel, with a high security level. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a schematic diagram of the method of an embodiment of the present invention.

[0023] Figure 2 It is a flow chart of the interaction between the audit and authentication signature center and the USB device in an embodiment of the present invention.

[0024] Figure 3 It is a flow chart of the interaction between the management center and the protected machine in the embodiment of the present invention. DETAILED DESCRIPTION

[0025] The present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0026] like Figure 1 As shown, this embodiment discloses a method for safely using a USB device, wherein the audit and certification signature center 1, the management center 2, and the protected machine 3 cooperate to implement safety protection during the use of the USB device 4, including protection before and when the USB device 4 is plugged in, and the process is as follows:

[0027] (1) Figure 2 As shown, before the USB device 4 is plugged into the protected machine 3, the USB device 4 is first plugged into the USB interface of the audit and authentication signature center 1, and the USB device 4 is subjected to a security review by the audit and authentication signature center 1 to obtain review information, and the USB device 4 is configured to obtain configuration information.

[0028] Specifically, the security review of the USB device 4 by the audit and certification signature center 1 includes the review of the USB device 4 itself and the review of the files in the USB device 4. The review information obtained through the review of the USB device 4 itself includes the manufacturer information, the unique identification code (including the serial number) information, the size information and the file system information. The review information obtained through the review of the files in the USB device 4 includes whether it is an executable file, whether it contains malicious code, the file identity (including which manufacturer the file comes from, the software package it belongs to, the author, etc.), the file HASH value, the file creation time, the modification time, the access time, the ACL, and the extended attributes.

[0029] The configuration information obtained by the audit and authentication signature center 1 from configuring the USB device 4 includes the operation machine information, operation time information, operation program information on the operation machine, operation identity information of the operation program, and specific operation information. That is, the configuration determines which machines, at what time, which programs can access, and / or execute, and / or modify, and / or other operations with what identity.

[0030] After the audit and authentication signature center 1 obtains the audit information and configuration information, it performs legality authentication on the audit information and configuration information. The legality authentication process is as follows:

[0031] (1) Verify whether the USB device is of a permitted manufacturer and model. If it is not permitted, it is considered illegal. Verify whether the USB device has been registered. If it has not been registered, it is considered illegal.

[0032] (2) Verify whether the files and file systems in the USB have undergone security review. During the file review, determine whether the file contains malware such as viruses. If so, it is considered illegal; determine whether it is an allowed data file and whether it contains unauthorized highly confidential files. If so, it is considered illegal; determine whether the file system contains other hidden files or malicious files. If so, it is considered illegal.

[0033] (3) Verify the file identity, including the manufacturer, software package, author, etc. Whether the information is missing, clear, and permitted. If the identity is missing, unclear, or not permitted, it is considered illegal.

[0034] If the legality authentication fails, the audit authentication signature center 1 stops executing the subsequent process. If the legality authentication passes, the audit authentication signature center 1 generates a unique ID based on the review information and configuration information and writes it into the USB device 4. The unique ID generation process is as follows.

[0035] In this embodiment, the unique ID is generated using the HASH algorithm from the following four pieces of information:

[0036] A) USB device information: including manufacturer information, unique identification code (including serial number);

[0037] B) File information: file name, file size, hash value, file creation time, modification time, access time, ACL, and extended attributes;

[0038] C) File system information: file system type, file volume size, number of files in the file volume;

[0039] D) Information added by the administrator: some configuration information and annotation information, such as comments added by the administrator.

[0040] Then, the audit and certification signature center 1 generates a key and uses the private key in the key to sign the unique ID written into the USB device 4. Finally, the audit and certification signature center 1 sends the review information, configuration information, unique ID and public key in the key corresponding to the USB device 4 to the management center 2.

[0041] (2) Figure 3 As shown, when the USB device 4 is plugged into the protected machine 3, the kernel of the protected machine 3 first uses a security interception mechanism to intercept the insertion event of the USB device 4, and the protected machine 3 obtains the unique ID of the USB device 4 signed by the private key and the plugging time of the USB device 4 and transmits them to the management center. In this embodiment, the protected machine 3 specifically uses the HOOK technology to intercept the probe and other functions of the USB device to intercept the USB device 4 when it is plugged in.

[0042] After the management center 2 obtains the unique ID and the plug-in time signed by the private key transmitted by the protected machine 3, it first uses the public key to decrypt the unique ID and determines whether the unique ID is correct, that is, whether the unique ID belongs to the unique ID transmitted by the audit and certification signature center 1. If the unique ID is incorrect, the management center 1 stops executing the subsequent process; if the unique ID is correct, the management center 1 determines whether the plug-in time is within the set time range for allowing the USB device 4 to be plugged into the protected machine 3. If the plug-in time is within the set time range, the management center 2 sends the configuration information and public key corresponding to the USB device 4 to the protected machine 3; if the plug-in time is not within the set range, the management center 2 does not send information to the contained machine 3.

[0043] After receiving the configuration information and public key returned by the management center 2, the protected machine 3 uses the public key to perform signature authentication on the unique ID of the USB device 4. If the signature authentication fails, the protected machine 3 rejects the USB device 4 and issues an alarm; if the signature authentication passes, the protected machine 3 removes the interception and drives and matches the USB device 4 according to the configuration information, as well as setting permissions, and starts using the USB device 4.

[0044] Therefore, in this embodiment, the audit and authentication signature center 1, the management center 2 and the protected machine 3 constitute a USB device safe use system, and security protection is implemented during the use of the USB device 4 based on the USB device safe use system.

[0045] The preferred embodiments of the present invention are described in detail above in conjunction with the accompanying drawings. The embodiments described in the present invention are merely descriptions of the preferred embodiments of the present invention, and do not limit the concept and scope of the present invention. The various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction, and such combinations should also be regarded as the contents disclosed in the present disclosure as long as they do not violate the concept of the present invention. In order to avoid unnecessary repetition, the present invention will not further describe various possible combinations.

[0046] The present invention is not limited to the specific details of the above-mentioned embodiments. Within the technical concept of the present invention and without departing from the design concept of the present invention, various modifications and improvements made to the technical solution of the present invention by technical personnel in this field should fall within the protection scope of the present invention. The technical contents for which protection is sought in the present invention have been fully recorded in the claims.

Claims

1. A method for safely using a USB device, characterized in that: The process is as follows: Before the USB device is plugged into the protected machine, the audit and authentication signature center first conducts a security audit on the USB device to obtain the audit information, and configures the USB device to obtain the configuration information. Then, the audit and authentication signature center conducts a legality authentication on the audit information and configuration information. If the legality authentication passes, the audit and authentication signature center generates a unique ID and writes it into the USB device. After the audit and authentication signature center generates a key, it uses the private key in the key to sign the unique ID written into the USB device. Finally, the audit and authentication signature center sends the audit information, configuration information, unique ID and public key in the key corresponding to the USB device to the management center. When a USB device is plugged into a protected machine, the protected machine first intercepts the insertion event, obtains the USB device's unique ID signed by the private key and the USB device plug-in time, and transmits them to the management center; the management center uses the public key to decrypt the unique ID, and then determines whether the unique ID is correct and whether the plug-in time is within the set time range. If the unique ID is correct and the plug-in time is within the set time range, the management center sends the configuration information and public key corresponding to the USB device to the protected machine; After the protected machine receives the configuration information and public key, it uses the public key to sign and authenticate the unique ID of the USB device. If the signature authentication passes, the protected machine will remove the interception and drive and match the USB device and set permissions according to the configuration information to start using the USB device.

2. The method for safe use of a USB device according to claim 1, characterized in that: The audit and authentication signature center generates a unique ID based on the review information and configuration information.

3. The method for safe use of a USB device according to claim 1, characterized in that: The audit information obtained by the audit authentication signature center includes information of the USB device itself.

4. The method for safe use of a USB device according to claim 1, characterized in that: The audit information obtained by the audit authentication signature center includes file information in the USB device.

5. The method for safe use of a USB device according to claim 1, characterized in that: The configuration information obtained by the audit and authentication signature center through configuring the USB device includes operation machine information, operation time information, operation program information on the operation machine, operation identity information of the operation program, and specific operation information.

6. A USB device installation and use system, characterized in that: It includes an audit and authentication signature center and a management center. The audit and authentication signature center, the management center and the protected machine cooperate to implement the USB device safe use method as described in any one of claims 1-5.

Images