USB device type control connection method

Abstract

The invention relates to the technical field of USB security detection, and discloses a USB equipment type control connection method, which comprises the following steps of: continuously detecting a USB equipment connection state of a specified port, acquiring descriptor information of USB equipment, matching the descriptor information according to a white list, judging whether the equipment is legal or not, allowing data connection if the white list is successfully matched, and if the white list is successfully matched, judging whether the equipment is legal or not. Otherwise, rejecting and triggering an alarm, allowing the connected equipment to carry out communication monitoring, carrying out continuous detection based on a security policy, and forcibly disconnecting and triggering the alarm if the communication behavior does not accord with the security policy, thereby effectively preventing the access of the unauthorized USB equipment, ensuring the legality of the equipment through white list verification, and monitoring the communication behavior in real time. And data leakage or malicious operation is prevented, the security and protection capability of the system are enhanced, and the problem of lack of security detection of the USB port in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of USB security detection, and in particular to a USB device type control connection method. Background Art

[0002] USB devices are widely used for data transmission, peripheral connection and storage operations, especially in highly sensitive environments such as enterprise, medical and financial. However, the openness of USB devices also brings potential security threats, such as USB attack tools and USB viruses. These devices attack the system through malicious code. Traditional security measures focus on the protection of peripheral networks, while USB ports are easily overlooked and become potential attack entry points. Summary of the invention

[0003] The object of the present invention is to provide a USB device type control connection method, aiming to solve the problem of lack of safety detection of USB ports in the prior art.

[0004] The present invention is implemented in this way. The present invention provides a USB device type control connection method, comprising: Continuously performing connection detection of the USB device on the designated port, and when detecting that the designated port is in a connected state with the USB device, obtaining descriptor information of the USB device in a connected state with the designated port; wherein the descriptor information includes a device type, a protocol type, a VID, and a PID of the USB device; Performing matching processing on the descriptor information according to a preset whitelist to detect whether the descriptor information completely matches the whitelist; If the detection result is that the descriptor information completely matches the whitelist, the USB device is allowed to establish a data connection with the designated port; If the detection result is that the descriptor information does not completely match the whitelist, the USB device is denied data connection with the designated port and an alarm mechanism is triggered; When the allowed USB device establishes data connection with the designated port, the communication of the USB device is continuously monitored, and the communication monitoring data of the USB device is continuously security checked according to a predefined security policy. If the result of the security check is that it does not comply with the security policy, the USB device is forced to disconnect the data connection with the designated port and an alarm mechanism is triggered.

[0005] The present invention provides a USB device type control connection method, which has the following beneficial effects: The present invention obtains USB device descriptor information by continuously detecting the connection status of the USB device of the designated port, and determines whether the device is legal according to the whitelist matching descriptor information. If the whitelist matching is successful, the data connection is allowed, otherwise it is rejected and an alarm is triggered. The connected device is allowed to perform communication monitoring, and continuous detection is performed based on the security policy. If the communication behavior does not comply with the security policy, the connection is forcibly disconnected and an alarm is triggered. This process effectively prevents unauthorized USB devices from accessing, ensures the legality of the device through whitelist verification, monitors the communication behavior in real time, prevents data leakage or malicious operation, enhances the security and protection capability of the system, and solves the problem of lack of security detection of USB ports in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 The present invention is a schematic diagram of the steps of a USB device type control connection method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0007] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0008] The implementation of the present invention is described in detail below in conjunction with specific embodiments.

[0009] Reference Figure 1 As shown, a preferred embodiment of the present invention is provided.

[0010] The present invention provides a USB device type control connection method, comprising: S1: continuously performing connection detection of a USB device on a designated port, and when detecting that the designated port is connected to a USB device, obtaining descriptor information of the USB device connected to the designated port; wherein the descriptor information includes a device type, a protocol type, a VID, and a PID of the USB device; S2: performing matching processing on the descriptor information according to a preset whitelist to detect whether the descriptor information completely matches the whitelist; S3: If the detection result is that the descriptor information completely matches the whitelist, the USB device is allowed to establish a data connection with the designated port; S4: If the detection result is that the descriptor information does not completely match the whitelist, the USB device is denied data connection with the designated port and an alarm mechanism is triggered; S5: When the allowed USB device establishes data connection with the designated port, the communication of the USB device is continuously monitored, and the communication monitoring data of the USB device is continuously security checked according to a predefined security policy. If the result of the security check is not in compliance with the security policy, the USB device is forced to disconnect the data connection with the designated port and an alarm mechanism is triggered.

[0011] Specifically, in step S1 of the embodiment provided by the present invention, the designated port is continuously monitored to detect whether a USB device is connected, and the connection status of the USB device is detected by polling or event triggering.

[0012] More specifically, when a USB device is detected to be connected to the specified port, further operations are triggered, namely obtaining the USB device descriptor information. Once the device is connected, the descriptor information of the USB device is obtained. The descriptor information includes: device type: determine whether the device is a storage device, peripheral, input device, etc.; protocol type: confirm the protocol used by the device, such as USB 2.0 or USB3.0, etc.; VID (Vendor ID): a unique identifier that identifies the manufacturer of the device; PID (Product ID): a product identifier that identifies a specific device.

[0013] More specifically, the acquired device descriptor information is recorded for subsequent matching and security analysis.

[0014] It is understandable that by continuously monitoring the designated port, the system can detect the connection status of the USB device in real time, ensuring that no device connection event will be missed. The descriptor information of the device is obtained immediately after the device is connected, achieving rapid response. Through detailed information such as device type, protocol type, VID and PID, the identity of the USB device can be accurately identified to prevent unknown or unauthorized devices from accessing. This information helps to distinguish devices in complex environments, especially when there may be multiple different devices connected. The obtained descriptor information provides basic data for subsequent security checks, such as whitelist matching, permission verification, etc., to further ensure the legitimacy and security of the device, and the preliminary screening and identification of access devices lays the foundation for subsequent communication monitoring and security policy execution.

[0015] Specifically, in steps S2, S3, and S4 of the embodiment provided by the present invention, a whitelist is pre-defined in the system, which contains descriptor information of USB devices allowed to be accessed, including device type, protocol type, VID (vendor ID) and PID (product ID), etc. The whitelist is loaded into the memory when the system starts to quickly perform matching operations.

[0016] More specifically, after detecting that a USB device is connected, the descriptor information of the device is obtained, and the obtained descriptor information is matched item by item with the records in the whitelist. The specific steps include: comparing whether the device type is consistent, comparing whether the protocol type is consistent, comparing whether the VID (vendor ID) is consistent, and comparing whether the PID (product ID) is consistent.

[0017] More specifically, if the descriptor information completely matches the whitelist, the USB device is allowed to establish a data connection with the designated port, the connection event is recorded, the log is updated, and it is marked as "authorized device access".

[0018] More specifically, if the descriptor information does not match the whitelist, the USB device's connection request is rejected, the device is prohibited from transmitting data to the port, and an alarm mechanism is triggered to notify the administrator or security system, and the mismatch event is recorded and marked as "unauthorized device attempted access."

[0019] More specifically, when an unmatched USB device is detected, an alarm is triggered immediately. The alarm method may include a pop-up window, sound prompt, SMS or email notification, etc. All matching results are recorded, including successful matching and unmatched event logs, for subsequent review and analysis.

[0020] It can be understood that through whitelist matching, it is ensured that only authorized devices can connect and transmit data, and unauthorized or potentially dangerous devices are blocked from access, thereby significantly improving the security of the system. The matching process is carried out in real time, which can quickly respond to device access requests, promptly block illegal device access, and reduce the potential impact of security threats. The whitelist matching and processing process is automated, reducing the need for manual intervention, improving the system's automated management capabilities and operating efficiency, and recording all matching results and alarm events through logs, providing detailed traceability, which is helpful for subsequent audits and security incident investigations. The content of the whitelist can be dynamically updated and maintained as needed to ensure that the system can adapt to the access requirements of new devices and maintain the flexibility and scalability of the system.

[0021] Specifically, in step S5 of the embodiment provided by the present invention, once the USB device is allowed to connect to the designated port, the system starts to continuously monitor the communication of the device, and captures the data flow between the device and the port in real time, including the transmitted files, commands, data packets, etc., and sets monitoring standards according to predefined security policies, such as data flow restrictions, protocol rules, file type restrictions, etc., and performs real-time analysis and detection on the captured communication data to ensure that data transmission complies with the security policy.

[0022] More specifically, if the communication data complies with all security policy requirements, the data connection will continue to be maintained and monitoring will continue. If it is found that the communication data does not comply with the security policy (such as abnormal traffic, illegal commands, data leakage, etc.), the USB device will be immediately disconnected from the port. At the same time, the alarm mechanism will be triggered to notify the system administrator or security team and record the abnormal event.

[0023] More specifically, all communication monitoring data, detection results, disconnection reasons and alarm information are recorded in detail for subsequent analysis and auditing, and relevant personnel are notified through various means (such as pop-up windows, emails, and text messages) for rapid response and processing.

[0024] It is understandable that continuous communication monitoring ensures that any potential security threats or abnormal activities can be discovered and handled in a timely manner throughout the entire process of data connection. Real-time security detection can prevent data leakage, malicious operations and illegal data transmission, thereby protecting the security of systems and data. Automated disconnection and alarm mechanisms reduce the need for human intervention, quickly respond to potential security threats, reduce system risks, record detailed monitoring data and event logs, provide comprehensive audit and analysis basis, and help track, analyze and investigate security incidents. The implementation of continuous monitoring and real-time detection improves the stability and reliability of the system, ensuring that only devices that comply with security policies can continue to operate. Security policies can be adjusted and updated according to actual needs to ensure that they can meet changing security challenges and needs.

[0025] The present invention provides a USB device type control connection method, which has the following beneficial effects: The present invention obtains USB device descriptor information by continuously detecting the connection status of the USB device of the designated port, and determines whether the device is legal according to the whitelist matching descriptor information. If the whitelist matching is successful, the data connection is allowed, otherwise it is rejected and an alarm is triggered. The connected device is allowed to perform communication monitoring, and continuous detection is performed based on the security policy. If the communication behavior does not comply with the security policy, the connection is forcibly disconnected and an alarm is triggered. This process effectively prevents unauthorized USB devices from accessing, ensures the legality of the device through whitelist verification, monitors the communication behavior in real time, prevents data leakage or malicious operation, enhances the security and protection capability of the system, and solves the problem of lack of security detection of USB ports in the prior art.

[0026] Preferably, when the permitted USB device is connected to the designated port for data connection, the steps of continuously monitoring the communication of the USB device and continuously performing security detection on the communication monitoring data of the USB device according to a predefined security policy include: S51: acquiring an operation instruction of the USB device through a data connection between the USB device and the designated port, and recording an instruction type and an operation time of the operation instruction of the USB device to obtain communication monitoring data of the USB device; S52: performing characteristic analysis processing of the instruction frequency on the communication monitoring data to obtain the frequency characteristics of the communication monitoring data, and evaluating the frequency characteristics according to a preset standard to obtain a first evaluation parameter corresponding to the frequency characteristics; S53: performing characteristic analysis processing of the command target on the communication monitoring data to obtain the target characteristic of the communication monitoring data, and performing evaluation processing on the target characteristic according to a preset standard to obtain a second evaluation parameter corresponding to the target characteristic; S54: performing feature distribution processing of the instruction pattern on the communication monitoring data to obtain pattern features of the communication monitoring data, and performing evaluation processing on the pattern features according to a preset standard to obtain a third evaluation parameter corresponding to the pattern features; S55: Perform weighted comprehensive calculation on the first evaluation parameter, the second evaluation parameter and the third evaluation parameter to obtain weighted evaluation parameters of the communication monitoring data, and perform security detection on the communication monitoring data using the weighted evaluation parameters.

[0027] Specifically, through the data connection between the USB device and the designated port, all operation instructions of the USB device (such as read and write operations, file transfers, protocol commands, etc.) are captured in real time, and the type of each instruction (such as read, write, control commands) and its execution timestamp are recorded to form complete communication monitoring data.

[0028] More specifically, the frequency of instruction types in the recorded communication data is counted, the number of occurrences and frequency of each operation instruction is calculated, and the characteristics of the instruction frequency are analyzed according to preset standards (such as the reasonable range of a certain instruction frequency or the frequency of abnormal operations) to generate the first evaluation parameter. If the frequency is too high or too low, it may indicate potential abnormal behavior.

[0029] More specifically, the instruction targets (such as data read and write targets, file locations, etc.) in the communication data are analyzed to identify their differences from normal operation targets, and the rationality of the instruction targets is evaluated according to preset standards (for example, whether they point to sensitive data, illegal targets, etc.), and a second evaluation parameter is generated. Abnormal target features indicate potential security issues.

[0030] More specifically, the time interval, sequence, operation logic and other patterns of the instructions are analyzed to identify common pattern features, such as continuous reading and writing, large batch operations, etc. According to the preset standards (such as the distribution law of normal instruction patterns), the instruction pattern is evaluated to see whether it conforms to normal operations and a third evaluation parameter is generated. Abnormal pattern features such as frequent switching of instructions or nonlinear operations may indicate abnormal activities.

[0031] More specifically, a weighted calculation is performed on the first evaluation parameter (frequency feature), the second evaluation parameter (target feature) and the third evaluation parameter (pattern feature). Different parameters can be assigned different weights according to their importance in security detection, thereby generating weighted evaluation parameters. Based on the weighted evaluation parameters, a comprehensive security evaluation is performed on the overall communication monitoring data to determine whether the communication behavior of the current USB device complies with the predefined security policy.

[0032] More specifically, if the weighted assessment parameters indicate that the communication behavior complies with the predefined security policy, the USB device will continue to be connected to the designated port and continuously monitored. If the weighted assessment parameters exceed the security threshold, indicating a potential security risk, the data connection between the USB device and the port will be forcibly disconnected immediately, and an alarm mechanism will be triggered to notify the system administrator or security team.

[0033] It is understandable that through multi-dimensional analysis of the frequency, target and pattern characteristics of instructions, the system can conduct in-depth monitoring of the behavior of USB devices and evaluate their security from multiple angles. This refined monitoring method helps to identify hidden security threats and avoid loopholes caused by single standard evaluation. Through comprehensive weight calculation, various evaluation parameters can be flexibly adjusted according to actual needs to achieve accurate response to different security needs. The comprehensive evaluation of frequency, target and pattern can identify abnormal behavior more comprehensively and accurately. After detecting abnormal behavior, the system can quickly handle it, prevent data leakage or malicious operations by forcibly disconnecting the connection, and trigger the alarm mechanism at the same time to reduce the duration of security threats. Real-time alarms and log records help administrators intervene in time to reduce security risks. Continuous monitoring and real-time evaluation ensure that the entire communication process after the device is connected is under monitoring, avoiding security checks only at the beginning of the connection, and increasing the long-term security of the system.

[0034] Preferably, the step of performing characteristic analysis processing of the command target on the communication monitoring data to obtain the target characteristics of the communication monitoring data includes: S531: Obtain a target pointing reference vector of each of the operation instructions in the communication monitoring data; wherein the target pointing reference vector is used to describe a possible target effect of the operation instruction; S532: Obtaining the instruction distribution status of each of the operation instructions in the communication monitoring data; wherein the instruction distribution status is used to describe the relative position relationship between each of the operation instructions; S533: performing superposition analysis processing on the target pointing reference vectors of each of the operation instructions within adjacent ranges based on the instruction distribution status, so as to obtain a plurality of expected reference vectors representing the target pointing reference vectors within each adjacent range; wherein the expected reference vectors are used to describe the common possible target effects of the operation instructions within the adjacent ranges; S534: Taking the expected reference vectors together as target features of the communication monitoring data.

[0035] Specifically, the target pointing reference vector of each operation instruction is first extracted from the communication monitoring data. This vector is used to describe the potential target effect of each operation instruction, that is, the object it is expected to affect or operate. For example, a file operation instruction may point to a specific file path, and a data transmission instruction may point to a specific network node or port. The target pointing reference vector provides a description of the target effect of each operation instruction, which helps to analyze whether the intention of the instruction is consistent with the normal operation process.

[0036] More specifically, in the communication monitoring data, the distribution status of each operation instruction is obtained. The distribution status describes the relative position relationship of the operation instructions in the data transmission process. It includes the execution time and sequence of the instructions, and their relative positions in the data packet or file operation. By analyzing the distribution of these instructions, the system can determine the correlation between the instructions, such as whether there are consecutive instructions that execute similar goals, or whether certain instructions appear repeatedly in a specific time period and point to the same target.

[0037] More specifically, based on the instruction distribution, the system will perform superposition analysis on the target pointing reference vectors of adjacent operation instructions. The "adjacent range" here refers to instructions that are close to each other in time, position or logic, and they point to the same target or perform similar operations.

[0038] More specifically, through overlay analysis processing, the system generates several expected reference vectors, which are used to describe the common target effects of the operation instructions in these adjacent ranges when they are executed. For example, multiple consecutive file write operations may point to the same storage path, and the expected reference vector summarizes the common goals of these operations.

[0039] More specifically, all expected reference vectors are integrated as target features of the communication monitoring data. Through these features, the system can determine the overall target tendency of the operation instructions, and then identify whether there are abnormal target directions (such as illegal access, abnormal data writing, etc.).

[0040] It can be understood that by introducing the target pointing reference vector, the system can accurately describe the target effect of the operation instruction. Compared with simple instruction recognition, this analysis method can more accurately capture the target intention of each instruction, which is helpful to identify potential risk operations, distribution status and superposition analysis of adjacent instructions, so that the system can not only analyze the target effect of a single instruction, but also judge a wider range of operation trends through the correlation between instructions. For example, a combination of multiple instructions may form a harmful operation, while a single instruction may not show an abnormality. The generation and use of expected reference vectors can uniformly evaluate multiple related instructions, improving the precision and accuracy of detection. This comprehensive analysis method avoids potential threats that may be missed when evaluating a single instruction. Based on the target feature analysis of adjacent instructions, the system can dynamically evaluate risk behaviors in communication data in real time. This dynamic processing method can detect abnormal operations in a timely manner, especially in large-scale data transmission or complex operation scenarios, and has stronger adaptability. Through in-depth analysis of the target features of instructions, the solution can adapt to different types of USB devices and operation scenarios, whether it is data transmission, file operation or network communication, etc., it can perform effective security monitoring and anomaly detection.

[0041] Preferably, the step of performing characteristic distribution processing of the instruction pattern on the communication monitoring data to obtain the pattern characteristics of the communication monitoring data includes: S541: generating a first reference element of the expected reference vector according to the number and occupation time of each of the operation instructions corresponding to the expected reference vector; S542: generating a second reference element of each of the expected reference vectors according to the relative position relationship between the expected reference vectors fed back by the instruction distribution status; S543: Combine the first reference element and the second reference element of the expected reference vector with the expected reference vector to obtain a pattern factor, and use the pattern factors corresponding to each of the expected reference vectors as the pattern feature.

[0042] Specifically, for each expected reference vector, the number of corresponding operation instructions is counted. This includes the total number of all instructions represented by the expected reference vector, and at the same time, the time range occupied by these operation instructions is calculated, that is, the sum of the time these instructions take from the start to the end of execution, which helps to understand the distribution of the operations represented by the expected reference vector in the time dimension.

[0043] More specifically, the above quantity and occupation time are used as the first reference element of the expected reference vector. The first reference element reflects the characteristics of the expected reference vector in terms of instruction execution frequency and duration, which helps to identify the intensity and persistence of different operations, and analyzes the relative position relationship between each expected reference vector according to the instruction distribution, which includes the order, distance and frequency of the expected reference vectors on the time axis.

[0044] More specifically, these relative position relationships are used as the second reference element of each expected reference vector. The second reference element describes the relationship characteristics between different operation instructions, such as whether certain instructions always appear together or are repeatedly executed at specific time intervals. This helps capture the patterns and associations between instructions. The first reference element (the number of instructions and the time they occupy) and the second reference element (the relative position relationship) of each expected reference vector are combined. The purpose of the combined processing is to merge the features of these two different dimensions to obtain a comprehensive description. The combined result forms a pattern factor. The pattern factor is a comprehensive description of each expected reference vector during the instruction execution process, reflecting its multi-dimensional characteristics in terms of quantity, time, and relative relationship.

[0045] More specifically, the pattern factors of all expected reference vectors are integrated to form an overall pattern feature, which represents the instruction pattern in the communication monitoring data and can be used to identify abnormal behaviors or unusual patterns in data transmission.

[0046] It can be understood that by generating the first and second reference elements, the system can analyze the pattern of operation instructions from multiple dimensions such as quantity, time, and position relationship. This multi-dimensional analysis method can more accurately capture complex instruction behavior patterns than single-dimensional analysis. The generation of pattern factors combines the quantity and time characteristics of instructions and the relative position relationship, and can comprehensively reflect the execution of instructions. In this way, abnormal patterns can be detected more accurately, such as frequent abnormal data transmission or irregular instruction operations. Combined processing can effectively capture complex operation patterns, such as periodic repetition between instructions, sudden operations, and complex instruction sequences. This processing method can identify more diverse abnormal behaviors and improve the breadth of security detection. This method can dynamically analyze real-time communication data and perform continuous evaluation based on the pattern factors generated in real time. This real-time analysis capability enables the system to respond quickly to abnormal operations and avoid the expansion of potential security threats. Since the generation method of pattern factors takes into account multiple characteristics (quantity, time, relative position), it can flexibly adapt to different types of USB devices and usage scenarios. Both high-frequency data transmission and low-frequency control commands can be effectively monitored. Based on the generated pattern features, the system can more efficiently execute preset security policies. When abnormal patterns are detected, corresponding measures can be taken quickly, such as alarms, disconnections, or logging.

[0047] Preferably, the whitelist is dynamically updated through a management interface pre-set on the whitelist, and the dynamic update is used to add or delete the device type, protocol type, VID and PID allowed to connect on the whitelist.

[0048] Specifically, a management interface is preset in the system for dynamically updating the whitelist. The management interface can be a network service, management backend or dedicated control panel. Ensure that the management interface has appropriate permission settings to prevent unauthorized access and modification. Users authenticate through the management interface to confirm that they have the permission to update the whitelist and access the management interface to perform dynamic updates of the whitelist. The interface should provide a user-friendly input method to facilitate the addition or deletion of device types, protocol types, VIDs (vendor IDs), and PIDs (product IDs).

[0049] More specifically, the user enters the device type, protocol type, VID and PID to be added in the management interface. The system verifies the input information to ensure the legitimacy of its format and content, adds the verified information to the whitelist, and saves the update. The user selects the device type, protocol type, VID and PID to be deleted from the whitelist. The system requires the user to confirm the deletion operation to prevent accidental deletion, removes the selected device information from the whitelist, and saves the update.

[0050] More specifically, the system synchronizes the updated whitelist to all relevant security devices or system components to ensure that newly added or deleted entries take effect immediately, and records logs of all dynamic update operations, including operator, time, and operation content, for audit and tracking. The system checks the updated whitelist to ensure that all newly added or deleted entries are correct, and performs tests to confirm that the device connection behavior after the whitelist update is as expected, and no unnecessary connections or connection denials occur.

[0051] It is understandable that administrators are allowed to flexibly add or delete device information as needed to adapt to the ever-changing network environment and device requirements. Updates can be synchronized to the system in real time, which improves the timeliness and efficiency of management. By accurately controlling the types of devices allowed to be connected, protocol types, VIDs and PIDs, the access of unauthorized devices is reduced, and the security protection capabilities of the system are enhanced. The confirmation mechanism and verification steps in the update process reduce security risks caused by misoperation. The management interface is user-friendly and simplifies the maintenance and update process of the whitelist, allowing managers to operate easily. The automatic synchronization and recording functions reduce the complexity of manual operations and improve work efficiency. The logging function provides detailed operation records for subsequent audits and problem tracking, which improves the transparency and traceability of system management. Through accurate whitelist updates, potential device conflicts and compatibility issues in the system are reduced, and the stability and reliability of the system are improved.

[0052] Preferably, during the process of data connection between the USB device and the designated port, the USB device is re-detected at a predetermined interval to detect whether the USB device still completely matches the whitelist; if the detection result is still a complete match, the data connection between the USB device and the designated port is maintained; if the detection result is not a complete match, the data connection between the USB device and the designated port is interrupted.

[0053] Specifically, when a USB device is inserted into a designated port, the system first identifies the basic information of the device, including the device type, protocol type, VID (vendor ID), and PID (product ID), and checks the identified USB device information against the current whitelist. If the device information completely matches the whitelist, the data connection is allowed; otherwise, the connection is rejected and a warning message is sent.

[0054] More specifically, the system sets a predetermined time interval (for example, every 5 minutes) for periodically re-detecting connected USB devices. This time interval can be configured according to security policies and specific needs. When each predetermined time interval arrives, the system automatically triggers the re-detection process, obtains the type, protocol type, VID and PID of the currently connected USB device again, and compares the re-detected device information with the latest whitelist to check whether the device information still completely matches the whitelist.

[0055] More specifically, if the re-detection result shows that the USB device information still completely matches the whitelist, the system maintains the data connection between the USB device and the designated port unchanged; if the re-detection result shows that the USB device information no longer completely matches the whitelist (for example, the device information has changed or the whitelist has been updated), the system will immediately interrupt the data connection between the USB device and the designated port, generate a warning event, and record the event and related information in the log for subsequent analysis and auditing.

[0056] More specifically, the system can be configured to automatically send a notification to the user or administrator to inform the reason for the connection interruption after the data connection between the USB device and the designated port is interrupted. According to the security policy, further corresponding response measures can be taken, such as isolating the device, initiating a security scan, or performing other protective operations. The system maintains a cyclic monitoring state and repeats the above-mentioned re-detection and matching check process at every predetermined time interval to ensure the security of the USB device.

[0057] It can be understood that by periodically re-detecting the matching of USB devices with the whitelist, the system can monitor the legitimacy of connected devices in real time and prevent unauthorized devices from connecting to system ports for a long time. When it is detected that the device no longer matches the whitelist, the system can quickly interrupt the data connection, reducing potential security risks and the possibility of data leakage. Through periodic re-detection, even if the USB device is verified during the initial connection, it can still prevent the device information from being tampered with or disguised during the connection, thereby providing continuous security protection. The system can dynamically adapt to the update of the whitelist to ensure that any new security policies or device restrictions can take effect in a timely manner to prevent old devices from continuing to access. The re-detection and matching check process is fully automatic and does not require manual intervention, which improves the efficiency and reliability of system management. The system automatically records the results and processing process of each re-detection to form a detailed audit log, which provides a basis for tracking and analyzing security incidents. The connection will only be interrupted when the device no longer matches the whitelist, balancing security and user experience and reducing unnecessary connection interruptions.

[0058] Preferably, it also includes generating a corresponding connection time limit according to the descriptor information of the USB device, and when the data connection time between the USB device and the designated port reaches the connection time limit, disconnecting the data connection between the USB device and the designated port.

[0059] Specifically, when a USB device establishes a connection with a designated port, the system reads the descriptor information of the USB device, including the device type, VID, PID, etc. Based on the descriptor information of the USB device, the system generates a corresponding connection time limit according to preset rules. For example, different types of devices may have different time limits. The generated connection time limit is stored in the system for subsequent use. When a USB device establishes a connection with a designated port, the system starts a timer to track the duration of the data connection and periodically checks whether the current connection time has reached the generated time limit.

[0060] More specifically, when it is detected that the connection duration reaches a predetermined limit, the system automatically disconnects the data connection between the USB device and the designated port, records the disconnection event, and notifies relevant personnel or systems to ensure safety and compliance.

[0061] It is understandable that by limiting the connection time, potential security risks can be reduced, unnecessary connections for a long time can be prevented, the use of USB ports can be effectively managed and optimized, resource waste due to long connections can be avoided, specific security and compliance requirements can be met, and the rationality of the system in managing USB devices can be ensured.

[0062] Preferably, when the USB device is disconnected from the designated port, the cache file of the designated port is deleted.

[0063] Specifically, the system continuously monitors the connection status of the USB device and the designated port. When the system detects that the USB device is disconnected from the designated port, the system immediately triggers a disconnection event, and the system obtains relevant information of the disconnected device (such as device ID, port number) for subsequent operations.

[0064] More specifically, based on the relevant information of the disconnected device, the system locates the cache files associated with the device. Cache files are usually temporary data files generated during the interaction with the device and are stored in a specified directory or location. It ensures that the cache files found are related to the disconnected device and the specified port to avoid accidental deletion of irrelevant files. After the disconnection event is triggered, the system performs a safe deletion operation to clear the cache files related to the USB device and port. The system ensures that the file deletion operation is successful to avoid interference or security issues in subsequent use due to residual cache files.

[0065] More specifically, the system records the deletion operation of the cache file, including the deletion time, device information, port number, and path of the deleted file, to facilitate subsequent auditing and tracking. The system can be configured with a notification function to send a notification to the administrator or relevant personnel after deleting the cache file to ensure that the device disconnection operation is as expected.

[0066] It is understandable that deleting cache files related to USB devices can avoid the risk of unauthorized access or sensitive data leakage after the device is unplugged. By automatically deleting cache files, user privacy is protected, especially when dealing with sensitive data or temporary files. By promptly clearing cache files that are no longer needed, the system can effectively manage storage resources, reduce the accumulation of useless files, and improve system performance. Deleting irrelevant cache files can prevent cache files from interfering with new device connections when the port is used subsequently. Through the mechanism of automating the deletion of cache files, human operational errors are reduced, and the stability and security of the system are improved. Cleaning cache files after disconnecting the device can avoid data confusion or unexpected errors the next time the device is connected.

[0067] Preferably, an external security program is applied and deployed to the designated port through a preset application programming interface, so that the external security program deployed through the application programming interface performs security detection on the data connection between the designated port and the USB device.

[0068] Specifically, the system first needs to define an API interface for external security programs to call, ensuring that external programs can interact with the specified port through the API. The API interface should include basic parameters such as port number, USB device information, and data flow direction. The API interface needs to be permission managed to ensure that only authorized external security programs can access and control the specified port through the API.

[0069] More specifically, through a preset API interface, an external security program can be deployed to a specified port. The security program can be a firewall, an intrusion detection system, or other security tools for monitoring data transmission between a USB device and a port.

[0070] More specifically, during the deployment process, the external security program will be initialized according to the configuration parameters (such as monitoring frequency, detection depth, data filtering rules, etc.) to ensure that it adapts to the specific port and device security requirements.

[0071] More specifically, the external security program starts to monitor the data connection between the designated port and the USB device in real time, detecting possible security threats during data transmission, such as abnormal data packets, malware, or unauthorized access requests. By analyzing the connection behavior, the external security program can detect whether the data transmission complies with the whitelist rules or the predetermined security policy. If abnormal behavior is detected, the external program will trigger the corresponding alarm or protection mechanism.

[0072] More specifically, when an abnormal data connection is detected, the external security program sends an alarm through the API interface to notify the system administrator and record relevant security events (such as device information, time, and detected threats). According to the preset security policy, the system can immediately take security measures, such as restricting the permissions of USB devices, disconnecting data connections, isolating ports, or conducting further security scans.

[0073] More specifically, the system will record all detection operations of external security programs on ports and USB devices, and generate detailed log files, including detection results, timestamps, and security measures taken. The system provides a feedback mechanism that allows administrators to view and analyze detection logs in order to timely optimize the configuration of security policies and API interfaces.

[0074] It is understandable that by deploying external security programs, the system can monitor and detect data transmission between USB devices and ports in real time, promptly discover and prevent potential security threats, and through behavioral analysis and rule detection of external security programs, it can prevent malware or unauthorized devices from accessing the system, thereby improving overall security.

[0075] More specifically, through the API interface, administrators can deploy different external security programs according to different security needs, ensuring that the system is flexible and scalable and can adapt to a variety of usage scenarios. The use of the API interface enables the system to dynamically adjust security policies, and administrators can update the configuration and detection rules of security programs based on the latest security needs and threat situations.

[0076] More specifically, the deployment and detection process of external security programs is automated, reducing the need for manual intervention and improving the efficiency and accuracy of security management. Through automated early warning and processing mechanisms, the system can respond to threats as soon as they occur, ensuring that the security of the system is not compromised.

[0077] More specifically, through the deployment and real-time detection of external security programs, the security risks caused by USB device connections can be effectively reduced to ensure stable system operation. External programs can optimize resource usage according to set security policies, avoid long-term invalid connections and potential threats, and improve the efficiency of overall resource management. In summary, the deployment of external security programs through the application programming interface can effectively perform real-time security detection on the data connection between USB devices and designated ports, thereby improving the security, automated management capabilities and flexibility of the system.

[0078] Preferably, the external security program deployed through the application programming interface includes a USB device monitoring program, and the functions of the USB device monitoring program include: S61: recording the data interaction amount between the USB device and the designated port in real time to obtain a data interaction amount sequence between the USB device and the designated port; S62: Recording the performance operation degree of the USB device in real time to obtain a performance operation degree sequence of the USB device; S63: Analyze and process the correlation characteristics based on the data interaction amount sequence and the performance operation degree sequence to obtain the correlation characteristics of the data interaction amount sequence and the performance operation degree sequence; wherein the correlation characteristics are used to describe the correlation relationship between the performance operation degree of the USB device and the data interaction amount; S64: scheduling theoretical association features corresponding to the USB device in a database according to the descriptor information of the USB device, performing difference analysis processing on the association features according to the theoretical association features, and performing security detection on the USB device according to the result of the analysis processing; S65: If the difference between the associated feature and the theoretical associated feature is within an expected range, it is determined that the USB device is operating normally; S66: If the difference between the association feature and the theoretical association feature does not conform to the expected range, it is determined that the operation of the USB device is in an abnormal state, and the data connection between the USB device and the designated port is interrupted.

[0079] Specifically, the above is an example of an external security program that can be called through an application programming interface, and does not limit the use of other forms of external security programs.

[0080] More specifically, the USB device monitoring program is deployed to the designated port using a preset API interface to ensure that the program can interact with the USB device and the port. The monitoring program records in real time the amount of data interaction between the USB device and the designated port, including data transmission frequency, packet size, etc., to generate a data interaction amount sequence. The monitoring program also records the performance operation degree of the USB device (such as CPU usage, memory usage, etc.) to generate a performance operation degree sequence.

[0081] More specifically, based on the recorded interaction volume sequence and performance operation degree sequence, correlation feature analysis is performed to analyze the relationship between the two to understand the correlation between data interaction volume and device performance, and correlation features are extracted from the analysis results. These features are used to describe the relationship between data interaction volume and performance operation degree of USB devices.

[0082] More specifically, based on the descriptor information of the USB device, theoretical association features related to the device are searched in the database. These features are generated based on the device specifications and expected behaviors. The actual measured association features are compared with the theoretical association features, and their differences are analyzed to identify potential abnormal behaviors.

[0083] More specifically, if the difference between the associated feature and the theoretical associated feature is within the expected range, the working state of the USB device is determined to be normal, and if the difference between the associated feature and the theoretical associated feature is beyond the expected range, the working state of the USB device is determined to be abnormal. The system will interrupt the data connection between the USB device and the designated port to prevent potential security threats.

[0084] More specifically, each detection result is recorded, including the basis for judging normal and abnormal states, as well as detailed information on interrupted operations, and a security detection report is generated for system administrators to review, ensuring transparency and traceability of device behavior.

[0085] It is understandable that through real-time monitoring and correlation feature analysis, it is possible to promptly discover and respond to abnormal behavior of USB devices, reduce the risk of data leakage or system intrusion, interrupt the connection of abnormal devices, prevent possible malware or data tampering, ensure system stability and security, and conduct comprehensive analysis based on data interaction volume and performance operation degree. Compared with single indicator monitoring, it provides more accurate security detection results. Using theoretical correlation features as a benchmark, it can effectively identify abnormal status of devices and reduce the probability of false alarms and missed alarms. Through continuous monitoring of normal status devices and automatic interruption of abnormal status, system resources are saved and the need for manual intervention by administrators is reduced. Regular data and performance analysis can optimize the use of USB devices and avoid the impact of performance degradation on the overall operation of the system.

[0086] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A USB device type control connection method, characterized in that: include: Continuously performing connection detection of the USB device on the designated port, and when detecting that the designated port is in a connected state with the USB device, obtaining descriptor information of the USB device in a connected state with the designated port; wherein the descriptor information includes a device type, a protocol type, a VID, and a PID of the USB device; Performing matching processing on the descriptor information according to a preset whitelist to detect whether the descriptor information completely matches the whitelist; If the detection result is that the descriptor information completely matches the whitelist, the USB device is allowed to establish a data connection with the designated port; If the detection result is that the descriptor information does not completely match the whitelist, the USB device is denied data connection with the designated port and an alarm mechanism is triggered; When the allowed USB device establishes data connection with the designated port, the communication of the USB device is continuously monitored, and the communication monitoring data of the USB device is continuously security checked according to a predefined security policy. If the result of the security check is that it does not comply with the security policy, the USB device is forced to disconnect the data connection with the designated port and an alarm mechanism is triggered.

2. The USB device type control connection method according to claim 1, characterized in that: When the permitted USB device is connected to the designated port for data connection, the steps of continuously monitoring the communication of the USB device and continuously performing security detection on the communication monitoring data of the USB device according to a predefined security policy include: Acquire the operation instruction of the USB device through the data connection between the USB device and the designated port, and record the instruction type and operation time of the operation instruction of the USB device to obtain the communication monitoring data of the USB device; Performing characteristic analysis processing of instruction frequency on the communication monitoring data to obtain frequency characteristics of the communication monitoring data, and evaluating the frequency characteristics according to a preset standard to obtain a first evaluation parameter corresponding to the frequency characteristics; Performing characteristic analysis processing of the command target on the communication monitoring data to obtain the target characteristic of the communication monitoring data, and evaluating the target characteristic according to a preset standard to obtain a second evaluation parameter corresponding to the target characteristic; Performing feature distribution processing of the instruction pattern on the communication monitoring data to obtain pattern features of the communication monitoring data, and performing evaluation processing on the pattern features according to a preset standard to obtain a third evaluation parameter corresponding to the pattern features; The first evaluation parameter, the second evaluation parameter and the third evaluation parameter are weighted and comprehensively calculated to obtain weighted evaluation parameters of the communication monitoring data, and security detection is performed on the communication monitoring data using the weighted evaluation parameters.

3. The USB device type control connection method according to claim 2, characterized in that: The step of performing characteristic analysis processing of the command target on the communication monitoring data to obtain the target characteristics of the communication monitoring data includes: Obtaining a target pointing reference vector of each of the operation instructions in the communication monitoring data; wherein the target pointing reference vector is used to describe a possible target effect of the operation instruction; Obtaining the instruction distribution status of each of the operation instructions in the communication monitoring data; wherein the instruction distribution status is used to describe the relative position relationship between each of the operation instructions; Based on the instruction distribution status, the target pointing reference vectors of each of the operation instructions are subjected to superposition analysis within adjacent ranges to obtain a plurality of expected reference vectors representing the target pointing reference vectors within each adjacent range; wherein the expected reference vectors are used to describe the common possible target effects of the operation instructions within the adjacent ranges; The expected reference vectors are collectively used as target features of the communication monitoring data.

4. The USB device type control connection method according to claim 3, characterized in that: The step of performing characteristic distribution processing of the instruction pattern on the communication monitoring data to obtain the pattern characteristics of the communication monitoring data includes: Generate a first reference element of the expected reference vector according to the number and occupation time of each of the operation instructions corresponding to the expected reference vector; generating a second reference element of each of the expected reference vectors according to the relative positional relationship between each of the expected reference vectors fed back by the instruction distribution status; The first reference element and the second reference element of the expected reference vector are combined with the expected reference vector to obtain a pattern factor, and the pattern factors corresponding to each of the expected reference vectors are collectively used as the pattern feature.

5. The USB device type control connection method according to claim 1, characterized in that: The whitelist is dynamically updated through a management interface pre-set on the whitelist, and the dynamic update is used to add or delete the device type, protocol type, VID and PID allowed to connect on the whitelist.

6. The USB device type control connection method according to claim 1, characterized in that: During the process of data connection between the USB device and the designated port, the USB device is re-detected at a predetermined interval to detect whether the USB device still completely matches the whitelist; if the detection result is still a complete match, the data connection between the USB device and the designated port is maintained; if the detection result is not a complete match, the data connection between the USB device and the designated port is interrupted.

7. The USB device type control connection method according to claim 1, characterized in that: It also includes generating a corresponding connection time limit according to the descriptor information of the USB device, and disconnecting the data connection between the USB device and the designated port when the data connection time between the USB device and the designated port reaches the connection time limit.

8. The USB device type control connection method according to claim 1, characterized in that: When the USB device is disconnected from the designated port, the cache file of the designated port is deleted.

9. The USB device type control connection method according to claim 1, characterized in that: The external security program is applied and deployed to the designated port through a preset application programming interface, so that the external security program deployed through the application programming interface performs security detection on the data connection between the designated port and the USB device.

10. The USB device type control connection method according to claim 9, characterized in that: The external security program deployed through the application programming interface includes a USB device monitoring program, and the functions of the USB device monitoring program include: Recording the data interaction amount between the USB device and the designated port in real time to obtain a data interaction amount sequence between the USB device and the designated port; Recording the performance operation degree of the USB device in real time to obtain a performance operation degree sequence of the USB device; Performing correlation feature analysis based on the data interaction amount sequence and the performance operation degree sequence to obtain correlation features between the data interaction amount sequence and the performance operation degree sequence; wherein the correlation features are used to describe the correlation relationship between the performance operation degree of the USB device and the data interaction amount; Scheduling theoretical association features corresponding to the USB device in a database according to the descriptor information of the USB device, performing difference analysis processing on the association features according to the theoretical association features, and performing security detection on the USB device according to the result of the analysis processing; If the difference between the correlation feature and the theoretical correlation feature is within an expected range, it is determined that the USB device is operating normally; If the difference between the association feature and the theoretical association feature does not conform to the expected range, it is determined that the operation of the USB device is in an abnormal state, and the data connection between the USB device and the designated port is interrupted.

Images