USB device authentication method and system based on windows system

Abstract

The invention provides a USB device authentication method and system based on a windows system, and the method comprises the steps: a server side analyzes a USB device obtaining instruction to obtain first information, and processes the first information based on a preset encryption algorithm to obtain each first identifier; processing each first identifier and the first information based on a first combinatorial algorithm to obtain a target white list file; when a target client monitors that a second USB device is inserted into the USB interface of the target client, obtaining second information and processing the second information based on a preset encryption algorithm to obtain a second identifier; authenticating the second USB device according to the second identifier and the target white list file; therefore, the white list file is created and stored through the server, compared with a physical disk, the method is more convenient, large-scale online deployment can be achieved, carrying is not needed, meanwhile, the convenience of updating the white list file and the safety of the system are greatly improved, and the risk of data leakage is reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a USB device authentication method and system based on Windows system. Background Art

[0002] With the rapid development of computer technology, the application of Universal Serial Bus (USB) interface is becoming more and more widespread. USB interface realizes the plug-and-play and hot-swap functions of external devices. Therefore, external devices such as USB flash drives, mobile hard disks, USB wireless network cards, cameras, etc. are usually designed to use USB interfaces to connect to computers. Such external devices can be called USB devices.

[0003] While people enjoy the ease of use brought by USB devices, they also face a series of data leakage problems brought by them, so people have higher and higher requirements for the security control of USB devices. With the advent of the Internet of Things era, for commercial network environments, various USB devices need to be strictly controlled. In addition to the control of common USB flash drives and mobile hard drives, other new USB devices such as USB wireless network cards and USB cameras also need to be controlled to prevent the leakage of trade secrets.

[0004] Among them, the patent publication number CN116842500A discloses a device filtering method and system based on a whitelist, which judges and screens the legality of the inserted USB storage device, and compares the whitelist list stored in the SPI-FLASH module of the platform hardware. If it exists, the USB storage device is enabled, and if it does not exist, the USB storage device is disabled and an alarm is issued. The whitelist list can be updated through a dedicated key USB flash drive. However, this solution requires a special Flash to store the USB device whitelist, and the cost will increase due to the replacement of a larger Flash as the amount of stored data increases, and manpower will also be required to replace the old version of the flash, which is very inconvenient. A special USB device is required to store the whitelist list. When deploying, the USB flash drive must be used for on-site deployment, which is time-consuming, labor-intensive, inconvenient, and has poor security. Summary of the invention

[0005] The embodiment of the present invention provides a USB device authentication method and system based on Windows system, aiming to solve the problems of using physical disk to store white list in the prior art, such as troublesome deployment, inconvenient carrying and poor security.

[0006] In a first aspect, an embodiment of the present invention provides a USB device authentication method based on a Windows system, which is applied to a USB device authentication system based on a Windows system, wherein the USB device authentication system based on a Windows system comprises a server and at least one client, wherein the server is connected to the at least one client, and comprises:

[0007] In response to the USB device acquisition instruction, the server parses the USB device acquisition instruction to obtain first information, and processes the first information based on a preset encryption algorithm to obtain each first identifier;

[0008] The server processes each first identifier and the first information based on a first combination algorithm to obtain a target whitelist file, and sends the target whitelist file to the at least one client for storage;

[0009] When a target client among the at least one client detects that a second USB device is inserted into its USB interface, the target client acquires second information of the second USB device, and processes the second information based on the preset encryption algorithm to obtain a second identifier of the second USB device;

[0010] The target client performs an authentication comparison on the second identifier and each first identifier in the target whitelist file to obtain an authentication comparison result;

[0011] If the authentication comparison result is that the second identifier is consistent with any first identifier in the target whitelist file, the target client determines that the authentication of the second USB device is successful.

[0012] In a second aspect, an embodiment of the present invention provides a USB device authentication system based on a Windows system, wherein the USB device authentication system based on a Windows system comprises a server and at least one client, wherein the server is connected to the at least one client, and comprises:

[0013] The server is used to respond to the USB device acquisition instruction, parse the USB device acquisition instruction to obtain first information, and process the first information based on a preset encryption algorithm to obtain each first identifier;

[0014] The server is further configured to process each first identifier and the first information based on a first combination algorithm to obtain a target whitelist file, and send the target whitelist file to the at least one client for storage;

[0015] The at least one client includes a target client, which is used to obtain second information of the second USB device when detecting that a second USB device is inserted into the USB interface of the client, and process the second information based on the preset encryption algorithm to obtain a second identifier of the second USB device;

[0016] The target client is further used to perform an authentication comparison on the second identifier and each first identifier in the target whitelist file to obtain an authentication comparison result;

[0017] The target client is further configured to determine that the authentication of the second USB device is successful if the authentication comparison result is that the second identifier is consistent with any first identifier in the target whitelist file.

[0018] In a third aspect, an embodiment of the present application further provides a computer device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the Windows-based USB device authentication method described in the first aspect is implemented.

[0019] In a fourth aspect, an embodiment of the present application further provides a storage medium, wherein the storage medium stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the Windows-based USB device authentication method described in the first aspect above.

[0020] The embodiment of the present invention provides a USB device authentication method and system based on a Windows system, comprising: a server side parses a USB device acquisition instruction to obtain first information, processes the first information based on a preset encryption algorithm to obtain each first identifier; and processes each first identifier and the first information based on a first combination algorithm to obtain a target whitelist file; when a target client detects that a second USB device is inserted into its own USB interface, obtains second information and processes the second information based on a preset encryption algorithm to obtain a second identifier; authenticates the second USB device according to the second identifier and the target whitelist file; thereby creating and storing a whitelist file through a server, which is more convenient than using a physical disk and can be deployed online on a large scale without the need to be carried around, and at the same time greatly improves the convenience of updating the whitelist file and the security of the system, and reduces the risk of data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0022] Figure 1 A flowchart of a Windows-based USB device authentication method provided by an embodiment of the present invention;

[0023] Figure 2 A schematic block diagram of a Windows-based USB device authentication system provided by an embodiment of the present invention;

[0024] Figure 3 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0027] It should also be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0028] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0029] See also Figure 1 , Figure 1A flowchart of a USB device authentication method based on a Windows system provided in an embodiment of the present application. The USB device authentication method based on a Windows system is applied to a USB device authentication system based on a Windows system. The USB device authentication system based on a Windows system includes a server and at least one client, wherein the server is connected to each of the at least one client, wherein the server is a server, and the client can be a smart terminal device with communication function such as a tablet computer, a laptop computer, a desktop computer, and a personal digital assistant.

[0030] like Figure 1 As shown, the method includes steps S110 to S150.

[0031] S110. In response to a USB device acquisition instruction, the server parses the USB device acquisition instruction to obtain first information, and processes the first information based on a preset encryption algorithm to obtain each first identifier.

[0032] In this embodiment, the server runs software that automatically acquires USB devices and generates a whitelist, wherein the USB device acquisition instruction can be triggered by relevant staff. When the server receives the USB device acquisition instruction triggered by the user (i.e., there is a USB device inserted into the device terminal), the USB device acquisition instruction is parsed to obtain the first information corresponding to the USB device; wherein the first information includes the first physical feature information of each first USB device, and the first preset character corresponding to each first physical feature information. Moreover, the first USB device can specifically be a U disk, a mouse, an MP3, a mobile hard disk, a keyboard, a USB display and other devices. In addition, in this embodiment, the server processes the first information based on a preset encryption algorithm to obtain each first identifier, so as to ensure that the first identifier generated by each first USB device is unique, thereby effectively preventing the user on the client from forging the first identifier.

[0033] In one embodiment, the step S110 includes:

[0034] The server parses the USB device acquisition instruction to obtain first physical feature information of each first USB device and a first preset character corresponding to each first physical feature information;

[0035] The server calculates each first physical feature information and the corresponding first preset character based on the preset encryption algorithm to obtain a first identifier corresponding to each first physical feature information.

[0036] In this embodiment, in order to ensure that the identity authentication process of the USB device is both secure and unique, this embodiment uses the first physical feature information of the first USB device and the customized first preset character, and encrypts it through a preset encryption algorithm to generate a unique encrypted string, and uses the encrypted string as the first identifier of the first USB device.

[0037] The specific implementation process of obtaining each first identifier is as follows: the server parses the USB device acquisition instruction to automatically obtain the first physical feature information of each first USB device and the first preset character corresponding to each first physical feature information; wherein each first physical feature information includes a product identifier (PID), a vendor identifier (VID) and a serial number (SN); the product identifier (PID) is the product ID of each first USB device, the vendor identifier (VID) is the manufacturer ID of each first USB device, and the serial number (SN) is the serial number of each first USB device; and the server calculates each first physical feature information and the corresponding first preset character based on the preset encryption algorithm to obtain the first identifier corresponding to each first physical feature information. In this embodiment, the preset encryption algorithm is preferably a SHA-256 algorithm, which is a Secure Hash Algorithm 2, which can convert input data of any length into a fixed-length (256-bit) hash value. This embodiment obtains the first physical characteristic information of each first USB device and the customized first preset character corresponding to each first physical characteristic information, and then generates a unique first identifier through the SHA-256 algorithm, thereby ensuring the unforgeability of the first identifier.

[0038] In one embodiment, the server calculates each first physical feature information and the corresponding first preset character based on the preset encryption algorithm to obtain a first identifier corresponding to each first physical feature information, including:

[0039] The server combines each first physical feature information and the corresponding first preset character to obtain a first character string corresponding to each first physical feature information;

[0040] The server calculates the first character string corresponding to each first physical feature information according to the preset encryption algorithm to obtain a first identifier corresponding to each first physical feature information.

[0041] In this embodiment, in order to generate a unique first identifier, specifically, the server first combines each first physical feature information and the corresponding first preset character to obtain a first character string corresponding to each first physical feature information, so as to add the corresponding first preset character on the basis of each first physical feature information, thereby increasing additional security and uniqueness. In addition, in order to further improve the uniqueness of the first identifier, the server calculates the first character string corresponding to each first physical feature information according to the preset encryption algorithm; wherein, the preset encryption algorithm is preferably the SHA-256 algorithm in this embodiment, which is a widely recognized secure hash algorithm that can resist brute force and collision attacks, so that the first character string corresponding to each first physical feature information is calculated by the SHA-256 algorithm to generate an encrypted hash value (i.e., the first identifier).

[0042] In one embodiment, the server calculates the first string corresponding to each first physical feature information according to the preset encryption algorithm to obtain the first identifier corresponding to each first physical feature information, including:

[0043] The server responds to the initialization instruction and initializes the configuration parameters of the preset encryption algorithm according to the initialization instruction;

[0044] The server pre-processes the first character string according to the initialized preset encryption algorithm to obtain data to be processed;

[0045] The server processes the data to be processed in blocks according to the preset encryption algorithm after the initialization to obtain 512-bit data blocks;

[0046] The server performs 64 rounds of hash operations on each of the 512-bit data blocks according to the initialized preset encryption algorithm to obtain a first identifier corresponding to each first physical feature information.

[0047] In this embodiment, since the preset encryption algorithm is preferably the SHA-256 algorithm, the preset encryption algorithm calculates the first string corresponding to each first physical feature information, and the specific execution steps of obtaining the first identifier corresponding to each first physical feature information are as follows: the server responds to the initialization instruction and initializes the configuration parameters of the preset encryption algorithm according to the initialization instruction; specifically, when the SHA-256 algorithm starts, 8 initial hash values ​​are set, wherein the 8 initial hash values ​​are obtained based on the first 32 bits of the decimal part of the square roots of the first 8 prime numbers, for example, the first 32 bits of the decimal part of the square root of the prime number 2 correspond to 0x6a09e667. Then, the server pre-processes the first string according to the initialized preset encryption algorithm, that is, fills the first string so that the length of the first string meets the specific standard required by the SHA-256 algorithm, and after the filling process is completed, adds a 64-bit length value to represent the length of the first string, thereby obtaining the data to be processed. In addition, the server processes the data to be processed in blocks according to the preset encryption algorithm after the initialization to obtain 512-bit data blocks; and performs 64 rounds of hash operation processing on each data block in the 512-bit data block, thereby obtaining an encrypted hash value composed of 8 hash values ​​(i.e., the first identifier corresponding to each first physical feature information). Among them, the hash operation processing specifically includes logical functions (such as AND, OR, and XOR, etc.), addition, and bit rotation, etc. This embodiment calculates the first character string corresponding to each first physical feature information through the SHA-256 algorithm to ensure that the output first identifier is deterministic, irreversible, and collision-resistant, thereby preventing malicious forgery of the first identifier, thereby enhancing the security of subsequent USB device authentication.

[0048] In one embodiment, the method further comprises:

[0049] In response to the USB device adding instruction, the server parses the USB device adding instruction to obtain third information, and processes the third information based on the preset encryption algorithm to obtain each third identifier;

[0050] The server determines a mapping relationship between the third information and each third identifier, and updates the mapping relationship to the target whitelist file.

[0051] In this embodiment, the server manages the target whitelist file, and is maintained and added by the server. When the target whitelist file is updated (such as adding a new USB device or deleting a USB device, etc.), the server will synchronize the updated target whitelist file to the client. In specific implementation, when the server responds to the USB device new instruction, it parses the USB device new instruction to obtain the third information; wherein, the third information includes each third physical feature information of the newly added USB device, and the third preset character corresponding to each third physical feature information; and the third information is processed based on the preset encryption algorithm to obtain each third identifier; thereby determining the mapping relationship between the third information and each third identifier, and then updating the mapping relationship to the target whitelist file. Among them, the execution process of adding a new USB device is consistent with that of deleting a USB device, which will not be repeated here. Therefore, this embodiment greatly enhances security while ensuring convenient update of the target whitelist file.

[0052] S120: The server processes each first identifier and the first information based on a first combination algorithm to obtain a target whitelist file, and sends the target whitelist file to the at least one client.

[0053] In this embodiment, after obtaining each first identifier, in order to generate a whitelist file that is convenient for subsequent client authentication, the server processes each first identifier and the first information based on a first combination algorithm to obtain a target whitelist file; wherein, each first identifier in the target whitelist file is mapped one-to-one with the first information. Therefore, storing the target whitelist file through the server is more convenient than the physical disk transmission storage in the prior art, and can be deployed on a large scale, and can be directly operated online without carrying it with you. In addition, after the server obtains the target whitelist file, the target whitelist file is synchronously sent to the whitelist file storage path of each client in the at least one client, and each client in the at least one client can automatically maintain the target whitelist file. wherein, as long as the server and the at least one client are in the same communication network, a communication connection can be achieved.

[0054] S130: When a target client among the at least one client detects that a second USB device is inserted into its USB interface, the target client obtains second information of the second USB device, and processes the second information based on the preset encryption algorithm to obtain a second identifier of the second USB device.

[0055] In this embodiment, after receiving the target whitelist file, each of the at least one client will traverse whether there is a second USB device on its own USB interface when it is turned on, and then monitor the hot plug event of the second USB device in real time through the USB device servo program during the operation process; in addition, in order to ensure that the identifier generated when the second USB device is consistent with the first USB device obtained in the server is consistent, each of the at least one client and the server share a set of algorithm logic. Therefore, when a target client in the at least one client detects that a second USB device is inserted into its own USB interface, the target client obtains the second information of the second USB device; wherein the second information includes second physical feature information and a second preset character corresponding to each second physical feature information; and the target client combines the second physical feature information and the corresponding second preset character to obtain a second string corresponding to the second physical feature information; the target client calculates the second string according to the preset encryption algorithm to obtain a second identifier corresponding to the second physical feature information. When a target client in the at least one client detects that a second USB device is unplugged from its own USB interface, the log of the current second USB device is recorded. In addition, in order to prevent users from making modifications to the USB device servo program, a filtering driver is registered on the Windows system in at least one of the clients, so that all user operations on the USB device servo program are invalid, thereby ensuring that the USB device servo program is not affected during system operation, thereby playing a role in process protection.

[0056] S140: The target client performs an authentication comparison on the second identifier and each first identifier in the target whitelist file to obtain an authentication comparison result.

[0057] In this embodiment, after the target client obtains the second identifier of the second USB device, the target client authenticates the second USB device according to the second identifier and the target whitelist file. In specific implementation, the target client performs authentication comparison between the second identifier and each first identifier in the target whitelist file, that is, traverses the first identifier in the target whitelist file to see if there is one that is consistent with the second identifier, and then uses the traversal result as the authentication comparison result; wherein the authentication comparison result is that the second identifier is consistent with any first identifier in the target whitelist file, or the second identifier is inconsistent with any first identifier in the target whitelist file. Thus, the Windows system on the target client performs legitimacy judgment and screening on the second USB device connected to its own USB interface to reduce the risk of data leakage.

[0058] In one embodiment, the step S140 includes:

[0059] The target client detects whether the target whitelist file exists in the whitelist file storage path, and obtains a detection result;

[0060] If the detection result is that the target whitelist file exists in the whitelist file storage path, the target client parses the target whitelist file to obtain the first information and each first identifier;

[0061] If the detection result is that the target whitelist file does not exist in the whitelist file storage path, the target client generates a first alarm prompt;

[0062] The first warning prompt is used to prompt the user to uninstall the second USB device.

[0063] In this embodiment, in order to further improve the security of the target client windows system, the target client will also detect whether the target whitelist file exists in the whitelist file storage path to obtain a detection result; if the detection result is that the target whitelist file exists in the whitelist file storage path, the target client parses the target whitelist file to obtain the first information and each first identifier, so as to facilitate the subsequent authentication comparison of the parsed first identifier with the second identifier of the second USB device of the client. If the detection result is that the target whitelist file does not exist in the whitelist file storage path, it means that the target client may have a system malicious deletion or system elimination of the target whitelist file, and the target client generates a first warning prompt to prompt the user to uninstall the second USB device, thereby reducing the risk of data leakage.

[0064] S150: If the authentication comparison result is that the second identifier is consistent with any first identifier in the target whitelist file, the target client determines that the authentication of the second USB device is successful.

[0065] In this embodiment, after the target client obtains the authentication comparison result, if the authentication comparison result is that the second identifier is consistent with any first identifier in the target whitelist file, it is determined that the authentication of the second USB device is successful, and the second USB device can be used normally in the target client. In addition, after determining that the authentication of the second USB device is successful, the target client records and stores the second identifier of the current second USB device after the authentication is successful, so that when the target client detects that the current second USB device is inserted into its own USB interface later, the authentication comparison step can be skipped and the comparison is directly performed with the stored second identifier. If the comparison is consistent, the current second USB device is identified as a legal device, and the current second USB device is allowed to perform corresponding operations on the target client. In addition, if the authentication comparison result is that the second identifier is inconsistent with any first identifier in the target whitelist file, the target client determines that the authentication of the second USB device fails, and generates a second alarm prompt; wherein, the second alarm prompt is used to prompt the user to uninstall the second USB device. In addition, after determining that the second USB device fails to be authenticated, the target client records and stores the second identifier of the current second USB device after the authentication fails, so that when the target client detects that the current second USB device is inserted into its own USB interface later, the authentication comparison step is skipped and the second identifier is directly compared with the stored second identifier. If the comparison is inconsistent, the current second USB device is identified as an illegal device, and the current second USB device is refused to perform any operation on the target client. Thus, by performing authentication comparison between the second identifier of the second USB device and each first identifier in the target whitelist file, it is ensured that the second USB device after successful authentication can operate normally on the target client, thereby enhancing the security of the system.

[0066] It can be seen from the above technical solutions that the present invention creates and stores whitelist files through a server, which is more convenient than using a physical disk and can be deployed online on a large scale without having to be carried around. At the same time, it greatly improves the convenience of whitelist file updates and the security of the system, and reduces the risk of data leakage.

[0067] The present application also provides a Windows-based USB device authentication system, which is used to execute any embodiment of the aforementioned Windows-based USB device authentication method. Figure 2 , Figure 2 It is a schematic block diagram of a Windows-based USB device authentication system provided in an embodiment of the present application.

[0068] Among them, Figure 2 As shown, the Windows-based USB device authentication system 100 includes a server 110 and at least one client 120 .

[0069] The server 110, in response to the USB device acquisition instruction, parses the USB device acquisition instruction to obtain first information, and processes the first information based on a preset encryption algorithm to obtain each first identifier.

[0070] In this embodiment, the server runs software that automatically acquires USB devices and generates a whitelist, wherein the USB device acquisition instruction can be triggered by relevant staff. When the server receives the USB device acquisition instruction triggered by the user (i.e., there is a USB device inserted into the device terminal), the USB device acquisition instruction is parsed to obtain the first information corresponding to the USB device; wherein the first information includes the first physical feature information of each first USB device, and the first preset character corresponding to each first physical feature information. Moreover, the first USB device can specifically be a U disk, a mouse, an MP3, a mobile hard disk, a keyboard, a USB display and other devices. In addition, in this embodiment, the server processes the first information based on a preset encryption algorithm to obtain each first identifier, so as to ensure that the first identifier generated by each first USB device is unique, thereby effectively preventing the user on the client from forging the first identifier.

[0071] In one embodiment, the server 110 is specifically used for:

[0072] The server 110 is used to parse the USB device acquisition instruction to obtain the first physical characteristic information of each first USB device and the first preset character corresponding to each first physical characteristic information;

[0073] The server 110 is used to calculate each first physical feature information and the corresponding first preset character based on the preset encryption algorithm to obtain a first identifier corresponding to each first physical feature information.

[0074] In this embodiment, in order to ensure that the identity authentication process of the USB device is both secure and unique, this embodiment uses the first physical feature information of the first USB device and the customized first preset character, and encrypts it through a preset encryption algorithm to generate a unique encrypted string, and uses the encrypted string as the first identifier of the first USB device.

[0075] The specific implementation process of obtaining each first identifier is as follows: the server parses the USB device acquisition instruction to automatically obtain the first physical feature information of each first USB device and the first preset character corresponding to each first physical feature information; wherein each first physical feature information includes a product identifier (PID), a vendor identifier (VID) and a serial number (SN); the product identifier (PID) is the product ID of each first USB device, the vendor identifier (VID) is the manufacturer ID of each first USB device, and the serial number (SN) is the serial number of each first USB device; and the server calculates each first physical feature information and the corresponding first preset character based on the preset encryption algorithm to obtain the first identifier corresponding to each first physical feature information. In this embodiment, the preset encryption algorithm is preferably a SHA-256 algorithm, which is a Secure Hash Algorithm 2, which can convert input data of any length into a fixed-length (256-bit) hash value. This embodiment obtains the first physical characteristic information of each first USB device and the customized first preset character corresponding to each first physical characteristic information, and then generates a unique first identifier through the SHA-256 algorithm, thereby ensuring the unforgeability of the first identifier.

[0076] In one embodiment, the server 110 is used to calculate each first physical feature information and the corresponding first preset character based on the preset encryption algorithm to obtain a first identifier corresponding to each first physical feature information, including:

[0077] The server 110 is used to combine each first physical feature information and the corresponding first preset character to obtain a first character string corresponding to each first physical feature information;

[0078] The server 110 is used to calculate the first character string corresponding to each first physical feature information according to the preset encryption algorithm to obtain the first identifier corresponding to each first physical feature information.

[0079] In this embodiment, in order to generate a unique first identifier, specifically, the server first combines each first physical feature information and the corresponding first preset character to obtain a first character string corresponding to each first physical feature information, so as to add the corresponding first preset character on the basis of each first physical feature information, thereby increasing additional security and uniqueness. In addition, in order to further improve the uniqueness of the first identifier, the server calculates the first character string corresponding to each first physical feature information according to the preset encryption algorithm; wherein, the preset encryption algorithm is preferably the SHA-256 algorithm in this embodiment, which is a widely recognized secure hash algorithm that can resist brute force and collision attacks, so that the first character string corresponding to each first physical feature information is calculated by the SHA-256 algorithm to generate an encrypted hash value (i.e., the first identifier).

[0080] In one embodiment, the server 110 is used to calculate the first string corresponding to each first physical feature information according to the preset encryption algorithm to obtain the first identifier corresponding to each first physical feature information, including:

[0081] The server 110 is used to respond to the initialization instruction and initialize the configuration parameters of the preset encryption algorithm according to the initialization instruction;

[0082] The server 110 is used to pre-process the first character string according to the preset encryption algorithm after initialization to obtain data to be processed;

[0083] The server 110 is used to process the data to be processed in blocks according to the initialized preset encryption algorithm to obtain 512-bit data blocks;

[0084] The server 110 is used to perform 64 rounds of hash operation processing on each data block in the 512-bit data block according to the initialized preset encryption algorithm to obtain a first identifier corresponding to each first physical feature information.

[0085] In this embodiment, since the preset encryption algorithm is preferably the SHA-256 algorithm, the preset encryption algorithm calculates the first string corresponding to each first physical feature information, and the specific execution steps of obtaining the first identifier corresponding to each first physical feature information are as follows: the server responds to the initialization instruction and initializes the configuration parameters of the preset encryption algorithm according to the initialization instruction; specifically, when the SHA-256 algorithm starts, 8 initial hash values ​​are set, wherein the 8 initial hash values ​​are obtained based on the first 32 bits of the decimal part of the square roots of the first 8 prime numbers, for example, the first 32 bits of the decimal part of the square root of the prime number 2 correspond to 0x6a09e667. Then, the server pre-processes the first string according to the initialized preset encryption algorithm, that is, fills the first string so that the length of the first string meets the specific standard required by the SHA-256 algorithm, and after the filling process is completed, adds a 64-bit length value to represent the length of the first string, thereby obtaining the data to be processed. In addition, the server processes the data to be processed in blocks according to the preset encryption algorithm after the initialization to obtain 512-bit data blocks; and performs 64 rounds of hash operation processing on each data block in the 512-bit data block, thereby obtaining an encrypted hash value composed of 8 hash values ​​(i.e., the first identifier corresponding to each first physical feature information). Among them, the hash operation processing specifically includes logical functions (such as AND, OR, and XOR, etc.), addition, and bit rotation, etc. This embodiment calculates the first character string corresponding to each first physical feature information through the SHA-256 algorithm to ensure that the output first identifier is deterministic, irreversible, and collision-resistant, thereby preventing malicious forgery of the first identifier, thereby enhancing the security of subsequent USB device authentication.

[0086] In one embodiment, the system further comprises:

[0087] The server 110 is used for responding to the USB device new addition instruction, parsing the USB device new addition instruction to obtain third information, and processing the third information based on the preset encryption algorithm to obtain each third identifier;

[0088] The server 110 is used to determine a mapping relationship between the third information and each third identifier, and update the mapping relationship to the target whitelist file.

[0089] In this embodiment, the server manages the target whitelist file, and is maintained and added by the server. When the target whitelist file is updated (such as adding a new USB device or deleting a USB device, etc.), the server will synchronize the updated target whitelist file to the client. In specific implementation, when the server responds to the USB device new instruction, it parses the USB device new instruction to obtain the third information; wherein, the third information includes each third physical feature information of the newly added USB device, and the third preset character corresponding to each third physical feature information; and the third information is processed based on the preset encryption algorithm to obtain each third identifier; thereby determining the mapping relationship between the third information and each third identifier, and then updating the mapping relationship to the target whitelist file. Among them, the execution process of adding a new USB device is consistent with that of deleting a USB device, which will not be repeated here. Therefore, this embodiment greatly enhances security while ensuring convenient update of the target whitelist file.

[0090] The server 110 is further configured to process each first identifier and the first information based on a first combination algorithm to obtain a target whitelist file, and send the target whitelist file to the at least one client 120 .

[0091] In this embodiment, after obtaining each first identifier, in order to generate a whitelist file that is convenient for subsequent client authentication, the server processes each first identifier and the first information based on a first combination algorithm to obtain a target whitelist file; wherein, each first identifier in the target whitelist file is mapped one-to-one with the first information. Therefore, storing the target whitelist file through the server is more convenient than the physical disk transmission storage in the prior art, and can be deployed on a large scale, and can be directly operated online without carrying it with you. In addition, after the server obtains the target whitelist file, the target whitelist file is synchronously sent to the whitelist file storage path of each client in the at least one client, and each client in the at least one client can automatically maintain the target whitelist file. wherein, as long as the server and the at least one client are in the same communication network, a communication connection can be achieved.

[0092] The target client 120 in the at least one client 120 is used to obtain second information of the second USB device when detecting that a second USB device is inserted into its own USB interface, and process the second information based on the preset encryption algorithm to obtain a second identifier of the second USB device.

[0093] In this embodiment, after receiving the target whitelist file, each of the at least one client will traverse whether there is a second USB device on its own USB interface when it is turned on, and then monitor the hot plug event of the second USB device in real time through the USB device servo program during the operation process; in addition, in order to ensure that the identifier generated when the second USB device is consistent with the first USB device obtained in the server is consistent, each of the at least one client and the server share a set of algorithm logic. Therefore, when a target client in the at least one client detects that a second USB device is inserted into its own USB interface, the target client obtains the second information of the second USB device; wherein the second information includes second physical feature information and a second preset character corresponding to each second physical feature information; and the target client combines the second physical feature information and the corresponding second preset character to obtain a second string corresponding to the second physical feature information; the target client calculates the second string according to the preset encryption algorithm to obtain a second identifier corresponding to the second physical feature information. When a target client in the at least one client detects that a second USB device is unplugged from its own USB interface, the log of the current second USB device is recorded. In addition, in order to prevent users from making modifications to the USB device servo program, a filtering driver is registered on the Windows system in at least one of the clients, so that all user operations on the USB device servo program are invalid, thereby ensuring that the USB device servo program is not affected during system operation, thereby playing a role in process protection.

[0094] The target client 120 is further configured to perform an authentication comparison on the second identifier and each first identifier in the target whitelist file to obtain an authentication comparison result.

[0095] In this embodiment, after the target client obtains the second identifier of the second USB device, the target client authenticates the second USB device according to the second identifier and the target whitelist file. In specific implementation, the target client performs authentication comparison between the second identifier and each first identifier in the target whitelist file, that is, traverses the first identifier in the target whitelist file to see if there is one that is consistent with the second identifier, and then uses the traversal result as the authentication comparison result; wherein the authentication comparison result is that the second identifier is consistent with any first identifier in the target whitelist file, or the second identifier is inconsistent with any first identifier in the target whitelist file. Thus, the Windows system on the target client performs legitimacy judgment and screening on the second USB device connected to its own USB interface to reduce the risk of data leakage.

[0096] In one embodiment, the target client 120 is specifically used for:

[0097] The target client 120 is used to detect whether the target whitelist file exists in the whitelist file storage path and obtain a detection result;

[0098] The target client 120 is configured to parse the target whitelist file to obtain the first information and each first identifier if the detection result is that the target whitelist file exists in the whitelist file storage path;

[0099] The target client 120 is configured to generate a first alarm prompt if the detection result is that the target whitelist file does not exist in the whitelist file storage path;

[0100] The first warning prompt is used to prompt the user to uninstall the second USB device.

[0101] In this embodiment, in order to further improve the security of the windows system in the target client, the target client will also detect whether the target whitelist file exists in the whitelist file storage path to obtain a detection result; if the detection result is that the target whitelist file exists in the whitelist file storage path, the target client parses the target whitelist file to obtain the first information and each first identifier, so as to facilitate the subsequent authentication comparison of the parsed first identifier with the second identifier of the second USB device of the client. If the detection result is that the target whitelist file does not exist in the whitelist file storage path, it means that the target client may have a system malicious deletion or system elimination of the target whitelist file, and the target client generates a first warning prompt to prompt the user to uninstall the second USB device, thereby reducing the risk of data leakage.

[0102] The target client 120 is further configured to determine that the authentication of the second USB device is successful if the authentication comparison result is that the second identifier is consistent with any first identifier in the target whitelist file.

[0103] In this embodiment, after the target client obtains the authentication comparison result, if the authentication comparison result is that the second identifier is consistent with any first identifier in the target whitelist file, it is determined that the authentication of the second USB device is successful, and the second USB device can be used normally in the target client. In addition, after determining that the authentication of the second USB device is successful, the target client records and stores the second identifier of the current second USB device after the authentication is successful, so that when the target client detects that the current second USB device is inserted into its own USB interface later, the authentication comparison step can be skipped and the comparison is directly performed with the stored second identifier. If the comparison is consistent, the current second USB device is identified as a legal device, and the current second USB device is allowed to perform corresponding operations on the target client. In addition, if the authentication comparison result is that the second identifier is inconsistent with any first identifier in the target whitelist file, the target client determines that the authentication of the second USB device fails, and generates a second alarm prompt; wherein, the second alarm prompt is used to prompt the user to uninstall the second USB device. In addition, after determining that the second USB device fails to be authenticated, the target client records and stores the second identifier of the current second USB device after the authentication fails, so that when the target client detects that the current second USB device is inserted into its own USB interface later, the authentication comparison step is skipped and the second identifier is directly compared with the stored second identifier. If the comparison is inconsistent, the current second USB device is identified as an illegal device, and the current second USB device is refused to perform any operation on the target client. Thus, by performing authentication comparison between the second identifier of the second USB device and each first identifier in the target whitelist file, it is ensured that the second USB device after successful authentication can operate normally on the target client, thereby enhancing the security of the system.

[0104] It can be seen from the above technical solutions that the present invention creates and stores whitelist files through a server, which is more convenient than using a physical disk and can be deployed online on a large scale without having to be carried around. At the same time, it greatly improves the convenience of whitelist file updates and the security of the system, and reduces the risk of data leakage.

[0105] The above-mentioned USB device authentication system based on Windows system can be implemented in the form of a computer program, and the computer program can be used in Figure 3 Runs on the computer device shown.

[0106] See also Figure 3 , Figure 3500 is a schematic block diagram of a computer device provided in an embodiment of the present invention. The computer device 500 is a server, which may be an independent server or a server cluster composed of multiple servers. The computer device 500 may also be a sending end, which may be an electronic device with communication functions such as a smart phone, a tablet computer, a laptop computer, a desktop computer, a personal digital assistant, and a wearable device.

[0107] See also Figure 3 The computer device 500 includes a processor 502 , a memory and a network interface 505 connected via a system bus 501 , wherein the memory may include a storage medium 503 and an internal memory 504 .

[0108] The storage medium 503 can store an operating system 5031 and a computer program 5032. When the computer program 5032 is executed, the processor 502 can execute a USB device authentication method based on a Windows system.

[0109] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500 .

[0110] The internal memory 504 provides an environment for the operation of the computer program 5032 in the storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a USB device authentication method based on the Windows system.

[0111] The network interface 505 is used for network communication, such as providing data information transmission, etc. Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present invention, and does not constitute a limitation on the computer device 500 to which the solution of the present invention is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0112] The processor 502 is used to run a computer program 5032 stored in the memory to implement the Windows-based USB device authentication method disclosed in the embodiment of the present invention.

[0113] Those skilled in the art will understand that Figure 3 The embodiments of the computer device shown in the figure do not constitute a limitation on the specific composition of the computer device. In other embodiments, the computer device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, in some embodiments, the computer device may only include a memory and a processor. In such embodiments, the structure and function of the memory and the processor are the same as those of the embodiment of the present invention. Figure 3The embodiments shown are consistent and will not be described again here.

[0114] It should be understood that in the embodiment of the present invention, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0115] In another embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium may be a non-volatile computer-readable storage medium. The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the USB device authentication method based on the Windows system disclosed in the embodiment of the present invention is implemented.

[0116] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the above-described equipment, system and unit can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. Those of ordinary skill in the art can appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0117] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. Units with the same function may also be combined into one unit. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, systems or units, or may be electrical, mechanical or other forms of connection.

[0118] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention.

[0119] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0120] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), disk or optical disk and other media that can store program codes.

[0121] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A USB device authentication method based on Windows system, applied to a USB device authentication system based on Windows system, wherein the USB device authentication system based on Windows system comprises a server and at least one client, wherein the server is connected to the at least one client, and wherein: include: In response to the USB device acquisition instruction, the server parses the USB device acquisition instruction to obtain first information, and processes the first information based on a preset encryption algorithm to obtain each first identifier; The server processes each first identifier and the first information based on a first combination algorithm to obtain a target whitelist file, and sends the target whitelist file to the at least one client; When a target client among the at least one client detects that a second USB device is inserted into its USB interface, the target client acquires second information of the second USB device, and processes the second information based on the preset encryption algorithm to obtain a second identifier of the second USB device; The target client performs an authentication comparison on the second identifier and each first identifier in the target whitelist file to obtain an authentication comparison result; If the authentication comparison result is that the second identifier is consistent with any first identifier in the target whitelist file, the target client determines that the authentication of the second USB device is successful.

2. The method for USB device authentication based on Windows system according to claim 1, characterized in that: The server parses the USB device acquisition instruction to obtain first information, and processes the first information based on a preset encryption algorithm to obtain each first identifier, including: The server parses the USB device acquisition instruction to obtain first physical feature information of each first USB device and a first preset character corresponding to each first physical feature information; The server calculates each first physical feature information and the corresponding first preset character based on the preset encryption algorithm to obtain a first identifier corresponding to each first physical feature information.

3. The USB device authentication method based on Windows system according to claim 2, characterized in that: The server calculates each first physical feature information and the corresponding first preset character based on the preset encryption algorithm to obtain a first identifier corresponding to each first physical feature information, including: The server combines each first physical feature information and the corresponding first preset character to obtain a first character string corresponding to each first physical feature information; The server calculates the first character string corresponding to each first physical feature information according to the preset encryption algorithm to obtain a first identifier corresponding to each first physical feature information.

4. The method for USB device authentication based on Windows system according to claim 3, characterized in that: The server calculates the first character string corresponding to each first physical feature information according to the preset encryption algorithm to obtain the first identifier corresponding to each first physical feature information, including: The server responds to the initialization instruction and initializes the configuration parameters of the preset encryption algorithm according to the initialization instruction; The server pre-processes the first character string according to the initialized preset encryption algorithm to obtain data to be processed; The server processes the data to be processed in blocks according to the preset encryption algorithm after the initialization to obtain 512-bit data blocks; The server performs 64 rounds of hash operations on each of the 512-bit data blocks according to the initialized preset encryption algorithm to obtain a first identifier corresponding to each first physical feature information.

5. The USB device authentication method based on Windows system according to claim 1, characterized in that: The method further comprises: In response to the USB device adding instruction, the server parses the USB device adding instruction to obtain third information, and processes the third information based on the preset encryption algorithm to obtain each third identifier; The server determines a mapping relationship between the third information and each third identifier, and updates the mapping relationship to the target whitelist file.

6. The USB device authentication method based on Windows system according to claim 1, characterized in that: Before the target client performs authentication comparison on the second identifier and each first identifier in the target whitelist file to obtain the authentication comparison result, the method further includes: The target client detects whether the target whitelist file exists in the whitelist file storage path, and obtains a detection result; If the detection result is that the target whitelist file exists in the whitelist file storage path, the target client parses the target whitelist file to obtain the first information and each first identifier; If the detection result is that the target whitelist file does not exist in the whitelist file storage path, the target client generates a first alarm prompt; The first warning prompt is used to prompt the user to uninstall the second USB device.

7. The USB device authentication method based on Windows system according to claim 1, characterized in that: After obtaining the authentication comparison result, the method further includes: If the authentication comparison result is that the second identifier is inconsistent with any first identifier in the target whitelist file, the target client determines that the authentication of the second USB device fails and generates a second alarm prompt; The second warning prompt is used to prompt the user to uninstall the second USB device.

8. A USB device authentication system based on Windows system, comprising a server and at least one client, wherein the server is connected to the at least one client, and characterized in that: include: The server is used to respond to the USB device acquisition instruction, parse the USB device acquisition instruction to obtain first information, and process the first information based on a preset encryption algorithm to obtain each first identifier; The server is further configured to process each first identifier and the first information based on a first combination algorithm to obtain a target whitelist file, and send the target whitelist file to the at least one client; The target client in the at least one client is configured to obtain second information of the second USB device when detecting that a second USB device is inserted into the USB interface of the target client, and process the second information based on the preset encryption algorithm to obtain a second identifier of the second USB device; The target client is further used to perform an authentication comparison on the second identifier and each first identifier in the target whitelist file to obtain an authentication comparison result; The target client is further configured to determine that the authentication of the second USB device is successful if the authentication comparison result is that the second identifier is consistent with any first identifier in the target whitelist file.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the Windows-based USB device authentication method as described in any one of claims 1 to 7 is implemented.

10. A storage medium, characterized in that: The storage medium stores a computer program, which includes program instructions. When the program instructions are executed by a processor, the processor executes the Windows-based USB device authentication method according to any one of claims 1 to 7.

Images