Security management method and system for mobile storage device

Abstract

The invention belongs to the technical field of information security, and particularly relates to a security management method and system for mobile storage equipment. When a mobile storage device to be accessed is accessed to a host, the mobile storage device is firstly accessed to a set security management and control device arranged at a host end; after the mobile storage device is accessed, the accessed mobile storage device is bound with a security operator account created under a system administrator account under the system administrator account under the system administrator account of the security management and control device; setting an operation authority of a security operator account bound with the accessed mobile storage equipment to the mobile storage equipment through the system administrator account; after a user is limited to log in the security operator account created under the system administrator account through the system administrator account, the mobile storage device bound with the security operator account is operated only under the operation or authority set by the system administrator account.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security, and in particular relates to a security management method and system for a mobile storage device. Background Art

[0002] In recent years, with the accelerated advancement of the global energy Internet process, new-generation information technologies represented by big data, cloud computing, and artificial intelligence have fully penetrated into the energy and power fields, and network asset equipment has become increasingly complex. Among them, mobile storage devices use USB interfaces, support hot plugging, and have the characteristics of fast transmission speed, simple use, small size, large capacity, and easy portability. They have become the most widely used mobile storage media and play an important role in Internet information transmission.

[0003] When in use, ordinary mobile storage devices are transparent mobile storage media devices with no operational control over data operations. Any party with a USB interface can use them unimpeded. Therefore, when mobile storage devices are used by people, they can transmit data to key system hosts or confidential hosts, leading to numerous issues such as illegal access, unauthorized access, mixed and misconnected connections, and risks in managing and controlling peripheral access incidents. These issues pose a serious challenge to network security access management and significantly increase potential network security risks.

[0004] Currently, the most common approach to managing and controlling common mobile storage devices is to manage operating permissions by generating blacklists and whitelists. This blacklist-based security management relies entirely on the simple permission management logic of the antivirus engine, making it difficult to reliably configure and restrict permissions. This can lead to misjudgments of mobile storage device operating permissions or the inability to restrict them, resulting in the loss of important files and the inability to retrieve them. Summary of the Invention

[0005] The purpose of the present invention is to provide a method and system for security management of mobile storage devices, which is used to solve the problem that the existing method of security management of mobile storage devices through black / white lists is difficult to configure and restrict permissions in a targeted manner, resulting in misjudgment of mobile storage device operation permissions or inability to restrict mobile storage device operation permissions.

[0006] In order to achieve the above-mentioned purpose, the present invention provides a security management method for mobile storage devices, which comprises the following steps: when a mobile storage device to be connected is connected to a host, the mobile storage device is first connected to a security control device set on the host side; after the connection, the connected mobile storage device is bound to a security operator account created under the system administrator account under the system administrator account of the security control device, and the operation authority of the mobile storage device for the security operator account bound to the connected mobile storage device is set through the system administrator account, so that the user can only operate the mobile storage device bound to the security operator account under the operation authority set by the system administrator account after logging into the security operator account created under the system administrator account.

[0007] Beneficial effects: The present invention provides a new security management method for mobile storage devices. The method creates a security operator account for the mobile storage device by using a system administrator account, grants the security operator account the operating authority for the mobile storage device, and then binds the created security operator account to the mobile storage device. Since the security operator account is created by the system administrator for the mobile storage device, and the authority of the security operator account is configured and restricted by the system administrator account, each security operator account corresponds specifically to the mobile storage device it is bound to, and the operating authority of the security operator account for the mobile storage device it is bound to can be set specifically. In this way, the authority isolation of the system administrator account, whose authority is difficult to restrict, and the mobile storage device can be achieved, and the configuration and restriction of the operating authority of each security operator account for the mobile storage device it is bound to can be achieved through the system administrator account. Ultimately, the permissions of the mobile storage device can be configured and restricted in a targeted manner, so that the operating authority of the mobile storage device can be accurately and effectively judged, avoiding losses such as file loss caused by misjudgment of the operating authority of the mobile storage device or failure to restrict the operating authority of the mobile storage device.

[0008] Furthermore, the method of connecting the mobile storage device to the setting security control device set on the host side includes: obtaining information built into the mobile storage device to be connected through the setting security control device, and determining whether to allow the mobile storage device to access according to whether the information built into the mobile storage device to be connected includes a security certificate; If the mobile storage device identity information includes a security certificate, the judgment result is that access is allowed, and the mobile storage device to be accessed is connected to the host normally; if the mobile storage device identity information does not include a security certificate, the judgment result is that access is not allowed, and the mobile storage device to be accessed is blocked from accessing the host.

[0009] Furthermore, the method of creating a security operator account under the system administrator account includes: creating a security operator account including a password through the system administrator account, and configuring the security operator identity information and user authentication method of the security operator account; the security operator identity information is used to describe the characteristics of the security operator account to distinguish different security operator accounts; the user authentication method is a method for performing login verification when logging into the security operator account; the user authentication method includes password authentication.

[0010] Furthermore, the method for a user to log in to the security operator account created under the system administrator account includes: performing a login verification when the security operator account logs in according to the configured user authentication method, and if the login verification passes, it is determined that the user has successfully logged in to the security operator account.

[0011] Furthermore, when a formatting operation is required for the mobile storage device, the formatting operation is performed on the mobile storage device through the management authority of the system administrator account corresponding to the mobile storage device.

[0012] Furthermore, the operating permissions set for the system administrator account include: read-only permissions, writable permissions or read-write permissions; having the read-only permissions means that the security operator account only has the permission to browse the resources in the mobile storage device; having the writable permissions means that the security operator account has the permission to edit the resources in the mobile storage device; having the read-write permissions means that the security operator account has the permission to browse the resources in the mobile storage device, and the permission to edit the resources in the mobile storage device.

[0013] Furthermore, if the security operator account has writable permissions or read-write permissions for the mobile storage device to which it is bound, the operation permissions possessed by the security operator account include: download permissions, upload permissions, new permissions, delete permissions, rename permissions, virus scan permissions, and whitelist management permissions.

[0014] Furthermore, before downloading the file in the mobile storage device to the local host, if there is a file / folder with the same name and the same MD5 value, the file or the file / folder with the same name is processed according to the download authority of the security operator; When the file is in the downloading state, if virus information is found, the security operator account is re-authorized through the system administrator account corresponding to the security operator account to perform a second intervention in the download process; the second authorization includes: cancellation of authorization, trust authorization and deletion authorization; the cancellation of authorization is used to authorize the cancellation of file download; the trust authorization is used to ignore virus information to continue downloading the poisonous file and add the poisonous file to the whitelist, and no longer authorize virus checking; the deletion authorization is used to authorize the removal of the poisonous file from the mobile storage device; when the file is in the downloading state, the download process is not affected by operations other than the second authorization.

[0015] Furthermore, before uploading a local file on the host to the mobile storage device, if a file / folder with the same name exists in the target path of the current mobile storage device, the file to be uploaded or the file / folder with the same name is processed using the upload authority possessed by the security operator; the processing methods include: cancel processing, overwrite processing and rename processing; When the file is in the uploading state, if virus information is found, the security operator account is re-authorized through the system administrator account corresponding to the security operator account to intervene in the upload process for the second time; the secondary authorization includes: cancellation of authorization and trust authorization; the trust authorization is used to ignore the virus information to continue to upload the poisonous file for authorization, and add the poisonous file to the whitelist, and no longer authorize it to check for viruses; the cancellation of authorization is used to authorize the cancellation of file upload.

[0016] Furthermore, if a virus is found in the process of virus checking resources in the mobile storage device through the virus checking authority possessed by the security operator, the system administrator account corresponding to the security operator account is used to perform secondary intervention by re-authorizing the security operator account to operate on the poisonous file; the secondary authorization includes: cancellation of authorization, trust authorization and deletion authorization; the cancellation of authorization is used to authorize the cancellation of the virus checking process; the trust authorization is used to add the poisonous file to the whitelist and no longer authorize virus checking for it; the deletion authorization is used to authorize the removal of the poisonous file from the mobile storage device.

[0017] Furthermore, the files in the mobile storage device are whitelisted according to needs through whitelist management authority to ignore viruses and no longer perform virus checks; the whitelist management includes two methods: manually adding the file to the whitelist before transferring it, and adding it to the whitelist through trust authorization when the file is secondary authorized by the system administrator account corresponding to the security operator account; the secondary authorization includes: trust authorization and deletion authorization; the trust authorization is used to add the poisonous file to the whitelist and no longer authorize virus checking; the deletion authorization is used to delete the poisonous file from the whitelist to authorize the removal of the poisonous file from the trust zone.

[0018] Furthermore, when the system administrator account is logged in, all management operations performed in the mobile storage device are recorded by the set audit administrator account to generate an audit log, view the audit log, and configure the audit parameter settings of the audit administrator account.

[0019] The present invention also provides a new security management system for mobile storage devices, comprising a processor, wherein the processor is used to execute a computer program to implement the steps of the security management method for mobile storage devices.

[0020] The security management system of the mobile storage device can achieve the same beneficial effects as the security management method of the mobile storage device described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is an example diagram of a process for performing security management on a mobile storage device in an embodiment of a security management method for a mobile storage device of the present invention; Figure 2 It is a schematic diagram of the principle of the security management method for mobile storage devices in an embodiment of the security management method for mobile storage devices of the present invention. DETAILED DESCRIPTION

[0022] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention is further described in detail below with reference to the accompanying drawings and embodiments.

[0023] Embodiment of a method for securely managing a mobile storage device This embodiment provides a method for securely managing mobile storage devices. The method comprises the following steps: when a mobile storage device to be connected is connected to a host, the mobile storage device is first connected to a security control device set on the host side; after the connection, the connected mobile storage device is bound to a security operator account created under the system administrator account under the system administrator account of the security control device, and the system administrator account is used to set operation permissions (for example, "access" is a type of operation, namely, "access operation", and the access operation is usually a read-only operation) for the security operator account bound to the connected mobile storage device, so that the system administrator account is used to restrict a user from logging into the security operator account created under the system administrator account to operate the mobile storage device bound to the security operator account only under the operation permissions set by the system administrator account.

[0024] Specifically, if Figure 1 As shown, when a USB mobile storage device is connected to the host side, the USB mobile storage device to be connected needs to be connected to the USB device security control device set on the host side (that is, the set security control device set on the host side), and the USB device security control device is connected to the host side of the on-site workstation through the network, and the control software is run on the host side of the on-site workstation; a security operator account is created through the system administrator account set in the USB device security control device on the host side; the online USB mobile storage device list is refreshed by running the control software to identify the connected mobile storage device; and the exclusive security operator account created for the connected mobile storage device is bound to the connected mobile storage device through the above-mentioned system administrator account; and the operation authority of the mobile storage device is set by the system administrator account with the security operator account bound to the connected mobile storage device (such as Figure 2 As shown, the system administrator account can manage the user accounts set under it, and can also authorize the security operator account to operate the mobile storage device bound to it, and the security operator account can only operate the mobile storage device bound to it under the permissions set by the system administrator account). The system administrator account limits the operating permissions of the security operator account bound to the mobile storage device (that is, the security operator account can only operate the mobile storage device bound to the security operator account under the operating permissions set by the system administrator account); and only the security operator account bound to the mobile storage device has the permission to operate the file resources in the mobile storage device.

[0025] In this embodiment, the method of connecting the mobile storage device to the setting security control device set on the host side includes: obtaining information built into the mobile storage device to be connected through the setting security control device, and determining whether to allow the mobile storage device to access based on whether the information built into the mobile storage device to be connected includes a security certificate; If the mobile storage device identity information includes a security certificate, the judgment result is that access is allowed, and the mobile storage device to be accessed is connected to the host normally; if the mobile storage device identity information does not include a security certificate, the judgment result is that access is not allowed, and the mobile storage device to be accessed is blocked from accessing the host.

[0026] Specifically, when a USB mobile storage device (i.e., a mobile storage device) is accessed on the host side, the USB mobile storage device to be accessed needs to be connected to a USB device security control device set on the host side (i.e., a set security control device set on the host side), and the USB device security control device is connected to the host side of the on-site workstation through a network, and the control software is run on the host side of the on-site workstation; the USB device security control device automatically identifies the connected USB mobile storage device and obtains the built-in information of the mobile storage device to be accessed, and determines whether to allow the mobile storage device to be accessed to access based on whether the built-in information of the mobile storage device to be accessed contains a security certificate; if the built-in information of the mobile storage device to be accessed contains a security certificate, it is determined that access is allowed, and the mobile storage device to be accessed is connected to the host; otherwise, it is determined that access is not allowed, and the mobile storage device to be accessed is prevented from accessing the host (i.e., only USB mobile storage devices whose built-in information contains a security certificate are allowed to access the host and access the mobile storage device to be accessed).

[0027] In this embodiment, the method of creating a security operator account under the system administrator account includes: creating a security operator account including a password through the system administrator account, and configuring the security operator identity information and user authentication method of the security operator account; the security operator identity information is used to describe the characteristics of the security operator account to distinguish different security operator accounts; the user authentication method is a method for performing login verification when logging into the security operator account; the user authentication method includes password authentication.

[0028] Specifically, a security operator account (this full operator account includes a password for password authentication) is created using a system administrator account set up in the host-side USB device security control device. Security operator identity information is configured for this security operator account, and the user authentication method for this security operator account is configured as required. The security operator identity information includes: security operator name, security operator unit, and security operator contact information. The user authentication method is based on authentication information such as the IP address of the host the security operator is logging into, the MAC address of the host the security operator is logging into, a fingerprint, and an authentication Ukey (i.e., a password). This user authentication method is used to verify the security operator account upon login. The initial password for password authentication is required and does not require configuration. Other authentication methods can be combined with password authentication, and one or more authentication methods can be selected. In this embodiment, the method for a user to log in to the security operator account created under the system administrator account includes: performing a login verification according to the configured user authentication method upon login. If the login verification passes, the user's login to the security operator account is determined to be successful.

[0029] Specifically, when a user logs in to a security operator account created by the system administrator account, they must undergo a login verification based on the configured user authentication method, namely, the authentication method that includes authentication information such as the IP address of the host to be logged in, the MAC address of the host to be logged in, a fingerprint, and an authentication Ukey (i.e., a password). In this embodiment, if the security operator account is configured with one or more of the following authentication methods: the IP address of the host to be logged in, the MAC address of the host to be logged in, a fingerprint, or a Ukey, the authentication information configured for the security operator account is checked item by item. If all the checked authentication information matches, the login verification passes. If the login verification passes, the user is deemed to have successfully logged into the security operator account. In other embodiments, the authentication information configured for the security operator account may not be checked item by item; for example, as long as all the checked account and password authentication information matches, the login verification passes. In this embodiment, when a removable storage device needs to be formatted, the removable storage device is formatted using the administrative permissions of the system administrator account corresponding to the removable storage device.

[0030] Specifically, when a mobile storage device needs to be formatted, it can be formatted using the system administrator account associated with the mobile storage device. There's no limit to the number of mobile storage devices that can be formatted with the system administrator account (i.e., the system administrator account can format all online mobile storage devices). Available formats include FAT32, NTFS, exFAT, and more.

[0031] In this embodiment, the operating permissions set for the system administrator account include: read-only permissions, writable permissions, or read-write permissions; having read-only permissions means that the security operator account only has the permission to browse the resources in the mobile storage device; having writable permissions means that the security operator account has the permission to edit the resources in the mobile storage device; having read-write permissions means that the security operator account has the permission to browse the resources in the mobile storage device, and the permission to edit the resources in the mobile storage device.

[0032] Specifically, the operating permissions of the security operator account bound to the connected mobile storage device set by the system administrator account include: read-only permissions, writable permissions or read-write permissions; read-only permissions are permissions for only browsing the resources in the mobile storage device; writable permissions are permissions for editing the resources in the mobile storage device; read-write permissions are permissions for both browsing the resources in the mobile storage device and editing the resources in the mobile storage device.

[0033] In this embodiment, if the security operator account has a writable permission or a read-write permission for the mobile storage device to which it is bound, the operation permissions possessed by the security operator include: download permission, upload permission, create permission, delete permission, rename permission, virus check permission and whitelist management permission.

[0034] Specifically, if the security operator account bound to the connected mobile storage device set by the system administrator account has writable permissions or read-write permissions for the mobile storage device, then the operation permissions of the security operator account for the mobile storage device to which it is bound include: download permissions (i.e., permissions to download files / folders in the mobile storage device), upload permissions (i.e., permissions to upload files / folders in the mobile storage device), create permissions (i.e., permissions to create new files / folders in the mobile storage device), delete permissions (i.e., permissions to delete files in the mobile storage device), rename permissions (i.e., permissions to rename files / folders in the mobile storage device), virus check permissions (i.e., permissions to check for viruses in files / folders in the mobile storage device) and whitelist management permissions (i.e., permissions to write files / folders in the mobile storage device to the whitelist or remove them from the whitelist).

[0035] In this embodiment, before downloading a file from a mobile storage device to a local host, if there is a file / folder with the same name and the same MD5 value, the file or the file / folder with the same name is processed according to the download authority of the security operator; When the file is in the downloading state, if virus information is found, the security operator account is re-authorized through the system administrator account corresponding to the security operator account to perform a second intervention in the download process; the second authorization includes: cancellation of authorization, trust authorization and deletion authorization; the cancellation of authorization is used to authorize the cancellation of file download; the trust authorization is used to authorize the ignoring of virus information to continue downloading the poisonous file, and to add the poisonous file to the whitelist and no longer authorize the virus check; the deletion authorization is used to authorize the removal of the poisonous file from the mobile storage device; when the file is in the downloading state, the download process is not affected by any operation other than the second authorization.

[0036] Specifically, the above-mentioned download permission allows files in a mobile storage device (whose default download path can be modified) to be downloaded to the local host. Before actually downloading the file, the local download path of the current host is compared to see if there are files / folders with the same name and the same MD5 value. If there are files / folders with the same MD5 value (i.e., there is a risk of MD5 collision), the files or files / folders with the same name are processed using the download permission of the security operator account. The processing content includes: if there is a file / folder with the same name and the same MD5 value as the file to be downloaded, a "Cancel", "Overwrite", or "Rename" prompt box will pop up; if "Cancel" is selected, the download operation of the file is terminated; if "Overwrite" is selected, the file with the same name in the current download path is overwritten; if "Rename" is selected, a file name must be entered, and the file to be downloaded will be renamed and saved to the download path. During the file download process, the system interface will be locked to prevent other operations from interfering with the download process. The download progress will be displayed in real time using a progress bar. If a virus is detected during the download process, the interface will be unlocked and a secondary authorization window will pop up (this secondary authorization is performed through the system administrator account corresponding to the security operator account) to display the virus details. This secondary authorization can be performed by selecting "Cancel," "Trust," or "Delete." Selecting this option will cause a secondary intervention in the file download process. If you select "Cancel," the file download will be terminated. If you select "Trust," the virus information will be ignored, the download will continue, and the file will be added to the whitelist. No virus scan will be performed on subsequent file transfers. If you select "Delete," the infected file will be removed from the mobile storage device.

[0037] In this embodiment, before uploading a local file to be uploaded to a mobile storage device, if a file / folder with the same name exists in the target path of the current mobile storage device, the file to be uploaded or the file / folder with the same name is processed using the upload authority of the security operator; the processing methods include: cancellation processing, overwriting processing and renaming processing; When the file is in the uploading state, if virus information is found, the security operator account is re-authorized through the system administrator account corresponding to the security operator account to intervene in the upload process for the second time; the secondary authorization includes: cancellation of authorization and trust authorization; the trust authorization is used to authorize the upload of the poisonous file by ignoring the virus information to continue uploading, and the poisonous file is added to the whitelist and is no longer authorized to be checked for viruses; the cancellation of authorization is used to authorize the cancellation of file upload.

[0038] Specifically, the upload permission (the upload permission requires that the security operator account has write permission or read-write permission on the mobile storage device to which it is bound) is to upload files locally on the host to a specified directory on the mobile storage device.

[0039] When uploading a file, you will need to compare whether there is a file / folder with the same name as the file to be uploaded in the target path of the mobile storage device. If so, a prompt box will pop up, choosing "Cancel" (i.e., "Cancel" authorization), "Overwrite" (i.e., "Overwrite" authorization), or "Rename" (i.e., "Rename" authorization). If you select "Cancel" authorization, the file upload operation will be terminated; if you select "Overwrite" authorization, the file with the same name in the current USB drive target path will be overwritten; if you select "Rename" authorization, you will need to enter a file name, and the file to be downloaded will be renamed and saved to the target path of the current mobile storage device. If you select "Cancel" authorization, the file upload operation will be terminated; if you select "Overwrite" authorization, the file / folder with the same name in the current mobile storage device target path will be overwritten.

[0040] When uploading a file, a virus scan is required. If the scan reveals a virus, a secondary authorization window (this secondary authorization is performed by the system administrator account corresponding to the security operator account) will pop up, displaying virus details. You can choose to "Cancel" or "Trust" the secondary authorization. Choosing "Trust" allows the file transfer to proceed and the file will be added to the whitelist. Choosing "Cancel" cancels the upload.

[0041] In this embodiment, according to needs, if the resources in the mobile storage device are scanned for viruses through the virus scanning authority possessed by the security operator; if a virus is found during the virus scanning process, the system administrator account corresponding to the security operator account is secondary-authorized to operate the poisonous file for secondary intervention; the secondary authorization includes: cancellation of authorization, trust authorization and deletion authorization; the cancellation of authorization is used to authorize the cancellation of the virus scanning process; the trust authorization is used to authorize the addition of the poisonous file to the whitelist and no longer to scan for viruses; the deletion authorization is used to authorize the removal of the poisonous file from the mobile storage device.

[0042] Specifically, the above-mentioned virus checking permission (virus checking permission requires that the security operator account have write permission or read-write permission on the mobile storage device to which it is bound) is to perform individual virus checking operations on the files in the mobile storage device as needed. If the file is found to contain a virus during the virus checking process, a secondary authorization window (this secondary authorization is performed through the system administrator account corresponding to the security operator account) will pop up, displaying the virus details. This secondary authorization can choose from three authorization operations: "Cancel" authorization, "Trust" authorization, and "Delete" authorization. If "Trust" authorization is selected, the infected file will be added to the whitelist; files added to the whitelist will no longer be checked for viruses during the current and subsequent file transfer processes; if "Cancel" authorization is selected, the virus checking process is terminated, and the original file remains unchanged; if "Delete" authorization is selected, the infected file will be deleted from the mobile storage device.

[0043] In this embodiment, the file resources in the mobile storage device are whitelisted according to needs through whitelist management authority to ignore viruses and no longer perform virus checks; the whitelist management includes two methods: manually adding the file to the whitelist before transferring it, and adding the file to the whitelist through trust authorization when the file is secondary authorized by the system administrator account corresponding to the security operator account; the secondary authorization includes: trust authorization and deletion authorization; the trust authorization is used to authorize the addition of the poisonous file to the whitelist and no longer perform virus checks on it; the deletion authorization is used to authorize the deletion of the poisonous file from the whitelist to remove the poisonous file from the trust zone.

[0044] Specifically, the whitelist management permission allows you to whitelist files on mobile storage devices (i.e., add files to or remove files from the whitelist). Files on the whitelist are added to the trusted zone, and virus scanning is no longer performed during file transfers. This whitelist management supports setting whitelists before and during file transfers. 1) Before transferring files, you can manually add files in the mobile storage device to the whitelist; 2) During file transfer, if a virus is found, you can select "Trust" authorization during the second authorization to add the infected file to the whitelist. Files added to the whitelist will no longer be checked for viruses during the current and subsequent file transfers.

[0045] The whitelist management also supports deleting files that already exist in the whitelist; after deleting a file, the deleted file is removed from the trusted zone.

[0046] In this embodiment, when the system administrator account is logged in, the audit administrator account set up records all management operations performed on the mobile storage device to generate an audit log; the audit log can be viewed through the audit administrator account; and the audit parameter settings of the audit administrator account can be configured through the audit administrator account. Specifically, when a user logs in to the system administrator account (i.e., the system administrator account is logged in), the audit administrator account set up by the system administrator account records all management operations performed on the mobile storage device according to each administrator account as an audit log. This audit log is used for security traceability. The audit administrator account can view this audit log; the audit administrator account can also configure the audit parameter settings of this audit administrator account.

[0047] Implementation of a security management system for mobile storage devices This embodiment provides a new security management system for mobile storage devices, which includes a processor having executable program instructions stored therein. The executable program instructions are used to implement the security management method for mobile storage devices in the above-mentioned security management method embodiment for mobile storage devices.

[0048] Since the specific working mode and working principle of the mobile storage device security management system of this embodiment have been described in detail in the above-mentioned mobile storage device security management method embodiment, they will not be repeated here.

[0049] It should be understood that the above specific embodiments of the present invention are only used to illustrate or explain the principles of the present invention, and do not constitute a limitation of the present invention.

Claims

1. A method for secure management of a mobile storage device, characterized in that: When the mobile storage device to be connected is connected to the host, the mobile storage device is first connected to the setting security control device set on the host side; After access, the connected mobile storage device is bound to the security operator account created under the system administrator account of the security management and control device, and the operation permissions of the mobile storage device for the security operator account bound to the connected mobile storage device are set through the system administrator account, so that the user can log in to the security operator account created under the system administrator account through the system administrator account and operate the mobile storage device bound to the security operator account only under the operation permissions set by the system administrator account.

2. A method for securely managing a mobile storage device according to claim 1, characterized in that: The method of connecting the mobile storage device to the setting security control device set on the host side includes: obtaining the information built in the mobile storage device to be connected through the setting security control device, and judging whether to allow the mobile storage device to access according to whether the information built in the mobile storage device to be connected contains a security certificate; If the mobile storage device identity information includes a security certificate, the judgment result is that access is allowed, and the mobile storage device to be accessed is normally connected to the host; if the mobile storage device identity information does not include a security certificate, the judgment result is that access is not allowed, and the mobile storage device to be accessed is blocked from accessing the host.

3. A method for secure management of a mobile storage device according to claim 1, characterized in that: The method of creating a security operator account under the system administrator account includes: creating a security operator account including a password through the system administrator account, and configuring the security operator identity information and user authentication method of the security operator account; the security operator identity information is used to describe the characteristics of the security operator account to distinguish different security operator accounts; the user authentication method is a method for performing login verification when logging into the security operator account; the user authentication method includes password authentication.

4. A method for securely managing a mobile storage device according to claim 3, characterized in that: The method for a user to log in to the security operator account created under the system administrator account includes: performing a login verification when the security operator account logs in according to the configured user authentication method, and if the login verification passes, it is determined that the user has successfully logged in to the security operator account.

5. The method for secure management of a mobile storage device according to claim 1, characterized in that: When the mobile storage device needs to be formatted, the mobile storage device is formatted using the management authority of the system administrator account corresponding to the mobile storage device.

6. A method for secure management of a mobile storage device according to claim 1, characterized in that: The operating permissions set for the system administrator account include: read-only permissions, writable permissions or read-write permissions; having the read-only permissions means that the security operator account only has the permission to browse the resources in the mobile storage device; having the writable permissions means that the security operator account has the permission to edit the resources in the mobile storage device; having the read-write permissions means that the security operator account has the permission to browse the resources in the mobile storage device and the permission to edit the resources in the mobile storage device.

7. A method for securely managing a mobile storage device according to claim 6, characterized in that: If the security operator account has writable permissions or read-write permissions for the mobile storage device to which it is bound, the security operator account has the following operating permissions: download permission, upload permission, create permission, delete permission, rename permission, virus scan permission, and whitelist management permission.

8. A method for secure management of a mobile storage device according to claim 7, characterized in that: Before downloading the file in the mobile storage device to the local host, if there is a file / folder with the same name and the same MD5 value, the file or the file / folder with the same name is processed according to the download authority of the security operator; When the file is in the downloading state, if virus information is found, the security operator account is re-authorized through the system administrator account corresponding to the security operator account to perform secondary intervention on the download process; the secondary authorization includes: cancellation authorization, trust authorization and deletion authorization; the cancellation authorization is used to authorize the cancellation of file download; The trust authorization is used to ignore virus information to continue downloading the poisonous file and add the poisonous file to the whitelist without authorizing virus checking; the deletion authorization is used to authorize the removal of the poisonous file from the mobile storage device; when the file is in the downloading state, the download process is not affected by operations other than secondary authorization.

9. The method for secure management of a mobile storage device according to claim 7, characterized in that: Before uploading the local file of the host to the mobile storage device, if there is a file / folder with the same name under the target path of the current mobile storage device, the file to be uploaded or the file / folder with the same name is processed through the upload authority of the security operator; the processing methods include: cancellation processing, overwriting processing and renaming processing; When the file is in the uploading state, if virus information is found, the security operator account is re-authorized through the system administrator account corresponding to the security operator account to perform secondary intervention in the upload process; the secondary authorization includes: cancellation of authorization and trust authorization; the trust authorization is used to ignore virus information to continue to upload the poisonous file for authorization, and add the poisonous file to the whitelist, and no longer authorize virus checking for it; the cancellation of authorization is used to authorize the cancellation of file upload.

10. The method for secure management of a mobile storage device according to claim 7, characterized in that: If a virus is found in the process of checking the resources in the mobile storage device through the virus checking authority of the security operator, the system administrator account corresponding to the security operator account will be used to re-authorize the security operator account to operate the virus-containing file for secondary intervention; The secondary authorization includes: cancel authorization, trust authorization and delete authorization; the cancel authorization is used to authorize the cancellation of the virus scanning process; The trust authorization is used to add the poisonous file to the whitelist and no longer authorize the virus check; the deletion authorization is used to authorize the removal of the poisonous file from the mobile storage device.

11. A method for securely managing a mobile storage device according to claim 7, characterized in that: Through the whitelist management authority, files in the mobile storage device are whitelisted according to needs to ignore viruses and no longer check for viruses; the whitelist management includes two methods: manually adding the file to the whitelist before the file is transferred, and adding the file to the whitelist through trust authorization when the system administrator account corresponding to the security operator account performs secondary authorization on the file; The secondary authorization includes: trust authorization and deletion authorization; the trust authorization is used to add the poisonous file to the whitelist and no longer authorize its virus check; the deletion authorization is used to delete the poisonous file from the whitelist to authorize the removal of the poisonous file from the trust zone.

12. The method for secure management of a mobile storage device according to claim 1, characterized in that: When the system administrator account is logged in, all management operations performed on the mobile storage device are recorded through the set audit administrator account to generate an audit log, view the audit log, and configure the audit parameter settings of the audit administrator account.

13. A security management system for a mobile storage device, comprising a processor, characterized in that: The processor is used to execute a computer program to implement the steps of the mobile storage device security management method according to any one of claims 1 to 12.

Images