Access control method and system of USB (Universal Serial Bus) equipment

Abstract

The invention belongs to the technical field of USB (Universal Serial Bus) equipment, and discloses an access control method and system of USB equipment. The method comprises the steps that when an access event is detected, accessed USB equipment is intercepted through disk equipment before operation system processing; the sector information of the accessed USB equipment is acquired; querying the sector information from a preset strategy rule information base so as to identify access strategy information corresponding to the accessed USB equipment; and performing access control on the accessed USB equipment based on the access strategy information. Through the above mode, the sector information of the USB equipment is combined and the preset strategy rule information base is utilized to identify the USB equipment which is forbidden to access and the USB equipment which is allowed to access, so that corresponding control is executed, the USB equipment which is not threatened and the USB equipment which is threatened are differentially controlled, and convenience is provided for users.

Description

Technical Field

[0001] The present invention relates to the technical field of USB devices, and in particular to an access control method and system for USB devices. Background Art

[0002] With the rapid development of computer hardware, the number of peripheral devices is increasing. Keyboards, mice, modems, printers, and scanners have long been known to everyone. Digital cameras and MP3 players are coming one after another. They generally use the increasingly common USB interface to connect to the PC. The use of the USB interface plug-and-play (PP) concept simplifies the hardware installation process, which makes users feel the convenience of using USB devices. While bringing convenience to users, it also brings security risks to various units, especially confidential units. The USB interface is an important way for internal network information to leak, and it is also a virus source for the internal network. Therefore, many confidential units use physical disabling of USB ports. However, due to the wide variety of USB devices and their widespread use, simply disabling the USB interface simply and roughly will also make non-threatening peripheral devices such as USB mouse, keyboard, USBKey and other devices unusable, which will bring a lot of inconvenience to users.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present invention is to provide a method and system for controlling access to USB devices, aiming to solve the technical problem that all USB interfaces are currently disabled in a simple and crude manner, which makes non-threatening peripheral devices unusable and thus brings inconvenience to users.

[0005] To achieve the above object, the present invention provides a method for controlling access to a USB device, the method comprising the following steps:

[0006] When an access event is detected, the connected USB device is intercepted by the disk device before the operating system processes it;

[0007] Obtaining sector information of the connected USB device;

[0008] Querying the sector information from a preset policy rule information library to identify access policy information corresponding to the connected USB device;

[0009] Access control is performed on the connected USB device based on the access policy information.

[0010] In some embodiments, the disk device stack is a hierarchical structure, and includes an upper filter, a functional device object, a lower filter, and a physical device object in order from top to bottom, and intercepting the connected USB device before the operating system processes it through the disk device includes:

[0011] Obtaining all I / O request packets of the connected USB device that triggers the access event;

[0012] The I / O request packet is transmitted to the upper filter of the disk device, and the I / O request packet is filtered to the lower filter through the upper filter;

[0013] The I / O request packet is filtered by the lower filter to intercept the connected USB device before the operating system processes it.

[0014] In some embodiments, the preset policy rule information base is provided with an identification model, and querying the sector information from the preset policy rule information base to identify the access policy information corresponding to the connected USB device includes:

[0015] Mapping the sector information to a multi-dimensional real number space through an embedding layer of the recognition model to obtain a sector information sequence;

[0016] Converting the sector information sequence into an embedding matrix, and inputting the embedding matrix into a computational layer of the recognition model;

[0017] generating an attention matrix based on the sector information sequence through the computing layer;

[0018] According to the calculation layer, the embedding matrix and the attention matrix are used to obtain information importance;

[0019] The corresponding access policy information is obtained using the information importance.

[0020] In some embodiments, the obtaining corresponding access policy information by using the information importance includes:

[0021] extracting reference features from the sector information using the information importance;

[0022] Performing a maximum pooling operation on the reference features through the pooling layer of the recognition model, and concatenating the maximum values ​​obtained by the pooling to obtain a one-dimensional feature vector;

[0023] A full connection operation is performed on the neurons of the recognition model based on the one-dimensional feature to obtain a recognition result, and access policy information is acquired based on the recognition result.

[0024] In some embodiments, the method further comprises:

[0025] Determine the device type of the connected USB device;

[0026] Determining whether the device type is the first type or the second type;

[0027] If the device type is the first type, executing the step of obtaining the sector information of the connected USB device;

[0028] If the device type is the second type, determining the target sub-device type of the connected USB device;

[0029] Access policy information of the connected USB device is obtained based on the target sub-device type.

[0030] In some embodiments, determining the target sub-device type of the connected USB device includes:

[0031] Identify the interface type of the connected USB device;

[0032] Determining a reference sub-device type based on the interface type;

[0033] Obtaining the descriptor information of the connected USB device;

[0034] A target sub-device type is determined based on the descriptor information on the basis of the reference sub-device type.

[0035] In some embodiments, the performing access control on the connected USB device based on the access policy information includes:

[0036] Determine the access permission corresponding to the connected USB device based on the access policy information;

[0037] If the access permission is to allow access, the connected USB device is allowed to operate normally to exchange data with the operating system;

[0038] If the access permission is to prohibit access, then the mounting is prevented or a removal event of the connected USB device is simulated, so that the connected USB device is invisible in the operating system.

[0039] In addition, to achieve the above-mentioned purpose, the present invention also proposes an access control system for USB devices, the access control system for USB devices comprising:

[0040] An interception module, used for intercepting the connected USB device before the operating system processes it through the disk device when an access event is detected;

[0041] A reading module, used to obtain the sector information of the connected USB device;

[0042] A query module, used to query the sector information from a preset policy rule information library to identify access policy information corresponding to the connected USB device;

[0043] A control module is used to perform access control on the connected USB device based on the access policy information.

[0044] In some embodiments, the disk device stack is a hierarchical structure, and includes, in order from top to bottom, an upper filter, a functional device object, a lower filter, and a physical device object, and the interception module is used to obtain all I / O request packets of the connected USB device that triggers the access event;

[0045] The I / O request packet is transmitted to the upper filter of the disk device, and the I / O request packet is filtered to the lower filter through the upper filter;

[0046] The I / O request packet is filtered by the lower filter to intercept the connected USB device before the operating system processes it.

[0047] In some embodiments, the preset strategy rule information base is provided with a recognition model, and the query module is used to map the sector information to a multi-dimensional real number space through an embedding layer of the recognition model to obtain a sector information sequence;

[0048] Converting the sector information sequence into an embedding matrix, and inputting the embedding matrix into a computational layer of the recognition model;

[0049] generating an attention matrix based on the sector information sequence through the computing layer;

[0050] According to the calculation layer, the embedding matrix and the attention matrix are used to obtain information importance;

[0051] extracting feature data from the sector information using the information importance;

[0052] Corresponding access policy information is acquired based on the characteristic data.

[0053] In the present invention, when an access event is detected, the connected USB device is intercepted by the disk device before the operating system processes it; the sector information of the connected USB device is obtained; the sector information is queried from the preset policy rule information library to identify the access policy information corresponding to the connected USB device; and the access control of the connected USB device is performed based on the access policy information. In the above manner, the USB devices that are prohibited from access and allowed to access are identified by combining the sector information of the USB device and using the preset policy rule information library, so as to perform corresponding control, distinguish and control non-threatening USB devices from threatening USB devices, and provide convenience for users. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A schematic diagram of a flow chart of a first embodiment of a method for controlling access to a USB device according to the present invention;

[0055] Figure 2 This is a structural block diagram of a first embodiment of an access control system for USB devices of the present invention.

[0056] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0057] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0058] The embodiment of the present invention provides a method for controlling access to a USB device, referring to Figure 1 , Figure 1 The figure is a flow chart of a first embodiment of a method for controlling access to a USB device according to the present invention.

[0059] In this embodiment, the USB device access control method includes the following steps:

[0060] Step S10: When an access event is detected, the connected USB device is intercepted by the disk device before being processed by the operating system.

[0061] In this embodiment, the executor of this embodiment is an access control device of a USB device, wherein the access control device of the USB device has functions such as data processing, data communication and program running. The access control device of the USB device can be a computer terminal device or other network device, and of course can also be other devices with similar functions, which is not limited in this embodiment.

[0062] It should be noted that with the rapid development of computer hardware, the number of peripheral devices has increased day by day. Keyboards, mice, modems, printers, and scanners have long been known to people. Digital cameras and MP3 players have followed suit. They generally use the increasingly common USB interface to connect to the PC. The use of the USB interface plug-and-play (PP) concept simplifies the hardware installation process, which makes users feel the convenience of using USB devices. While bringing convenience to users, it also brings security risks to various units, especially confidential units. The USB interface is an important way for internal network information leakage and a virus source for the internal network. Therefore, many confidential units adopt physical disabling of USB ports. However, due to the wide variety of USB devices and their widespread use, simply disabling the USB interface simply and roughly will also make non-threatening peripheral devices such as USB mouse, keyboard, USBKey and other devices unusable, which will bring a lot of inconvenience to users.

[0063] In order to solve the above technical problems, in this embodiment, when an access event is detected, the connected USB device is intercepted by the disk device before the operating system processes it; the sector information of the connected USB device is obtained; the sector information is queried from the preset policy rule information library to identify the access policy information corresponding to the connected USB device; and the access control of the connected USB device is performed based on the access policy information. In the above manner, the USB devices that are prohibited from access and allowed to access are identified by combining the sector information of the USB device and using the preset policy rule information library, so as to perform corresponding control, distinguish and control non-threatening USB devices from threatening USB devices, and provide convenience for users. Specifically, it can be implemented in the following manner.

[0064] In a specific implementation, after an access event is detected in this embodiment, the connected USB device will be intercepted through the disk device. It should be understood that when the USB device triggers an access event, it corresponds to physical access. For the connected USB device, corresponding access control will be performed in this embodiment. The access control is aimed at intercepting it through the disk device before the operating system processes the USB device, that is, before the operating system exchanges data with the USB device. The specific process is to obtain all I / O request packets of the connected USB device that triggers the access event; pass the I / O request packet to the upper filter of the disk device, and filter the I / O request packet to the lower filter through the upper filter; filter the I / O request packet through the lower filter to intercept the connected USB device before the operating system processes it.

[0065] It should be noted that the device stack of the disk device in this embodiment is a hierarchical structure, and the corresponding sequential structure from top to bottom includes upper-level filters, functional device objects, lower-level filters and physical device objects. The above-mentioned filtering mechanism intercepts I / O request packets to avoid data exchange between USB and the operating system before the USB device is identified.

[0066] Step S20: Acquire the sector information of the connected USB device.

[0067] It should be understood that not all USB devices have sector information, such as some input devices. Therefore, in this embodiment, it is necessary to first determine the device type of the connected USB device, and then determine whether the device type is the first type or the second type. If the device type is the first type, the step of obtaining the sector information of the connected USB device can be performed. If the device type is the second type, it is necessary to determine the target sub-device type of the connected USB device. In this embodiment, for such USB devices, the corresponding access policy information is obtained based on the target sub-device type.

[0068] It should be noted that the first type is a storage type USB device, such as a large-capacity storage device and a mobile hard disk, and the second type is an input type USB device, such as a keyboard, a mouse, a camera, and a game controller.

[0069] Furthermore, the process of determining the target sub-device type of the connected USB device is specifically to identify the interface type of the connected USB device; determine the reference sub-device type based on the interface type; obtain the descriptor information of the connected USB device; and determine the target sub-device type based on the descriptor information based on the reference sub-device type.

[0070] It should be noted that, based on the interface type, a preliminary type judgment can be made on the connected USB to determine the reference sub-device type. For example, USB Type-A usually corresponds to a mouse, keyboard, and game controller. In order to further distinguish, the descriptor information is obtained for further identification to determine whether the target sub-device type is a keyboard, a mouse, or a game controller. The access policy information, for example, the mouse and keyboard are peripheral devices that are allowed to be accessed, while the game controller is a device that is prohibited from accessing. The descriptor information provides detailed information about the device function, configuration, interface, and endpoint. The descriptor information in this embodiment includes, for example, a device descriptor, a configuration descriptor, an interface descriptor, and an endpoint descriptor.

[0071] Step S30: querying the sector information from a preset policy rule information library to identify access policy information corresponding to the connected USB device.

[0072] In the specific implementation, in this embodiment, after obtaining the sector information, it is necessary to further combine the preset policy rule information library to obtain the access policy information corresponding to the connected USB device. The specific process is to map the sector information to the multidimensional real number space through the embedding layer of the recognition model to obtain a sector information sequence; convert the sector information sequence into an embedding matrix, and input the embedding matrix into the computing layer of the recognition model; generate an attention matrix based on the sector information sequence through the computing layer; obtain the information importance by combining the embedding matrix and the attention matrix according to the computing layer; and obtain the corresponding access policy information using the information importance.

[0073] It should be noted that in this embodiment, the preset policy rule information library is provided with an identification model, and the sector information includes but is not limited to the sector number, sector size, sector status and sector data. Assuming that the USB device has 5 sectors, numbered 0 to 4, a two-dimensional real number space is constructed and the sector information is mapped: sector 0→(0,1), sector 1→(0.25,0), sector 2→(0.5,1), sector 3→(0.75,1) and sector 4→(1,0) generate a sector information sequence of [(0,1), (0.25,0), (0.5,1), (0.75,1), (1,0)]. After determining the matrix dimension, the sector information sequence can be traversed, and each element can be placed in the correct position in the matrix to obtain an embedded matrix. A sliding window is used to calculate the weight of the local embedded matrix. The sliding window size is j, and the weight of each window is not shared. To ensure that the central words of the window are all words in the matrix of the original vector and cover all embedded vectors, (j-1) / 2 random initial vectors are added to the beginning and end of the input matrix to obtain the attention matrix. The formula for information importance is s i =W·X i:i+j-1 +b, where s i is the information importance, X i:i+j-1 is the embedding matrix of the input window from i to i+j-1, W is the attention matrix, and b is the preset attention bias value.

[0074] Furthermore, the specific process of using the information importance to obtain the corresponding access policy information is to extract reference features from the sector information using the information importance; perform a maximum pooling operation on the reference features through the pooling layer of the recognition model, and concatenate the maximum value obtained by pooling to obtain a one-dimensional feature vector; perform a full connection operation based on the one-dimensional feature and the neurons of the recognition model to obtain a recognition result, and obtain access policy information based on the recognition result.

[0075] It should be noted that the extraction of reference features is co i =f(W·X i:i+j-1 +b), coi That is, the feature extraction calculation result of the convolution layer corresponds to the reference feature, which represents the f() Sigmoid activation function, and the one-dimensional feature vector is The recognition result is Sigmoid is used to convert internal functions into probability functions in classification problems. f is the preset one-dimensional matrix used for identification, b f is its corresponding bias value.

[0076] Step S40: performing access control on the connected USB device based on the access policy information.

[0077] In a specific implementation, the access rights corresponding to the connected USB device can be determined based on the access policy information obtained above, and the access rights include allowing access and prohibiting access. If the access right is allowing access, the connected USB device is allowed to work normally to exchange data with the operating system. If the access right is prohibiting access, it is prevented from mounting or simulating the removal event of the connected USB device, so that the connected USB device is invisible in the operating system. The access rights corresponding to the specific device can be set according to actual needs, and this is not limited in this embodiment.

[0078] In this embodiment, when an access event is detected, the connected USB device is intercepted by the disk device before the operating system processes it; the sector information of the connected USB device is obtained; the sector information is queried from the preset policy rule information library to identify the access policy information corresponding to the connected USB device; and the access control of the connected USB device is performed based on the access policy information. In the above manner, the USB devices that are prohibited from access and allowed to access are identified by combining the sector information of the USB device and using the preset policy rule information library, so as to perform corresponding control, distinguish and control non-threatening USB devices from threatening USB devices, and provide convenience for users.

[0079] Reference Figure 2 , Figure 2 This is a structural block diagram of a first embodiment of an access control system for USB devices of the present invention.

[0080] like Figure 2 As shown, the access control system of the USB device proposed in the embodiment of the present invention includes:

[0081] The interception module 10 is used to intercept the connected USB device through the disk device before the operating system processes it when an access event is detected;

[0082] The reading module 20 is used to obtain the sector information of the connected USB device;

[0083] A query module 30, configured to query the sector information from a preset policy rule information library to identify access policy information corresponding to the connected USB device;

[0084] The control module 40 is used to perform access control on the connected USB device based on the access policy information.

[0085] In this embodiment, when an access event is detected, the connected USB device is intercepted by the disk device before the operating system processes it; the sector information of the connected USB device is obtained; the sector information is queried from the preset policy rule information library to identify the access policy information corresponding to the connected USB device; and the access control of the connected USB device is performed based on the access policy information. In the above manner, the USB devices that are prohibited from access and allowed to access are identified by combining the sector information of the USB device and using the preset policy rule information library, so as to perform corresponding control, distinguish and control non-threatening USB devices from threatening USB devices, and provide convenience for users.

[0086] In some embodiments, the disk device stack is a hierarchical structure, and includes an upper filter, a functional device object, a lower filter, and a physical device object in order from top to bottom. The interception module 10 is used to obtain all I / O request packets of the connected USB device that triggers the access event;

[0087] The I / O request packet is transmitted to the upper filter of the disk device, and the I / O request packet is filtered to the lower filter through the upper filter;

[0088] The I / O request packet is filtered by the lower filter to intercept the connected USB device before the operating system processes it.

[0089] In some embodiments, the preset strategy rule information base is provided with a recognition model, and the query module 30 is used to map the sector information to a multi-dimensional real number space through an embedding layer of the recognition model to obtain a sector information sequence;

[0090] Converting the sector information sequence into an embedding matrix, and inputting the embedding matrix into a computational layer of the recognition model;

[0091] generating an attention matrix based on the sector information sequence through the computing layer;

[0092] According to the calculation layer, the embedding matrix and the attention matrix are used to obtain information importance;

[0093] extracting feature data from the sector information using the information importance;

[0094] Corresponding access policy information is acquired based on the characteristic data.

[0095] In some embodiments, the query module 30 is used to extract reference features from the sector information using the information importance;

[0096] Performing a maximum pooling operation on the reference features through the pooling layer of the recognition model, and concatenating the maximum values ​​obtained by the pooling to obtain a one-dimensional feature vector;

[0097] A full connection operation is performed on the neurons of the recognition model based on the one-dimensional feature to obtain a recognition result, and access policy information is acquired based on the recognition result.

[0098] In some embodiments, the access control system of the USB device further includes a determination module;

[0099] The judging module is used to determine the device type of the connected USB device;

[0100] Determining whether the device type is the first type or the second type;

[0101] The acquisition module 10 is used to execute the step of acquiring the sector information of the connected USB device if the device type is the first type;

[0102] The query module 30 is used to determine the target sub-device type of the connected USB device if the device type is the second type;

[0103] Access policy information of the connected USB device is obtained based on the target sub-device type.

[0104] In some embodiments, the determination module is used to identify the interface type of the connected USB device;

[0105] Determining a reference sub-device type based on the interface type;

[0106] Obtaining the descriptor information of the connected USB device;

[0107] A target sub-device type is determined based on the descriptor information on the basis of the reference sub-device type.

[0108] In some embodiments, the control module 40 is used to determine the access permission corresponding to the connected USB device based on the access policy information;

[0109] If the access permission is to allow access, the connected USB device is allowed to operate normally to exchange data with the operating system;

[0110] If the access permission is to prohibit access, then the mounting is prevented or a removal event of the connected USB device is simulated, so that the connected USB device is invisible in the operating system.

[0111] An embodiment of the present application also provides an access control device for a USB device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus, and the memory is used to store an access control program for the USB device; and the processor is used to implement the above-mentioned access control method for the USB device when executing the program stored in the memory.

[0112] The communication bus mentioned in the access control device of the above USB device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0113] The communication interface is used for communication between the access control device of the USB device and other devices.

[0114] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0115] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, and discrete hardware components.

[0116] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integration. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0117] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0118] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0119] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0120] It should be understood that the above is only an example and does not constitute any limitation on the technical solution of the present invention. In specific applications, technicians in this field can make settings as needed, and the present invention does not limit this.

[0121] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.

[0122] In addition, for technical details not fully described in this embodiment, reference may be made to the USB device access control method provided in any embodiment of the present invention, and will not be repeated here.

[0123] In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0124] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0125] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0126] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0127] It is understandable that the system provided by the embodiment of the present invention corresponds to the method provided by the embodiment of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts in the above method.

Claims

1. A method for controlling access to a USB device, characterized in that: The USB device access control method comprises: When an access event is detected, the connected USB device is intercepted by the disk device before the operating system processes it; Obtaining sector information of the connected USB device; Querying the sector information from a preset policy rule information library to identify access policy information corresponding to the connected USB device; Access control is performed on the connected USB device based on the access policy information.

2. The USB device access control method according to claim 1, characterized in that: The disk device stack is a hierarchical structure, and includes an upper filter, a functional device object, a lower filter, and a physical device object in order from top to bottom. The method of intercepting the connected USB device before the operating system processes it through the disk device includes: Obtaining all I / O request packets of the connected USB device that triggers the access event; The I / O request packet is transmitted to the upper filter of the disk device, and the I / O request packet is filtered to the lower filter through the upper filter; The I / O request packet is filtered by the lower filter to intercept the connected USB device before the operating system processes it.

3. The USB device access control method according to claim 1, characterized in that: The preset policy rule information base is provided with an identification model, and the querying of the sector information from the preset policy rule information base to identify the access policy information corresponding to the connected USB device includes: Mapping the sector information to a multi-dimensional real number space through an embedding layer of the recognition model to obtain a sector information sequence; Converting the sector information sequence into an embedding matrix, and inputting the embedding matrix into a computational layer of the recognition model; generating an attention matrix based on the sector information sequence through the computing layer; According to the calculation layer, the embedding matrix and the attention matrix are used to obtain information importance; The corresponding access policy information is obtained using the information importance.

4. The USB device access control method according to claim 3, characterized in that: The obtaining corresponding access policy information by using the information importance includes: extracting reference features from the sector information using the information importance; Performing a maximum pooling operation on the reference features through the pooling layer of the recognition model, and concatenating the maximum values ​​obtained by the pooling to obtain a one-dimensional feature vector; A full connection operation is performed on the neurons of the recognition model based on the one-dimensional feature to obtain a recognition result, and access policy information is acquired based on the recognition result.

5. The USB device access control method according to claim 1, characterized in that: The method further comprises: Determine the device type of the connected USB device; Determining whether the device type is the first type or the second type; If the device type is the first type, executing the step of obtaining the sector information of the connected USB device; If the device type is the second type, determining the target sub-device type of the connected USB device; Access policy information of the connected USB device is obtained based on the target sub-device type.

6. The USB device access control method according to claim 5, characterized in that: The determining the target sub-device type of the connected USB device includes: Identify the interface type of the connected USB device; Determining a reference sub-device type based on the interface type; Obtaining the descriptor information of the connected USB device; A target sub-device type is determined based on the descriptor information on the basis of the reference sub-device type.

7. The USB device access control method according to any one of claims 1 to 6, characterized in that: The performing access control on the connected USB device based on the access policy information includes: Determine the access permission corresponding to the connected USB device based on the access policy information; If the access permission is to allow access, the connected USB device is allowed to operate normally to exchange data with the operating system; If the access permission is to prohibit access, then the mounting is prevented or a removal event of the connected USB device is simulated, so that the connected USB device is invisible in the operating system.

8. An access control system for USB devices, characterized in that: The access control system of the USB device comprises: An interception module, used for intercepting the connected USB device before the operating system processes it through the disk device when an access event is detected; A reading module, used to obtain the sector information of the connected USB device; A query module, used to query the sector information from a preset policy rule information library to identify access policy information corresponding to the connected USB device; A control module is used to perform access control on the connected USB device based on the access policy information.

9. The USB device access control system according to claim 8, characterized in that: The disk device stack is a hierarchical structure, and includes an upper filter, a functional device object, a lower filter and a physical device object in order from top to bottom. The interception module is used to obtain all I / O request packets of the connected USB device that triggers the access event; The I / O request packet is transmitted to the upper filter of the disk device, and the I / O request packet is filtered to the lower filter through the upper filter; The I / O request packet is filtered by the lower filter to intercept the connected USB device before the operating system processes it.

10. The USB device access control system according to claim 8, characterized in that: The preset strategy rule information base is provided with a recognition model, and the query module is used to map the sector information to a multi-dimensional real number space through an embedding layer of the recognition model to obtain a sector information sequence; Converting the sector information sequence into an embedding matrix, and inputting the embedding matrix into a computational layer of the recognition model; generating an attention matrix based on the sector information sequence through the computing layer; According to the calculation layer, the embedding matrix and the attention matrix are used to obtain information importance; extracting feature data from the sector information using the information importance; Corresponding access policy information is acquired based on the characteristic data.

Images