Cross-platform safe USB flash disk management method and system

Abstract

The invention discloses a cross-platform safe USB flash disk management method, which comprises the following steps of: constructing a file system comprising a safe information area, an extended metadata area, a data area and a control area, and placing a common USB flash disk to obtain a safe USB flash disk; randomly generating a secret key of the security U disk, selecting a shared user and correspondingly setting permissions, generating a role permission list and an operation permission list, and correspondingly storing the role permission list and the operation permission list to a control area and an extension metadata area; encrypting the secret key based on a corresponding user public key obtained by the shared user and a registration public key generated by the registration user to obtain encrypted content; the encrypted content is stored in a security information area to complete security U disk registration; decrypting the encrypted content based on the private key of the to-be-authenticated user, and completing secure USB flash disk authentication based on a decryption result; after the authentication is passed, obtaining a user identity based on a role permission list; and executing a corresponding data operation on the data area based on the user identity and the operation authority list. And data stored in the USB flash disk is prevented from being accessed, tampered and hostile attacked without authorization.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more particularly to a cross-platform secure USB flash drive management method and system. Background Art

[0002] At present, USB flash drives have become an indispensable tool for data exchange and transmission in daily life due to their plug-and-play, portable and easy-to-use features. However, data security was not considered at the beginning of the design, resulting in any computer being able to easily connect to the USB flash drive and access the data in it. The loss of the USB flash drive will lead to data leakage. Therefore, it is very important to protect the data security on the USB flash drive. Currently, two solutions are commonly used: hardware protection and software encryption.

[0003] The hardware protection solution is a strategy to enhance the security of USB flash drive data by integrating specific hardware devices. For example, by introducing a fingerprint authentication module, only a verified fingerprint can authorize access to the data in the USB flash drive; or by integrating an encryption chip, requiring the user to enter the correct key to decrypt the ciphertext data in the USB flash drive to obtain the plaintext information. However, adopting this hardware protection solution not only requires the modification of the original USB flash drive structure, but may also increase the user's usage cost due to the introduction of additional hardware devices.

[0004] Software protection scheme is a strategy to ensure data security through software encryption technology when the host accesses the USB flash drive. For example, design a secure file system and use encryption technology to protect the data stored in it to prevent unauthorized access; or intercept the USB flash drive of the system and encrypt the data in real time during the USB communication process, so as to effectively protect the data in the USB flash drive from being illegally obtained or tampered with. In the software-based protection scheme, the x86 hardware environment is currently the research object, and the solutions proposed for Windows or Linux systems are proposed. With the construction of domestic informatization, a solution that is compatible with multiple platforms and systems and provides users with unified operation and usage methods is needed. At the same time, the current scheme mainly focuses on using cryptographic technology to protect the data on the USB flash drive, but often lacks an authentication mechanism, and cannot confirm the detailed information of the host and the USB flash drive, resulting in the inability to control the use environment and operation permissions of the USB flash drive. In addition, the design of data sharing between multiple users and file access control is relatively rough, resulting in unreasonable information usage permissions during use.

[0005] Therefore, how to prevent the USB flash drive data from being accessed, tampered with, and maliciously attacked without authorization is a problem that needs to be solved urgently by those skilled in the art. Summary of the invention

[0006] In view of this, the present invention provides a cross-platform secure USB flash drive management method and system, which implements fine-grained access control on USB flash drive data, so that the data stored on the USB flash drive is protected from unauthorized access, tampering and malicious attacks.

[0007] In order to achieve the above object, the present invention adopts the following technical solution:

[0008] A cross-platform secure USB flash drive management method, comprising:

[0009] Construct a file system including a security information area, an extended metadata area, a data area, and a control area and place it in a common USB flash drive to obtain a secure USB flash drive;

[0010] Randomly generate a key for the secure USB flash drive, select a shared user and set permissions accordingly, generate a role permission list and an operation permission list and save them to the control area and the extended metadata area accordingly;

[0011] The secret key is encrypted based on the user public key corresponding to the shared user and the registered public key generated by the registered user to obtain encrypted content;

[0012] The encrypted content is saved to the security information area to complete the secure USB disk registration;

[0013] Decrypting the encrypted content based on the private key of the user to be authenticated, and completing the secure USB flash drive authentication based on the decryption result;

[0014] After authentication, the user identity is obtained based on the role permission list;

[0015] Perform corresponding data operations on the data area based on the user identity and the operation permission list.

[0016] Preferably, the role authority list specifically includes:

[0017] Administrator: can use the secure USB flash drive and can change and set user roles;

[0018] Prohibit the user: cannot use the secure USB flash drive;

[0019] Ordinary user: can use the secure USB flash drive but cannot change or set the user role;

[0020] Restricted user: can use the secure USB flash drive, but cannot view, create or operate data information with specified restricted conditions in the secure USB flash drive.

[0021] Preferably, the administrator is a registered person who has full control authority over the intermediate files generated by the ordinary user and the restricted user, and can set other users as administrators;

[0022] Both the common user and the restricted user can set the operation authority of other users except the administrator on the intermediate file.

[0023] Preferably, the registration process further includes:

[0024] The marker is encrypted using a symmetric encryption algorithm based on the key to obtain an encrypted marker and save it in the security information area.

[0025] Preferably, obtaining the encrypted content specifically includes:

[0026] Encrypting the secret key based on all the user public keys respectively to obtain multiple shared encryption results;

[0027] Encrypting the secret key based on the registration public key to obtain a registration encryption result;

[0028] The registered encryption result and the shared encryption result together constitute the encrypted content;

[0029] The encrypted content is stored in a corresponding area of ​​the security information area.

[0030] Preferably, the secure USB disk authentication specifically includes:

[0031] Decrypting the registration encryption result based on the private key of the user to be authenticated to obtain a first pre-decryption key;

[0032] Determining whether a correct marker is obtained by decrypting the encrypted marker based on the first pre-decryption key;

[0033] If yes, it means that the secure USB flash drive has been shared with the user to be authenticated and the key has been obtained;

[0034] If not, decrypt the shared encryption result based on the private key, and after traversing all the shared encryption results, determine whether the correct key is obtained;

[0035] If yes, it indicates that the user to be authenticated is the shared user and the authentication is successful;

[0036] If not, it indicates that the authentication has failed and the secure USB flash drive cannot be used.

[0037] Preferably, performing corresponding data operations on the data area specifically includes:

[0038] Determine the user identity of the user to be authenticated based on the role authority list and the shared encryption result;

[0039] If the user is the administrator, then all data in the secure USB flash drive can be operated;

[0040] If the user identity is the common user, then performing corresponding operations on the data information in the secure USB flash drive based on the permission operation list;

[0041] If the user identity is the prohibited user, the secure USB flash drive cannot be used;

[0042] If the user identity is the restricted user, the user cannot view, create and operate the data information with specified restricted conditions in the secure USB flash drive.

[0043] Preferably, when the shared user stores files based on the secure USB flash drive, a sharing permission list is generated based on the stored files and stored in the extended metadata area;

[0044] Before other users other than the administrator operate the storage file, they determine whether they have the operation authority based on the sharing authority list. If they have the operation authority, they can perform the corresponding operation, otherwise they cannot perform the operation.

[0045] Preferably, the extended metadata area stores a verification hash value of the file, and when the content of the file changes, the hash value of the corresponding changed file is calculated and saved in the file verification area.

[0046] A cross-platform secure USB disk management system, comprising: a secure USB disk construction module, a permission setting module, a registration module, an authentication module and a data operation module;

[0047] The secure USB disk construction module is used to construct a file system including a security information area, an extended metadata area, a data area, and a control area and place it into an ordinary USB disk to obtain a secure USB disk;

[0048] The permission setting module is used to randomly generate a key for the secure USB flash drive, select a shared user and set permissions accordingly, generate a role permission list and an operation permission list and save them to the control area and the extended metadata area accordingly;

[0049] The registration module is used to encrypt the key based on the corresponding user public key obtained by the shared user and the registration public key generated by the registered user to obtain encrypted content; the encrypted content is saved to the security information area to complete the secure USB disk registration;

[0050] The authentication module is used to decrypt the encrypted content based on the private key of the user to be authenticated, and complete the secure USB flash drive authentication based on the decryption result;

[0051] The data operation module is used to obtain the user identity based on the role permission list after authentication; and perform corresponding data operations on the data area based on the user identity and the operation permission list.

[0052] It can be seen from the above technical solutions that, compared with the prior art, the present invention discloses a cross-platform secure USB flash drive management method and system, which has the following beneficial effects:

[0053] 1. Ensure the confidentiality and integrity of USB flash drive data based on a secure and controllable file system; through authorization, only authenticated and legitimate platforms or users can access the data in the secure USB flash drive. By setting role permission lists and operation permission lists, fine-grained access control of USB flash drive data is achieved, protecting the data stored on the USB flash drive from unauthorized access, tampering and malicious attacks.

[0054] 2. By randomly generating keys and encrypting them using public key encryption technology, it ensures that only users with the corresponding private keys can decrypt and access the data in the USB flash drive, effectively preventing unauthorized data access and enhancing data confidentiality.

[0055] 3. Based on the role permission list and operation permission list, the administrator can assign specific operation permissions to different shared users. This mechanism allows detailed access control policies to be set according to the actual needs of users, achieving more refined data protection, while also simplifying the permission management process.

[0056] 4. By configuring independent access rights for each shared user, the same USB flash drive can be used by multiple users at different levels, which not only ensures the efficiency of information exchange during teamwork, but also avoids the risk of data leakage caused by excessive permissions.

[0057] 5. Due to the use of standard file system structure and common encryption algorithm (such as AES), the solution can run on multiple operating system platforms, including but not limited to Windows, Mac OS X and Linux, greatly improving its application scope and convenience.

[0058] 6. The present invention saves detailed permission configuration information and log records in the control area, which is convenient for subsequent retrospective analysis, helps to discover potential threats or violations, and take timely measures to deal with them. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0060] Figure 1 A schematic flow chart of a cross-platform secure USB flash drive management method provided by the present invention.

[0061] Figure 2 This is a schematic diagram of the file system format provided by the present invention.

[0062] Figure 3 This is a flow chart of the secure USB flash drive authentication provided by the present invention.

[0063] Figure 4 A schematic diagram of the structure of a cross-platform secure USB disk management system provided by the present invention.

[0064] Figure 5 This is a schematic diagram of the overall framework of the secure USB flash drive provided by the present invention. DETAILED DESCRIPTION

[0065] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] Example 1

[0067] like Figure 1 As shown, the embodiment of the present invention discloses a cross-platform secure USB flash drive management method, including:

[0068] Construct a file system including a security information area, an extended metadata area, a data area, and a control area and place it in a common USB flash drive to obtain a secure USB flash drive;

[0069] Randomly generate a key for the secure USB flash drive, select a shared user and set permissions accordingly, generate a role permission list and an operation permission list and save them to the control area and extended metadata area accordingly;

[0070] The keys are encrypted based on the user public key corresponding to the shared user and the registered public key generated by the registered user to obtain the encrypted content;

[0071] The encrypted content is saved to the security information area to complete the secure USB disk registration;

[0072] Decrypt the encrypted content based on the private key of the user to be authenticated, and complete the secure USB flash drive authentication based on the decryption result;

[0073] After authentication, the user identity is obtained based on the role permission list;

[0074] Perform corresponding data operations on the data area based on user identity and operation permission list.

[0075] Example 2

[0076] The embodiment of the present invention discloses a cross-platform secure USB flash drive management method, including:

[0077] like Figure 2 As shown, a file system including a security information area, an extended metadata area, a data area, and a control area is constructed and placed in a common USB flash drive to obtain a secure USB flash drive:

[0078] Preferably, a file system including a security information area, an extended metadata area, a data area and a control area is constructed as the secure and controllable file system of the present invention, wherein the security information area is used to store the key encrypted by the registered public key and the user public key, which can ensure the confidentiality of the U disk data while enabling sharing among different users, and also stores a marker, which is stored using the key of the U disk, and only the user who has the key of the U disk can obtain the correct marker and use the U disk correctly; the extended metadata area adds a file hash value on the basis of the traditional file system to ensure the integrity and non-tamperability of the data; the data area uses a symmetric encryption algorithm to encrypt the stored data to ensure the confidentiality of the stored data; the control area is used to store the role permission list of the file, which is used to implement role access control based on the role permission list.

[0079] Preferably, the secure and controllable file system also includes a boot sector for allowing the computer to understand the layout and operation method of the file system.

[0080] Preferably, the boot sector, extended metadata area, data area and control area are all encrypted and stored using the key of the secure USB flash drive.

[0081] Preferably, the extended metadata area stores the verification hash value of the file. When the content of the file changes (addition, deletion, modification, query, etc.), the hash value of the corresponding changed file is updated and saved in the file verification area. The hash value verification is used to ensure the integrity and non-tamperability of the data stored on the secure USB flash drive.

[0082] Preferably, the integrity, availability, confidentiality and authentication of the secure USB flash drive data are ensured based on a secure and controllable file system.

[0083] Randomly generate a key for the secure USB flash drive, select a shared user and set permissions accordingly, generate a role permission list and an operation permission list and save them to the control area and extended metadata area accordingly:

[0084] Preferably, the role permission list records the roles corresponding to known shared users and the permissions possessed by the roles and is stored in the control area. When the secure USB flash drive authentication is successful, the user's USB flash drive usage permissions are determined based on the role permission list.

[0085] Preferably, the user roles or user identities include: administrator, prohibited user, ordinary user and restricted user.

[0086] Preferably, the role permission list specifically includes:

[0087] Administrator: can use the secure USB drive and change user roles;

[0088] Prohibited user: cannot use secure USB drive;

[0089] Ordinary users: can use the secure USB drive but cannot change the user role.

[0090] Restricted user: Can use the secure USB flash drive, but cannot view, create, or operate data or information with specified restricted conditions in the secure USB flash drive.

[0091] Preferably, the administrator is a registered person who has full control over the intermediate files generated by ordinary users and restricted users, and can set other users as administrators;

[0092] Both ordinary users and restricted users can set operation permissions for intermediate files for users other than administrators. Restricted users cannot create operation permissions for files with restricted conditions.

[0093] Preferably, if some users are not allowed to use the secure USB flash drive, the administrator can set the user as a prohibited user in the role permission list; if some users are restricted from using the USB flash drive, the administrator creates a new role Ri, records the restricted conditions of the role, and then adds these users to the role Ri.

[0094] Preferably, the present invention defines a seven-tuple (U, R, TU, O, TO, f ut ,f uo ), where the elements are defined as follows:

[0095] User set U: the subject set that accesses resources in the secure USB flash drive. It is the subject that operates the access resources. It is formally described as: U = {u1,u2,…,u n};

[0096] Role set R: a set of users with the same data access rights and secure USB flash drive management rights, formally described as R = {r1, r2, …, r n};

[0097] Role permission type set TU: a role r i The set of all possible operation permission values ​​of the secure USB flash drive is called the value range of r, which is formally described as T = {T r |r∈R}, where T r = {o(x)|x∈R}, where r and x both belong to the role set;

[0098] File set O: the set of files in the secure USB flash drive. The formal description is: O = {o1, o2, …, o n};

[0099] File permission type set TO: a certain user u i For a file in the secure USB drive i The set of all possible operation permissions is called the value range of the tuple (u, o), which is formally described as T = {T u,o |u∈U,o∈O}, where T u,o ={uo(x,y)|x∈U,y∈O};

[0100] Information function f ut :U→TU:For each user u in the user set i The operation permission value for the secure USB flash drive. The formal description is:

[0101] Information function f uo :U×O→TO:For each user u in the user set i For each file o in the file set O i The file permission value is formally described as:

[0102] Preferably, the relationship between users and roles is many-to-one, where one user corresponds to one role, and one role can correspond to multiple users, one role corresponds to one role authority, and the relationship between files and users is many-to-many. Therefore, the present invention uses access control matrix A to intuitively express the relationship between users and files:

[0103] a i,j =f uo (u i ,o j )

[0104] The i-th row u of the matrix i Represents user u i The operation permissions for all files in this secure USB drive, the i-th column of the matrix o i Indicates the files in this secure USB drive. i Allow all users to have the same permissions.

[0105] Preferably, the role permission type set TU of the present invention is specifically defined as: TU = {administrator, prohibited user, ordinary user, restricted condition a class user, restricted condition b class user, ..., restricted condition n class user}, and the file permission type set TO is specifically defined as: TO = {read, read and write, modify, full control, hide}.

[0106] Preferably, based on constructing a seven-tuple (U, R, TU, O, TO, f ut ,f uo ), defines user sets, role sets, role permission type sets, file sets, file permission type sets, and related operation functions. In this way, the administrator (high-level role) sets the roles and role permissions of the secure USB flash drive. At the same time, both registered users and shared users can be assigned different roles to operate files, so that when the secure USB flash drive is shared, different users' access to resources can be restricted.

[0107] Preferably, the operation permission list of the present invention includes: read, read and write, modify, full control and hide.

[0108] Based on the shared user's corresponding user public key and the registered public key generated by the registered user, the keys are encrypted to obtain the encrypted content:

[0109] Preferably, obtaining the encrypted content specifically includes:

[0110] Encrypt the secret key based on all the user public keys respectively to obtain multiple shared encryption results;

[0111] Encrypt the secret key based on the registered public key to obtain a registered encryption result;

[0112] The registered encryption result and the shared encryption result together constitute the encrypted content;

[0113] The encrypted content is saved in the corresponding area of ​​the security information area.

[0114] Preferably, multiple shared encryption results are correspondingly saved in KM-1 area, KM-2 area, ..., KM-n area of ​​the security information area, where n represents the nth shared user; and the registered encryption result is saved in KM-0 area of ​​the security information area.

[0115] The encrypted content is saved to the security information area to complete the secure USB disk registration;

[0116] Preferably, other sectors of the secure USB flash drive are formatted to establish a file system, and when data is written to the sectors, the data is encrypted and stored using a key to complete the secure USB flash drive registration.

[0117] Preferably, the method further comprises: encrypting the marker using a symmetric encryption algorithm based on the key, obtaining the encrypted marker and saving it in the security information area. Only the user with the key can obtain the correct marker and use the secure USB flash drive correctly.

[0118] Decrypt the encrypted content based on the private key of the user to be authenticated, and complete the secure USB flash drive authentication based on the decryption result:

[0119] Preferably, Figure 3 As shown in the figure, secure USB flash drive authentication specifically includes:

[0120] Decrypting the registration encryption result based on the private key of the user to be authenticated to obtain a first pre-decryption key;

[0121] Determining whether a correct marker is obtained by decrypting the encrypted marker based on the first pre-decryption key;

[0122] If yes, it means that the secure USB drive has been shared with the user to be authenticated and the key has been obtained;

[0123] If not, decrypt the shared encryption result based on the private key, and after traversing all the shared encryption results, determine whether the correct key is obtained;

[0124] If yes, it means the user to be authenticated is a shared user and the authentication is successful;

[0125] If not, it means the authentication has failed and the secure USB drive cannot be used.

[0126] After authentication, the user identity is obtained based on the role permission list:

[0127] Preferably, after passing the secure USB flash drive authentication, the user cannot directly interact with data, and uses the USB flash drive key to decrypt the control area of ​​the secure USB flash drive, thereby obtaining the role permission list of the secure USB flash drive;

[0128] The user identity is determined based on the role permission list and the area KM-n where the user to be authenticated obtains the USB key.

[0129] Perform corresponding data operations on the data area based on the user identity and operation permission list:

[0130] Preferably, performing corresponding data operations on the data area specifically includes:

[0131] The user identity of the user to be authenticated is determined based on the role permission list and the shared encryption result;

[0132] If the user is an administrator, he can operate all the data information in the secure USB drive;

[0133] If the user is a common user, corresponding operations are performed on the data in the secure USB flash drive based on the permission operation list;

[0134] If the user identity is a prohibited user, the secure USB drive cannot be used;

[0135] If the user identity is a restricted user, he / she cannot view, create, or operate data information with specified restricted conditions in the secure USB flash drive.

[0136] Preferably, when a shared user stores files based on a secure USB flash drive, a sharing permission list is generated based on the stored files and stored in the extended metadata area;

[0137] Before other users other than administrators operate on stored files, they determine whether they have the operation permission based on the sharing permission list. If they have the operation permission, they can perform the corresponding operation, otherwise they cannot perform the operation.

[0138] Preferably, the sharing permission list and the operation permission list have the same content, both including: read, read and write, modify, full control and hide.

[0139] Example 3

[0140] like Figure 4 As shown, a cross-platform secure USB disk management system includes: a secure USB disk construction module, a permission setting module, a registration module, an authentication module and a data operation module;

[0141] A secure USB flash drive construction module is used to construct a file system including a security information area, an extended metadata area, a data area, and a control area and place it into a common USB flash drive to obtain a secure USB flash drive;

[0142] The permission setting module is used to randomly generate the key of the secure USB flash drive, select the shared user and set the corresponding permissions, generate the role permission list and the operation permission list and save them to the control area and the extended metadata area;

[0143] The registration module is used to encrypt the key based on the corresponding user public key obtained by the shared user and the registration public key generated by the registered user to obtain the encrypted content; the encrypted content is saved to the security information area to complete the secure USB disk registration;

[0144] The authentication module is used to decrypt the encrypted content based on the private key of the user to be authenticated, and complete the secure USB flash drive authentication based on the decryption result;

[0145] The data operation module is used to obtain the user identity based on the role permission list after authentication; and perform corresponding data operations on the data area based on the user identity and the operation permission list.

[0146] Preferably, the above modules of the present invention correspond one-to-one to the above implementation methods, and will not be described one by one here.

[0147] Example 4

[0148] The overall framework of the secure USB flash drive of the present invention is as follows: Figure 5 As shown, it includes UI layer, business logic layer, secure USB drive layer and application environment. The overall framework of the secure USB drive of the present invention adopts the strategy of separating business processing from display logic, and adopts a hierarchical mode of business logic layer and UI layer:

[0149] Among them, the UI layer provides users with a unified interface and operations, including user management, USB disk management, and file management functions;

[0150] The business logic layer is responsible for the business logic of the secure USB flash drive, including the underlying processing logic, such as data encryption, file operations, secure file systems, etc.; it also includes user-oriented access logic, such as secure USB flash drive registration, secure USB flash drive authentication, data access control, etc.;

[0151] Secure USB drive driver layer. Due to different underlying hardware and operating systems, the USB access methods and mechanisms of different platforms are different. In order to adapt to the localization and X86 environment, USB drivers for Linux and Windows operating systems are encapsulated, providing a unified access interface for the implementation of general USB protocols, USB storage protocols and SCSI commands.

[0152] Preferably, from the bottom layer, the access to the USB flash drive is encapsulated for different bottom layer hardware and operating systems, and a unified interface and data exchange format are defined according to the USB flash drive storage protocol to achieve the decoupling between the upper layer application's USB flash drive operation and the bottom layer platform. From the user layer, the cross-platform system solution provides a unified interface and operation, ensuring that users can obtain a consistent application interface and interactive experience on different devices.

[0153] Example 5

[0154] Based on the same inventive concept, the present invention also provides a computer device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0155] Memory, used to store computer programs;

[0156] The processor, when used to execute the program stored in the memory, can implement a cross-platform secure USB flash drive management method as in Example 1 or 2.

[0157] The electronic device may include: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus. The processor may call the logic instructions in the memory to execute a cross-platform secure USB flash drive management method in Embodiment 1 or 2.

[0158] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0159] Through the above technical solutions, it can be seen that the present invention discloses a cross-platform secure USB flash drive management method and system, which has the following beneficial effects:

[0160] 1. Ensure the confidentiality and integrity of USB flash drive data based on a secure and controllable file system; through authorization, only authenticated and legitimate platforms or users can access the data in the secure USB flash drive. By setting role permission lists and operation permission lists, fine-grained access control of USB flash drive data is achieved, protecting the data stored on the USB flash drive from unauthorized access, tampering and malicious attacks.

[0161] 2. By randomly generating keys and encrypting them using public key encryption technology, it ensures that only users with the corresponding private keys can decrypt and access the data in the USB flash drive, effectively preventing unauthorized data access and enhancing data confidentiality.

[0162] 3. Based on the role permission list and operation permission list, the administrator can assign specific operation permissions to different shared users. This mechanism allows detailed access control policies to be set according to the actual needs of users, achieving more refined data protection, while also simplifying the permission management process.

[0163] 4. By configuring independent access rights for each shared user, the same USB flash drive can be used by multiple users at different levels, which not only ensures the efficiency of information exchange during teamwork, but also avoids the risk of data leakage caused by excessive permissions.

[0164] 5. Due to the use of standard file system structure and universal encryption algorithm (such as SM4), the solution can run on multiple operating system platforms, including but not limited to Windows, Mac OS X and Linux, greatly improving its application scope and convenience.

[0165] 6. The present invention saves detailed permission configuration information and log records in the control area, which is convenient for subsequent retrospective analysis, helps to discover potential threats or violations, and take timely measures to deal with them.

[0166] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0167] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A cross-platform secure USB flash drive management method, characterized in that: include: Construct a file system including a security information area, an extended metadata area, a data area, and a control area and place it in a common USB flash drive to obtain a secure USB flash drive; Randomly generate a key for the secure USB flash drive, select a shared user and set permissions accordingly, generate a role permission list and an operation permission list and save them to the control area and the extended metadata area accordingly; The secret key is encrypted based on the user public key corresponding to the shared user and the registered public key generated by the registered user to obtain encrypted content; The encrypted content is saved to the security information area to complete the secure USB disk registration; Decrypting the encrypted content based on the private key of the user to be authenticated, and completing the secure USB flash drive authentication based on the decryption result; After authentication, the user identity is obtained based on the role permission list; Perform corresponding data operations on the data area based on the user identity and the operation permission list.

2. A cross-platform secure USB flash drive management method according to claim 1, characterized in that: The role permission list specifically includes: Administrator: can use the secure USB flash drive and can change and set user roles; Prohibit the user: cannot use the secure USB flash drive; Ordinary user: can use the secure USB flash drive, but cannot change or set the user role; Restricted user: can use the secure USB flash drive, but cannot view, create or operate data information with specified restricted conditions in the secure USB flash drive.

3. A cross-platform secure USB flash drive management method according to claim 2, characterized in that: The administrator is a registered person who has full control over the intermediate files generated by the ordinary user and the limited user, and can set other users as administrators; Both the common user and the restricted user can set the operation authority of other users except the administrator on the intermediate file.

4. A cross-platform secure USB flash drive management method according to claim 3, characterized in that: The registration process also includes: The marker is encrypted using a symmetric encryption algorithm based on the key to obtain an encrypted marker and save it in the security information area.

5. A cross-platform secure USB flash drive management method according to claim 4, characterized in that: Get the encrypted content, including: Encrypting the secret key based on all the user public keys respectively to obtain multiple shared encryption results; Encrypting the secret key based on the registration public key to obtain a registration encryption result; The registered encryption result and the shared encryption result together constitute the encrypted content; The encrypted content is stored in a corresponding area of ​​the security information area.

6. A cross-platform secure USB flash drive management method according to claim 5, characterized in that: The secure USB flash drive authentication specifically includes: Decrypting the registration encryption result based on the private key of the user to be authenticated to obtain a first pre-decryption key; Determining whether a correct marker is obtained by decrypting the encrypted marker based on the first pre-decryption key; If yes, it means that the secure USB flash drive has been shared with the user to be authenticated and the key has been obtained; If not, decrypt the shared encryption result based on the private key, and after traversing all the shared encryption results, determine whether the correct key is obtained; If yes, it means that the user to be authenticated is the shared user and the authentication is successful; If not, it means that the authentication has failed and the secure USB flash drive cannot be used.

7. A cross-platform secure USB flash drive management method according to claim 5, characterized in that: Performing corresponding data operations on the data area specifically includes: Determine the user identity of the user to be authenticated based on the role authority list and the shared encryption result; If the user is the administrator, then all data in the secure USB flash drive can be operated; If the user identity is the common user, then performing corresponding operations on the data information in the secure USB flash drive based on the permission operation list; If the user identity is the prohibited user, the secure USB flash drive cannot be used; If the user identity is the restricted user, the user cannot view, create and operate the data information with specified restricted conditions in the secure USB flash drive.

8. A cross-platform secure USB flash drive management method according to claim 1, characterized in that: When the shared user stores files based on the secure USB flash drive, a sharing permission list is generated based on the stored files and stored in the extended metadata area; Before other users other than the administrator operate the storage file, they determine whether they have the operation authority based on the sharing authority list. If they have the operation authority, they can perform the corresponding operation, otherwise they cannot perform the operation.

9. A cross-platform secure USB flash drive management method according to claim 1, characterized in that: The extended metadata area stores the verification hash value of the file. When the content of the file changes, the hash value of the corresponding changed file is calculated and saved in the file verification area.

10. A cross-platform secure USB disk management system, applied to a cross-platform secure USB disk management method as claimed in any one of claims 1 to 9, characterized in that: include: Secure USB flash drive construction module, permission setting module, registration module, authentication module and data operation module; The secure USB disk construction module is used to construct a file system including a security information area, an extended metadata area, a data area, and a control area and place it into an ordinary USB disk to obtain a secure USB disk; The permission setting module is used to randomly generate a key for the secure USB flash drive, select a shared user and set permissions accordingly, generate a role permission list and an operation permission list and save them to the control area and the extended metadata area accordingly; The registration module is used to encrypt the key based on the corresponding user public key obtained by the shared user and the registration public key generated by the registered user to obtain encrypted content; the encrypted content is saved to the security information area to complete the secure USB disk registration; The authentication module is used to decrypt the encrypted content based on the private key of the user to be authenticated, and complete the secure USB flash drive authentication based on the decryption result; The data operation module is used to obtain the user identity based on the role permission list after authentication; and perform corresponding data operations on the data area based on the user identity and the operation permission list.

Images