Secure access method and device of removable storage equipment, electronic equipment and medium

Abstract

According to the secure access method and device of the removable storage device, the electronic device and the storage medium, the method comprises the steps that through verification of the digital certificate, misjudgment and forbidding of legal hardware are effectively reduced, so that inconvenience caused by frequent forbidding of legal equipment by a user is reduced, and the user experience is improved. According to the method, reporting and processing are carried out without relying on real-time network connection, effective management of access of the mobile storage device can still be kept under the condition that no network exists or the network is unstable, potential risks are reduced, once it is found that the digital certificate to be checked is not compliant, the mobile storage device is forbidden immediately, and the safety of the digital certificate to be checked is improved. The quick response reduces the possible virus infection diffusion opportunity, improves the information security management efficiency, also can avoid frequent reporting of risk hardware, reduces the burden of network communication in enterprises, destroys the digital certificate to be checked after the security of the removable storage device is confirmed, prevents the certificate from being stolen by others, and improves the safety of the enterprises. And the data security of the enterprise is further ensured.

Description

Technical Field

[0001] The present invention relates to the field of mobile storage device security technology, and in particular to a method, device, electronic equipment and medium for securely accessing a mobile storage device. Background Art

[0002] Removable storage devices can be easily connected to a variety of devices, which makes them vulnerable to virus infection. Malware is often spread from one computer to another through mobile devices, especially when used in public computers (such as Internet cafes, schools, etc.). Users unknowingly copy virus-infected files to their devices, which may lead to data loss, privacy leakage and system crashes.

[0003] In order to ensure information security, many enterprises and organizations have adopted the technology of virus scanning and reporting on mobile storage devices. However, this virus reporting method is highly dependent on network connection. In the absence of network or unstable network, virus infection cannot be reported in time, which increases the risk. Secondly, even if the network connection is normal, there may be delays in the reporting and feedback process, which makes it difficult to quickly locate infected devices and transmission paths. In addition, frequent reporting increases the burden of network communication in the enterprise. Summary of the invention

[0004] The present application provides a secure access method, apparatus, electronic device and medium for a removable storage device to solve the above technical problems.

[0005] An embodiment of the present application provides a method for secure access to a removable storage device, the method comprising: identifying whether a removable storage device to be verified has a digital certificate to be verified; the removable storage device to be verified comprises a removable storage device connected to a target terminal; when it is identified that the removable storage device to be verified has a digital certificate to be verified, verifying the digital certificate to be verified; if the verification of the digital certificate to be verified is successful, marking the removable storage device to be verified that has successfully been verified as a safe removable storage device, scanning the safe removable storage device, and destroying the digital certificate to be verified; if the verification of the digital certificate to be verified fails, disabling the removable storage device to be verified.

[0006] In one embodiment of the present application, before the access request of the mobile storage device is monitored, it also includes: generating a digital certificate with a validity period through a digital certificate generation tool, recorded as an initial digital certificate; randomly generating a serial number, and embedding the serial number into the initial digital certificate to obtain a target digital certificate; writing the target digital certificate into the target mobile storage device through the main program, and sending the certificate information of the target digital certificate to the target terminal, the certificate information including the validity period and one-time use identifier of the digital certificate.

[0007] In one embodiment of the present application, when it is identified that the removable storage device to be verified has a digital certificate to be verified, the digital certificate to be verified is verified, including: reading the certificate information of the digital certificate to be verified through an agent program, verifying whether the current time is within the validity period of the digital certificate based on the certificate information of the target digital certificate received by the target terminal, and verifying whether the one-time use identifier is used; if it is verified that the current time is within the validity period of the digital certificate and the one-time use identifier has not been used, marking the one-time use identifier as used, and prompting a verification success message on the target terminal.

[0008] In one embodiment of the present application, when it is identified that the removable storage device to be verified has a digital certificate to be verified, the digital certificate to be verified is verified, and the process also includes: if it is verified that the current time is not within the validity period of the digital certificate, a verification failure message is prompted at the target terminal; if it is verified that the current time is within the validity period of the digital certificate and the one-time use identifier has been used, a verification failure message is prompted at the target terminal; when it is identified that the removable storage device to be verified is not the target removable storage device, a verification failure message is prompted at the target terminal.

[0009] In one embodiment of the present application, destroying the digital certificate to be verified includes: recording the destruction information of the digital certificate to be verified in the target terminal, the destruction information including the destruction time and a unique identifier; and destroying the digital certificate to be verified by a file destruction tool in accordance with the destruction information by means of a quick overwrite.

[0010] In one embodiment of the present application, before identifying whether the removable storage device to be inspected has the digital certificate to be inspected, it also includes: performing virus detection on the removable storage device to be inspected, and if no virus is detected, checking whether the file system of the removable storage device to be inspected is complete; if the file system of the removable storage device to be inspected is complete, checking whether there are suspicious files in the removable storage device to be inspected; if there are no suspicious files in the removable storage device to be inspected, encrypting sensitive data of the removable storage device to be inspected; if there are suspicious files in the removable storage device, issuing a risk warning message.

[0011] In one embodiment of the present application, disabling a removable storage device to be checked includes: when the removable storage device to be checked is identified as a target removable storage device, but it is identified that the removable storage device to be checked does not have a digital certificate to be checked, then disabling the removable storage device to be checked; performing virus detection on the removable storage device to be checked, and if a virus is detected, disabling the removable storage device to be checked; performing virus detection on the removable storage device to be checked, and if no virus is detected, but it is detected that the file system of the removable storage device to be checked is incomplete, then disabling the removable storage device to be checked.

[0012] The embodiment of the present application provides a secure access device for a removable storage device, the device comprising: a digital certificate identification module, used to identify whether the removable storage device to be verified has a digital certificate to be verified; the removable storage device to be verified comprises a removable storage device connected to a target terminal; a verification module, used to verify the digital certificate to be verified when it is identified that the removable storage device to be verified has a digital certificate to be verified; and marking the removable storage device to be verified that has successfully been verified as a secure removable storage device, scanning the secure removable storage device, and destroying the digital certificate to be verified; if the verification of the digital certificate to be verified fails, disabling the removable storage device to be verified.

[0013] An embodiment of the present application provides an electronic device, including a processor, a memory and a communication bus; the communication bus is used to connect the processor and the memory; the processor is used to execute a computer program stored in the memory to implement the above-mentioned secure access method for the removable storage device.

[0014] The beneficial effects of the present application are as follows: through the verification of digital certificates, the misjudgment and mis-banning of legal hardware are effectively reduced, thereby reducing the inconvenience caused to users by frequent disabling of legal devices. The present application does not rely on real-time network connection for reporting and processing, and can maintain effective management of access to mobile storage devices under conditions of no network or unstable network, thereby reducing potential risks. Once the digital certificate to be verified is found to be non-compliant, the removable storage device will be immediately disabled. Rapid response reduces the chance of possible virus infection and spread, improves the efficiency of information security management, and can also avoid frequent reporting of risky hardware, reducing the burden of network communication in the enterprise. After confirming the security of the removable storage device, the digital certificate to be verified will be destroyed to prevent the credentials from being stolen by others, thereby further protecting the data security of the enterprise.

[0015] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0017] Figure 1 is a flow chart of a secure access method for a removable storage device shown in an exemplary embodiment of the present application;

[0018] Figure 2 is a block diagram of a secure access device for a removable storage device shown in an exemplary embodiment of the present application;

[0019] Figure 3 It is a structural schematic diagram of an electronic device shown in an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0020] The following will describe the implementation methods of the present application with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. The present application can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be understood that the preferred embodiments are only for illustrating the present application, not for limiting the scope of protection of the present application.

[0021] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present application, and thus the drawings only show components related to the present application rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed at will, and the component layout may also be more complicated.

[0022] In the following description, a large number of details are discussed to provide a more thorough explanation of the embodiments of the present application. However, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present application difficult to understand.

[0023] The embodiments of the present application respectively provide a secure access method for a removable storage device, a secure access device for a removable storage device, an electronic device, and a storage medium. These embodiments will be described in detail below.

[0024] See also Figure 1 , Figure 1 FIG. 1 shows a flow chart of a secure access method for a removable storage device according to an embodiment of the present application. Figure 1 As shown, the method at least includes steps S110 to S130, which are described in detail as follows:

[0025] Step S110: if the removable storage device to be verified is identified as the target removable storage device, then it is identified whether the removable storage device to be verified has a digital certificate to be verified.

[0026] In one embodiment of the present application, after an access request of a removable storage device to be verified is monitored, it is identified whether the removable storage device to be verified is a target removable storage device. As an example, the removable storage device to be verified is a USB flash drive (USB Flash Drive), referred to as a U disk. The U disk is a portable storage device that is connected to a computer and other devices through a USB interface and is widely used for data storage and transmission. By verifying the digital certificate of the removable storage device to be verified, it is ensured that only authenticated devices can access the system, which fundamentally reduces the risk of intrusion by malicious hardware. After identifying the target removable storage device, the digital certificate is first verified to ensure the legitimacy of its identity, further protecting the system environment from the threat of unknown viruses. After marking the removable storage device to be verified as safe, the virus scanning workflow is performed to improve processing efficiency.

[0027] Step S120: When it is identified that the removable storage device to be verified has a digital certificate to be verified, the digital certificate to be verified is verified.

[0028] Step S130, if the verification of the digital certificate to be verified is successful, the removable storage device to be verified that has been successfully verified is marked as a safe removable storage device, the safe removable storage device is scanned, and the digital certificate to be verified is destroyed; if the verification of the digital certificate to be verified fails, the removable storage device to be verified is disabled.

[0029] exist Figure 1In the technical solution shown, by verifying the digital certificate of the removable storage device to be verified, it is ensured that only authenticated devices can access the system, which fundamentally reduces the risk of intrusion by malicious hardware. After identifying the target removable storage device, the digital certificate is first verified to ensure the legitimacy of its identity, further protecting the system environment from the threat of unknown viruses. After marking the removable storage device to be verified as safe, the virus scanning workflow is performed, which improves processing efficiency. Through the verification of the digital certificate, the misjudgment and misbanning of legitimate hardware are effectively reduced, thereby reducing the inconvenience caused to users by frequently disabling legitimate devices. This application does not rely on real-time network connection for reporting and processing. It can maintain effective management of access to removable storage devices under conditions of no network or unstable network, reducing potential risks. Once the digital certificate to be verified is found to be non-compliant, the removable storage device will be disabled immediately. Rapid response reduces the chance of virus infection and spread, improves the efficiency of information security management, and avoids frequent reporting of risky hardware, reducing the burden of network communication in the enterprise. After confirming the security of the removable storage device, the digital certificate to be verified will be destroyed to prevent the credentials from being stolen by others, thereby further protecting the data security of the enterprise.

[0030] In one embodiment of the present application, before the access request of the mobile removable storage device is intercepted, it also includes: generating a digital certificate with a validity period through a digital certificate generation tool, recorded as an initial digital certificate; randomly generating a serial number, and embedding the serial number into the initial digital certificate to obtain a target digital certificate; writing the target digital certificate into the target mobile removable storage device through the main program, and sending the certificate information of the target digital certificate to the target terminal, the certificate information includes the validity period and one-time use identification of the digital certificate. Setting a validity period for the digital certificate can prevent the use of expired certificates, ensuring that only certificates within the validity period have the right to access and use the mobile removable storage device, thereby further strengthening the security of the system, and the introduction of the one-time use identification ensures that the certificate can only be used once after each connection, which greatly reduces the possibility of the credential being abused and enhances the security of data transmission.

[0031] As an example, the certificate information of the target digital certificate is sent to the target terminal, and the user name of the target removable storage device is also sent to the target terminal. When the removable storage device to be verified is identified as the target removable storage device, the digital certificate verification is performed.

[0032] As an example, a reliable digital certificate generation tool or service is used to generate a unique digital certificate. During the generation process, the validity period of the digital certificate is set, for example, it is set to expire after 24 hours. A one-time identifier, such as a randomly generated serial number or UUID, is embedded in the digital certificate with a limited period to ensure that each certificate can only be used once. This identifier is stored for subsequent verification. The generated digital certificate is written to a USB flash drive using a main program, and the file is set to read-only to prevent modification. The validity period and one-time identifier information of the certificate are released to authorized users through a secure channel, such as sending an email or private message. After the user inserts the USB flash drive, the agent program reads the digital certificate and verifies its validity and one-time use identifier, checks whether the current time is within the validity period of the certificate, and whether the identifier has not been used. Once the digital certificate to be verified is verified and used, the one-time identifier is marked as used, and subsequent access requests are blocked. By generating an initial digital certificate and embedding a serial number, each target mobile removable storage device can be ensured to have a unique identity, enhancing the authentication and identification capabilities of the device and reducing the risk of forgery or abuse. Setting an expiration date for digital certificates can prevent the use of expired certificates and ensure that only certificates within the validity period are authorized to access and use removable storage devices, thereby further strengthening the security of the system. The introduction of one-time use identification ensures that the certificate can only be used once after each connection, greatly reducing the possibility of credentials being abused and enhancing the security of data transmission.

[0033] In one embodiment of the present application, when it is identified that a removable storage device to be verified contains a digital certificate to be verified, the digital certificate to be verified is verified, including: reading the certificate information of the digital certificate to be verified through an agent program, verifying whether the current time is within the validity period of the digital certificate based on the certificate information of the target digital certificate received by the target terminal, and verifying whether the one-time use identifier is used; if the verification shows that the current time is within the validity period of the digital certificate and the one-time use identifier has not been used, the one-time use identifier is marked as used, and a verification success message is prompted on the target terminal.

[0034] As an example, the target terminal is a computer, and a reliable digital certificate generation tool or service is used to generate a unique digital certificate. During the generation process, the validity period of the digital certificate is set, for example, it is set to expire after 24 hours. A one-time identifier, such as a randomly generated serial number or UUID, is embedded in the digital certificate with a limited period to ensure that each certificate can only be used once. This identifier is stored for subsequent verification. The generated digital certificate is written to a USB flash drive using a main program, and the file is set to read-only to prevent modification. The validity period and one-time identifier information of the certificate are released to authorized users through a secure channel, such as sending an email or private message. After the user inserts the USB flash drive, the agent program reads the digital certificate and verifies its validity and one-time use identifier, checks whether the current time is within the validity period of the certificate, and whether the identifier has not been used. Once the digital certificate to be verified is verified and used, the one-time identifier is marked as used, and subsequent access requests are blocked. Security is enhanced by controlling the release of the content and related data of the USB flash drive through the main program, ensuring that only authorized users can access the content of the USB flash drive through the agent program, and protecting data security by controlling access rights. The two work together to ensure the safety and effectiveness of the use of the USB flash drive.

[0035] In one embodiment of the present application, when it is identified that a removable storage device to be verified has a digital certificate to be verified, the digital certificate to be verified is verified, and also includes: if the verification shows that the current time is not within the validity period of the digital certificate, a verification failure message is prompted on the target terminal; if the verification shows that the current time is within the validity period of the digital certificate and the one-time use identifier has been used, a verification failure message is prompted on the target terminal; when it is identified that the removable storage device to be verified is not the target removable storage device, a verification failure message is prompted on the target terminal.

[0036] As an example, after the computer prompts a verification failure message, the USB flash drive to be verified is immediately disabled.

[0037] In one embodiment of the present application, destroying the digital certificate to be verified includes: recording the destruction information of the digital certificate to be verified in the target terminal, the destruction information including the destruction time and the unique identifier; and destroying the digital certificate to be verified by a file destruction tool in a quick overwrite manner according to the destruction information. By recording the destruction information of the digital certificate to be verified, it is ensured that each destruction operation is traceable, thereby enhancing the transparency and traceability of data management. Using the file destruction tool and destroying the digital certificate in a quick overwrite manner can effectively prevent recovery, ensure that sensitive information cannot be recovered by malicious users or attackers, and improve information security.

[0038] As an example, before destruction, ensure that the digital certificate has been verified and confirm that the user has completed the required operations. Record the destruction information of the certificate in the system, including the destruction time, the destruction user ID, and the unique identifier of the certificate. Use professional file destruction tools to completely delete the digital certificate file in the USB flash drive. These tools usually overwrite the file data to ensure that it cannot be recovered. In the system database, update the status of the certificate to "destroyed" and disable the one-time identification associated with it to prevent any subsequent use. Send a destruction notification to the relevant user or system administrator to confirm that the digital certificate has been successfully destroyed and is no longer valid. Perform security audits on USB flash drives regularly to ensure that the destroyed certificate data cannot be recovered and maintain the overall security of the system. By recording the destruction information of the digital certificate to be verified, it is ensured that each destruction operation is traceable, thereby enhancing the transparency and traceability of data management. Using file destruction tools and destroying digital certificates in a quick overwrite manner can effectively prevent recovery, ensure that sensitive information cannot be recovered by malicious users or attackers, and improve information security.

[0039] In one embodiment of the present application, before identifying whether the removable storage device to be inspected has the digital certificate to be inspected, it also includes: performing virus detection on the removable storage device to be inspected, and if no virus is detected, checking whether the file system of the removable storage device to be inspected is complete; if the file system of the removable storage device to be inspected is complete, checking whether there are suspicious files in the removable storage device to be inspected; if there are no suspicious files in the removable storage device to be inspected, encrypting sensitive data of the removable storage device to be inspected; if there are suspicious files in the removable storage device, issuing a risk warning message.

[0040] As an example, before identifying whether the removable storage device to be inspected has the digital certificate to be inspected, use reliable antivirus software, such as Norton, Kaspersky, etc., to perform a comprehensive scan of the USB flash drive to ensure that no viruses or malware exist on the USB flash drive. Use the system's built-in tools, such as Windows' "chkdsk" command, to check whether the file system of the USB flash drive is complete to avoid the risk of data leakage due to file system damage. Enable "View hidden files" in the file explorer to check whether there are unknown or hidden files in the USB flash drive to ensure that there is no suspicious content. Right-click the file in the USB flash drive to view its properties and confirm that there is no unknown "read-only" or "system" logo to prevent tampering or hidden files. Check whether the USB flash drive uses secure password protection or encryption technology to enhance security.

[0041] In one embodiment of the present application, disabling a removable storage device to be checked includes: when the removable storage device to be checked is identified as a target removable storage device, but it is identified that the removable storage device to be checked does not have a digital certificate to be checked, then disabling the removable storage device to be checked; performing virus detection on the removable storage device to be checked, and if a virus is detected, disabling the removable storage device to be checked; performing virus detection on the removable storage device to be checked, and if no virus is detected, but it is detected that the file system of the removable storage device to be checked is incomplete, then disabling the removable storage device to be checked.

[0042] As an example, after the verification fails, the software should mark the status of the USB flash drive as "disabled". The ways to disable the USB flash drive may include the following: disabling in the software interface: in the agent program used to handle verification and management operations related to the USB flash drive, disable the USB flash drive according to the status prompt; disabling in the system device manager, directly find the USB flash drive in the computer's device manager, right-click and select "Disable". It can also be disabled through a script or command line, that is, using a specific command line tool or script to automatically disable the USB flash drive.

[0043] Figure 2 FIG. 1 is a block diagram of a secure access device for a removable storage device according to an exemplary embodiment of the present application. Figure 2As shown, a secure access device 200 for a removable storage device according to an embodiment of the present application includes: a digital certificate identification module 210 and a verification module 220. The digital certificate identification module is used to identify whether the removable storage device to be verified has a digital certificate to be verified; the removable storage device to be verified includes a removable storage device connected to a target terminal; the verification module is used to verify the digital certificate to be verified when it is identified that the removable storage device to be verified has a digital certificate to be verified; and mark the removable storage device to be verified that has successfully been verified as a safe removable storage device, scan the safe removable storage device, and destroy the digital certificate to be verified; if the verification of the digital certificate to be verified fails, the removable storage device to be verified is disabled. Through the verification of digital certificates, the misjudgment and wrongful banning of legitimate hardware is effectively reduced, thereby reducing the inconvenience caused to users by frequent disabling of legitimate devices. This application does not rely on real-time network connection for reporting and processing, and can maintain effective management of access to mobile storage devices under conditions of no network or unstable network, reducing potential risks. Once the digital certificate to be verified is found to be non-compliant, the removable storage device will be disabled immediately. The rapid response reduces the chance of possible virus infection and spread, improves the efficiency of information security management, and avoids frequent reporting of risky hardware, reducing the burden of network communication in the enterprise. After confirming the security of the removable storage device, the digital certificate to be verified will be destroyed to prevent the credentials from being stolen by others, thereby further protecting the data security of the enterprise.

[0044] In one embodiment of the present application, the secure access apparatus for a removable storage device further includes a monitoring module 230 for identifying whether the removable storage device to be verified is a target removable storage device after monitoring an access request of the removable storage device to be verified.

[0045] In one embodiment of the present application, the secure access device of the removable storage device also includes a digital certificate writing module 240, which is used to generate a digital certificate with a validity period through a digital certificate generation tool, recorded as an initial digital certificate; randomly generate a serial number, and embed the serial number into the initial digital certificate to obtain a target digital certificate; write the target digital certificate into the target removable storage device through the main program, and send the certificate information of the target digital certificate to the target terminal, and the certificate information includes the validity period and one-time use identifier of the digital certificate. Setting a validity period for a digital certificate can prevent the use of expired certificates, ensuring that only certificates within the validity period have the right to access and use the removable storage device, thereby further strengthening the security of the system. The introduction of a one-time use identifier ensures that the certificate can only be used once after each connection, greatly reducing the possibility of abuse of the credential and enhancing the security of data transmission.

[0046] As an example, a reliable digital certificate generation tool or service is used to generate a unique digital certificate. During the generation process, the validity period of the digital certificate is set, for example, it is set to expire after 24 hours. A one-time identifier, such as a randomly generated serial number or UUID, is embedded in the digital certificate with a limited period to ensure that each certificate can only be used once. This identifier is stored for subsequent verification. The generated digital certificate is written to a USB flash drive using a main program, and the file is set to read-only to prevent modification. The validity period and one-time identifier information of the certificate are released to authorized users through a secure channel, such as sending an email or private message. After the user inserts the USB flash drive, the agent program reads the digital certificate and verifies its validity and one-time use identifier, checks whether the current time is within the validity period of the certificate, and whether the identifier has not been used. Once the digital certificate to be verified is verified and used, the one-time identifier is marked as used, and subsequent access requests are blocked. By generating an initial digital certificate and embedding a serial number, each target mobile removable storage device can be ensured to have a unique identity, enhancing the authentication and identification capabilities of the device and reducing the risk of forgery or abuse. Setting an expiration date for digital certificates can prevent the use of expired certificates and ensure that only certificates within the validity period are authorized to access and use removable storage devices, thereby further strengthening the security of the system. The introduction of one-time use identification ensures that the certificate can only be used once after each connection, greatly reducing the possibility of credentials being abused and enhancing the security of data transmission.

[0047] In one embodiment of the present application, the verification module is used to read the certificate information of the digital certificate to be verified through an agent program, and verify whether the current time is within the validity period of the digital certificate based on the certificate information of the target digital certificate received by the target terminal, and verify whether the one-time use identifier is used; if the verification shows that the current time is within the validity period of the digital certificate and the one-time use identifier has not been used, the one-time use identifier is marked as used, and a verification success message is prompted on the target terminal.

[0048] As an example, the target terminal is a computer, and a reliable digital certificate generation tool or service is used to generate a unique digital certificate. During the generation process, the validity period of the digital certificate is set, for example, it is set to expire after 24 hours. A one-time identifier, such as a randomly generated serial number or UUID, is embedded in the digital certificate with a limited period to ensure that each certificate can only be used once. This identifier is stored for subsequent verification. The generated digital certificate is written to a USB flash drive using a main program, and the file is set to read-only to prevent modification. The validity period and one-time identifier information of the certificate are released to authorized users through a secure channel, such as sending an email or private message. After the user inserts the USB flash drive, the agent program reads the digital certificate and verifies its validity and one-time use identifier, checks whether the current time is within the validity period of the certificate, and whether the identifier has not been used. Once the digital certificate to be verified is verified and used, the one-time identifier is marked as used, and subsequent access requests are blocked. Security is enhanced by controlling the release of the content and related data of the USB flash drive through the main program, ensuring that only authorized users can access the content of the USB flash drive through the agent program, and protecting data security by controlling access rights. The two work together to ensure the safety and effectiveness of the use of the USB flash drive.

[0049] In one embodiment of the present application, the verification module is used to prompt a verification failure message on the target terminal if it is verified that the current time is not within the validity period of the digital certificate; if it is verified that the current time is within the validity period of the digital certificate and the one-time use identifier has been used, then a verification failure message is prompted on the target terminal; if it is identified that the removable storage device to be verified is not the target removable storage device, then a verification failure message is prompted on the target terminal.

[0050] In one embodiment of the present application, the secure access device of the removable storage device further includes a destruction module 250, which is used to record the destruction information of the digital certificate to be verified in the target terminal, the destruction information including the destruction time and the unique identifier; and to destroy the digital certificate to be verified by means of a quick overwrite according to the destruction information through a file destruction tool. By recording the destruction information of the digital certificate to be verified, it is ensured that each destruction operation is traceable, thereby enhancing the transparency and traceability of data management. Using a file destruction tool and destroying the digital certificate in a quick overwrite manner can effectively prevent recovery, ensure that sensitive information cannot be recovered by malicious users or attackers, and improve information security.

[0051] As an example, before destruction, ensure that the digital certificate has been verified and confirm that the user has completed the required operations. Record the destruction information of the certificate in the system, including the destruction time, the destruction user ID, and the unique identifier of the certificate. Use professional file destruction tools to completely delete the digital certificate file in the USB flash drive. These tools usually overwrite the file data to ensure that it cannot be recovered. In the system database, update the status of the certificate to "destroyed" and disable the one-time identification associated with it to prevent any subsequent use. Send a destruction notification to the relevant user or system administrator to confirm that the digital certificate has been successfully destroyed and is no longer valid. Perform security audits on USB flash drives regularly to ensure that the destroyed certificate data cannot be recovered and maintain the overall security of the system. By recording the destruction information of the digital certificate to be verified, it is ensured that each destruction operation is traceable, thereby enhancing the transparency and traceability of data management. Using file destruction tools and destroying digital certificates in a quick overwrite manner can effectively prevent recovery, ensure that sensitive information cannot be recovered by malicious users or attackers, and improve information security.

[0052] In one embodiment of the present application, the verification module is used to perform virus detection and elimination on the removable storage device to be inspected. If no virus is detected, it is used to check whether the file system of the removable storage device to be inspected is complete; when the file system of the removable storage device to be inspected is complete, it is checked whether there are suspicious files in the removable storage device to be inspected; if there are no suspicious files in the removable storage device to be inspected, sensitive data of the removable storage device to be inspected is encrypted; if there are suspicious files in the removable storage device, a risk warning message is issued.

[0053] As an example, before identifying whether the removable storage device to be inspected has the digital certificate to be inspected, use reliable antivirus software, such as Norton, Kaspersky, etc., to perform a comprehensive scan of the USB flash drive to ensure that no viruses or malware exist on the USB flash drive. Use the system's built-in tools, such as Windows' "chkdsk" command, to check whether the file system of the USB flash drive is complete to avoid the risk of data leakage due to file system damage. Enable "View hidden files" in the file explorer to check whether there are unknown or hidden files in the USB flash drive to ensure that there is no suspicious content. Right-click the file in the USB flash drive to view its properties and confirm that there is no unknown "read-only" or "system" logo to prevent tampering or hidden files. Check whether the USB flash drive uses secure password protection or encryption technology to enhance security.

[0054] In one embodiment of the present application, the inspection module is used to, when it is identified that the removable storage device to be inspected is a target removable storage device, but it is identified that the removable storage device to be inspected does not have a digital certificate to be inspected, then disable the removable storage device to be inspected; perform virus inspection on the removable storage device to be inspected, and if a virus is detected, disable the removable storage device to be inspected; perform virus inspection on the removable storage device to be inspected, and if no virus is detected, but it is detected that the file system of the removable storage device to be inspected is incomplete, then disable the removable storage device to be inspected.

[0055] As an example, after the verification fails, the software should mark the status of the USB flash drive as "disabled". The ways to disable the USB flash drive may include the following: disabling in the software interface: in the agent program used to handle verification and management operations related to the USB flash drive, disable the USB flash drive according to the status prompt; disabling in the system device manager, directly find the USB flash drive in the computer's device manager, right-click and select "Disable". It can also be disabled through a script or command line, that is, using a specific command line tool or script to automatically disable the USB flash drive.

[0056] It should be noted that the device provided in the above embodiment and the method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs the operation has been described in detail in the method embodiment, and will not be repeated here. In practical applications, the device provided in the above embodiment can distribute the above functions to different functional modules as needed, that is, divide the internal structure of the device into different functional modules to complete all or part of the functions described above, and this is not limited here.

[0057] See also Figure 3 , Figure 3 is a structural diagram of an electronic device shown in an exemplary embodiment of the present application. It should be noted that: Figure 3 The electronic device 300 shown is only an example and should not bring any limitation to the functions and usage area of ​​the embodiments of the present application.

[0058] like Figure 3 As shown, the electronic device 300 includes a processor 301, a memory 302 and a communication bus 303; the communication bus 303 is used to connect the processor 301 and the memory 302; the processor 301 is used to execute the computer program stored in the memory 302 to implement one or more methods in the above embodiments.

[0059] The electronic device provided in the present application includes a processor, a memory, a transceiver and a communication interface. The memory and the communication interface are connected to the processor and the transceiver and complete communication with each other. The memory is used to store computer programs, the communication interface is used to communicate, and the processor and the transceiver are used to run the computer program so that the electronic device executes each step of the above method.

[0060] In this embodiment, the memory may include a random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0061] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0062] The above embodiments are merely illustrative of the principles and effects of the present application, and are not intended to limit the present application. Anyone familiar with the technology may modify or change the above embodiments without violating the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by a person of ordinary skill in the art without departing from the spirit and technical ideas disclosed in the present application shall still be covered by the claims of the present application.

Claims

1. A secure access method for a removable storage device, characterized in that: The method comprises: Identify whether the removable storage device to be verified has a digital certificate to be verified; the removable storage device to be verified includes a removable storage device connected to the target terminal; When it is identified that the removable storage device to be verified has a digital certificate to be verified, verifying the digital certificate to be verified; If the verification of the digital certificate to be verified is successful, the removable storage device to be verified that has been successfully verified will be marked as a safe removable storage device, and the safe removable storage device will be scanned, and the digital certificate to be verified will be destroyed; if the verification of the digital certificate to be verified fails, the removable storage device to be verified will be disabled.

2. The secure access method for a removable storage device according to claim 1, characterized in that: Before monitoring the access request of the removable storage device, the method further comprises: Generate a digital certificate with a validity period through a digital certificate generation tool, which is recorded as the initial digital certificate; Randomly generate a serial number, and embed the serial number into the initial digital certificate to obtain a target digital certificate; The target digital certificate is written into the target removable storage device through the main program, and the certificate information of the target digital certificate is sent to the target terminal, wherein the certificate information includes the validity period and one-time use mark of the digital certificate.

3. The secure access method for a removable storage device according to claim 2, characterized in that: When it is identified that the removable storage device to be verified has a digital certificate to be verified, the digital certificate to be verified is verified, including: Reading the certificate information of the digital certificate to be verified through the agent program, verifying whether the current time is within the validity period of the digital certificate based on the certificate information of the target digital certificate received by the target terminal, and verifying whether the one-time use identifier is used; If it is verified that the current time is within the validity period of the digital certificate and the one-time use identifier has not been used, the one-time use identifier is marked as used, and a verification success message is prompted on the target terminal.

4. The secure access method for a removable storage device according to claim 2, characterized in that: When it is identified that the removable storage device to be verified has a digital certificate to be verified, the digital certificate to be verified is verified, further comprising: If the current time is not within the validity period of the digital certificate, the target terminal is prompted with a verification failure message; If it is verified that the current time is within the validity period of the digital certificate and the one-time use identifier has been used, a verification failure message is displayed on the target terminal; When it is identified that the removable storage device to be verified is not the target removable storage device, a verification failure message is prompted on the target terminal.

5. The secure access method for a removable storage device according to claim 1, characterized in that: Destroying the digital certificate to be verified includes: Recording destruction information of the digital certificate to be verified in the target terminal, the destruction information including a destruction time and a unique identifier; The digital certificate to be verified is destroyed by a file destruction tool in accordance with the destruction information by means of a rapid overwriting method.

6. The secure access method for a removable storage device according to claim 1, characterized in that: Before identifying whether the removable storage device to be checked has the digital certificate to be checked, the method further includes: Perform virus detection on the removable storage device to be checked, and if no virus is detected, check whether the file system of the removable storage device to be checked is complete; In the case that the file system of the removable storage device to be checked is complete, checking whether there is a suspicious file in the removable storage device to be checked; If there is no suspicious file in the removable storage device to be checked, the sensitive data of the removable storage device to be checked is encrypted; if there is a suspicious file in the removable storage device, a risk warning message is issued.

7. The secure access method for a removable storage device according to claim 1 or 6, characterized in that: Disable removable storage devices to be checked, including: When it is identified that the removable storage device to be verified is a target removable storage device, but it is identified that the removable storage device to be verified does not have a digital certificate to be verified, then the removable storage device to be verified is disabled; Perform virus detection on the removable storage device to be checked, and if a virus is detected, disable the removable storage device to be checked; The removable storage device to be checked is checked for viruses. If no virus is detected but it is detected that the file system of the removable storage device to be checked is incomplete, the removable storage device to be checked is disabled.

8. A secure access device for a removable storage device, characterized in that: The secure access device of the removable storage device comprises: A digital certificate identification module, used to identify whether the removable storage device to be verified has a digital certificate to be verified; the removable storage device to be verified includes a removable storage device connected to the target terminal; The verification module is used to verify the digital certificate to be verified when it is identified that the removable storage device to be verified has the digital certificate to be verified; and mark the removable storage device to be verified that has successfully been verified as a safe removable storage device, scan the safe removable storage device, and destroy the digital certificate to be verified; if the verification of the digital certificate to be verified fails, the removable storage device to be verified is disabled.

9. An electronic device, characterized in that: The electronic device comprises: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the electronic device to implement the secure access method for a removable storage device as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and the computer program is used to enable a computer to execute the secure access method for a removable storage device as claimed in any one of claims 1 to 7.

Images