USB access safety control system

Abstract

The invention discloses a USB access safety control system, and particularly relates to the field of USB access electric digital data processing, which comprises an identification module, an isolation module, an encryption continuous transmission module, an auditing module and a kernel interrupt signal triggered by USB physical insertion, and the identification module is used for receiving the kernel interrupt signal and writing the kernel interrupt signal into the interrupt event buffer area, generating a to-be-analyzed interrupt data group, analyzing and generating identification notification information and pushing the identification notification information as a USB access snapshot data frame. Strong binding of USB device access identities, interval control of permission states and traceable closed management of behavior tracks are achieved by constructing a security context vector with device fingerprints, authorization group IDs and insertion timestamps as cores and forming a dynamic association verification path among isolation state judgment, behavior integrity measurement and chain audit account books. The key problems of equipment loopback cheating, permission mismatching, audit failure and the like are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of USB access electrical digital data processing, and more particularly to a USB access safety control system. Background Art

[0002] In today's terminal environment, where multiple users operate concurrently and sensitive permission groups coexist, the mainstream method for operating systems to achieve instant identification of USB devices through kernel message push combined with pipeline communication mechanisms has become popular. Especially in scenarios where zero-delay identification and security control of USB flash drives are required, capturing kernel-level plug-in and unplug events and isolating permissions are particularly critical. However, in actual applications, some malicious USB devices with renaming and interface reuse capabilities exploit the kernel's recognition logic's prioritization of the first insertion event and its lax fault tolerance for subsequent state changes. They can then forge new device access by actively canceling the initialization handshake and immediately re-triggering the physical layer insertion interrupt. The operating system incorrectly allocates a new logical endpoint and permission mapping to the same physical device before completing the resource release and permission unbinding of the previous session, forming a hidden "loopback" link. In this case, multiple logical instances in the link share the same hardware device, making it impossible to identify the true physical ownership in subsequent system-level permission determination and audit tracing. This can easily cause devices to bypass dual or interval security modes and directly access sensitive data channels. This also circumvents port-triggered permission binding policies, ultimately undermining the centralized permission grouping control system and creating a window for permission violations and reverse engineering analysis. Therefore, the current system architecture lacks a strong binding mechanism and multiple context consistency verification methods when dealing with device loopback deception, which is a key technical shortcoming that makes USB access security control ineffective. Summary of the Invention

[0003] To overcome the above-mentioned shortcomings of the prior art, an embodiment of the present invention provides a USB access security control system. By constructing a security context vector centered around a device fingerprint, an authorization group ID, and an insertion timestamp, and forming a dynamic association verification path between isolation status determination, behavior integrity measurement, and a chained audit ledger, the system achieves strong binding of USB device access identities, interval control of permission status, and traceable and closed management of behavior trajectories, thereby addressing key issues such as device loop deception, permission mismatch, and audit failure raised in the above-mentioned background technology.

[0004] To achieve the above object, the present invention provides the following technical solutions: a USB access security control system, comprising an identification module, an isolation module, an encryption and retransmission module, an audit module, and a kernel interrupt signal triggered by physical insertion of a USB; The identification module is used to receive kernel interrupt signals and write them into the interrupt event buffer, generate an interrupt data group to be parsed, parse and generate identification notification information and push it as a USB access snapshot data frame, extract the structured feature fields in the USB access snapshot data frame to generate a device fingerprint, and query the permission binding relationship table based on this to construct a security context vector; The isolation module is used to read the security context vector and determine the isolation status identifier based on the current device fingerprint. It generates the endpoint access permission structure based on the isolation status identifier and the authorization group information, performs instruction replay and behavior integrity verification, adjusts the isolation status identifier, and generates an isolation mode switching record frame. The encrypted resuming module is used to perform window segmentation and index generation on the file blocks to be uploaded, SM4 encrypt the segmented content and write it into the task queue, and complete the ciphertext upload and verification retransmission through the breakpoint resuming mechanism; The audit module is used to generate operational behavior entries and perform permission consistency comparison, record the adjudication results in the audit ledger, generate and issue permission adjustment instructions, and output the operation and maintenance audit interface for behavior tracing and permission management.

[0005] In a preferred embodiment, the identification module captures the kernel interrupt signal triggered by the physical insertion of the USB, writes the kernel interrupt signal as an input event into the interrupt event buffer, and forms an interrupt data group to be parsed that is relied upon for subsequent identification; Deliver the interrupt data group to be parsed to the interrupt event hook function process, parse out the identification notification information including the device port address and event timestamp; use the kernel-user space event reflection channel to push the identification notification information to the user side and cache it as a USB access snapshot data frame; In the snapshot parsing stage, the device descriptor information and the initial handshake response content in the USB access snapshot data frame are extracted and reorganized into a structured feature field set. The device fingerprint hash value is then calculated using the structured feature field set as input. The device fingerprint hash value is used as an index to query the permission binding relationship table and, combined with the current timestamp, write the status tag processing flow of the USB device access session to generate a security context vector for permission identification and isolation control; the security context vector includes the device fingerprint, authorization group ID, and insertion timestamp.

[0006] In a preferred embodiment, the isolation module is used to read the authorization group ID and insertion timestamp contained in the security context vector, combine and match them with the currently identified device fingerprint, input them into the security status determination process, and parse the isolation status identifier corresponding to the current USB device based on the preset time isolation conditions and group mapping rules; the isolation status identifier is a binary value, namely normal mode and interval mode, where normal mode indicates direct authorization channel access and interval mode indicates access to a restricted access channel; Based on the authorization group ID and USB access port number corresponding to the isolation status identifier, the two are combined to form the identification and positioning parameters of the current device, and mapped to generate an endpoint access permission structure. The endpoint access permission structure is used to limit the scope of operation permissions of the USB device during the current access cycle; After starting the behavior command analysis process, the response command stream of the USB device is captured and command replay and reverse entropy verification are performed to output the behavior integrity measurement value; If the difference between the behavior integrity measurement value and the preset device behavior baseline template set exceeds the preset threshold, the original isolation status identifier is updated to the status value of the corresponding interval mode, and the endpoint access permission structure corresponding to the current USB device is regenerated based on the status value of the interval mode; then the updated isolation status identifier and the preset threshold corresponding to the integrity measurement value are written into the USB device status exchange table, and an isolation mode switching record frame is generated for subsequent audit process calls.

[0007] In a preferred embodiment, the encrypted retransmission module uses window fragmentation processing logic to cut the file blocks to be uploaded in the USB device into an indexed transmission fragment set according to a fixed window length; the indexed transmission fragment set includes a sequence index and an integrity check digest; the indexed transmission fragment set is processed by the SM4 encryption engine in the national secret algorithm processing flow, and symmetric encryption is performed on each indexed transmission fragment and a ciphertext fragment set is output; By means of the breakpoint resume scheduling process, the ciphertext fragment set is written into the sending task queue and the resume index linked list is recorded. Then, the ciphertext fragments in the sending task queue are uploaded through the network protocol stack, and the fragment reception confirmation signaling returned by the platform is received. The fragment reception confirmation signaling is compared with the local verification summary. If the verification is consistent, the record is successful. Otherwise, the index is rolled back and the corresponding ciphertext fragment is rescheduled to achieve resume transmission.

[0008] In a preferred embodiment, the audit module is used to aggregate the verification results of the isolation mode switching record frame and the uploaded ciphertext fragment, and generate an operation behavior entry set through an event merging process. The operation behavior entry set includes an operation ID, a policy decision, and a device fingerprint; Based on the permission judgment basis formed by the combination of the authorization group ID and the isolation status identifier, the authorization group associated with the operation ID in the operation behavior entry set is checked for correspondence with the permission judgment basis, permission consistency comparison is performed, and a behavior judgment result sequence is output. The behavior judgment result sequence, together with the corresponding device fingerprint and insertion timestamp, is recorded in the permission audit ledger chain through chain writing; After parsing the latest adjudication node in the ledger chain, the adjudication result, device fingerprint, and isolation status identifier are extracted, and the extracted adjudication result, device fingerprint, and isolation status identifier are combined as input to generate a centralized permission adjustment instruction frame. The permission adjustment instruction frame is written into the endpoint access scope configuration corresponding to the current USB device to update its real-time access rights in the current isolation state; The behavior judgment results, device fingerprints and insertion timestamps recorded in the ledger chain are input into the audit rendering process to generate an operation and maintenance audit interface containing historical operation records and permission change tracing for subsequent behavior tracing and permission management operations.

[0009] In a preferred embodiment, the isolation module reads the insertion timestamp of the security context vector With the authorization group ID, real-time monitoring of device response flow , calculate the time suppression function in turn , group activation function , weighted entropy product and integrity response function , after symbol determination, the isolation status mark is obtained And generate endpoint access permissions accordingly; ; ; ; ; ; ; in Current timestamp; insert timestamp Indicates the timestamp of when the USB device is inserted; Indicates the cumulative access time since insertion; is the Gaussian suppression coefficient; is the lower bound of the isolation time window; is the upper bound of the isolation time window; is the time suppression function; is the authorization group ID; represents the exponential function; represents a cryptographic hash function; group activation function The value is 1 or 0 according to the parity of the hash result; Indicates that the authorization group ID is hashed three times and then modulo 2, and the result is 0 or 1; the device response flow Indicates time Collected USB device response command stream; time To indicate a historical moment; is the instantaneous response entropy density, which corresponds to time The information entropy strength of the instruction stream; is the length of the entropy observation sliding window; is the exponential decay constant; the weighted entropy product Express The entropy density of the interval is exponentially rolled up; is the integrity response factor; is the preset integrity threshold; is the hyperbolic tangent function; integrity response function The output value range is ; Determine the bias term for isolation; is a sign function, the input of the sign function is positive output , input non-positive output ; Isolation status mark, Isolation status mark is Indicates normal mode, the isolation status is marked as Indicates interval mode.

[0010] In a preferred embodiment, the encrypted retransmission module is used to by Cut into ,structure , execute SM4 encryption to get , compare the summary returned by the platform and recursively Decide to retransmit or move forward; ; ; ; ; ; in Represents the complete original file byte stream to be uploaded; Indicates the window length; Indicates the fragment sequence index of the current fragment; Indicates the Window slice content; Indicates the An indexed sharding structure, which is used to encrypt input, consists of four parts connected in series: 、 、 and ; in Represents the SHA-256 hash digest of the current shard content; Indicates that the previous summary is hashed again with SHA3; the symbol Represents data connection operation; Represents the SM4 encryption function, where is a symmetric key; Indicates the encrypted fragment ciphertext; Indicates the The digest value of the encrypted fragment ciphertext; Indicates the first The confirmation summary value of each shard; Indicates the The result value of whether a fragment is successfully uploaded. For the indicator: If ,but ,otherwise ; in represents the indicator function, only when The value is 1 when the condition is met, otherwise it is 0; Indicates the shard index cursor in the current upload process; Indicates the next processing shard index in the upload scheduling process. The value of the previous index Corresponding upload results Decision; if upload is successful , then move forward; if you fail , then retransmit the current fragment; Indicates the indexed transmission round number of the current ciphertext fragment during the resumable transmission scheduling process.

[0011] In a preferred embodiment, the audit module further includes encoding the verification result of the isolation mode switching record frame and the uploaded ciphertext fragment into an event raw vector , and establish an adjacency set in the time directed graph ;right Perform multi-head time series graph attention mechanism calculation and embedding generation , while solving the contrastive learning loss To obtain a robust representation of the decision; Bundle As a reinforcement learning environment state Enter the Q-network, based on the immediate reward Update action and value functions , output decision action And generate the corresponding ruling mark according to the preset threshold ; Will The hash value is inserted into the verification accumulator , and generate a zero-knowledge proof object ; At the same time, write the same hash cascade into the chain ledger root ; Utilizing Mapping Generate centralized authority adjustment instruction frame , refresh real-time endpoint access scope The chained ledger root and the verification accumulator jointly drive the rendering of the operation and maintenance audit interface; Embedding the attention mechanism for multi-head time series graph: ; Introducing self-supervised contrast loss: ; For Q-learning value iteration and policy distribution: ; ; ; Introducing a validating accumulator and a chained ledger root as dual writes: ; ; ; Adjust the mapping for permissions: ; in For the event raw vector, For the event raw vector, For the event raw vector, 、 and The dimension is , 、 and Obtained by mapping the operation ID, policy decision, and device fingerprint through the embedded dictionary; adjacency set Represents a directed time graph with events There is a set of adjacent vertices with causal edges; is the number of multi-head attention heads; Indicates the Attention Head Projection matrix; Indicates the Attention Head Parameterized attention weight vector in dimensional embedding space; Representing an event and events time interval; Representing an event and events time interval; Transpose; event Indicates the target event node currently being modeled; event Representation and Events There are historical event nodes that are causally connected; Indicates in In the attention head, for the event of via Mapping to attention subspace; events Represents adjacent event nodes; Represents the concatenation operation of the output results of multi-head attention in the attention head dimension; in Representing an event The embedding vector after multi-head temporal attention aggregation, Representing an event The embedding vector after multi-head temporal attention aggregation, Representing an event The embedding vector after multi-head temporal attention aggregation, 、 and The dimension is ; is the vector cosine similarity function; Represents the positive sample index in contrastive learning; Indicates comparison between batch and event A collection of sample indexes that appear simultaneously; events and events All belong to ; To compare and learn temperature parameters; in is the state of the reinforcement learning environment, where The value of ; is the decision action, and the discrete value set of the decision action is , Indicates that the current operation behavior is determined to be authorized. Indicates that the current operation behavior is judged to be rejected; For immediate rewards, If the action is consistent with the system authority and there is no violation, it is a positive reward, otherwise it is a negative reward; Represents the learning rate of Q-learning, and its value range is expressed as: ; is the discount factor, and its value range is expressed as: ; Indicates time The action-value function under Used to output action value; Indicates that the policy network is Top pair probability; is the candidate decision action currently participating in the softmax operation, To determine the action space; is the exponential normalization function; Indicates time When Take the following The corresponding action-value function; Indicates , another candidate action besides the currently selected action; in A sign of adjudication; Indicates The probability value of taking the action Allow; For the The device fingerprint hash value corresponding to the record; For the System timestamp of the record; Cryptographic hash functions; Update operator for multi-set verification accumulator; verification accumulator Indicates the accumulator status in The value after the strip is written; A private witness for the accumulator's zero-knowledge proof; It is the object of zero-knowledge proof; Indicates the cryptographic operation mechanism used to verify the correctness of the chain ledger or data; the chain ledger root Indicates that the chain ledger is writing The root hash state obtained after the data is updated; For the genesis hash; in Indicates The isolation status flag corresponding to the moment, where +1 indicates normal mode and -1 indicates interval mode; Adjust the mapping function for permissions; Indicates The set of endpoint access permissions that will take effect later.

[0012] Technical effects and advantages of the present invention: 1. This invention constructs a security context vector based on the device fingerprint, authorization group ID, and insertion timestamp, and combines it with the isolation status determination process to achieve continuous identification and permission consistency verification for loopback inserted devices. This solves the problem of the operating system incorrectly assigning new permissions in the unbound state and blocks the logical vulnerability of bypassing permission control. 2. By introducing a hash index and kernel event snapshot linkage mechanism during the USB access identification process, permission groups can be bound and isolation status determined in a short period of time. This ensures permission stability and response timeliness in scenarios where multiple users access the system concurrently, and prevents permission confusion caused by overlapping logical endpoints. 3. Using indexed window sharding and national secret SM4 encryption combined with a breakpoint resume scheduling list, the USB file upload process is encrypted and protected with continuity verification, improving security consistency and anti-attack capabilities during disconnection and retransmission. 4. By building an audit ledger chain and a causal mapping mechanism for behavior adjudication, a closed-loop control from permission judgment to centralized adjustment is achieved, enabling dynamic linkage between device behavior changes and access rights, and enhancing the accuracy of the system's response to policy triggers and behavior variations. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 Schematic diagram of the system module of the present invention. DETAILED DESCRIPTION

[0014] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0015] Refer to the instruction manual Figure 1 , a USB access security control system according to an embodiment of the present invention includes an identification module, an isolation module, an encryption and retransmission module, an audit module, and a kernel interrupt signal triggered by physical insertion of a USB; The identification module is used to receive kernel interrupt signals and write them into the interrupt event buffer, generate an interrupt data group to be parsed, parse and generate identification notification information and push it as a USB access snapshot data frame, extract the structured feature fields in the USB access snapshot data frame to generate a device fingerprint, and query the permission binding relationship table based on this to construct a security context vector; The isolation module is used to read the security context vector and determine the isolation status identifier based on the current device fingerprint. It generates the endpoint access permission structure based on the isolation status identifier and the authorization group information, performs instruction replay and behavior integrity verification, adjusts the isolation status identifier, and generates an isolation mode switching record frame. The encrypted resuming module is used to perform window segmentation and index generation on the file blocks to be uploaded, SM4 encrypt the segmented content and write it into the task queue, and complete the ciphertext upload and verification retransmission through the breakpoint resuming mechanism; The audit module is used to generate operational behavior entries and perform permission consistency comparison, record the adjudication results in the audit ledger, generate and issue permission adjustment instructions, and output the operation and maintenance audit interface for behavior tracing and permission management.

[0016] The identification module captures the kernel interrupt signal triggered by the physical insertion of the USB, writes the kernel interrupt signal as an input event into the interrupt event buffer, and forms an interrupt data group to be parsed for subsequent identification. Deliver the interrupt data group to be parsed to the interrupt event hook function process, parse out the identification notification information including the device port address and event timestamp; use the kernel-user space event reflection channel to push the identification notification information to the user side and cache it as a USB access snapshot data frame; During the snapshot parsing phase, the device descriptor information and initial handshake response content in the USB access snapshot data frame are extracted and reorganized into a structured feature field set. The structured feature field set is then used as input to calculate the device fingerprint hash value. The device fingerprint hash value is used as an index to query the permission binding relationship table and, combined with the current timestamp, write the status tag processing flow of the USB device access session to generate a security context vector for permission identification and isolation control. The security context vector includes the device fingerprint, authorization group ID, and insertion timestamp. It should be noted that the kernel interrupt signal refers to a hardware-level interrupt event triggered by the physical insertion of a USB device and perceived by the operating system kernel. This interrupt event is written into the interrupt event buffer as the input signal of the identification module, and is used to subsequently construct the interrupt data group to be parsed to start the device identification process. In addition, after receiving the kernel interrupt signal triggered by the USB insertion behavior, the identification module writes the interrupt signal into the interrupt event buffer as a standardized input event format, that is, encapsulating the original interrupt signal with meta-information such as timing and port source. The written events are then organized into a data set with structural characteristics, namely the "interrupt data group to be parsed", which serves as the starting input source for subsequent identification processes (such as hook function parsing, device fingerprint extraction, etc.) and is used to drive the execution starting point of the device identification chain. In addition, during the snapshot parsing phase, the device descriptor information extracted by the identification module from the USB access snapshot data frame refers to the basic identity parameters (such as manufacturer ID, product ID, device category, etc.) automatically reported by the USB device through the standard protocol during the enumeration process. The initial handshake response content is the first set of response signal sequences returned by the device after the host sends an enumeration request to the device, which is used to reflect the device connection status and negotiation characteristics. After the device is inserted, these two pieces of information are automatically collected and cached by the operating system kernel through the USB protocol stack at the beginning of the connection establishment. Therefore, they are pushed into the snapshot data frame along with the interrupt event. During parsing, these two parts of content need to be subjected to structure field extraction and sequence reorganization respectively, and then combined to form a structured feature field set as the input for subsequent device fingerprint calculation. In the process of extracting and reorganizing the structured feature field set, the four fields of manufacturer ID, product ID, device version number and device category code in the device descriptor information are connected to the field set structure as the first segment content, and the three fields of response code, response delay and response length in the initial handshake response content are appended to the end of the field set as the tail segment content, forming a splicing structure with a fixed order; in the process of calculating the device fingerprint hash value, each field in the field set is first filled with zeros according to the eight-byte boundary, and then the filled field set is rearranged according to the preset mapping relationship. Finally, the rearranged field sequence is input into the national secret summary generation process, and a fixed-length summary string is generated as the device fingerprint hash value by executing the group compression, XOR mixing and cyclic permutation calculation steps; During the permission binding query and status mark writing process, the generated device fingerprint hash value is first sent as the unique index key to the retrieval logic of the permission binding relationship table, the device fingerprint field is matched row by row, the corresponding record is located, and the preset authorization group ID is read; then the device fingerprint hash value, the retrieved authorization group ID and the current system timestamp are written into the status mark processing flow of the USB device access session according to the fixed field sequence of "fingerprint-authorization group-timestamp": within this process, the identification module creates or updates the session record area with the port number and session number as the key, writes the three fields into the corresponding field slots, and allocates a thread safety lock to the record area to ensure concurrent consistency; after the writing is completed, the process calls the vector construction subroutine to combine the three fields into a security context vector with fixed length and immutable order according to the preset byte alignment rules. The fields of the security context vector are arranged in the following order: device fingerprint, authorization group ID, and insertion timestamp, which are used for subsequent permission identification and isolation status control.

[0017] The isolation module is used to read the authorization group ID and insertion timestamp contained in the security context vector, combine and match them with the currently identified device fingerprint, input them into the security status determination process, and parse the isolation status identifier corresponding to the current USB device based on the preset time isolation conditions and group mapping rules; the isolation status identifier is a binary value, namely normal mode and interval mode. Normal mode indicates direct authorization channel access, and interval mode indicates access to a restricted access channel. Based on the authorization group ID and USB access port number corresponding to the isolation status identifier, the two are combined to form the identification and positioning parameters of the current device, and mapped to generate an endpoint access permission structure. The endpoint access permission structure is used to limit the scope of operation permissions of the USB device during the current access cycle; After starting the behavior command analysis process, the response command stream of the USB device is captured and command replay and reverse entropy verification are performed to output the behavior integrity measurement value; If the difference between the behavior integrity measurement value and the preset device behavior baseline template set exceeds the preset threshold, the original isolation status identifier is updated to the status value of the corresponding interval mode, and the endpoint access permission structure corresponding to the current USB device is regenerated based on the status value of the interval mode; then the updated isolation status identifier and the preset threshold corresponding to the integrity measurement value are written into the USB device status exchange table, and an isolation mode switching record frame is generated for subsequent audit process calls.

[0018] The encrypted transfer resuming module uses window fragmentation processing logic to cut the file blocks to be uploaded in the USB device into an indexed transfer fragment set according to a fixed window length. The indexed transfer fragment set includes a sequence index and an integrity check summary. The indexed transfer fragment set is processed by the SM4 encryption engine in the national secret algorithm process, which performs symmetric encryption on each indexed transfer fragment and outputs a ciphertext fragment set. By means of the breakpoint resume scheduling process, the ciphertext fragment set is written into the sending task queue and the resume index linked list is recorded. Then, the ciphertext fragments in the sending task queue are uploaded through the network protocol stack, and the fragment reception confirmation signaling returned by the platform is received. The fragment reception confirmation signaling is compared with the local verification summary. If the verification is consistent, the record is successful. Otherwise, the index is rolled back and the corresponding ciphertext fragment is rescheduled to achieve resume transmission.

[0019] The audit module aggregates the verification results of isolation mode switching record frames and uploaded ciphertext fragments, and generates an operation behavior entry set through the event merging process. The operation behavior entry set includes the operation ID, policy decision, and device fingerprint. Based on the permission judgment basis formed by the combination of the authorization group ID and the isolation status identifier, the authorization group associated with the operation ID in the operation behavior entry set is checked for correspondence with the permission judgment basis, permission consistency comparison is performed, and a behavior judgment result sequence is output. The behavior judgment result sequence, together with the corresponding device fingerprint and insertion timestamp, is recorded in the permission audit ledger chain through chain writing; After parsing the latest adjudication node in the ledger chain, the adjudication result, device fingerprint, and isolation status identifier are extracted, and the extracted adjudication result, device fingerprint, and isolation status identifier are combined as input to generate a centralized permission adjustment instruction frame. The permission adjustment instruction frame is written into the endpoint access scope configuration corresponding to the current USB device to update its real-time access rights in the current isolation state; The behavior judgment results, device fingerprints and insertion timestamps recorded in the ledger chain are input into the audit rendering process to generate an operation and maintenance audit interface containing historical operation records and permission change tracing for subsequent behavior tracing and permission management operations.

[0020] It should be noted that in the formula structure involved in this solution, dimensionless terms can serve as proportionality or structural adjustment factors. When combined with quantities with units, they only play a numerical scaling role and do not introduce new physical dimensions. Therefore, they will not change or confuse the overall unit system of expression. This combination of "dimensionless terms and units" can be understood as a composite structural expression commonly used in mathematical and physical modeling, conforming to the principle of dimensional consistency and having a clear physical interpretation basis. Secondly, in the formula structure of this scheme, if multiple variables with different physical units are involved, including but not limited to time, mass or energy variables, their joint appearance is to express the collaborative modeling relationship of multiple physical mechanisms. Each variable can be formed into a unified structure through function mapping, ratio combination or normalization adjustment. The units and meanings are clear, and the overall expression conforms to the principle of dimensional consistency and the common formula of engineering modeling. Any constants, weights, adjustment factors, threshold parameters, and proportional coefficients involved in this solution are all adjustable control parameters for different application environments. Their values depend on the target device configuration, data input characteristics, and performance optimization goals. During the implementation phase, they are set within a reasonable range through model verification, performance constraints, or engineering calibration. Although these parameters do not have preset unique values, they have clear adjustment logic and calculation paths and are part of the deterministic setting process in engineering implementation. The purpose of such setting is to ensure that the solution is both universally adaptable, reproducible, and operable, without affecting its technical clarity and feasibility. The isolation module inserts the timestamp when reading the security context vector With the authorization group ID, real-time monitoring of device response flow , calculate the time suppression function in turn , group activation function , weighted entropy product and integrity response function , after symbol determination, the isolation status mark is obtained And generate endpoint access permissions accordingly; ; ; ; ; ; ; in Current timestamp, in seconds; insert timestamp Indicates the timestamp of when the USB device is inserted, in seconds. Written with the security context vector; Indicates the cumulative access time since insertion, in seconds; is the Gaussian suppression coefficient, dimension In the above formula, the Gaussian suppression coefficient is used to control the attenuation steepness of the time suppression function; in addition, in this scheme, The value of can also be estimated by the peak degree of each isolation period distribution in the device access history instead of a fixed constant. Specifically, the steepness index of the distribution is constructed based on the minimum time interval and change gradient of the isolation time difference series set recorded in the current system. When the isolation period is highly concentrated and the time interval distribution is steep, the system can give a larger value to enhance the ability to punish atypical access opportunities. On the contrary, when access behaviors are more dispersed and periodic changes are frequent, the system can Dynamically adjust to a smaller value to improve the model's tolerance to timing disturbances. It can be a temporal distribution steepness adjustment factor generated based on the feedback of the aggregation strength of system behavior, reflecting the consistency of the overall access rhythm; The lower bound of the isolation time window, in seconds, is lower than Considered as premature access; The upper limit of the isolation time window, in seconds, is higher than Considered as access timeout; In addition, It is the slope coefficient used to control the steepness of the sigmoid function in logistic regression, indicating that when near or When , the function output changes more rapidly, achieving highly sensitive suppression judgment of the time boundary. The reason for taking 10 in practical applications is that it can approximately make the sigmoid function quickly approach 1 from 0 when the input approaches the boundary value, ensuring that the isolation judgment has a sufficiently steep response sensitivity near the threshold. is the time suppression function, which represents the combined suppression of Gaussian weight and Sigmoid on the access duration. The value range of the time suppression function is ; The authorization group ID is an integer index used for group mapping. represents the exponential function; Represents the cryptographic hash function, in the above formula Used for Do cubic hashing; group activation function The value is 1 or 0 according to the parity of the hash result; The authorization group ID is hashed three times and then modulo 2, and the result is 0 or 1. Used to construct a pseudo-random binary switching factor to determine whether to trigger a specific isolation strategy path; device response flow Indicates time The collected USB device response instruction stream, The bit sequence function corresponding to the device response instruction stream; time To indicate a historical moment; is the instantaneous response entropy density, which corresponds to time The information entropy intensity of the instruction stream, unit ; is the length of the entropy observation sliding window, in seconds; The exponential decay constant, measured in seconds, is used to control the weight of recent responses. The actual value should be set based on the temporal density of the device's command response flow and the probability of behavioral mutation. Its essence is to perform nonlinear compression on event weight distribution within a limited time window, giving behaviors closer to the current time point a higher weight. For specific selection, the time distribution intervals of dense and sparse command response flows over multiple access cycles should be statistically analyzed. The inverse of the shortest stable response cycle within this interval is taken as a benchmark. The delay tolerance threshold is then quantitatively modified based on the policy response chain, ultimately forming a decay factor value strategy that adapts to the current isolation policy. The value of the exponential decay constant should satisfy the following two constraints: first, the contribution value of the most distant behavioral event naturally approaches zero within the current policy activation cycle, but does not completely disappear, maintaining a weak perception of distant sudden events. Second, at the half-decay time point of the exponential function (i.e., after this point, the contribution value drops to half of the initial value), the behavior period covered by the constant does not exceed the lower bound of the policy judgment tolerance interval, thereby ensuring that policy adjustments are highly responsive and behaviorally sensitive. Express The entropy density of the interval is exponentially accumulated, in bits; is the integrity response factor, unit In practical applications, the integrity response coefficient is used to amplify the threshold difference To address the impact of device isolation, the integrity response coefficient should be dynamically calibrated based on the historical difference distribution between the entropy product of device instructions and the integrity threshold. First, the maximum amplitude and average deviation range of the difference between the entropy product and the threshold in multiple rounds of isolation determination are statistically analyzed. The inverse logarithm of the value that can quickly push the response function output to the saturation value within this amplitude range is selected as the benchmark coefficient, thereby amplifying the sensitivity of small deviations to the isolation state. The size of the integrity response coefficient should meet two constraints: when the entropy product just touches the threshold, the gain change of the function still remains in a detectable linear section to avoid determination jitter; and when the entropy product exceeds the upper threshold limit, the gain quickly approaches saturation to prevent over-amplification of anomalies, thus achieving a balance between high sensitivity and stability. is the preset integrity threshold, in bits. Used to define the upper limit of the qualified entropy product; is the hyperbolic tangent function; integrity response function The output value range is ; The isolation determination bias term is a real constant. The isolation determination bias term is used to adjust the sign function trigger threshold. The isolation determination bias term should be taken when the device is under normal access conditions. The midpoint between the historical minimum value and the corresponding maximum value under abnormal conditions is used to leave a stable judgment margin. The size of the isolation judgment bias term must meet the following requirements: it must be larger than the upper bound of the three-factor product corresponding to all abnormal samples to prevent misjudgment of normal modes, and smaller than the lower bound corresponding to all normal samples to ensure sensitive detection without jitter. is a sign function, the input of the sign function is positive output , input non-positive output ; Isolation status mark, Isolation status mark is Indicates normal mode (direct empowerment channel), and the isolation state is marked as Indicates bay mode (restricted access channel).

[0021] The encrypted retransmission module is used to by Cut into ,structure , execute SM4 encryption to get , compare the summary returned by the platform and recursively Decide to retransmit or move forward; ; ; ; ; ; in Indicates the complete original file byte stream to be uploaded. The type of the complete original file byte stream to be uploaded is an ordered byte sequence, and the unit is Byte; Indicates the window length, which is the number of bytes in each fragment. The unit is Byte. The window length is fixed and is used to determine the length of each fragment. the range in; The fragment sequence number index of the current fragment. The fragment sequence number index value is a non-negative integer. The fragment sequence number index is used to identify the currently processed fragment. shards; Indicates the Window slice content, Depend on Middle arrive Byte composition, namely: ; Indicates the An indexed sharding structure, which is used to encrypt input, consists of four parts connected in series: 、 、 and ; in Represents the SHA-256 hash digest of the current shard content; Indicates that the previous summary is hashed again with SHA3, and the previous summary is hashed again with SHA3 to form a nonlinear feature; the symbol Represents a data concatenation operation, which is used to sequentially concatenate multiple data elements into a new composite structure, including byte string concatenation or vector-level concatenation; Represents the SM4 encryption function, where Symmetric key (128-bit) is one of the national encryption standard algorithms used for Perform symmetric encryption and output ciphertext; Indicates the encrypted fragment ciphertexts, The value of is the ciphertext of Ik encrypted with the SM4 key K; Indicates the The digest value of the encrypted fragment ciphertext, The summary value of the encrypted fragment ciphertext is used for subsequent comparison and integrity verification; Indicates the first The confirmation summary value of each shard is used as the benchmark value for the platform to confirm the successful upload and is used for local verification and comparison; Indicates the The result value of whether a fragment is successfully uploaded. For the indicator: If ,but ,otherwise ; in represents the indicator function, only when The value is 1 when the condition is met, otherwise it is 0, which is used to compare whether the summaries are consistent; Indicates the shard index cursor during the current upload process, that is, the current position number; Indicates the next processing shard index in the upload scheduling process. The value of the previous index Corresponding upload results Decision; if upload is successful , then move forward; if you fail , then retransmit the current fragment; Indicates the indexed transmission round number of the current ciphertext fragment during the resumable transmission scheduling process.

[0022] The audit module also includes encoding the verification results of the isolation mode switching record frame and the uploaded ciphertext fragment into the event raw vector , and establish an adjacency set in the time directed graph ;right Perform multi-head time series graph attention mechanism calculation and embedding generation , while solving the contrastive learning loss To obtain a robust representation of the decision; Bundle As a reinforcement learning environment state Enter the Q-network, based on the immediate reward Update action and value functions , output decision action And generate the corresponding ruling mark according to the preset threshold ; Will The hash value is inserted into the verification accumulator , and generate a zero-knowledge proof object ; At the same time, write the same hash cascade into the chain ledger root ; Utilizing Mapping Generate centralized authority adjustment instruction frame , refresh real-time endpoint access scope The chained ledger root and the verification accumulator jointly drive the rendering of the operation and maintenance audit interface; Embedding the attention mechanism for multi-head time series graph: ; Introducing self-supervised contrast loss: ; For Q-learning value iteration and policy distribution: ; ; ; Introducing a validating accumulator and a chained ledger root as dual writes: ; ; ; Adjust the mapping for permissions: ; in For the event raw vector, For the event raw vector, For the event raw vector, 、 and The dimension is , 、 and Obtained by mapping the operation ID, policy decision, and device fingerprint through the embedded dictionary; adjacency set Represents a directed time graph with events There is a set of adjacent vertices with causal edges; is the number of multi-head attention heads, which is a positive integer, and each head learns weights independently; Indicates the Attention Head projection matrix, Used to linearly transform event vectors; Indicates the Attention Head Parameterized attention weight vector in dimensional embedding space; Representing an event and events Time interval, in seconds; Representing an event and events time interval; Transpose; event Indicates the target event node currently being modeled; event Representation and Events There are historical event nodes that are causally connected; Indicates in In the attention head, for the event of via Mapped to the attention subspace, Used as the query representation corresponding to the attention head; event Indicates adjacent event nodes, events The role is to participate in the soft-attention weight normalization, event and events An event The adjacency set of , but the event is the target of the current aggregation, event It is the reference for normalization among all adjacent items, and the two are in different attention structure roles; Represents the concatenation operation of the output results of multi-head attention in the attention head dimension; in Representing an event The embedding vector after multi-head temporal attention aggregation, Representing an event The embedding vector after multi-head temporal attention aggregation, Representing an event The embedding vector after multi-head temporal attention aggregation, 、 and The dimension is ; is the vector cosine similarity function; represents the positive sample index in contrastive learning, Satisfaction and Events Belong to the same authority tag; Indicates comparison between batch and event A collection of sample indexes that appear simultaneously; events and events All belong to ; The contrast learning temperature parameter is a positive real number. The contrast learning temperature parameter is used to adjust the smoothness of the distribution, that is, it is used to scale the similarity between embedded vectors (such as cosine similarity). The sensitivity in the softmax function, the smaller the value, the sharper the softmax output, the model tends to strengthen the distinction between the most similar samples. On the contrary, a larger temperature parameter will make the distribution flat, the similarity difference will be weakened, and thus the distinction will be weakened. The value of the learning temperature parameter in practical applications ranges from 0.05 to 0.2, which can be determined by tuning the validation set. If it is too small, it will lead to unstable training or even gradient disappearance. If it is too large, the contrast effect will be weakened, and the positive sample will not be effectively brought closer and the negative sample will be pushed away. Therefore, its essence is to adjust the trade-off coefficient between the model's tolerance to the similarity judgment boundary and the learning sensitivity. Used to bring positive sample embedding closer and push negative sample embedding further away; in is the state of the reinforcement learning environment, where The value of ; is the decision action, and the discrete value set of the decision action is , Indicates that the current operation behavior is determined to be authorized. Indicates that the current operation behavior is judged to be rejected; For immediate rewards, If the action is consistent with the system authority and there is no violation, it is a positive reward, otherwise it is a negative reward; Represents the learning rate of Q-learning, and its value range is expressed as: ; is the discount factor, and its value range is expressed as: ; Indicates time The action-value function under Used to output action value; Indicates that the policy network is Top pair probability; is the candidate decision action currently participating in the softmax operation, To determine the action space, the action space is the set of all possible actions; is the exponential normalization function, which is used to map a set of real values into a probability distribution in the interval (0,1) according to their relative exponential ratio, with a sum of 1; Indicates time When Take the following The corresponding action-value function; Indicates In addition to the currently selected action, another candidate action, In the above formula, it is used for probability calculation or comparative analysis; express At this moment, All possible actions corresponding to In the equation, Q refers to the maximum value of the action-value function; in A sign of judgment, The decision flag is 1 (allowed) when the condition is met, otherwise it is 0 (rejected); Indicates The probability value of taking the action Allow is the probability that the model predicts that the action is allowed; For the The device fingerprint hash value corresponding to the record; For the System timestamp of the record, in seconds; A cryptographic hash function (SHA-512 in the above formula) that outputs a 512-bit digest. It is a multi-set verification accumulator update operator, which is used to support insertion and zero-knowledge proof; verification accumulator Indicates the accumulator status in The value after the strip is written; The private witness of the accumulator's zero-knowledge proof contains the previous and next states and the inserted value. It is a zero-knowledge proof object, which is used to externally verify the consistency of the accumulator; Indicates the cryptographic operation mechanism used to verify the correctness of the chain ledger or data; the chain ledger root Indicates that the chain ledger is writing The root hash state obtained after the data is updated; For the genesis hash; in Indicates The isolation status flag corresponding to the moment, where +1 indicates normal mode and -1 indicates interval mode; The permission adjustment mapping function is used to map the isolation status, the ruling flag, and the embedding vector into a machine-executable instruction JSON; It is the centralized authority adjustment instruction frame, which is composed of generate; Indicates The set of endpoint access permissions that will take effect later.

[0023] It should be noted that this solution builds a security system architecture based on the integration of real-time judgment, behavior integrity verification, and chain auditing around the USB access security control system. The purpose is to solve structural problems existing in the existing USB management and control mechanism, such as high latency, ambiguous authorization, untraceable behavior, and inability to distinguish and manage devices. The overall solution is constructed with event triggering as the entry point, behavior recognition as the foundation, security context as the core, isolation and permissions as the execution logic, and continuous auditing as the feedback loop, forming a four-layer control path of perception, judgment, execution, and feedback. The development process of this solution begins with kernel-level interrupt events. The interrupt signal in the system kernel is used as a zero-latency trigger input, written into the interrupt event buffer, and a pending interrupt data set that can be parsed by the upper layer is constructed. The design purpose of this step is to ensure that USB access behavior can be captured immediately as the starting point of the entire security judgment chain. After this, the system extracts the original device information, bus status parameters, and port number from the interrupt event, and through structured reorganization forms a feature field set in a unified format. This feature field set is then input into the hash calculation process to generate a device fingerprint hash value with unique device identification characteristics. The generation of this device fingerprint hash value is not simply based on static hardware parameters, but can integrate multi-dimensional data such as behavior sequence, bus occupancy, and device status context, making it anti-spoofing and stable. The system then uses the device fingerprint hash value as an index to find the corresponding authorization group ID in the permission binding relationship table in combination with the current timestamp. The system then writes the authorization group ID, timestamp, and fingerprint into the status tag processing flow of the USB device access session, thereby constructing the security context vector that the current session relies on. This security context vector is not only an expression of static identity, but also a carrier of behavioral associations. All subsequent control logic revolves around this vector. In the isolation module, the system reads the authorization group ID and insertion timestamp in the security context vector, and combines it with the currently identified device fingerprint as a composite input to the security status determination process; the determination logic relies on the preset time isolation conditions and group mapping rules to output a binary isolation status identifier of whether the current USB device is in "normal mode" or "interval mode"; the "interval mode" here introduces the time factor and the dynamic pairing logic of the authorization group to prevent the device from crossing the authorization group or repeatedly accessing in a short period of time, causing security escape; after the isolation status identifier is generated, it will be combined with the device access port number to generate the device identification and positioning parameters, and then generate the endpoint access permission structure, which is used to limit the scope of operations such as reading, writing, and executing within the current access cycle of the device; The system then proceeds to the behavioral command analysis process, capturing the USB device's response command stream during initialization and interaction, and performing command replay and reverse entropy verification. This step is designed to non-invasively verify the integrity of device behavior, calculate a behavioral integrity measurement value, and compare it with a preset behavioral baseline template set. Once the difference exceeds the set threshold, the original isolation state is automatically updated to interval mode, and an updated permission structure is generated based on the new isolation state, achieving immediate and secure closure. This switching behavior is recorded as an isolation mode switch record frame and synchronously written to the device status exchange table, retaining detailed evidence for subsequent audit operations. In the encrypted resumable upload module, the file blocks to be uploaded are windowed and cut into fixed-length transmission fragments. Each fragment is accompanied by a sequence number index and integrity check digest, and is symmetrically encrypted using the SM4 algorithm to generate a set of ciphertext fragments. Through the breakpoint resume scheduling mechanism, the ciphertext fragments are written to the sending queue and uploaded. If the reception confirmation signaling returned by the platform is consistent with the local checksum, the transmission is recorded as successful. Otherwise, it automatically rolls back to the corresponding index and reschedules, ensuring safe and uninterrupted file transmission in the event of network or device interruptions. The audit module is built to form a traceable and decision-making permission tracing system after all control processes. The audit module aggregates isolation mode switching records and ciphertext upload verification results, and generates a set of operation behavior entries through the event merging process. Each record clearly indicates the operation ID, policy decision and device fingerprint; the authorization group ID and isolation status are combined to form the basis for permission judgment. The system performs a permission consistency comparison of the operation behavior entries, outputs a sequence of decision results, and writes them into the permission audit ledger chain in combination with the corresponding device fingerprint and timestamp; the chain structure ensures that the decision results cannot be tampered with and are traceable; based on the latest decision node content of the ledger chain, the system can generate a centralized permission adjustment instruction frame for real-time dynamic adjustment of the device access range configuration; in addition, the system can also provide a visual operation and maintenance audit interface, rendering historical operations and permission change trajectories to serve security analysis, compliance inspection and operation and maintenance decision-making; Overall, this solution links "device identification - policy binding - dynamic isolation - behavior verification - permission closure - encrypted retransmission - audit feedback" together, forming a closed-loop control logic through kernel triggering and chain feedback. The designs adopted in each link, such as the entropy test of behavioral instructions, the dynamic switching of interval mode, the breakpoint recovery mechanism of the transmission list, and the writing of judgment consistency in the audit chain, are all aimed at enhancing the system's adaptability and response speed to abnormal behaviors in actual operation and maintenance, reflecting the depth of protection and solving the problems of "difficult identification, slow judgment, weak traceability, and chaotic permissions" in traditional USB management and control.

[0024] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A USB access security control system, comprising an identification module, an isolation module, an encrypted transmission module, an audit module, and a kernel interrupt signal triggered by physical USB insertion, characterized in that: The identification module is used to receive kernel interrupt signals and write them into the interrupt event buffer, generate an interrupt data group to be parsed, parse and generate identification notification information and push it as a USB access snapshot data frame, extract the structured feature fields in the USB access snapshot data frame to generate a device fingerprint, and query the permission binding relationship table based on this to construct a security context vector; The isolation module is used to read the security context vector and determine the isolation status identifier based on the current device fingerprint. It generates the endpoint access permission structure based on the isolation status identifier and the authorization group information, performs instruction replay and behavior integrity verification, adjusts the isolation status identifier, and generates an isolation mode switching record frame. The encrypted resuming module is used to perform window segmentation and index generation on the file blocks to be uploaded, SM4 encrypt the segmented content and write it into the task queue, and complete the ciphertext upload and verification retransmission through the breakpoint resuming mechanism; The audit module is used to generate operational behavior entries and perform permission consistency comparison, record the adjudication results in the audit ledger, generate and issue permission adjustment instructions, and output the operation and maintenance audit interface for behavior tracing and permission management.

2. A USB access security control system according to claim 1, characterized in that: The identification module captures the kernel interrupt signal triggered by the physical insertion of the USB, writes the kernel interrupt signal as an input event into the interrupt event buffer, and forms an interrupt data group to be parsed for subsequent identification. Deliver the interrupt data group to be parsed to the interrupt event hook function process, and parse out the identification notification information including the device port address and event timestamp; Using the kernel-user space event reflection channel, the identification notification information is pushed to the user side and cached as a USB access snapshot data frame; In the snapshot parsing stage, the device descriptor information and the initial handshake response content in the USB access snapshot data frame are extracted and reorganized into a structured feature field set. The device fingerprint hash value is then calculated using the structured feature field set as input. The device fingerprint hash value is used as an index to query the permission binding relationship table and, combined with the current timestamp, write the status tag processing flow of the USB device access session to generate a security context vector for permission identification and isolation control; the security context vector includes the device fingerprint, authorization group ID, and insertion timestamp.

3. A USB access security control system according to claim 2, characterized in that: The isolation module is used to read the authorization group ID and insertion timestamp contained in the security context vector, combine and match them with the currently identified device fingerprint, input them into the security status determination process, and parse the isolation status identifier corresponding to the current USB device based on the preset time isolation conditions and group mapping rules; The isolation status identifier is a binary value, namely normal mode and interval mode, normal mode indicates direct authorization channel access, and interval mode indicates access to a restricted access channel; Based on the authorization group ID and USB access port number corresponding to the isolation status identifier, the two are combined to form the identification and positioning parameters of the current device, and mapped to generate an endpoint access permission structure. The endpoint access permission structure is used to limit the scope of operation permissions of the USB device during the current access cycle; After starting the behavior command analysis process, the response command stream of the USB device is captured and command replay and reverse entropy verification are performed to output the behavior integrity measurement value; If the difference between the behavior integrity measurement value and the preset device behavior baseline template set exceeds the preset threshold, the original isolation status identifier is updated to the status value of the corresponding interval mode, and the endpoint access permission structure corresponding to the current USB device is regenerated based on the status value of the interval mode; then the updated isolation status identifier and the preset threshold corresponding to the integrity measurement value are written into the USB device status exchange table, and an isolation mode switching record frame is generated for subsequent audit process calls.

4. A USB access security control system according to claim 3, characterized in that: The encrypted transfer resuming module uses window fragmentation processing logic to cut the file blocks to be uploaded in the USB device into an indexed transfer fragment set according to a fixed window length. The indexed transfer fragment set includes a sequence index and an integrity check summary. The indexed transfer fragment set is processed by the SM4 encryption engine in the national secret algorithm process, which performs symmetric encryption on each indexed transfer fragment and outputs a ciphertext fragment set. By means of the breakpoint resume scheduling process, the ciphertext fragment set is written into the sending task queue and the resume index linked list is recorded. Then, the ciphertext fragments in the sending task queue are uploaded through the network protocol stack, and the fragment reception confirmation signaling returned by the platform is received. The fragment reception confirmation signaling is compared with the local verification summary. If the verification is consistent, the record is successful. Otherwise, the index is rolled back and the corresponding ciphertext fragment is rescheduled to achieve resume transmission.

5. A USB access security control system according to claim 4, characterized in that: The audit module aggregates the verification results of isolation mode switching record frames and uploaded ciphertext fragments, and generates an operation behavior entry set through the event merging process. The operation behavior entry set includes the operation ID, policy decision, and device fingerprint. Based on the permission judgment basis formed by the combination of the authorization group ID and the isolation status identifier, the authorization group associated with the operation ID in the operation behavior entry set is checked for correspondence with the permission judgment basis, permission consistency comparison is performed, and a behavior judgment result sequence is output. The behavior judgment result sequence, together with the corresponding device fingerprint and insertion timestamp, is recorded in the permission audit ledger chain through chain writing; After parsing the latest adjudication node in the ledger chain, the adjudication result, device fingerprint, and isolation status identifier are extracted, and the extracted adjudication result, device fingerprint, and isolation status identifier are combined as input to generate a centralized permission adjustment instruction frame. The permission adjustment instruction frame is written into the endpoint access scope configuration corresponding to the current USB device to update its real-time access rights in the current isolation state; The behavior judgment results, device fingerprints and insertion timestamps recorded in the ledger chain are input into the audit rendering process to generate an operation and maintenance audit interface containing historical operation records and permission change tracing for subsequent behavior tracing and permission management operations.

6. A USB access security control system according to claim 5, characterized in that: The isolation module inserts the timestamp when reading the security context vector With the authorization group ID, real-time monitoring of device response flow , calculate the time suppression function in turn , group activation function , weighted entropy product and integrity response function , after symbol determination, the isolation status mark is obtained And generate endpoint access rights accordingly; ； ； ； ； ； ； in is the current timestamp; Insert timestamp Indicates the timestamp of when the USB device is inserted; Indicates the cumulative access time since insertion; is the Gaussian suppression coefficient; is the lower bound of the isolation time window; is the upper bound of the isolation time window; is the time suppression function; is the authorization group ID; represents the exponential function; represents a cryptographic hash function; group activation function The value is 1 or 0 according to the parity of the hash result; Indicates that the authorization group ID is hashed three times and then modulo 2, and the result is 0 or 1; the device response flow Indicates time Collected USB device response command stream; time To indicate a historical moment; is the instantaneous response entropy density, which corresponds to time The information entropy strength of the instruction stream; is the length of the entropy observation sliding window; is the exponential decay constant; the weighted entropy product Express The entropy density of the interval is exponentially rolled up; is the integrity response factor; is the preset integrity threshold; is the hyperbolic tangent function; integrity response function The output value range is ; Determine the bias term for isolation; is a sign function, the input of the sign function is positive output , input non-positive output ; Isolation status mark, Isolation status mark is Indicates normal mode, the isolation status is marked as Indicates interval mode.

7. A USB access security control system according to claim 6, characterized in that: The encrypted retransmission module is used to by Cut into ,structure , execute SM4 encryption to get , compare the summary returned by the platform and recursively Decide to retransmit or move forward; ； ； ； ； ； in Represents the complete original file byte stream to be uploaded; Indicates the window length; Indicates the fragment sequence index of the current fragment; Indicates the Window slice content; Indicates the An indexed sharding structure, which is used to encrypt input, consists of four parts connected in series: 、 、 and ; in Represents the SHA-256 hash digest of the current shard content; Indicates that the previous summary is hashed again with SHA3; the symbol Represents data connection operation; Represents the SM4 encryption function, where is a symmetric key; Indicates the encrypted fragment ciphertext; Indicates the The digest value of the encrypted fragment ciphertext; Indicates the first The confirmation summary value of each shard; Indicates the The result value of whether a fragment is successfully uploaded. For the indicator: If ,but ,otherwise ; in represents the indicator function, only when The value is 1 when the condition is met, otherwise it is 0; Indicates the shard index cursor in the current upload process; Indicates the next processing shard index in the upload scheduling process. The value of the previous index Corresponding upload results Decision; if upload is successful , then move forward; if you fail , then retransmit the current fragment; Indicates the indexed transmission round number of the current ciphertext fragment during the resumable transmission scheduling process.

8. A USB access security control system according to claim 7, characterized in that: The audit module also includes encoding the verification results of the isolation mode switching record frame and the uploaded ciphertext fragment into the event raw vector , and establish an adjacency set in the time directed graph ;right Perform multi-head time series graph attention mechanism calculation and embedding generation , while solving the contrastive learning loss To obtain a robust representation of the decision; Bundle As a reinforcement learning environment state Enter the Q-network, based on the immediate reward Update action and value functions , output decision action And generate the corresponding ruling mark according to the preset threshold ; Will The hash value is inserted into the verification accumulator , and generate a zero-knowledge proof object ; At the same time, write the same hash cascade into the chain ledger root ; Utilizing Mapping Generate centralized authority adjustment instruction frame , refresh real-time endpoint access scope The chained ledger root and the verification accumulator jointly drive the rendering of the operation and maintenance audit interface; Embedding the attention mechanism for multi-head time series graph: ； Introducing self-supervised contrast loss: ； For Q-learning value iteration and policy distribution: ； ； ； Introducing a validating accumulator and a chained ledger root as dual writes: ； ； ； Adjust the mapping for permissions: ； in For the event raw vector, For the event raw vector, For the event raw vector, 、 and The dimension is , 、 and Obtained by mapping the operation ID, policy decision, and device fingerprint through the embedded dictionary; adjacency set Represents a directed time graph with events There is a set of adjacent vertices with causal edges; is the number of multi-head attention heads; Indicates the Attention Head Projection matrix; Indicates the Attention Head Parameterized attention weight vector in dimensional embedding space; Representing an event and events time interval; Representing an event and events time interval; Transpose; event Indicates the target event node currently being modeled; event Representation and Events There are historical event nodes that are causally connected; Indicates in In the attention head, for the event of via Mapping to attention subspace; event Represents adjacent event nodes; Represents the concatenation operation of the output results of multi-head attention in the attention head dimension; in Representing an event The embedding vector after multi-head temporal attention aggregation, Representing an event The embedding vector after multi-head temporal attention aggregation, Representing an event The embedding vector after multi-head temporal attention aggregation, 、 and The dimension is ; is the vector cosine similarity function; Represents the positive sample index in contrastive learning; Indicates comparison between batch and event A collection of sample indexes that appear simultaneously; events and events All belong to ; To compare and learn temperature parameters; in is the state of the reinforcement learning environment, where The value of ; is the decision action, and the discrete value set of the decision action is , Indicates that the current operation behavior is determined to be authorized. Indicates that the current operation behavior is judged to be rejected; For immediate rewards, If the action is consistent with the system authority and there is no violation, it is a positive reward, otherwise it is a negative reward; Represents the learning rate of Q-learning, and its value range is expressed as: ; is the discount factor, and its value range is expressed as: ; Indicates time The action-value function under Used to output action value; Indicates that the policy network is Top pair probability; is the candidate decision action currently participating in the softmax operation, To determine the action space; is the exponential normalization function; Indicates time When Take the following The corresponding action-value function; Indicates , another candidate action besides the currently selected action; in A sign of adjudication; Indicates The probability value of taking the action Allow; For the The device fingerprint hash value corresponding to the record; For the System timestamp of the record; Cryptographic hash functions; Update operator for multi-set verification accumulator; verification accumulator Indicates the accumulator status in The value after the strip is written; A private witness for the accumulator's zero-knowledge proof; It is the object of zero-knowledge proof; Indicates the cryptographic operation mechanism used to verify the correctness of the chain ledger or data; the chain ledger root Indicates that the chain ledger is writing The root hash state obtained after the data is updated; For the genesis hash; in Indicates The isolation status flag corresponding to the moment, where +1 indicates normal mode and -1 indicates interval mode; Adjust the mapping function for permissions; Indicates The set of endpoint access permissions that will take effect later.

Images