Access method and device, computer equipment and storage medium
By enabling ADB tools using SCSI commands in the communication module, and combining this with login passwords and whitelisting mechanisms, the security risks associated with ADB tool access are resolved, thereby improving the security and stability of the communication module.
Patent Information
- Application Number
- CN202511073904.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-31
- Publication Date
- 2025-11-18
AI Technical Summary
Existing methods for accessing communication modules via ADB tools pose security risks such as unauthorized access, data leakage, and abuse of permissions, affecting the stability of the communication modules.
The ADB tool is enabled by sending SCSI commands through the high-capacity storage port, and based on the first login password and ADB command whitelist mechanism, it is ensured that only authorized devices can access the communication module, preventing unauthorized operations and data leakage.
It improves the security of the communication module, reduces the risk of unauthorized operation, prevents malicious operation and data leakage, and enhances the stability and user-friendliness of the communication module.
Smart Images
Figure CN120974475A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of communication technology, and in particular to an access method, apparatus, computer device and storage medium. Background Technology
[0002] With the development of communication technology, communication modules are used in various devices, such as Customer Premise Equipment (CPE), mobile routers (Mobile WiFi, MIFI), and adapters (dongles). During communication using these devices, communication anomalies may occur. Therefore, it is necessary to access the communication module through the Android Debug Bridge (ADB) tool to analyze these anomalies. However, current methods of accessing communication modules via ADB tools suffer from issues such as unauthorized access, data leakage, and permission abuse, posing significant security risks and potentially affecting the stability of the communication module.
[0003] Ensuring the security of communication modules during access is currently a hot research topic. Summary of the Invention
[0004] This application provides an access method, apparatus, computer device, and storage medium that can improve the security of the communication module during access.
[0005] In a first aspect, this application provides an access method, which may include: sending a Small Computer System Interface (SCSI) command to a communication module via a mass storage port between the module and the communication module; the SCSI command being used to indicate that an ADB tool is enabled; in response to the ADB tool being enabled, sending a first login command to the communication module; the first login command including a first login password, the first login command being used to request login to the ADB tool based on the first login password; in response to receiving a first login response from the communication module, sending a first ADB command to the communication module; the first login response being used to indicate that the first login password matches a preset login password successfully; the first ADB command being used to request access to the communication module; receiving a first ADB response from the communication module; the first ADB response being used to indicate that the first ADB command belongs to an ADB command whitelist and that the first ADB command is executed.
[0006] As can be seen, enabling ADB tools via SCSI commands and then completing authentication based on the initial login password ensures that only authorized devices can trigger ADB access, reducing the risk of unauthorized operations. Simultaneously, the communication module only executes ADB commands that belong to a preset whitelist; even if the password is leaked, unauthorized commands will be intercepted, preventing malicious operations or data leaks, thus improving the security of the communication module during access.
[0007] In one possible implementation, the above method may further include: sending encrypted notification information to the communication module; the encrypted notification information includes the identification code and encryption method information of the communication module, and the encrypted notification information is used to instruct the communication module to generate a preset login password based on the identification code, encryption method information and salt value of the communication module; receiving encrypted response information from the communication module; the encrypted response information includes the preset login password.
[0008] As can be seen, the encrypted notification message contains a unique identifier for the communication module. The communication module must verify that its own identifier matches the request before generating a password, preventing unauthorized devices from accessing the site. The preset login password is dynamically generated by the communication module based on the identifier, encryption method, and salt value, rather than being stored in a fixed location. This prevents the password from remaining valid indefinitely after being leaked, thus improving the security of the communication module.
[0009] In one possible implementation, the method may further include: in response to receiving a second login response from the communication module, sending a second login instruction to the communication module; the second login response is used to indicate that the first login password fails to match the preset login password; the second login instruction includes a second login password and is used to request to log in to the ADB tool based on the second login password.
[0010] As can be seen, when the first login password fails to match (such as due to incorrect user input or communication interference), the communication module allows retry via the second login command, reducing operation interruptions caused by accidental errors and improving user-friendliness.
[0011] In one possible implementation, the above method may further include: sending ADB command whitelist query information to the communication module; the ADB command whitelist query information is used to request a query of the ADB command whitelist; receiving ADB command whitelist response information from the communication module; the ADB command whitelist response information includes the ADB command whitelist; the above sending of the first ADB command to the communication module may include: sending the first ADB command to the communication module based on the ADB command whitelist, the ADB command whitelist including the first ADB command.
[0012] It is evident that before sending the first ADB command, the legitimacy of the first ADB command can be confirmed by querying the ADB command whitelist, reducing execution failures due to insufficient permissions and improving the success rate of the operation.
[0013] In one possible implementation, the method may further include: receiving a second ADB response from the communication module; the second response information is used to indicate that the first ADB instruction is an ADB instruction outside the ADB instruction whitelist.
[0014] It is evident that if the first ADB instruction is detected as not being in the ADB instruction whitelist before the communication module executes the first ADB instruction, the operation will be terminated immediately through the second ADB response to prevent illegal instructions (such as system reset, sensitive file read / write) from damaging the communication module.
[0015] Secondly, embodiments of this application provide another access method, which may include: receiving a SCSI command from a first device through a mass storage port; the SCSI command is used to instruct the ADB tool to be enabled; enabling the ADB tool in response to the SCSI command; receiving a first login command from the first device; the first login command includes a first login password, and the first login command is used to request login to the ADB tool based on the first login password; in response to the first login password successfully matching a preset login password, sending a first login response to the first device, the first login response being used to indicate that the first login password successfully matches the preset login password; receiving a first ADB command from the first device; the first ADB command is used to request access to a communication module; in response to the ADB command whitelist including the first ADB command, executing the first ADB command and sending a first ADB response to the first device; the first ADB response being used to indicate that the first ADB command belongs to the ADB command whitelist and that the first ADB command has been executed.
[0016] As can be seen, using a high-capacity storage port to transmit SCSI commands enables ADB tools and prevents the ADB port from being exposed, thus avoiding automatic triggering of the ADB service. Simultaneously, two-factor authentication based on the initial login password ensures that only authorized users can log in to the ADB tools, preventing unauthorized access after enabling the ADB tools. Furthermore, an ADB command whitelist mechanism restricts the range of executable ADB commands, improving the security of the communication module.
[0017] In one possible implementation, the SCSI command is also used to instruct the ADB access control application to be launched, and the method may further include: launching the ADB access control application in response to the SCSI command, and verifying the first login password through the ADB access control application.
[0018] As can be seen, the independent ADB permission management application is launched via SCSI command. This application runs in an independent process space and is completely decoupled from the ADB tool. The password verification logic is implemented by the ADB permission management application, and the ADB tool only receives the verification result, thus avoiding the exposure of plaintext passwords or verification algorithms in the ADB tool.
[0019] In one possible implementation, the method may further include: in response to the ADB instruction whitelist not including the first ADB instruction, sending a second ADB response to the first device; the second ADB response is used to indicate that the first ADB instruction is an ADB instruction outside the ADB instruction whitelist.
[0020] As can be seen, returning a second ADB response to commands not on the ADB command whitelist explicitly refuses execution without exposing internal system information, thus improving the security of the communication module.
[0021] Thirdly, embodiments of this application provide an access device, which further includes a transceiver unit and a processing unit. The transceiver unit is configured to send a SCSI command to the communication module via a high-capacity storage port; the SCSI command is used to indicate that an ADB tool is enabled; in response to the ADB tool being enabled, a first login command is sent to the communication module; the first login command includes a first login password, and the first login command is used to request login to the ADB tool based on the first login password; in response to receiving a first login response from the communication module, a first ADB command is sent to the communication module; the first login response is used to indicate that the first login password matches a preset login password successfully; the first ADB command is used to request access to the communication module; and a first ADB response is received from the communication module; the first ADB response is used to indicate that the first ADB command belongs to the ADB command whitelist and that the first ADB command is executed.
[0022] In one possible implementation, the transceiver unit is further configured to send encrypted notification information to the communication module; the encrypted notification information includes the identification code and encryption method information of the communication module, and the encrypted notification information is used to instruct the communication module to generate a preset login password based on the identification code, encryption method information and salt value of the communication module; and to receive encrypted response information from the communication module; the encrypted response information includes the preset login password.
[0023] In one possible implementation, the encryption method information mentioned above includes MD5 identification information, SHA256 identification information, or SHA512 identification information.
[0024] In one possible implementation, the transceiver unit is further configured to send a second login instruction to the communication module in response to receiving a second login response from the communication module; the second login response is used to indicate that the first login password fails to match the preset login password; the second login instruction includes a second login password and is used to request to log in to the ADB tool based on the second login password.
[0025] In one possible implementation, the transceiver unit is further configured to send ADB command whitelist query information to the communication module; the ADB command whitelist query information is used to request a query of the ADB command whitelist; receive ADB command whitelist response information from the communication module; the ADB command whitelist response information includes the ADB command whitelist; and send a first ADB command to the communication module based on the ADB command whitelist, the ADB command whitelist including the first ADB command.
[0026] In one possible implementation, the transceiver unit is further configured to receive a second ADB response from the communication module; the second response information is used to indicate that the first ADB instruction is an ADB instruction outside the ADB instruction whitelist.
[0027] Fourthly, embodiments of this application provide another access device, which further includes a transceiver unit and a processing unit. The transceiver unit is configured to receive a SCSI command from a first device via a mass storage port; the SCSI command is used to instruct the ADB tool to be enabled. The processing unit is configured to enable the ADB tool in response to the SCSI command. The transceiver unit is further configured to receive a first login command from the first device; the first login command includes a first login password, and the first login command is used to request login to the ADB tool based on the first login password; in response to a successful match between the first login password and a preset login password, the unit sends a first login response to the first device, the first login response indicating that the first login password matches the preset login password; and receives a first ADB command from the first device; the first ADB command is used to request access to the communication module. The processing unit is further configured to execute the first ADB command in response to the ADB command whitelist including the first ADB command, and send a first ADB response to the first device; the first ADB response indicating that the first ADB command belongs to the ADB command whitelist and that the first ADB command has been executed.
[0028] In one possible implementation, the processing unit is also configured to, in response to a SCSI command, launch an ADB access control application and verify the first login password through the ADB access control application.
[0029] In one possible implementation, the transceiver unit is further configured to send a second ADB response to the first device in response to the fact that the ADB instruction whitelist does not include the first ADB instruction; the second ADB response is used to indicate that the first ADB instruction is an ADB instruction outside the ADB instruction whitelist.
[0030] Fifthly, embodiments of this application provide an electronic device, the electronic device comprising: a memory for storing a program; and a processor for executing the program stored in the memory. When the program is executed by the processor, the processor executes a method as described in the first aspect and any possible implementation of the first aspect, or executes a method as described in the second aspect and any possible implementation of the second aspect.
[0031] Sixthly, embodiments of this application provide a computer storage medium storing a computer program, the computer program including program instructions, wherein when the program instructions are executed by a processor, the processor executes a method as described in the first aspect and any possible implementation thereof, or executes a method as described in the second aspect and any possible implementation thereof.
[0032] In a seventh aspect, embodiments of this application provide a computer program product, the computer program product comprising: instructions or a computer program; when the instructions or the computer program are executed, to implement the method as in the first aspect and any possible implementation thereof, or to implement the method as in the second aspect and any possible implementation thereof.
[0033] Eighthly, embodiments of this application provide a chip including a processor configured to execute instructions. When the processor executes the instructions, the chip performs a method as described in the first aspect and any possible implementation thereof, or performs a method as described in the second aspect and any possible implementation thereof. Optionally, the chip further includes an input / output interface configured to receive or transmit signals. Attached Figure Description
[0034] Figure 1 A schematic diagram of a system architecture provided for an embodiment of this application;
[0035] Figure 2 A flowchart illustrating an access method provided in an embodiment of this application;
[0036] Figure 3 A flowchart illustrating another access method provided in an embodiment of this application;
[0037] Figure 4 This is a schematic diagram of the structure of an access device provided in an embodiment of this application;
[0038] Figure 5 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation
[0039] The embodiments of this application will now be described with reference to the accompanying drawings.
[0040] The terms "first," "second," "third," and "fourth," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or apparatuses.
[0041] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.
[0042] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.
[0043] The terms “component,” “module,” “system,” etc., used in this specification are used to refer to computer-related entities, hardware, firmware, combinations of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program, and / or a computer. As illustrated, applications running on computing devices and computing devices can both be components. One or more components may reside in a process and / or an execution thread, and components may be located on a single computer and / or distributed among two or more computers. Furthermore, these components can be executed from various computer-readable media on which various data structures are stored. Components can communicate, for example, via local and / or remote processes based on signals having one or more data packets (e.g., data from two components interacting with another component between a local system, a distributed system, and / or a network, such as the Internet interacting with other systems via signals).
[0044] First, some of the terms used in this application will be explained to facilitate understanding by those skilled in the art.
[0045] I. ADB Tools
[0046] ADB is a cross-platform command-line toolkit officially provided by Google. It is used to establish communication channels between external devices and Android devices (such as mobile phones, tablets, in-vehicle systems, Internet of Things (IoT) devices, communication modules, etc.) to enable Android device management, debugging, data exchange, and other functions. ADB is one of the core tools for Android development, system maintenance, and security research, characterized by its lightweight, high efficiency, and rich functionality.
[0047] The ADB tool consists of three parts: an ADB client, an ADB server, and an ADB daemon, forming a client-server-daemon architecture. The ADB client is a command-line tool running on an external device, allowing users to interact with the Android device by inputting ADB commands. The ADB server is a background service running on the external device, responsible for managing the connection between the ADB client and the Android device, listening on the default port 5037. When an ADB client initiates a request, the ADB server forwards the ADB commands to the Android device via Universal Serial Bus (USB) or network (Transmission Control Protocol / Internet Protocol, TCP / IP). The ADB daemon, a background service running on the Android device, listens on the USB or network port, receives and executes the ADB commands forwarded by the ADB server, and returns the execution results to the ADB client.
[0048] ADB Shell is one of the core functions of the ADB tool, launching a remote command-line (shell) environment via the `adb shell` command. Through the shell environment, various operations can be performed directly on the connected device using a series of ADB commands, covering functions such as file management, system debugging, application control, and performance monitoring.
[0049] II. Communication Module
[0050] Communication modules serve as the "nerve center" connecting the Internet of Things (IoT), smart terminals, and digital ecosystems. Essentially, they highly integrate core components such as communication chips, radio frequency circuits, storage units, and power management, and utilize standardized interfaces to achieve plug-and-play functionality. Communication modules can be applied to various devices, such as CPEs, MiFi, and Dongles.
[0051] The communication module involved in the embodiments of this application will be described in the following aspects.
[0052] 1. Types of communication modules
[0053] Based on the technical type of the communication module, communication modules can be divided into cellular communication modules and non-cellular communication modules.
[0054] Cellular communication modules are based on cellular mobile communication technologies, such as 4G, 5G, and Narrow Band Internet of Things (NB-IoT). Cellular communication modules support global mobile communication networks, providing high-speed and stable data transmission services. Non-cellular communication modules, on the other hand, use non-cellular mobile communication technologies, such as Wireless Fidelity (WiFi) and Bluetooth. Non-cellular communication modules are suitable for short-range wireless communication and data transmission in specific scenarios.
[0055] For example, MiFi and CPE are cellular communication modules, while Dongle is a non-cellular communication module. MiFi, also known as a personal hotspot or mobile hotspot terminal, converts 4G and 5G signals into WiFi signals usable by mobile phones, tablets, and laptops. CPE is a mobile signal access device that receives mobile signals and forwards them as WiFi signals; it also converts high-speed 4G or 5G signals into WiFi signals. Dongle is a type of hardware adapter that relies on non-cellular networks for device connectivity and data transmission. It uses short-range, low-power, or high-bandwidth wireless technology to meet networking needs in specific scenarios.
[0056] 2. Standard interface of the communication module
[0057] The standard interface of a communication module is a core component for enabling interconnection, data transmission, and control between devices. Essentially, it ensures seamless interoperability between communication modules from different manufacturers and external devices (such as hosts, sensors, and actuators) through a unified physical form, electrical characteristics, and communication protocols. Standard interfaces provided by communication modules include USB, WiFi, and Ethernet interfaces. The USB interface supports high-speed data exchange between external devices and the communication module; the WiFi interface connects external devices to a local area network (LAN) or the internet; and the Ethernet interface provides a stable, low-latency data channel for external devices, suitable for high-bandwidth applications.
[0058] 3. Virtual port of the communication module
[0059] A virtual port is a logical channel created by a communication module for network communication, which encapsulates the functionality of standard interfaces (such as USB interfaces, WiFi interfaces, and Ethernet interfaces) or protocol stacks into a programmable port object.
[0060] The communication module, after being connected to an external device via a USB interface, can be recognized as a USB device by the external device, which can then enumerate various types of virtual ports. Each type of virtual port can perform different functions. The enumeration process includes: the USB device first reporting its descriptor information to the external device, such as device type, configuration, and one or more supported virtual ports; correspondingly, the external device obtains the above information, identifies the USB device, determines its basic information (such as the aforementioned descriptor information) and communication requirements (such as which virtual ports need to be used), in order to correctly communicate with the USB device.
[0061] For example, if the communication module enumerates a virtual port, such as port A, it can indicate that the communication module supports port A, reports its support for port A to an external device, and the external device has completed the resource configuration for port A. Therefore, the communication module and the external device can interact with each other via port A. The resource configuration for port A by the external device may include loading the driver corresponding to port A and configuring the port parameters of port A (e.g., baud rate, data bits, stop bits, parity bits).
[0062] For example, the types of virtual ports commonly enumerated by communication modules and their functions are as follows:
[0063] (1) Mass storage port, also known as MASS port, allows external devices to recognize the communication module as an external storage device, such as a USB hard drive or flash drive. Through this port, external devices can read and write data on the communication module, typically used for file transfer or storage.
[0064] (2) Remote Network Driver Interface Specification (RNDIS) port enables the communication module to communicate with external devices as a network adapter, allowing external devices to connect to networks such as 4G and 5G through the communication module.
[0065] (3) ADB port. ADB is a debugging tool provided by the Android system, which communicates with external devices through the port. The ADB port is the core interface for ADB communication, supporting functions such as device management, application debugging, and file transfer.
[0066] Currently, accessing the communication module via ADB tools primarily relies on directly logging into the ADB tool through the communication module's ADB port for analysis. However, ADB tools use a fixed port by default and support port enumeration scanning. Attackers can quickly locate the communication module using automated tools, providing an entry point for unauthorized access and posing a risk of port exposure. Furthermore, the ADB protocol natively does not support password authentication, relying only on physical connections or initial debugging authorization, making it vulnerable to man-in-the-middle attacks in remote debugging scenarios. Additionally, the ADB Shell has system-level access privileges by default, allowing the execution of arbitrary commands such as file modification and application installation. If the device has acquired superuser privileges, attackers can directly control the communication module, performing arbitrary operations and exposing it to serious security threats such as data leakage and system tampering.
[0067] In view of this, embodiments of this application provide an access method, apparatus, computer device, and storage medium. This method combines multiple security mechanisms such as SCSI communication, asymmetric encryption technology, account login, and blacklist / whitelist management, which can improve the security of the communication module during access to the communication module through ADB tools.
[0068] The following describes a system architecture applicable to the embodiments of this application.
[0069] Please see Figure 1 , Figure 1 This is a schematic diagram of a system architecture provided for an embodiment of this application. Figure 1 As shown, the system architecture includes a first device 101 and a communication module 102. The first device 101 can be the aforementioned external device, and the first device 101 and the communication module 102 can be connected and communicate via a USB interface. The number of first devices 101 and the number of communication modules 102 are for illustrative purposes only and do not constitute a limitation on the embodiments of this application.
[0070] The first device 101 is a device with a standard interface and data processing and communication functions. The first device 101 can be a device used by an object, such as a developer, test engineer, network security engineer, operations and maintenance personnel, or product manager, etc. The first device 101 can be a smartphone, tablet computer, smart wearable device, smart voice interaction device, smart home appliance, personal computer, in-vehicle terminal, embedded development board, virtual machine, virtual reality device (such as augmented reality (AR) device), etc., and this application does not limit this.
[0071] The communication module 102 supports multiple standard interfaces and communication protocols. The communication module 102 can be used as a standalone communication device to directly communicate with the first device 101. Optionally, the communication module 102 can also be integrated as an embedded functional module into the second device 103. The second device 103 can be a CPE, MIFI, Dongle, etc.
[0072] In this embodiment, the first device 101 and the communication module 102 are connected via a USB interface. The communication module 102 can enumerate the mass storage ports to the first device 101. The first device 101 can send corresponding instructions to the communication module 102 through the mass storage ports to enable the ADB tool. Then, the communication module can be accessed through the ADB tool. This eliminates the need to log in to the ADB tool through the ADB port of the communication module to access the communication module, thereby avoiding the risk of ADB port exposure.
[0073] The following describes the access method provided in the embodiments of this application.
[0074] Please see Figure 2 , Figure 2 This is a flowchart illustrating an access method provided in an embodiment of this application. Figure 2 As shown, the access method may include, but is not limited to, the following steps:
[0075] S201, the first device sends SCSI commands to the communication module through the mass storage port between the first device and the communication module. Correspondingly, the communication module receives SCSI commands from the first device through the mass storage port.
[0076] The communication module is plugged into the first device via a USB interface. The first device recognizes the communication module as a USB device and performs an enumeration process to enumerate the mass storage port and RNDIS port. During this enumeration process, the first device sends a series of control commands to the communication module to obtain communication module information, configure communication module parameters, and allocate system resources. For the mass storage port, the enumeration process checks whether the communication module supports mass storage protocols. Mass storage protocols are standard protocols used for transferring large amounts of data over interfaces such as USB. Mass storage protocols define how the communication module communicates with the first device, including data transfer, command interaction, and error handling. By implementing mass storage protocols, the communication module can be recognized as a mass storage device by the first device, and the mass storage port can be enumerated. The mass storage port, also known as the MASS port, allows the first device to recognize the communication module as an external storage device, such as a USB hard drive or flash drive. Through this port, the first device can read and write data on the communication module, typically for file transfer or storage.
[0077] In one possible implementation, the first device sends a SCSI command to the communication module via a mass storage port. This SCSI command instructs the ADB tool to be enabled. SCSI is a standard interface protocol used to connect communication modules in a computer system, primarily for data transfer and device control between the first device and the communication module. The SCSI command set contains a series of standard commands for data transfer, device control, task management, and query services.
[0078] The first device sends SCSI commands to the communication module through its high-capacity storage port, thereby enabling ADB tools. This eliminates the need for the communication module to enumerate ADB ports, avoiding the risk of ADB port exposure and improving the security of the communication module. Simultaneously, when accessing the communication module via SCSI commands, the communication module can verify the identity and permissions of the first device, ensuring that only authorized devices can perform debugging operations. This secure device access mechanism protects the stability of the communication module system and the security of its data.
[0079] S202, the communication module responds to SCSI commands and enables ADB tools.
[0080] The communication module receives a SCSI command from the first device, parses the SCSI command, and identifies the command type and parameters. In response to the SCSI command, it enables the ADB tool.
[0081] In one possible implementation, after the communication module enables the ADB tool, a default port is assigned to the ADB tool, and the ADB ports are re-enumerated for the first device to identify and connect to. Optionally, if the default port of the ADB tool is already in use, the next available port is automatically selected and logged to a log file for debugging.
[0082] S203, the first device sends a first login instruction to the communication module, the first login instruction including a first login password. Correspondingly, the communication module receives the first login instruction from the first device.
[0083] The first login command is `adb shell`, which also includes a first login password entered by the user. This first login command requests login to the ADB tool based on the first login password. In other words, it requests the startup of a remote command-line (Shell) environment based on the first login password. Through the Shell environment, users can directly perform various operations on the connected communication module using a series of ADB commands, covering functions such as file management, system debugging, application control, and performance monitoring. For example, the command `adb shell pm list packages` can be used to view application information in the communication module; the command `adb shell input` can simulate clicking, swiping, or pressing keys; the command `adb shell logcat` can be used to view the system or application logs of the communication module in real time; the command `adb pull` can be used to pull files from the communication module to the first device; and the command `adb push` can be used to push files from the first device to the communication module, etc.
[0084] S204, The communication module verifies the first login password.
[0085] After receiving the first login command, the communication module parses and verifies the first login password included in the first login command to ensure that it is consistent with the preset login password generated by the communication module.
[0086] In one possible implementation, the first device sends encrypted notification information to the communication module. This encrypted notification information includes the communication module's identifier and encryption method information. The notification information instructs the communication module to generate a preset login password based on the identifier, encryption method information, and salt value. After receiving the preset login password, the communication module sends encrypted response information to the first device. This response information includes the preset login password, allowing the user to access it.
[0087] In one possible implementation, the first device sends a startup notification to the communication module. This startup notification is used to launch the ADB access control application, and it can be a SCSI command. The first device also sends encrypted notification information to the communication module. This encrypted notification information includes the communication module's identifier and encryption method information. The encrypted notification information instructs the communication module's ADB access control application to generate a preset login password based on the communication module's identifier, encryption method information, and the communication module's salt value.
[0088] The identification code of the communication module is its International Mobile Equipment Identity (IMEI). The IMEI typically consists of 15 digits and serves as the communication module's "identity card," unique globally, used to identify the communication module in mobile networks. The IMEI allows users to query information such as the communication module's brand, model, and place of manufacture, aiding in authentication. The communication module must verify that its own identification code matches the identification code in the encrypted notification message before generating a preset login password, preventing unauthorized devices from accessing the network.
[0089] The encryption method information includes the identifiers for MD5, SHA256, or SHA512. MD5 is a widely used hash function that converts input data of any length into a fixed-length 128-bit hash value, typically represented as a 32-character hexadecimal string. The original data cannot be directly calculated from the MD5 hash result. SHA256 is an algorithm in the SHA-2 family that converts input data of any length into a fixed-length 256-bit hash value. Similar to MD5, SHA256 is irreversible, meaning the original data cannot be deduced from the hash value. SHA512 is also an algorithm in the SHA-2 family, similar to SHA256, but with a 512-bit output. SHA512 is often used to verify the integrity of large amounts of data, such as in file transfers and database backups. For systems with extremely high security requirements, SHA512 can be used to store user passwords, providing enhanced security.
[0090] The salt value of the communication module is stored within the module itself and is set by the module manufacturer. Optionally, the salt value can also be reset by the user and stored in the module. Based on the received identification code and encryption method information of the communication module, as well as the salt value stored in the module, the communication module generates a preset login password, enhancing the security of password storage and authentication.
[0091] In one possible implementation, the communication module receives a first login instruction from a first device and parses a first login password from the instruction. Simultaneously, the communication module retrieves encryption method information and its own salt value from encrypted notification information or local storage. It then parses the encryption algorithm and its parameters, such as hash algorithm, iteration count, and key length, from the encryption method information. Based on the encryption method information and the salt value, the communication module generates a local hash value (i.e., a preset login password). The module compares the recalculated preset login password with the received first login password. Based on the comparison result, the verification result of the first login password is obtained.
[0092] In one possible implementation, the SCSI command in step S201 is also used to instruct the ADB permission management application to be started. In response to the SCSI command, the ADB permission management application is started, and the first login password is verified by the ADB permission management application to obtain the verification result of the first login password.
[0093] S205, the communication module sends a first login response to the first device. Accordingly, the first device receives the first login response from the communication module.
[0094] In one possible implementation, the communication module obtains the verification result of the first login password, which indicates that the first login password matches the preset login password successfully. The module then sends a first login response to the first device, which indicates that the first login password matches the preset login password successfully.
[0095] In one possible implementation, the communication module receives the verification result of the first login password. If the verification result shows that the first login password fails to match the preset login password, the module sends a second login response to the first device. The second login response indicates that the first login password failed to match the preset login password. The second login response triggers the first device to send a second login instruction to the communication module. The second login instruction includes the second login password and requests to log in to the ADB tool based on the second login password. If the second login password successfully matches the preset login password, the communication module sends a third login response to the first device. The third login response indicates that the second login password successfully matches the preset login password, ensuring that only authorized devices can trigger ADB access and reducing the risk of unauthorized operations.
[0096] In one possible implementation, the first device sends three consecutive login commands to the communication module, each containing a different login password. The login response received by the first device from the communication module still indicates that the login password failed to match the preset password. At this point, the ADB tool will automatically lock, reducing the risk of password leakage and significantly improving the security, reliability, and user experience of the communication module.
[0097] S206, the first device sends a first ADB command to the communication module. Correspondingly, the communication module receives the first ADB command from the first device.
[0098] In one possible implementation, the first device, upon receiving a first login response from the communication module, logs into the ADB tool, i.e., starts a remote command-line (Shell) environment, and sends a first ADB command to the communication module based on the Shell environment. This first ADB command can be, for example, "adb shell pm list packages", "adb shellinput", "adb shell logcat", "adb pull", "adb push", etc.
[0099] In another possible implementation, the first device can send an ADB command whitelist query message to the communication module. This message requests access to the ADB command whitelist. Upon receiving the query message, the communication module sends an ADB command whitelist response message, which includes the ADB command whitelist. The whitelist contains at least one ADB command, which is executable by the communication module. Any ADB commands not included in the whitelist are not executable by the communication module.
[0100] The first device sends a first ADB command to the communication module based on the ADB command whitelist, and the ADB command whitelist includes the first ADB command.
[0101] S207, the communication module responds to the ADB instruction whitelist including the first ADB instruction and executes the first ADB instruction.
[0102] In one possible implementation, after the communication module receives the first ADB instruction from the first device, it executes the first ADB instruction in response to the ADB instruction whitelist including the first ADB instruction.
[0103] In one possible implementation, after receiving a first ADB command from a first device, the communication module does not execute the first ADB command if it is not included in the ADB command whitelist. This ADB command whitelist mechanism limits the range of executable ADB commands, thus improving the security of the communication module.
[0104] S208, the communication module sends a first ADB response to the first device. Correspondingly, the first device receives the first ADB response from the communication module.
[0105] Upon receiving a first ADB command from the first device, the communication module, in response to the ADB command whitelist including the first ADB command, executes the first ADB command and sends a first ADB response to the first device. The first ADB response indicates that the first ADB command belongs to the ADB command whitelist and that the first ADB command has been executed.
[0106] In one possible implementation, in response to the fact that the ADB command whitelist does not include the first ADB command, a second ADB response is sent to the first device. The second ADB response is used to indicate that the first ADB command is an ADB command outside the ADB command whitelist, triggering the first device to send the second ADB command to the communication module.
[0107] In response to the ADB command whitelist including the second ADB command, the communication module executes the second ADB command and sends a third ADB response to the first device; the third ADB response is used to indicate that the second ADB command belongs to the ADB command whitelist and that the second ADB command is executed; or, in response to the ADB command whitelist not including the second ADB command, the communication module sends a fourth ADB response to the first device; the fourth ADB response is used to indicate that the second ADB command is an ADB command outside the ADB command whitelist.
[0108] As can be seen, the access method provided in this application embodiment enables ADB tools via SCSI commands and completes authentication based on a first login password, ensuring that only authorized devices can trigger ADB access and reducing the risk of unauthorized operations. Simultaneously, the communication module only executes ADB commands belonging to a preset whitelist; even if the password is leaked, illegal commands will be intercepted, preventing malicious operations or data leaks, thus improving the security of the communication module during access.
[0109] Please see Figure 3 , Figure 3 This is a flowchart illustrating another access method provided in an embodiment of this application.
[0110] like Figure 3 As shown, the access method may include, but is not limited to, the following steps:
[0111] S301, the first device sends an encrypted notification message to the communication module. Correspondingly, the communication module receives the encrypted notification message from the first device.
[0112] In this embodiment, the encrypted notification information includes the identification code of the communication module and encryption method information. The encrypted notification information instructs the communication module to generate a preset login password based on the encrypted notification information and the salt value of the communication module. The encryption method information includes MD5 identification information, SHA256 identification information, or SHA512 identification information. The identification code of the communication module and the encryption method information are input by the user. MD5, SHA256, and SHA512 are three asymmetric encryption methods, which the user can choose as needed to avoid security vulnerabilities caused by a single algorithm.
[0113] For example, "1" represents the MD5 identifier, indicating that MD5 is selected as the encryption method; "2" represents the SHA256 identifier, indicating that SHA256 is selected as the encryption method; and "3" represents the SHA512 identifier, indicating that SHA512 is selected as the encryption method. When the user inputs "123456789012345,3", "123456789012345" is the communication module's identifier, i.e., the IMEI of the communication module, consisting of 15 digits; and "3" indicates that the user has selected SHA512 as the encryption method.
[0114] S302, the communication module generates a preset login password based on the encrypted notification information and the salt value of the communication module.
[0115] In this embodiment, the communication module generates a preset login password based on the communication module's identifier and encryption method information in the encrypted notification information, as well as the communication module's salt value.
[0116] S303, the communication module sends an encrypted response message to the first device. Correspondingly, the first device receives the encrypted response message from the communication module.
[0117] In this embodiment, after obtaining the preset login password, the communication module sends an encrypted response message to the first device. The encrypted response message includes the preset login password.
[0118] S304, the first device sends SCSI commands to the communication module through the mass storage port between them. Correspondingly, the communication module receives SCSI commands from the first device through the mass storage port.
[0119] The S305 communication module responds to SCSI commands and enables ADB tools.
[0120] S306, the first device sends a first login instruction to the communication module, the first login instruction including a first login password. Correspondingly, the communication module receives the first login instruction from the first device.
[0121] S307, the communication module verifies the first login password.
[0122] S308, the communication module sends a first login response to the first device. Correspondingly, the first device receives the first login response from the communication module.
[0123] S309, the first device sends a first ADB command to the communication module. Correspondingly, the communication module receives the first ADB command from the first device.
[0124] The specific implementation methods of steps S304-S309 can be found above. Figure 2 Steps S201-S206 in the process will not be described again here.
[0125] S310, the communication module determines whether the first ADB instruction belongs to the ADB instruction whitelist.
[0126] In this embodiment, the communication module includes an ADB command whitelist, which contains at least one executable ADB command. ADB commands not in the whitelist are non-executable. The at least one ADB command in the whitelist is set by the communication device manufacturer, and optionally, can be reset by the user.
[0127] For example, the ADB command whitelist may include "adb pull", "adb push", "adb usb", "adb tcpip", "adb root", etc., where "adb pull" is used to pull files from the communication module to the first device; "adb push" is used to push files from the first device to the communication module; "adb usb" is used to switch to connecting the communication module and the first device via USB; "adb tcpip" is used to switch to connecting the communication module and the first device via WiFi wirelessly; and "adb root" restarts the ADB daemon process as the root user, thereby obtaining higher privileges, such as accessing system partitions and modifying system files.
[0128] After receiving the first ADB command from the first device, the communication module determines whether the first ADB command belongs to the ADB command whitelist based on the ADB command whitelist.
[0129] S311, the communication module sends a second ADB response to the first device. Accordingly, the first device receives the second ADB response from the communication module.
[0130] In this embodiment of the application, in response to the fact that the ADB instruction whitelist does not include the first ADB instruction, the communication module sends a second ADB response to the first device; the second ADB response is used to indicate that the first ADB instruction is an ADB instruction outside the ADB instruction whitelist.
[0131] S312, the communication module executes the first ADB instruction.
[0132] In this embodiment of the application, in response to the ADB instruction whitelist including the first ADB instruction, the first ADB instruction is executed.
[0133] S313, the communication module sends a first ADB response to the first device. Correspondingly, the first device receives the first ADB response from the communication module.
[0134] In this embodiment of the application, in response to the ADB command whitelist including a first ADB command, the first ADB command is executed, and a first ADB response is sent to the first device. The first ADB response includes the execution result of the first ADB command, and the first ADB response is used to indicate that the first ADB command belongs to the ADB command whitelist and that the first ADB command has been executed.
[0135] As can be seen, the embodiments of this application combine multiple security mechanisms such as SCAI communication, IMEI uniqueness, asymmetric encryption technology, account login, and blacklist / whitelist management to ensure the security of the communication module during access.
[0136] The following describes the access device provided in the embodiments of this application.
[0137] Please refer to Figure 4 , Figure 4 This is a schematic diagram of an access device provided in an embodiment of this application. The access device may include a transceiver unit 410 and a processing unit 420. The transceiver unit 410 may be a device that has signal input (receive) or output (transmit) for transmitting signals to other devices or other components in a device.
[0138] The processing unit 420 can be a device with processing capabilities, and may include one or more processors. The processor can be a general-purpose processor or a dedicated processor. The processor can be a baseband processor or a central processing unit (CPU). The baseband processor can be used to process communication protocols and communication data, while the CPU can be used to control the device (e.g., a host node, relay node, or chip), execute software programs, and process data from the software programs.
[0139] The access device may be a first device or a communication module, or a device for implementing the functions of the first device or the communication module, such as a chip.
[0140] When the access device is a first device, the access device includes:
[0141] The transceiver unit 410 is configured to send SCSI commands to the communication module via a high-capacity storage port; the SCSI commands are used to indicate that the ADB tool is enabled; in response to the ADB tool being enabled, a first login command is sent to the communication module; the first login command includes a first login password and is used to request login to the ADB tool based on the first login password; in response to receiving a first login response from the communication module, a first ADB command is sent to the communication module; the first login response is used to indicate that the first login password matches a preset login password successfully; the first ADB command is used to request access to the communication module; and a first ADB response is received from the communication module; the first ADB response is used to indicate that the first ADB command belongs to the ADB command whitelist and that the first ADB command is executed.
[0142] In one possible implementation, the transceiver unit 410 is further configured to send encrypted notification information to the communication module; the encrypted notification information includes the identification code and encryption method information of the communication module, and the encrypted notification information is used to instruct the communication module to generate a preset login password based on the identification code, encryption method information and salt value of the communication module; and to receive encrypted response information from the communication module; the encrypted response information includes the preset login password.
[0143] In one possible implementation, the encryption method information mentioned above includes MD5 identification information, SHA256 identification information, or SHA512 identification information.
[0144] In one possible implementation, the transceiver unit 410 is further configured to send a second login instruction to the communication module in response to receiving a second login response from the communication module; the second login response is used to indicate that the first login password fails to match the preset login password; the second login instruction includes a second login password and is used to request to log in to the ADB tool based on the second login password.
[0145] In one possible implementation, the transceiver unit 410 is further configured to send ADB command whitelist query information to the communication module; the ADB command whitelist query information is used to request a query of the ADB command whitelist; receive ADB command whitelist response information from the communication module; the ADB command whitelist response information includes the ADB command whitelist; and send a first ADB command to the communication module based on the ADB command whitelist, the ADB command whitelist including the first ADB command.
[0146] In one possible implementation, the transceiver unit 410 is further configured to receive a second ADB response from the communication module; the second response information is used to indicate that the first ADB instruction is an ADB instruction outside the ADB instruction whitelist.
[0147] Alternatively, when the access device is a communication module, the access device includes:
[0148] The transceiver unit 410 is used to receive SCSI commands from the first device through the mass storage port; the SCSI commands are used to indicate that the ADB tool is enabled.
[0149] Processing unit 420 is used to enable ADB tools in response to SCSI commands.
[0150] The transceiver unit 410 is further configured to receive a first login instruction from the first device; the first login instruction includes a first login password, and the first login instruction is used to request login to the ADB tool based on the first login password; in response to the first login password successfully matching the preset login password, the transceiver unit 410 sends a first login response to the first device, and the first login response is used to indicate that the first login password successfully matches the preset login password; and receives a first ADB instruction from the first device; the first ADB instruction is used to request access to the communication module.
[0151] The processing unit 420 is further configured to, in response to the ADB instruction whitelist including the first ADB instruction, execute the first ADB instruction and send a first ADB response to the first device; the first ADB response is used to indicate that the first ADB instruction belongs to the ADB instruction whitelist and that the first ADB instruction has been executed.
[0152] In one possible implementation, the processing unit 420 is also configured to, in response to a SCSI command, launch an ADB access control application and verify the first login password through the ADB access control application.
[0153] In one possible implementation, the transceiver unit 410 is further configured to send a second ADB response to the first device in response to the fact that the ADB instruction whitelist does not include the first ADB instruction; the second ADB response is used to indicate that the first ADB instruction is an ADB instruction outside the ADB instruction whitelist.
[0154] For a description of the technical effects of the access device and any of its possible implementations, please refer to the description of the technical effects of the foregoing method embodiments; further details will not be repeated here.
[0155] According to the embodiments of this application, Figure 4The various units in the access device shown can be individually or entirely combined into one or more other units, or some of the units can be further divided into multiple functionally smaller units. This can achieve the same operation without affecting the technical effects of the embodiments of this application. The above units are based on logical function division. In practical applications, the function of one unit can also be implemented by multiple units, or the function of multiple units can be implemented by one unit.
[0156] This application also provides a computer device; please refer to [link / reference]. Figure 5 , Figure 5 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application.
[0157] like Figure 5 As shown, the computer device 500 may include one or more processors 510, one or more memories 530, one or more communication interfaces 520, and a bus 540, wherein the processors 510, memories 530, and communication interfaces 520 are connected via the bus 540. The computer device may be the access device 400 described above.
[0158] The memory 530 is used to store a program; the processor 510 is used to execute the program stored in the memory. When the program is executed, the processor 510 performs the method as described in any of the possible implementations of the communication method.
[0159] It should be understood that, in the embodiments of this application, the memory 530 mentioned above includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or compact disc read-only memory (CDROM), as well as external memory other than computer memory and processor cache. A portion of the memory 530 may also include non-volatile random access memory. For example, the memory 530 may also store device type information.
[0160] The processor 510 described above can be one or more Central Processing Units (CPUs). If the processor 510 is a CPU, it can be a single-core CPU or a multi-core CPU. The processor 510 can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.
[0161] The steps performed in the foregoing embodiments can be based on the above. Figure 5 The computer device 500 shown is implemented such that the processor 510 can execute any of the optional implementations of the access method provided in this application, as described in any of the embodiments, or it can execute the implementation of the access device 400 described in this application. Specifically, the processor 510 can implement... Figure 4 The processing unit 420 in the access device 400 shown in the figure has the function of [function name missing]. The communication interface 520 can implement the function of the transceiver unit 410 in the access device 400 shown in the figure. The memory 530 can provide a cache when the processor 510 executes the implementation of the access device 400 described in the embodiments of this application, and can also store the computer programs required by the processor 510 to execute the implementation of the access device 400 described in the embodiments of this application.
[0162] This application also provides a computer storage medium storing a computer program, the computer program including program instructions, which, when executed by a processor, enable the processor to implement the above-mentioned functions. Figure 2 or Figure 3 The method shown.
[0163] This application also provides a computer program product, which includes: instructions or a computer program; when the instructions or the computer program are executed, the above-mentioned functions can be achieved. Figure 2 or Figure 3 The method shown.
[0164] This application also provides a chip, which includes a processor. The processor executes instructions, enabling the chip to achieve the aforementioned... Figure 2 or Figure 3 The method shown is described above. Optionally, the chip also includes a communication interface for receiving or transmitting signals.
[0165] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by hardware related to computer programs. The computer programs can be stored in computer storage media, and when executed, they can implement the processes of the above method embodiments. The aforementioned computer storage media include various media capable of storing computer program code, such as read-only memory (ROM) or random access memory (RAM), magnetic disks, or optical disks.
Claims
1. An access method, characterized in that, include: A Small Computer System Interface (SCSI) command is sent to the communication module via a high-capacity storage port; the SCSI command is used to instruct the Android Debug Bridge (ADB) tool to be enabled. In response to the ADB tool being enabled, a first login instruction is sent to the communication module; the first login instruction includes a first login password, and the first login instruction is used to request to log in to the ADB tool based on the first login password; In response to receiving a first login response from the communication module, a first ADB command is sent to the communication module; The first login response indicates that the first login password matches the preset login password successfully; the first ADB command requests access to the communication module. Receive a first ADB response from the communication module; the first ADB response is used to indicate that the first ADB instruction belongs to the ADB instruction whitelist and that the first ADB instruction is executed.
2. The method as described in claim 1, characterized in that, The method further includes: Send encrypted notification information to the communication module; the encrypted notification information includes the identification code of the communication module and encryption method information, and the encrypted notification information is used to instruct the communication module to generate the preset login password based on the identification code of the communication module, the encryption method information and the salt value of the communication module; Receive encrypted response information from the communication module; the encrypted response information includes the preset login password.
3. The method as described in claim 1, characterized in that, The method further includes: In response to receiving a second login response from the communication module, a second login instruction is sent to the communication module; the second login response is used to indicate that the first login password fails to match the preset login password; the second login instruction includes a second login password, and the second login instruction is used to request to log in to the ADB tool based on the second login password.
4. The method as described in claim 1, characterized in that, The method further includes: Send ADB command whitelist query information to the communication module; the ADB command whitelist query information is used to request a query of the ADB command whitelist; Receive ADB command whitelist response information from the communication module; the ADB command whitelist response information includes the ADB command whitelist. Sending the first ADB command to the communication module includes: Based on the ADB instruction whitelist, a first ADB instruction is sent to the communication module, wherein the ADB instruction whitelist includes the first ADB instruction.
5. The method as described in claim 1, characterized in that, The method further includes: Receive a second ADB response from the communication module; the second response information is used to indicate that the first ADB instruction is an ADB instruction not included in the ADB instruction whitelist.
6. An access method, characterized in that, include: SCSI commands are received from the first device via the high-capacity storage port; the SCSI commands are used to instruct the ADB tool to be enabled. In response to the SCSI command, enable the ADB tool; Receive a first login instruction from the first device; the first login instruction includes a first login password, and the first login instruction is used to request to log in to the ADB tool based on the first login password; In response to the successful match between the first login password and the preset login password, a first login response is sent to the first device, the first login response being used to indicate that the first login password and the preset login password have successfully matched. Receive a first ADB instruction from the first device; the first ADB instruction is used to request access to the communication module. In response to the ADB command whitelist including the first ADB command, the first ADB command is executed, and a first ADB response is sent to the first device; the first ADB response is used to indicate that the first ADB command belongs to the ADB command whitelist and that the first ADB command is executed.
7. The method as described in claim 6, characterized in that, The method further includes: In response to the fact that the first ADB instruction is not included in the ADB instruction whitelist, a second ADB response is sent to the first device; the second ADB response is used to indicate that the first ADB instruction is an ADB instruction not included in the ADB instruction whitelist.
8. An access device, characterized in that, The access device includes units for implementing the method as described in any one of claims 1-5, or includes units for implementing the method as described in claims 6-7.
9. A computer device, characterized in that, include: Memory, processor; where: The memory is used to store computer programs, the computer programs including program instructions; The processor is configured to invoke the program instructions to cause the computer device to perform the method as described in any one of claims 1-5, or to perform the method as described in claims 6-7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1-5, or performs the method as described in claims 6-7.