A USB device identification and access method and system based on a computer operating system

Abstract

This invention provides a USB device identification and access method and system based on a computer operating system, relating to the field of data security technology. The USB device identification and access system includes: acquiring an access signal from the USB interface to the USB device; sequentially calling each preset trusted driver in a shared driver library to attempt a connection with the USB device based on the access signal, and obtaining the attempt result; when the USB device matches and connects with the corresponding preset trusted driver, maintaining continued communication between the preset trusted driver and the USB device based on the access signal; when the USB device cannot match the preset trusted driver, performing a trustworthiness isolation analysis on the USB device, generating an analysis result, and controlling the configuration of the corresponding driver and access environment based on the analysis result to complete the identification and access of the USB device. The access method and system provided by this invention can effectively ensure data security when the computer operating system accesses a USB device.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a method and system for identifying and connecting USB devices based on a computer operating system. Background Technology

[0002] With the increasing number of USB peripheral devices for computers, such as keyboards, mice, modems, printers, scanners, digital cameras, and MP3 players, all can connect to computer devices via USB connectors. For critical mainframe equipment in enterprises and institutions, high security of system data is paramount. This can be achieved through measures such as preventing leaks and protecting against virus infections. However, peripheral USB devices are also a major factor posing a threat to computer operating systems; therefore, the security of USB device access within the computer operating system is crucial.

[0003] In existing methods, when a USB device is connected to a computer operating system via a USB interface, the operating system typically needs to obtain device information from the USB device to select the appropriate driver and establish communication between the two. However, during the process of the operating system issuing query commands and retrieving device information from the USB device, data security vulnerabilities can still arise in the operating system due to data transmission between the two devices. Summary of the Invention

[0004] This invention provides a USB device identification and access method and system based on a computer operating system, in order to solve the technical problem in the prior art where the computer operating system may have data security risks due to the data transmission between the computer operating system and the USB device during the process of the computer operating system issuing query commands to the USB device and obtaining the device information of the USB device.

[0005] To achieve the above and other related objectives, this invention provides a USB device identification and access method based on a computer operating system. The method, applied to a computer operating system, includes: acquiring an access signal from a USB interface to a USB device; sequentially calling each preset trusted driver in a shared driver library to attempt a connection with the USB device based on the access signal, thereby obtaining the attempt result, wherein the shared driver library includes multiple preset trusted drivers; when the attempt result indicates that the USB device matches and connects with the corresponding preset trusted driver, maintaining continued communication between the preset trusted driver and the USB device based on the access signal; when the attempt result indicates that the USB device and the preset trusted driver cannot match, performing a trustworthiness isolation analysis on the USB device, generating an analysis result, and controlling and configuring the corresponding driver and access environment based on the analysis result to complete the identification and access of the USB device.

[0006] In one embodiment of the present invention, according to the access signal, each preset trusted driver in the shared driver library is sequentially invoked to attempt to connect with the USB device to obtain the attempt result, including: detecting the operation request of the USB device according to the access signal; based on the operation request, searching in the shared driver library through the calling module for several preset trusted drivers that cover the calling range corresponding to the operation request, as adapter drivers; and attempting to connect the operation request with the USB device through each adapter driver to obtain the attempt result.

[0007] In one embodiment of the present invention, the operation request includes a first operation request initiated by the computer operating system to the USB device; based on the operation request, a plurality of preset trusted drivers covering the calling scope corresponding to the operation request are searched in a shared driver library by a calling module as adaptation drivers, including: when the operation request is detected to be a first operation request initiated to the USB device, performing a requirement analysis on the first operation request to extract multiple requirement information corresponding to the driver requirements; calculating the matching degree of each requirement information corresponding to the same preset trusted driver. Based on the matching degree corresponding to each demand information Indicator factors corresponding to demand information The comprehensive matching index of the same preset trusted driver was calculated. For all preset trusted drivers and their corresponding comprehensive matching metrics Construct a comprehensive matching index set ; Determine the comprehensive matching index set Each comprehensive matching index Has the indicator threshold been reached? If yes, it means that the corresponding preset trusted driver covers the calling scope of the operation request, and the corresponding preset trusted driver is used as the adapter driver; if no, it means that the corresponding preset trusted driver cannot cover the calling scope of the operation request, and the corresponding preset trusted driver is discarded.

[0008] In one embodiment of the present invention, the operation request is attempted to connect to the USB device through each adapter driver to obtain the attempt result, including: based on the comprehensive matching index corresponding to each adapter driver. The system sorts the compatible drivers by size to obtain a sequence of compatible drivers. It then sequentially selects each compatible driver in the sequence to send the first operation request to the USB device. Feedback information from the USB device is received and split into multiple segments, each corresponding to a specific requirement in the first operation request. Each segment in the feedback information is compared with its corresponding requirement. If both the feedback and requirement information match, the USB device is successfully connected to the corresponding compatible driver. If at least one feedback message does not match the corresponding requirement, the USB device is considered unsuitable for connection with the corresponding compatible driver.

[0009] In one embodiment of the present invention, the operation request includes a second operation request initiated by the USB device to the computer operating system; when the operation request is the second operation request, all preset trusted drivers are used as adapter drivers; the operation request is attempted to connect with the USB device through each adapter driver to obtain the attempt result, including: sending the second operation request to each adapter driver respectively, obtaining the corresponding execution result data through the preset trusted driver; determining whether the execution result data belongs to a security instruction; if so, matching and connecting the USB device with the adapter driver corresponding to the execution result data is taken as the attempt result; if not, the USB device and the adapter driver cannot be matched as the attempt result.

[0010] In one embodiment of the present invention, determining whether the execution result data belongs to a security instruction includes: comparing the execution result data with each security instruction under the corresponding adapter driver to obtain a similarity value. Construct a similarity set Find the similarity set Maximum similarity value Determine the maximum similarity value Does it exceed the similarity threshold of the corresponding security directive? If yes, then the execution result data belongs to a safe instruction; if no, then the execution result data does not belong to a safe instruction.

[0011] In one embodiment of the present invention, performing a trustworthiness isolation analysis on a USB device and generating an analysis result includes: transferring the USB device to an isolation detection module, wherein the isolation detection module is used to receive remote control instructions issued by a computer operating system, the remote control instructions including a first remote control instruction for retrieving device information, a second remote control instruction for remotely verifying and controlling the isolation detection module, and a third remote control instruction for remotely calling and controlling the isolation detection module's device driver; sending the first remote control instruction to the isolation detection module; scanning the printing device information of the USB device by the isolation detection module to obtain the scanning device information of the USB device, wherein the printing device information is obtained by the isolation detection module after retrieving the device information of the USB device according to the first remote control instruction and then printing it; determining whether there is corresponding policy information consistent with the scanning device information according to the policy information in the policy rule information database; if yes, determining that the USB device is allowed to be accessed as the first analysis result; if no, further analyzing the USB device using the isolation detection module through the second remote control instruction to generate a second analysis result.

[0012] In one embodiment of the present invention, the USB device is further analyzed by the isolation detection module using a second remote control command to generate a second analysis result, including: configuring a corresponding third remote control command based on the device information corresponding to the USB device; remotely sending the third remote control command to the isolation detection module, wherein the isolation detection module calls the corresponding device driver according to the third remote control command to establish communication between the isolation detection module and the USB device; while the isolation detection module is communicating with the USB device, the second remote control command is wirelessly sent to the isolation detection module sequentially according to a preset security verification strategy to obtain the difference data before and after each execution of the second remote control command by the isolation detection module on the USB device, wherein the difference data is data related to the USB device before and after access; based on the difference data... Difference data Number of types and each difference data Corresponding weight Assess risk indicators for USB devices ,in, This is the cumulative value of the difference data; when the risk indicator If the risk level exceeds the first risk indicator threshold, then the USB device will not be allowed to connect, which will be considered the second analysis result; when the risk indicator... If the value is less than the second risk indicator threshold, then allowing the USB device to be connected will be considered as the second analysis result.

[0013] In one embodiment of the present invention, the USB device is further analyzed by the isolation detection module using a second remote control command to generate a second analysis result, including: configuring a corresponding third remote control command based on the device information corresponding to the USB device; remotely sending the third remote control command to the isolation detection module, wherein the isolation detection module calls the corresponding device driver according to the third remote control command to establish communication between the isolation detection module and the USB device; while the isolation detection module is communicating with the USB device, receiving a call signal for the second remote control command, retrieving the corresponding second remote control command and wirelessly sending it to the isolation detection module to obtain the difference data before and after each execution of the second remote control command by the isolation detection module on the USB device, wherein the difference data is data related to the USB device before and after access. ; Determine the difference in data Whether the acquisition conditions are met, including whether the trend of the difference values ​​in the difference data tends to be stable, and the number of times the difference data is acquired when the trend of the difference values ​​tends to be stable. More than the set number of times If so, then based on the difference data. Difference data Number of types Number of times and each difference data Corresponding weight Assess risk indicators for USB devices When risk indicators If the risk level exceeds the first risk indicator threshold, then the USB device will not be allowed to connect, which will be considered the second analysis result; when the risk indicator... If the value is less than the second risk indicator threshold, then allowing the USB device to be connected will be considered as the second analysis result.

[0014] To achieve the above and other related objectives, the present invention also provides a USB device identification and access system based on a computer operating system, applied to a computer operating system, comprising: an acquisition unit for acquiring access signals from a USB interface to a USB device; a connection attempt unit for sequentially calling each preset trusted driver in a shared driver library to attempt connection with the USB device according to the access signal, thereby obtaining the attempt result, wherein the shared driver library includes multiple preset trusted drivers; a communication control unit for maintaining continued communication between the preset trusted driver and the USB device according to the access signal when the attempt result indicates that the USB device matches the corresponding preset trusted driver; and an analysis and configuration unit for performing a trustworthiness isolation analysis on the USB device, generating an analysis result, and controlling the configuration of the corresponding driver and access environment based on the analysis result to complete the identification and access of the USB device.

[0015] The beneficial effects of this invention are as follows: This invention proposes a USB device identification and access method and system based on a computer operating system. After a USB device is connected to the USB interface, each preset trusted driver in the shared driver library is sequentially invoked to attempt a connection with the USB device. This effectively enables rapid matching of trusted USB devices based on trusted preset trusted drivers, thereby ensuring secure communication between the computer operating system and the USB device. Furthermore, if no corresponding preset trusted driver is found in the shared driver library, the risk indicators of the USB device can be analyzed and evaluated by using an isolation detection module to isolate access. Based on these risk indicators, the security of the USB device's access to the computer operating system is determined. Upon confirmation of security, the corresponding device driver is invoked to securely connect the USB device to the computer operating system, thus effectively improving data security when the computer operating system connects to USB devices. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0017] In the attached diagram:

[0018] Figure 1 This is a flowchart illustrating a USB device identification and access method based on a computer operating system, provided in an embodiment of the present invention.

[0019] Figure 2 This is a schematic diagram illustrating the instruction coordination process between the computer operating system and the isolation detection module, as provided in an embodiment of the present invention.

[0020] Figure 3 The diagram shown is a structural block diagram of a USB device identification and access system based on a computer operating system, provided in an embodiment of the present invention.

[0021] Figure 4 The diagram shown is a structural schematic of an electronic device according to an embodiment of the present invention.

[0022] The attached figures are labeled as follows:

[0023] Electronic device 1; USB device identification and access system 11 based on computer operating system; memory 12; processor 13; acquisition unit 111; connection attempt unit 112; communication control unit 113; analysis and configuration unit 114. Detailed Implementation

[0024] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments. Various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0025] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. The drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0026] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the invention. However, it will be apparent to those skilled in the art that embodiments of the invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the invention.

[0027] This invention provides a USB device identification and access method based on a computer operating system. When a USB device is plugged into a USB interface, the method analyzes and invokes relevant preset trusted drivers based on the USB device's access signal. Each preset trusted driver is sequentially attempted to connect to the USB device. If the connection attempt is successful, the USB device is considered trustworthy, and the corresponding preset trusted driver directly provides communication services to the USB device. If the connection attempt fails, the method performs a trustworthiness analysis of the USB device to determine its trustworthiness without communicating with the computer operating system. Based on the analysis results, the method can adjust the USB device's driver and access environment, thereby achieving secure access to the USB device. This method enables fast communication between preset types of trusted USB devices and the computer operating system through driver matching, without needing to access USB device information. This addresses the risk of reading device information from unknown USB devices when the computer operating system actively accesses and queries device information. Furthermore, when attempting to connect using a pre-set trusted driver fails, the trustworthiness of the unknown USB device can be further assessed by isolating it to determine whether the USB device can be recognized and connected, thereby ensuring the security of the USB device's connection to the computer operating system.

[0028] Figure 1 A flowchart illustrating a USB device identification and access method based on a computer operating system according to an exemplary embodiment of this application is shown. The method is applied to a computer operating system and includes steps S10-S40. The following will be combined with… Figure 1 The technical solution of this application will be described in detail below.

[0029] First, execute step S10 to obtain the USB interface's access signal to the USB device.

[0030] When a USB device attempts to establish a connection with a computer operating system, the USB interface communicates with the computer operating system through an interface switching module when the USB plug of the USB device is plugged into the USB interface. The interface switching module sends the access signal of the USB device to the computer operating system, so that the computer operating system can obtain the access signal of the USB device and, based on the access signal, attempt to communicate with the USB device by calling various preset trusted drivers in the shared driver library.

[0031] Next, step S20 is executed, in which each preset trusted driver in the shared driver library is called in turn to attempt to connect to the USB device according to the access signal, so as to obtain the attempt result. The shared driver library includes multiple preset trusted drivers.

[0032] When a computer operating system receives an access signal from a USB device, it directly calls a pre-configured shared driver library. Each preset trusted driver within this library attempts to connect to the USB device, thus determining whether the USB device matches the corresponding preset trusted driver or not. Each preset trusted driver in the shared driver library can be manually pre-defined. For example, when the USB device is a common USB mouse, keyboard, or USB key, the corresponding trusted driver can be pre-defined. These preset trusted drivers can be stored in the shared driver library or in a driver manifest. When a preset trusted driver is needed, it can be retrieved directly from the stored location using the corresponding number in the driver manifest to attempt a connection with the detected USB device.

[0033] In step S20, based on the access signal, each preset trusted driver in the shared driver library is sequentially invoked to attempt a connection with the USB device to obtain the attempt result, including:

[0034] Based on the access signal, detect the operation request of the USB device;

[0035] Based on the operation request, the calling module searches in the common driver library for several preset trusted drivers that cover the calling scope corresponding to the operation request, and uses them as the adaptation drivers.

[0036] The operation request attempts to connect to the USB device through each adapter driver to obtain the attempt result.

[0037] When a computer operating system receives an access signal from a USB device and attempts to connect using a pre-defined trusted driver, to improve the efficiency of this connection attempt, a preliminary screening of pre-defined trusted drivers in a shared driver library can be performed based on the relevant operation request. This allows the system to identify multiple pre-defined trusted drivers that cover the scope of the operation request and select them as the appropriate adapter drivers. Then, the operation request is sequentially sent to each adapter driver to attempt communication with the USB device. The result is determined based on the feedback data received from the USB device by the computer operating system. For example, when the computer operating system attempts to connect to the corresponding USBKey device using the adapter driver corresponding to the USBKey, after the operation request is sent to the USBKey device via the adapter driver, the computer operating system receives feedback data from the USBKey device. Based on this feedback data, the operating system determines which adapter driver is suitable for communication between the USBKey device and the computer operating system. Of course, to ensure the accuracy of the feedback data, we can also check the data format and the degree of matching with the operation request to determine whether the feedback data is incorrect. If the feedback data is correct, the corresponding adapter driver can be used as the driver for the corresponding USBKey device to communicate with the computer operating system.

[0038] Conversely, if the USB device is a USB storage device, and there is no default trusted driver corresponding to the USB storage device in the shared driver library, then the default trusted driver that enables the USB storage device to establish communication with the computer operating system cannot be obtained through the operation request. This will result in the USB device and the default trusted driver being mismatched, and the result of the attempt will be that the USB device and the default trusted driver are mismatched.

[0039] The operation request includes the first operation request initiated by the computer operating system to the USB device.

[0040] When the operation request is the first operation request, based on the operation request, the calling module searches in the common driver library for several preset trusted drivers that cover the calling scope corresponding to the operation request, and uses them as adaptation drivers. These drivers may further include:

[0041] When an operation request is detected as the first operation request initiated to the USB device, a requirement analysis is performed on the first operation request to extract multiple requirement information corresponding to the driver requirements.

[0042] Calculate the matching degree of each requirement information to the same preset trusted driver. ;

[0043] Based on the matching degree corresponding to each demand information Indicator factors corresponding to demand information The comprehensive matching index of the same preset trusted driver was calculated. ;

[0044] For all preset trusted drivers and their corresponding comprehensive matching metrics Construct a comprehensive matching index set ;

[0045] Judgment of comprehensive matching index set Each comprehensive matching index Has the indicator threshold been reached? :

[0046] If so, it means that the corresponding preset trusted driver covers the calling scope of the operation request, and the corresponding preset trusted driver is used as the adapter driver;

[0047] If not, it means that the corresponding preset trusted driver cannot cover the calling scope of the operation request, and the corresponding preset trusted driver will be discarded.

[0048] When searching for a preset trusted driver in a shared driver library using a calling module in the computer operating system, once the operation request is identified as the first operation request, demand information analysis can be performed directly on that first operation request to extract all the demand information corresponding to it. This first operation request can be an operation request initiated by a USBKey device, and the demand information corresponding to this request can include the digital transaction amount, digital transaction party information, etc. Then, each preset trusted driver will calculate the matching degree between each demand information and the preset trusted driver based on the corresponding demand information. Based on all matching degrees corresponding to the operation request To determine the comprehensive matching metrics for each preset trusted driver. An evaluation and calculation were performed. This was to ensure the overall matching indicators were accurate. The accuracy can be improved by using indicator factors. To adapt the matching degree corresponding to each type of information requirement. Then, based on all the adaptation results, the comprehensive matching index of each preset trusted driver is calculated by superimposing the results. That is, the formula is expressed as .

[0049] After obtaining the comprehensive matching index of each preset trusted driver Then, by further judging the comprehensive matching indicators Has the indicator threshold been reached? If so, it indicates the current comprehensive matching index. The corresponding preset trusted driver can be used as the adapter driver; otherwise, it indicates that the current overall matching index is not suitable. The corresponding default trusted driver cannot be used to attempt to establish a connection between the computer operating system and the corresponding USB device. This filtering method can effectively reduce the number of connection attempts and the connection attempt load of default trusted drivers in the shared driver library, thereby improving connection attempt efficiency.

[0050] Specifically, attempting to connect to the USB device via each adapter driver to obtain the connection result may further include:

[0051] Based on the comprehensive matching metrics corresponding to each adapter driver The size is used to sort the adapter drivers, resulting in a sequence of adapter drivers;

[0052] Each adapter driver in the adapter driver sequence is selected in turn to send the first operation request to the USB device;

[0053] Receive feedback information from the USB device, split the feedback information into multiple split pieces, where each split piece corresponds to each requirement piece of information corresponding to the first operation request;

[0054] Compare each segment of the feedback information with the corresponding requirement information;

[0055] If the feedback information matches the requirement information, then the USB device will be matched and connected with the corresponding adapter driver as the result of the attempt.

[0056] If at least one feedback message does not match the corresponding requirement information, then the result of the attempt is that the USB device and the corresponding adapter driver cannot be matched.

[0057] Furthermore, to improve connection attempt efficiency, after selecting compatible drivers, the comprehensive matching metrics corresponding to each compatible driver can be analyzed. The process involves comparing the sizes of the compatible drivers to sort them, either from largest to smallest or smallest to largest. After sorting, a sequence of compatible drivers is obtained. If the compatible drivers in the sequence are arranged in descending order, each driver in the sequence is selected sequentially, and the first operation request is attempted to be sent to the USB device through each selected driver. When the USB device receives the first operation request, it generates execution data as feedback information and sends it to the computer operating system. Upon receiving the feedback information, the operating system splits the feedback information into multiple parts, which can be data in a format corresponding to the requirement information. Each part is then compared with the corresponding requirement information. For example, if the corresponding part is empty, or the format or value range of the part is inconsistent with the requirement information, it indicates that the current USB device and the corresponding compatible driver are not compatible. If the feedback information matches the required information in terms of format and data value range, it indicates that the USB device and the corresponding adapter driver can connect. This is based on the comprehensive matching indicators described above. By prioritizing and calling adapter drivers, the invocation efficiency of adapter drivers can be effectively improved, increasing the efficiency of finding matching USB devices. Furthermore, when the adapter driver sends the first operation request to the USB device, by comparing and analyzing the feedback information with the corresponding requirement information, the reliability of the adapter driver's connection attempts between the computer operating system and the USB device can be further verified. This ensures that the adapter driver can be deployed only if it can reliably complete communication between the computer operating system and the USB device.

[0058] In addition, the operation request includes a second operation request initiated by the USB device to the computer operating system; when the operation request is a second operation request, all preset trusted drivers are used as adapter drivers.

[0059] When the operation request is a second operation request, the operation request will attempt to connect to the USB device through each adapter driver to obtain the attempt result, which may further include:

[0060] The second operation request is sent to each adapter driver, and the corresponding execution result data is obtained through the preset trusted driver.

[0061] Determine whether the execution result data belongs to a safe instruction;

[0062] If so, the USB device will be matched with the adapter driver corresponding to the execution result data and connected as the attempt result;

[0063] If not, the result of the attempt will be that the USB device and the adapter driver are incompatible.

[0064] Unlike the first operation request, which attempts to establish a connection, the second operation request primarily addresses situations where a request can be initiated from a USB device to the computer's operating system. Specifically, when the operation request is a second operation request, the computer's operating system's calling module receives the request from the USB device via the corresponding USB interface. For example, a USB mouse can initiate a second operation request by pressing a mouse button; a USB keyboard can initiate a second operation request by pressing a keyboard key. When the calling module receives the second operation request, it directly sends it to each adapter driver to determine if each driver can execute the request. If execution is possible, corresponding execution result data is generated; if not, the corresponding adapter driver is discarded. After obtaining the execution result data for all adapter drivers, it is necessary to further determine whether the execution result data can form a security instruction corresponding to the adapter driver. This security instruction is a trusted execution instruction that the computer operating system can execute based on the trusted USB device. If so, it indicates that the USB device and the adapter driver corresponding to the execution result data have completed the matching connection, and the corresponding adapter driver is used as the driver for communication between the computer operating system and the corresponding USB device. If the execution result data cannot form a security instruction, it indicates that the USB device and the adapter driver are incompatible. This method allows for the USB device to actively input relevant operation requests, further confirming whether the USB device can be used as a trusted USB device to establish communication with the computer operating system.

[0065] In summary, by calling the module to perform verification analysis on the first operation request and the second operation request, multiple verification systems can be implemented, such as active verification by the computer operating system or active verification by the USB device, to ensure the flexibility and security of communication between the USB device and the computer operating system.

[0066] Next, determining whether the execution result data belongs to a safe instruction may further include:

[0067] The execution result data is compared with the security instructions under the corresponding adapted driver to obtain the similarity value. Construct a similarity set ;

[0068] Find the similarity set Maximum similarity value ;

[0069] Determine the maximum similarity value Does it exceed the similarity threshold of the corresponding security directive? ;

[0070] If so, it means that the execution result data belongs to a safe instruction;

[0071] If not, it means that the execution result data does not belong to the safe instructions.

[0072] When a USB device sends a second operation request to the computer operating system via typing, the operating system's calling module invokes the adapter driver to generate execution result data. Then, it retrieves the pre-stored security instructions corresponding to each adapter driver and compares the execution result data sequentially with each security instruction to determine the similarity between the instruction information of the security instruction and the execution result data. Specifically, this can involve comparing the instruction information of the security instruction (e.g., instruction symbol, instruction format, etc.) with the corresponding information in the execution result data to obtain a similarity value. Then, construct a similarity set between the execution result data and all security instructions under the corresponding adapted driver. Then, for the similarity set... Maximum similarity value To perform the search, the formula is expressed as follows: This can be achieved through the maximum similarity value. This reflects the correspondence between the current execution result data and the security instructions. Then, the maximum similarity value is... Similarity threshold with corresponding security instructions By comparing the results, it is possible to achieve the maximum similarity value. Exceeding the similarity threshold If the execution result data is a safe instruction, it means that the current USB device and the corresponding adapter driver have completed the matching connection; otherwise, it means that the USB device and the adapter driver cannot be matched.

[0073] Next, step S30 is executed. When the attempt results in the USB device matching and connecting with the corresponding preset trusted driver, the preset trusted driver and the USB device continue to communicate according to the access signal.

[0074] In other words, when the computer operating system attempts to connect to a USB device by calling each preset trusted driver from the shared driver library, if the USB device matches and connects with the corresponding preset trusted driver, it means that the computer operating system and the USB device can communicate through the corresponding preset trusted driver. Therefore, the preset trusted driver maintains continued communication with the USB device as long as the USB device remains connected to the USB interface. In other words, as long as the USB device remains connected to the USB interface, the computer operating system continuously receives this access signal, thus ensuring continued communication between the computer operating system and the USB device using the preset trusted driver.

[0075] Next, step S40 is executed. When the attempt result shows that the USB device cannot match the preset trusted driver, the trustworthiness of the USB device is isolated and analyzed to generate analysis results. Based on the analysis results, the corresponding driver and access environment are controlled and configured to complete the identification and access of the USB device.

[0076] When a computer operating system attempts to connect to a USB device by calling each preset trusted driver from the shared driver library, if the USB device cannot be matched with a preset trusted driver, the trustworthiness of the current USB device is uncertain. The trustworthiness of the USB device can be determined by performing isolated trustworthiness analysis. If the analysis result indicates trustworthiness, the USB device can be identified and connected by configuring the appropriate driver and access environment. If it remains untrustworthy, the USB device cannot be directly connected to the computer operating system, thus ensuring the security of the computer operating system.

[0077] In step S40, a trustworthiness isolation analysis is performed on the USB device, and the analysis results are generated, which may further include:

[0078] The USB device is connected to the isolation detection module, which is used to receive remote control commands issued by the computer operating system. The remote control commands include a first remote control command for retrieving device information, a second remote control command for remotely verifying and controlling the isolation detection module, and a third remote control command for remotely calling and controlling the device driver of the isolation detection module.

[0079] Send the first remote control command to the isolation detection module;

[0080] The scanning isolation detection module prints the device information of the USB device to obtain the scanning device information of the USB device. The printed device information is obtained by the isolation detection module after retrieving the device information of the USB device according to the first remote control command and then printing it.

[0081] Based on the policy information in the policy rule information database, determine whether there is corresponding policy information that matches the scanning device information;

[0082] If so, then determine that the USB device is allowed to be connected as the first analysis result;

[0083] If not, the USB device will be further analyzed using the isolation detection module via the second remote control command to generate a second analysis result.

[0084] When performing trustworthiness isolation analysis on USB devices through a computer operating system, an additional isolation detection module can be configured to temporarily access the USB device for comprehensive analysis. This isolation detection module can be an independent detection host device separate from the host machine corresponding to the computer operating system. By using the isolation detection module to detect that the USB device poses no risk before allowing access to the computer operating system, the access security of peripheral USB devices connected to the computer operating system can be effectively guaranteed. Specifically, the USB device can connect to both the computer operating system and the isolation detection module via a USB interface. An interface switching module can be configured within the USB interface to switch between the computer operating system and the isolation detection module. When the USB device is incompatible with a preset trusted driver, the interface switching module can be used to transfer the USB device to the isolation detection module. During trustworthiness analysis of the USB device using the isolation detection module, communication between the computer operating system and the USB device can be executed based on remote control commands sent by the computer operating system to the isolation detection module. Communication between the computer operating system and the isolation detection module can be established using methods such as the Internet of Things (IoT) or Bluetooth.

[0085] Initially, to determine whether a USB device is a trusted device of the current computer operating system, the operating system can send a first remote control command to the isolation detection module. Based on this command, the isolation detection module retrieves relevant device information from the USB device. After obtaining the device information, the isolation detection module can also be configured with a printing submodule to print the device information for secure access by the computer operating system. Simultaneously, to ensure the security of information retrieval by the computer operating system, a scanning device, such as a camera, can be further configured on the computer operating system's host to capture and scan the USB device information printed by the isolation detection module, thus ensuring complete isolation between the computer operating system and the isolation detection module during information retrieval. The computer operating system then compares the USB device information with policy information in the corresponding policy rule database. If they match, the USB device is considered a trusted device, and access to the USB device is permitted. If the two are inconsistent, it means that the current USB device is not trusted by the computer operating system. Further analysis using the isolation detection module via the second remote control command is needed to confirm the trustworthiness of the USB device. Only after the USB device is confirmed to be trustworthy after analysis can it be further connected to the computer operating system.

[0086] Please see Figure 2 , Figure 2 In one embodiment, the computer operating system and the isolation detection module can switch connections with the USB device via an interface switching module of the USB interface. When the computer operating system detects that the USB device is untrusted, it can control the interface switching module to connect the USB device to the isolation detection module. Then, the computer operating system can wirelessly send relevant control commands, such as a first control command, a second control command, and a third control command, to the isolation detection module to perform relevant risky operations on behalf of the computer operating system. After execution, the isolation detection module feeds back the data to the computer operating system via printing. Based on the feedback information, the computer operating system further determines the risk indicators when the USB device is connected and controls whether the computer operating system connects to the USB device based on these risk indicators. This effectively ensures the data security of the computer operating system when the USB device establishes communication with the computer operating system.

[0087] The second analysis result, generated by using the isolation detection module via a second remote control command to further analyze the USB device, may further include:

[0088] Configure the corresponding third-party remote control commands based on the device information corresponding to the USB device;

[0089] The third remote control command is sent remotely to the isolation detection module, which in turn calls the corresponding device driver according to the third remote control command to establish communication between the isolation detection module and the USB device.

[0090] When the isolation detection module is communicating with the USB device, according to the preset security verification strategy, the second remote control command is wirelessly sent to the isolation detection module in sequence to obtain the difference data before and after the isolation detection module executes the second remote control command on the USB device each time. The difference data is related to the data before and after the USB device is connected.

[0091] Based on difference data Difference data Number of types and each difference data Corresponding weight Assess risk indicators for USB devices ,in, This represents the cumulative value of the difference data;

[0092] When risk indicators If the value exceeds the first risk indicator threshold, then the USB device will not be allowed to be connected as the second analysis result.

[0093] When risk indicators If the value is less than the second risk indicator threshold, then allowing the USB device to be connected will be considered as the second analysis result.

[0094] When the device information of a USB device does not match the computer's operating system, a second remote control command can be sent to the isolation detection module, enabling the module to continuously analyze and verify the USB device's trustworthiness. During this process, a third remote control command can be sent based on the USB device's device information to control the isolation detection module to invoke the corresponding device driver for communication between the module and the USB device. To improve the efficiency of USB device trustworthiness verification, iterative verification can be performed according to a preset security verification strategy to quickly confirm the USB device's trustworthiness. While the isolation detection module maintains communication with the USB device, a preset security verification strategy can be configured. Then, based on this strategy, second remote control commands corresponding to the preset security verification strategy are sequentially sent to the isolation detection module, enabling the module to access and control the USB device according to these commands. After each execution, the isolation detection module will also calculate the difference data of data that may be affected by the execution of the USB device before and after the execution. If there is no difference or the difference is small, it means that the USB device has no risk or the risk is small and access to the computer operating system can be achieved. Conversely, if there is a large difference, it means that the USB device has a risk and access to the computer operating system cannot be achieved. In this case, you can continue to access the USB device through the isolation detection module or stop accessing it to reduce security risks.

[0095] When performing differential analysis, computer operating systems can employ quantitative methods. Specifically, differential data from the isolation detection module can be obtained through scanning. Difference data Number of types Wait for the data, and then, based on each difference data... Corresponding weight To achieve risk indicators for USB devices The evaluation, expressed by the formula is as follows: This scheme can be an iterative process based on a preset security verification strategy. Therefore, the cumulative value of the difference data can be calculated by integration, i.e., the formula is: Of course, during iteration, it is also possible to obtain the difference data one by one. Then, the cumulative value of the difference data is calculated using an summation method. Furthermore, in the risk indicators... If the value exceeds the first risk indicator threshold, it indicates that the USB device is untrusted and should not be connected to the computer operating system. If the risk indicator... If the threshold is lower than the second risk indicator threshold, then conversely, it indicates that the USB device is allowed to be connected by the computer operating system. The second risk indicator threshold can be lower than the first risk indicator threshold to ensure that the risk indicators are balanced when determining USB device access. Conservatism.

[0096] In addition, by using the isolation detection module to further analyze the USB device via a second remote control command, a second analysis result can be generated, which may further include:

[0097] Configure the corresponding third-party remote control commands based on the device information corresponding to the USB device;

[0098] The third remote control command is sent remotely to the isolation detection module, which in turn calls the corresponding device driver according to the third remote control command to establish communication between the isolation detection module and the USB device.

[0099] When the isolation detection module is communicating with the USB device, it receives a call signal for the second remote control command, retrieves the corresponding second remote control command, and wirelessly sends it to the isolation detection module. This allows it to obtain the difference data before and after each execution of the second remote control command by the isolation detection module on the USB device. The difference data is related to the data before and after the USB device is connected. ;

[0100] Judging the difference data Whether the acquisition conditions are met, including whether the trend of the difference values ​​in the difference data tends to be stable, and the number of times the difference data is acquired when the trend of the difference values ​​tends to be stable. More than the set number of times ;

[0101] If so, then based on the difference data Difference data Number of types Number of times and each difference data Corresponding weight Assess risk indicators for USB devices ;

[0102] When risk indicators If the value exceeds the first risk indicator threshold, then the USB device will not be allowed to be connected as the second analysis result.

[0103] When risk indicators If the value is less than the second risk indicator threshold, then allowing the USB device to be connected will be considered as the second analysis result.

[0104] In analyzing whether a USB device can connect to a computer operating system, after establishing communication between the isolation detection module and the USB device via a third remote control command, the user can initiate a second remote control command to the computer operating system as needed. The computer operating system then sends this second remote control command to the isolation detection module, which executes the second remote control command on the USB device to obtain the difference data before and after each execution of the second remote control command. However, during each execution, the stability of the difference data trend and the number of times each difference data point is acquired are unknown. Therefore, further analysis of the discrepancies in the data is possible. Does the relevant USB device meet the conditions for obtaining risk indicators? If all conditions are met, then the risk can be directly determined based on the difference data. Difference data Number of types Number of times and each difference data Corresponding weight For risk indicators The formula can be expressed as follows: Thus utilizing risk indicators The numerical values ​​are used to determine whether a USB device is allowed to be connected to the computer's operating system. This user-verified method can also be used to assess the risk indicators of USB devices. An assessment was conducted to evaluate risk indicators for USB devices. When the requirements are met, connecting the USB device to the computer operating system ensures data security for the computer operating system when communicating with USB devices such as USB storage devices.

[0105] Please refer to 3. This invention also provides a USB device identification and access system 11 based on a computer operating system, applied to a computer operating system, comprising: an acquisition unit 111, used to acquire the access signal of the USB interface to the USB device; a connection attempt unit 112, used to sequentially call each preset trusted driver in a shared driver library to attempt connection with the USB device according to the access signal, to obtain the attempt result, wherein the shared driver library includes multiple preset trusted drivers; a communication control unit 113, used to maintain the continued communication between the preset trusted driver and the USB device according to the access signal when the attempt result is that the USB device matches the corresponding preset trusted driver; and an analysis and configuration unit 114, used to perform a trustworthiness isolation analysis on the USB device, generate an analysis result, and control the configuration of the corresponding driver and access environment based on the analysis result to complete the identification and access of the USB device.

[0106] It should be noted that the USB device identification and access system 11 based on a computer operating system provided in the above embodiments and the USB device identification and access method based on a computer operating system provided in the above embodiments belong to the same concept. The specific ways in which each module and unit performs operations have been described in detail in the method embodiments, and will not be repeated here. In practical applications, the USB device identification and access system 11 based on a computer operating system provided in the above embodiments can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. This is not a limitation here.

[0107] Please see Figure 4 The electronic device 1 may include a memory 12, a processor 13 and a bus, and may also include a computer program stored in the memory 12 and executable on the processor 13, such as a USB device identification and access program based on a computer operating system.

[0108] The memory 12 includes at least one type of readable storage medium, such as flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 12 can be an internal storage unit of the electronic device 1, such as a portable hard drive. In other embodiments, the memory 12 can be an external storage device of the electronic device 1, such as a plug-in portable hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the electronic device 1. Furthermore, the memory 12 can include both internal and external storage units of the electronic device 1. The memory 12 can be used not only to store application software and various types of data installed on the electronic device 1, such as USB device identification access codes based on a computer operating system, but also to temporarily store data that has been output or will be output.

[0109] In some embodiments, the processor 13 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits packaged with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The processor 13 is the control unit of the electronic device 1, connecting various components of the electronic device 1 via various interfaces and lines. It executes programs or modules stored in the memory 12 (e.g., USB device identification and access programs based on a computer operating system) and calls data stored in the memory 12 to perform various functions and process data of the electronic device 1.

[0110] The processor 13 executes the operating system of the electronic device 1 and various installed applications. The processor 13 executes the applications to implement the steps in the above-described USB device identification and access method based on a computer operating system.

[0111] For example, the computer program may be divided into one or more modules, which are stored in the memory 12 and executed by the processor 13 to complete this application. The one or more modules may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the electronic device 1. For example, the computer program may be divided into various units in a USB device identification access system based on a computer operating system.

[0112] The integrated unit implemented as a software functional module described above can be stored in a computer-readable storage medium, which can be non-volatile or volatile. The software functional module, stored in the storage medium, includes several instructions to cause a computer device (which may be a personal computer, computer equipment, or network device, etc.) or processor to execute some functions of the USB device identification and access method based on a computer operating system described in the various embodiments of this application.

[0113] In summary, the USB device identification and access method and system disclosed in this invention, based on a computer operating system, effectively achieves rapid matching of trusted USB devices by sequentially calling each preset trusted driver in the shared driver library to attempt connection after a USB device is connected to the USB interface. This ensures secure communication between the computer operating system and the USB device by relying on trusted preset trusted drivers. Furthermore, if no corresponding preset trusted driver is found in the shared driver library, the risk indicators of the USB device can be analyzed and evaluated using an isolation detection module. Based on these risk indicators, the security of the USB device's access to the computer operating system is determined. Upon confirmation of security, the corresponding device driver is invoked to securely connect the USB device to the computer operating system, thereby effectively improving data security during USB device access. Therefore, this invention effectively overcomes the various shortcomings of existing technologies and has high industrial applicability.

[0114] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

Claims

1. A computer operating system based USB device identification access method, characterized in that, The application is applied to the computer operating system, and comprises: obtaining an access signal of a USB interface to a USB device; according to the access signal, sequentially calling each preset trusted driver in a common driver library to attempt to connect with the USB device to obtain an attempt result, wherein the common driver library comprises a plurality of preset trusted drivers; when the attempt result is that the USB device is matched and connected with the corresponding preset trusted driver, then according to the access signal, maintaining the continuous communication of the preset trusted driver and the USB device; when the attempt result is that the USB device cannot be matched with the preset trusted driver, then performing isolation analysis on the trustworthiness of the USB device to generate an analysis result, and based on the analysis result, controlling the configuration of the corresponding driver and access environment to complete the identification and access of the USB device; the isolation analysis on the trustworthiness of the USB device to generate an analysis result comprises: adapting the USB device to an isolation detection module, wherein the isolation detection module is used to receive a remote control instruction issued by the computer operating system, and the remote control instruction comprises a first remote control instruction for calling device information and a second remote control instruction for remotely verifying and controlling the isolation detection module; sending the first remote control instruction to the isolation detection module; scanning the printing device information of the USB device by the isolation detection module to obtain scanning device information of the USB device, wherein the printing device information is obtained by printing by the isolation detection module according to the first remote control instruction after calling the device information of the USB device; determining whether there is corresponding policy information consistent with the scanning device information according to policy information in a policy rule information library; if yes, then determining that the USB device is allowed to be accessed as a first analysis result; if no, then further analyzing the USB device by the isolation detection module through the second remote control instruction to generate a second analysis result.

2. The computer operating system based USB device identification access method of claim 1, wherein, according to the access signal, sequentially calling each preset trusted driver in a common driver library to attempt to connect with the USB device to obtain an attempt result, comprising: detecting an operation request corresponding to the USB device according to the access signal; based on the operation request, finding a plurality of preset trusted drivers covering the calling range corresponding to the operation request in the common driver library as adaptive drivers through a calling module; attempting to connect the operation request with the USB device through each adaptive driver to obtain an attempt result.

3. The USB device identification access method based on a computer operating system according to claim 2, wherein, the operation request comprises a first operation request initiated by the computer operating system to the USB device; based on the operation request, finding a plurality of preset trusted drivers covering the calling range corresponding to the operation request in the common driver library as adaptive drivers through a calling module, comprising: When it is detected that the operation request is a first operation request initiated to the USB device, the first operation request is subjected to requirement analysis, and a plurality of requirement information corresponding to driver requirements is extracted; calculating a matching degree of each of the demand information corresponding to the same preset trusted driver ; Based on the matching degree corresponding to each of the demand information And the index factor corresponding to the demand information , The comprehensive matching index of the same preset trusted driver is calculated ; For all the preset trusted drivers and their corresponding comprehensive matching indexes , build a comprehensive matching index set ; determining whether each of the comprehensive matching indexes reaches an index threshold value :​ If yes, it indicates that the corresponding preset trusted driver covers the calling range corresponding to the operation request, and the corresponding preset trusted driver is taken as the adaptive driver; If no, it indicates that the corresponding preset trusted driver cannot cover the calling range corresponding to the operation request, and the corresponding preset trusted driver is discarded.

4. The USB device identification access method based on a computer operating system according to claim 3, wherein, The operation request is attempted to be connected to the USB device through each adaptive driver to obtain a trial result, including: According to the comprehensive matching index corresponding to each of the adaptive drivers Size, the adaptive drivers are sorted to obtain an adaptive driver sequence; Each adaptive driver in the adaptive driver sequence is selected in turn to send the first operation request to the USB device; The feedback information of the USB device is received, and the feedback information is subjected to data splitting to obtain a plurality of split information, wherein each split information corresponds to each requirement information corresponding to the first operation request; Each split information in the feedback information is compared with the corresponding requirement information; If the feedback information and the requirement information are matched with each other, the USB device and the corresponding adaptive driver are matched and connected as the trial result; If at least one feedback information and the corresponding requirement information are not matched, the USB device and the corresponding adaptive driver are not matched as the trial result.

5. The computer operating system based USB device identification access method of claim 2, wherein, The operation request includes a second operation request initiated by the USB device to the computer operating system; when the operation request is the second operation request, all the preset trusted drivers are taken as the adaptive driver; The operation request is attempted to be connected to the USB device through each adaptive driver to obtain a trial result, including: The second operation request is sent to each adaptive driver respectively, and corresponding execution result data is obtained through the preset trusted driver; It is judged whether the execution result data belongs to a safe instruction; If yes, the USB device and the adaptive driver corresponding to the execution result data are matched and connected as the trial result; If no, the USB device and the adaptive driver are not matched as the trial result.

6. The computer operating system based USB device identification access method of claim 5, wherein, It is judged whether the execution result data belongs to a safe instruction, including: The execution result data is compared with each of the security instructions under the corresponding adaptive driver in similarity to obtain a similarity value , and a similarity set is constructed ; finding a maximum similarity value in the set of similarities ;​ determining whether the maximum similarity value is greater than a similarity threshold of a corresponding safety instruction ;​ If yes, it indicates that the execution result data belongs to a safe instruction; If no, it indicates that the execution result data does not belong to a safe instruction.

7. The computer operating system based USB device identification access method of claim 1, wherein, The remote control instruction further includes a third remote control instruction for remotely calling and controlling the device driver of the isolation detection module; The USB device is further analyzed by the second remote control instruction through the isolation detection module to generate a second analysis result, including: According to the device information corresponding to the USB device, the corresponding third remote control instruction is configured; The third remote control instruction is remotely sent to the isolation detection module, wherein the isolation detection module calls a corresponding device driver according to the third remote control instruction to establish communication between the isolation detection module and the USB device; In the communication state between the isolation detection module and the USB device, a second remote control instruction is wirelessly sent to the isolation detection module according to a preset security verification strategy to obtain difference data before and after the isolation detection module executes the second remote control instruction on the USB device each time, wherein the difference data is data related to before and after the USB device is accessed; based on the difference data , the difference data number of categories and each of the difference data corresponding weight , evaluate the risk index of the USB device wherein, is the cumulative value of the difference data; When the risk indicators If the value exceeds the first risk indicator threshold, then the USB device will not be allowed to be connected as the second analysis result. When the risk indicators If the value is less than the second risk indicator threshold, then allowing the USB device to be connected is taken as the second analysis result.

8. The computer operating system based USB device identification access method of claim 1, wherein, The remote control instruction further comprises a third remote control instruction for remotely calling a device driver of the isolation detection module; The second remote control instruction is used to further analyze the USB device by the isolation detection module to generate a second analysis result, comprising: According to the device information corresponding to the USB device, the corresponding third remote control instruction is configured; The third remote control instruction is remotely sent to the isolation detection module, wherein the isolation detection module calls a corresponding device driver according to the third remote control instruction to establish communication between the isolation detection module and the USB device; When the isolation detection module is communicating with the USB device, it receives a call signal for the second remote control command, retrieves the corresponding second remote control command, and wirelessly sends it to the isolation detection module. This is to obtain the difference data before and after each execution of the second remote control command by the isolation detection module on the USB device, wherein the difference data is data related to the USB device before and after connection. ; Determine the difference data Whether the acquisition conditions are met, wherein the acquisition conditions include the trend of the difference value of the difference data tending to be stable, and the number of times the difference data is acquired when the trend of the difference value tends to be stable. More than the set number of times ; If yes, based on the difference data , the difference data , the number of categories , the acquisition times and the corresponding weight of each difference data , the risk index of the USB device is evaluated ; When the risk indicators If the value exceeds the first risk indicator threshold, then the USB device will not be allowed to be connected as the second analysis result. When the risk indicators If the value is less than the second risk indicator threshold, then allowing the USB device to be connected is taken as the second analysis result.

9. An identification access system for the computer operating system based USB device identification access method according to any one of claims 1-8, characterized in that, Applied to the computer operating system, comprising: An acquisition unit is configured to acquire an access signal of a USB interface to a USB device; A connection attempt unit is configured to call each preset trusted driver in a common driver library to attempt to connect with the USB device according to the access signal to obtain an attempt result, wherein the common driver library comprises a plurality of preset trusted drivers; A communication control unit is configured to maintain the preset trusted driver and the USB device in continuous communication according to the access signal when the attempt result is that the USB device is matched and connected with the corresponding preset trusted driver; and An analysis configuration unit is configured to perform isolation analysis on the USB device when the attempt result is that the USB device cannot be matched with the preset trusted driver, to generate an analysis result, and to control and configure a corresponding driver and access environment based on the analysis result to complete identification and access of the USB device.

Images