Mobile storage hardware protection method based on back injection technology

Abstract

The invention provides a mobile storage hardware protection method based on a back injection technology, which comprises the following steps: S1, when data transmission is carried out between mobile storage hardware and a host, capturing a data stream through an interception mechanism, and carrying out real-time monitoring; s2, extracting and analyzing multi-dimensional features of the data stream, comparing the multi-dimensional features with a normal data transmission reference mode, detecting and judging whether an abnormal behavior exists or not, and if a judgment result is yes, triggering an automatic defense mechanism for protection; s3, the automatic defense mechanism comprises a first defense measure and a second defense measure; and S4, realizing encryption and decryption operations through authority management, log auditing, automatic monitoring and key management. According to the method, various security threats can be effectively handled, malicious behavior injection is prevented, and data security is protected; meanwhile, the method has high adaptability, compatibility, abnormal data detection performance and the like, and provides more powerful technical support for mobile storage hardware protection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of mobile storage hardware protection, in particular to a mobile storage hardware protection method based on anti-injection technology. BACKGROUND

[0002] With the rapid development of information technology, mobile storage devices such as U disks, SD cards, etc. have become an indispensable part of our daily life and work. However, at the same time, the risk of data leakage and information theft has also increased. Especially when these devices are used for the transmission and processing of sensitive information, how to ensure the security of data becomes particularly important. Therefore, mobile storage hardware protection technology has emerged as the times require.

[0003] Traditional mobile storage hardware protection methods mainly rely on hardware encryption technologies such as AES, RSA, etc. and some simple software protection measures such as access control and password verification. However, these methods often seem inadequate in the face of advanced attack methods. Especially when attackers have enough resources and professional knowledge, they may bypass these protection measures by injecting malicious code or data to achieve the purpose of stealing data. Therefore, the present application proposes a mobile storage hardware protection method based on anti-injection technology to solve the above problems. SUMMARY

[0004] In order to overcome the shortcomings of the prior art, the purpose of the present application is to provide a mobile storage hardware protection method based on anti-injection technology, which can effectively deal with various security threats and prevent malicious behavior injection by comprehensively and real-time monitoring data flow and implementing automatic defense mechanism according to monitoring results, and protect data security. At the same time, this method has strong adaptability, compatibility and abnormal data detection performance, etc., which provides more powerful technical support for mobile storage hardware protection.

[0005] To achieve the above purpose, the present application provides the following scheme: a mobile storage hardware protection method based on anti-injection technology, comprising the following steps:

[0006] S1, when data transmission is performed between mobile storage hardware and host, data flow is captured by an interception mechanism for real-time monitoring, and user operation in the interception process is realized without sensing;

[0007] Among them, by developing an interception agent or a driver, comprehensively monitoring the data flow, the transparency and compatibility of the interception mechanism are enhanced, by introducing deep packet inspection technology, application state detection firewall, data verification and establishing feedback and repair mechanism, the accuracy and integrity of the data flow are improved;

[0008] S2, extract and analyze the multi-dimension features of the data stream, and compare with the normal data transmission benchmark mode to detect whether there is abnormal behavior, if the judgment result is yes, trigger the automatic defense mechanism to protect;

[0009] S3, the automatic defense mechanism includes a first defense measure based on the security threat degree of the abnormal behavior and a second defense measure based on the security threat category of the abnormal behavior and a preset serialization rule;

[0010] S4, through permission management, audit log, automatic monitoring and key management, encryption and decryption operations are realized.

[0011] Optionally, in step S1,

[0012] The deep packet inspection technology checks the header information and payload information of the data packet, and analyzes the surface features and application layer content of the data packet in real time, filters malicious traffic, and realizes deep detection by deploying a deep packet inspection system on the transmission path between the mobile storage hardware and the host;

[0013] The application of the state detection firewall identifies and tracks the state of each data stream by configuring firewall rules, dynamically monitors the network connection state, prevents unauthorized and suspicious data access, and realizes intelligent filtering of data;

[0014] The data verification performs integrity check on the data packet at each stage of data transmission, generates a hash value of the key data using a hash algorithm, and verifies the integrity and consistency of the data by comparing the checksum of the data packet with the hash value after data transmission is completed;

[0015] The feedback and repair mechanism is established, and the abnormal processing mechanism and data repair are started through the comparison result of the data verification.

[0016] Optionally, the specific implementation process of step S2 is:

[0017] Extract the data size, transmission speed, data format, protocol type, port number, destination address and timestamp of the data packet to obtain the multi-dimension features and perform behavior analysis to comprehensively identify potential malicious behavior;

[0018] Use machine learning algorithm to cluster analyze historical data, construct dynamically updated normal data transmission benchmark mode, and then assign feature weight based on the importance of different features by learning the normal data transmission benchmark mode;

[0019] Compare the multi-dimension features with the normal data transmission benchmark mode to determine whether there is abnormal behavior, if the judgment result is yes, trigger the automatic defense mechanism.

[0020] Optionally, the first defense measure is implemented as follows:

[0021] An anomaly detection algorithm is used to calculate the anomaly score of the multi-dimensional features and the normal data transmission baseline mode, and the anomaly score is compared with a set anomaly threshold. According to the comparison result, the corresponding first defense measure is triggered.

[0022]

[0023] wherein A(d) is the anomaly score of the data stream d, f i is the actual value of feature i, f i is the mean value of feature i in the normal data transmission baseline mode, and n is the total number of features.

[0024] When the anomaly score is greater than the anomaly threshold, it is determined to be an abnormal behavior. According to the security threat level of the abnormal behavior, the corresponding first defense measure is triggered. The rule definition formula of the security threat level is as follows:

[0025]

[0026] wherein τ1 is a serious abnormal behavior, τ2 is a moderate abnormal behavior, and τ3 is a slight abnormal behavior.

[0027] When the security threat level is a serious abnormal behavior, the affected device or network is immediately isolated. When the security threat level is a moderate abnormal behavior, the data transmission is interrupted. When the security threat level is a slight abnormal behavior, it is recorded and further monitored.

[0028] Optionally, the second defense measure is implemented as follows:

[0029] The security threat of the abnormal behavior is classified, including malicious software intrusion, unauthorized access, and data leakage. Three second defense measures are developed for the three security threat categories. Each second defense measure includes four levels. The four levels of each second defense measure are sorted, and the second defense measure is executed according to the preset serialization rule.

[0030] wherein the three second defense measures include a second defense measure a corresponding to the malicious software intrusion, a second defense measure b corresponding to the unauthorized access, and a second defense measure c corresponding to the data leakage.

[0031] Optionally, the second defense measure a comprises a level a1 for recording events and malware features to a security log, a level a2 for displaying warning information on the terminal and notifying a system administrator, a level a3 for isolating the infected terminal and limiting network access, and a level a4 for restarting the terminal in a security mode and performing a complete system scan;

[0032] The second defense measure b comprises a level b1 for recording suspicious login attempts to a security log, a level b2 for sending warning information to the account owner and the system administrator, a level b3 for temporarily locking the account and prohibiting further login attempts, and a level b4 for starting network monitoring and tracing the source of suspicious activities;

[0033] The second defense measure c comprises a level c1 for recording data transmission activities to a security log and marking as high risk, a level c2 for limiting the transmission of sensitive data and notifying the data owner, a level c3 for interrupting network connections and conducting a data leakage assessment, and a level c4 for clearing the cache of sensitive data and encrypting the affected system.

[0034] Optionally, the serialization rules of the second defense measures are:

[0035] When the abnormal behavior is detected as a malware intrusion, and an unauthorized process is found attempting to modify system files, the second defense measure a is triggered, which sequentially performs protection according to the level a1, the level a2, the level a3, and the level a4, and if the malware activity has not stopped within 30 minutes after the level a2 ends, it is upgraded to the level a3, and if the level a3 successfully isolates the malware and there is no recurrence within 24 hours, it is downgraded to the level a1 for monitoring;

[0036] When the abnormal behavior is detected as unauthorized access, and non-standard time account login activities are found, the second defense measure b is triggered, which sequentially performs protection according to the level b1, the level b2, the level b3, and the level b4, and if the unauthorized access attempt has not stopped within 1 hour after the level b2 ends, it is upgraded to the level b3, and if no further unauthorized access is found after the account is locked and after a security review, it is downgraded to the level b1 for monitoring;

[0037] When the abnormal behavior is detected as data leakage, and sensitive data is found to be transmitted through the network to an unauthorized destination, the second defense measure c is triggered, which sequentially protects in the order of the level c1, the level c2, the level c3, and the level c4, and if the data leakage risk is not reduced after the level c2, it is upgraded to the level c3, and if the data leakage risk is controlled and no further data leakage is confirmed through security review, it is downgraded to the level c1 for monitoring.

[0038] Optionally, the encryption and decryption operation implementation process is as follows:

[0039] The permission management reduces security risks by enabling users to have a minimum set of permissions through role-based access control and the principle of least privilege, and combining multi-factor authentication.

[0040] The audit log records detailed information of encryption and decryption operations and is regularly reviewed to discover and investigate suspicious behavior.

[0041] The key management enables key generation, distribution, use, rotation, and destruction through a key management system, and defines key lifecycle policies to enable regular key updates.

[0042] The present application provides a mobile storage hardware protection method based on anti-injection technology, and discloses the following technical effects:

[0043] 1. The present application can timely discover any abnormal data injection behavior and realize data flow protection without affecting system performance and user experience through comprehensive and real-time monitoring of data flow.

[0044] 2. The present application can ensure that the captured data flow is complete and accurate when data is transmitted between the mobile storage device and the host by introducing deep packet inspection (DPI) technology, application state detection firewall (SFW), implementing checksum or hash algorithm verification, and establishing a feedback and repair mechanism for data capture, which greatly improves data security and prevents data from being tampered with or damaged during transmission, providing a solid guarantee for data integrity and reliability.

[0045] 3. The present application improves the detection capability of abnormal data flow by accurately extracting and analyzing the key features of data flow and effectively comparing with normal data transmission mode, providing more powerful technical support for mobile storage hardware protection, ensuring the safety and reliability of data transmission.

[0046] 4、The present application provides clear guidance for security systems to respond appropriately to various security threats in a structured and organized manner, ensuring that appropriate responses are made when faced with various security threats, improving the efficiency and effectiveness of security incident handling, reducing the impact on normal business, and helping to build a more robust and reliable security protection system.

[0047] 5、The present application provides clear guidance for security systems to respond appropriately to various security threats in a structured and organized manner, ensuring that appropriate responses are made when faced with various security threats, improving the efficiency and effectiveness of security incident handling, reducing the impact on normal business, and helping to build a more robust and reliable security protection system.

[0048] The technical solutions of the present application will be described in further detail below with the aid of the accompanying drawings and examples. BRIEF DESCRIPTION OF DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed in the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present application, and other accompanying drawings can be obtained by those skilled in the art without creative labor.

[0050] Figure 1 The method flowchart provided for the embodiments of the present application. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present application will be described in further detail below with the aid of the accompanying drawings and examples. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0052] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the present application will be further described in detail below with the aid of the accompanying drawings and specific embodiments.

[0053] As shown in the accompanying drawings, Figure 1 The present application provides a mobile storage hardware protection method based on anti-injection technology, comprising the following steps:

[0054] S1, when transmitting data between mobile storage hardware and the host, capture data streams through an interception mechanism for real-time monitoring, while achieving user operation in the interception process. Among them, by developing an interception agent or driver, comprehensively monitoring the data stream, to enhance the transparency and compatibility of the interception mechanism, by introducing deep packet inspection technology, application state detection firewall, data verification and establishing feedback and repair mechanism, to improve the accuracy and integrity of the data stream. The specific implementation process is:

[0055] Data capture: when transmitting data between mobile storage devices and the host, capture data streams through hardware or software level interception mechanism, ensure that the captured data is complete and not distorted, so as to facilitate subsequent analysis. In order to enhance the transparency and compatibility of the interception mechanism, we need to take a series of technical measures to ensure the effectiveness of data stream monitoring and the non-sensitivity of user operation. The following is the detailed implementation process:

[0056] 1) Enhance the transparency and compatibility of the interception mechanism

[0057] 1.1) Develop efficient interception agent or driver

[0058] Design lightweight interception agent: develop an interception agent software with low system resource occupation and high running efficiency, which needs to work at the operating system level and can intercept and check data during transmission without obvious impact on system performance.

[0059] Optimization algorithm: use efficient data packet processing algorithms such as fast matching algorithm and multi-mode recognition technology to improve the data processing speed and accuracy of the interception agent.

[0060] Balance between user mode and kernel mode: when designing the interception agent, balance the use of user mode and kernel mode. User mode interception can provide better compatibility and update flexibility, while kernel mode interception can provide higher performance and deeper packet inspection.

[0061] 1.2) Implement comprehensive monitoring of data streams

[0062] Comprehensive monitoring strategy: develop a comprehensive monitoring strategy to ensure that all data streams entering and exiting the mobile storage device are intercepted and checked. This includes monitoring various data streams such as file transfer and network communication.

[0063] Real-time analysis: the interception agent needs to have real-time analysis capability, which can process captured data packets in real time and make judgments and responses according to preset security rules.

[0064] 1.3) Optimize the compatibility and adaptability of the interception mechanism

[0065] Multi-OS Support: Develop cross-platform interception agents to ensure compatibility with Windows, macOS, Linux, UOS, and other operating systems while maintaining high performance and stability.

[0066] Modular Design: Adopt a modular design philosophy to allow the interception mechanism to adapt flexibly to different file systems and hardware environments. For example, specific monitoring modules can be developed for different file systems.

[0067] Dynamic Configuration: Provide dynamic configuration capabilities to allow the interception mechanism to adjust itself according to the characteristics of the current running environment to achieve optimal performance and compatibility.

[0068] 1.4) User Experience

[0069] Transparent Operation: Ensure that the operation of the interception agent is transparent to the user, and the user will not feel additional delays or inconvenience when using the mobile storage device.

[0070] User Feedback Mechanism: Establish a user feedback mechanism to collect user problems and suggestions encountered during use, so as to continuously optimize the compatibility and user experience of the interception agent.

[0071] Through the above measures, we can achieve comprehensive monitoring of data flow without affecting system performance and user experience, while ensuring that the interception mechanism can be seamlessly integrated with various operating systems and file systems, improving its adaptability and compatibility in different environments. This will provide solid technical support for mobile storage hardware protection, effectively prevent malicious injection behavior, and protect data security.

[0072] 2) Improve the accuracy and completeness of data capture

[0073] 2.1) Introduce Deep Packet Inspection (DPI) technology

[0074] Deploy DPI system: Deploy a deep packet inspection system between the mobile storage device and the host. DPI can deeply inspect the content of data packets, including header information and payload data, to identify and capture all passing data.

[0075] Real-time analysis and filtering: The DPI system will perform real-time analysis on the data packets passing through, and use predefined rules and pattern recognition technology to filter and capture potential malicious traffic.

[0076] Multi-layer detection: DPI can not only detect the surface features of data packets such as source address, destination address and port number, but also analyze the application layer content of data packets such as protocol type and specific application data.

[0077] 2.2) Application State Detection Firewall (SFW)

[0078] Configuration state detection rules: Stateful firewalls can make intelligent filtering decisions based on session state information. Configure firewall rules to recognize and track the state of each data flow, allowing for more accurate capture and processing of data.

[0079] Dynamic monitoring: SFW can dynamically monitor the status of network connections, ensuring that only legitimate, verified data flows can pass through, while blocking unauthorized and suspicious data access.

[0080] 2.3) Implement checksum or hash algorithm verification

[0081] Data integrity check: During data capture, use checksums (such as CRC32) to check the integrity of data packets, which can ensure that data is not error or damaged during transmission.

[0082] Hash algorithm application: For critical data, use hash algorithms (such as SHA-256) to generate hash values of data, and after data transmission is completed, compare the hash values of data to verify the integrity and consistency of data.

[0083] Real-time verification process: Establish a real-time verification process to ensure that checksum or hash value comparison is performed at each stage of data transmission, and any abnormalities are detected and handled in a timely manner.

[0084] 2.4) Establish a feedback and repair mechanism for data capture

[0085] Exception handling: When the checksum or hash value of the data packet does not match, the system should immediately trigger an exception handling mechanism, such as isolating the data packet, recording event logs, and notifying the system administrator.

[0086] Data repair: For detected data damage, the system should attempt to automatically repair or provide repair guidance to ensure data availability and accuracy.

[0087] Through the above measures, we can ensure that when data is transmitted between mobile storage devices and hosts, the captured data stream is not only complete and accurate, but also accurate. This will greatly improve data security and prevent data from being tampered with or damaged during transmission, thereby providing a solid guarantee for data integrity and reliability.

[0088] S2, extract and analyze the multi-dimensional features of the data stream, and compare them with the normal data transmission benchmark mode to detect and determine whether there is abnormal behavior, and if the result is yes, trigger the automated defense mechanism for protection. The specific implementation process is:

[0089] 1) Extract the data size, transmission speed, data format, protocol type, port number, destination address and timestamp of the data packet, obtain the multi-dimensional features and perform behavior analysis (such as periodicity of data transmission, abnormality of access mode, etc.), and comprehensively identify potential malicious behaviors.

[0090] 2) Use machine learning algorithm to cluster historical data and construct dynamically updated normal data transmission benchmark mode, and based on the importance of different features, assign feature weights by learning the normal data transmission benchmark mode; the feature weighting formula can be expressed as:

[0091] F' = {(w1·f1), (w2·f2), …, (wn·fn)} n n}

[0092] Where F' is the weighted feature set, w i is the weight of the i-th feature, and f i is the original feature value.

[0093] 3) Compare the multi-dimensional features with the normal data transmission benchmark mode to determine whether there is abnormal behavior, and if the result is yes, trigger the automated defense mechanism.

[0094] S3, the automated defense mechanism includes a first defense measure based on the security threat level of the abnormal behavior and a second defense measure based on the security threat category of the abnormal behavior and a preset serialization rule. The specific implementation process is:

[0095] 1) The specific implementation process of the first defense measure is:

[0096] Use anomaly detection algorithm to calculate the multi-dimensional features and the normal data transmission benchmark mode to obtain an anomaly score, compare the anomaly score with a set anomaly threshold, and according to the comparison result, trigger the corresponding first defense measure, and the formula of the anomaly detection algorithm is:

[0097]

[0098] Where A(d) is the anomaly score of data stream d, f i is the actual value of feature i, is the mean value of feature i in the normal data transmission benchmark mode, and n is the total number of features.

[0099] When the anomaly score is greater than the anomaly threshold, it is determined that the behavior is abnormal, and according to the security threat level of the abnormal behavior, the corresponding first defense measure is triggered, and the rule definition formula of the security threat level is:

[0100] ​

[0101] wherein τ1 is a severe abnormal behavior, τ2 is a moderate abnormal behavior, and τ3 is a slight abnormal behavior.

[0102] When the security threat degree is a severe abnormal behavior, the affected device or network is immediately isolated; when the security threat degree is a moderate abnormal behavior, data transmission is interrupted; and when the security threat degree is a slight abnormal behavior, records are kept and further monitoring is performed.

[0103] 2) The second defense measure is specifically implemented as follows:

[0104] The security threat of the abnormal behavior is classified into three categories, including malicious software intrusion, unauthorized access, and data leakage, and three second defense measures are developed for the three categories of security threats (to ensure that each defense measure is designed to mitigate or eliminate a specific threat), each of which includes four levels. By sorting the four levels of each second defense measure, the second defense measure is executed according to a preset serialization rule.

[0105] The three second defense measures include a second defense measure a corresponding to the malicious software intrusion, a second defense measure b corresponding to the unauthorized access, and a second defense measure c corresponding to the data leakage.

[0106] The second defense measure a includes a level a1 for recording events and malicious software features to a security log, a level a2 for displaying warning information on a terminal and notifying a system administrator, a level a3 for isolating an infected terminal and limiting network access, and a level a4 for restarting the terminal in a security mode and performing a complete system scan.

[0107] The second defense measure b includes a level b1 for recording suspicious login attempts to a security log, a level b2 for sending warning information to an account owner and a system administrator, a level b3 for temporarily locking an account and prohibiting further login attempts, and a level b4 for starting network monitoring and tracing the source of suspicious activities.

[0108] The second defense measure c includes a level c1 for recording data transmission activities to a security log and marking them as high risk, a level c2 for limiting the transmission of sensitive data and notifying the data owner, a level c3 for interrupting network connections and performing data leakage evaluation, and a level c4 for clearing cached sensitive data and encrypting the affected system.

[0109] The serialization rule of the second defense measure is as follows:

[0110] When the abnormal behavior is detected as malware intrusion and an unauthorized process is found to be attempting to modify system files, the second defense measure a is triggered. The second defense measure a provides protection in the order of level a1, level a2, level a3, and level a4. If the malware activity does not stop within 30 minutes after the end of level a2, the protection is upgraded to level a3. If level a3 successfully isolates the malware and there is no recurrence within 24 hours, the protection is downgraded to level a1 for monitoring.

[0111] When the abnormal behavior is detected as unauthorized access and account login activity at non-standard times is found, the second defense measure b is triggered. The second defense measure b provides protection in the order of level b1, level b2, level b3, and level b4. If unauthorized access attempts do not stop within 1 hour after the end of level b2, the protection is upgraded to level b3. If no further unauthorized access is found after the account is locked and after a security review, the protection is downgraded to level b1 for monitoring.

[0112] When the abnormal behavior is detected as a data breach, and it is found that sensitive data is being transmitted over the network to an unauthorized destination, the second defense measure c is triggered. The second defense measure c provides protection in the order of level c1, level c2, level c3, and level c4. If the risk of data breach is not reduced after level c2 is completed, the protection is upgraded to level c3. If the risk of data breach is controlled and a security audit confirms that there is no further data breach, the protection is downgraded to level c1 for monitoring.

[0113] These rule-based logical definitions provide clear guidance for security systems, ensuring appropriate responses to various security threats. By setting explicit trigger conditions and defensive measures, the system can automatically execute necessary security operations and dynamically adjust response levels based on threat development. Such rule-based logical definitions help improve the efficiency and effectiveness of security incident handling while minimizing impact on normal business operations.

[0114] By defining such pre-defined serialization rules, the security system can respond to various security threats in a structured and organized manner, ensuring timely and effective defensive measures while minimizing disruption to normal business processes. This approach improves the efficiency and effectiveness of security responses and helps build a more robust and reliable security protection system.

[0115] S4. Encryption and decryption operations are implemented through access control, audit logs, automated monitoring, and key management. The implementation process is as follows:

[0116] 1) Strengthen access control

[0117] Implement Role-Based Access Control (RBAC) to ensure that only personnel assigned specific roles and strictly authenticated can perform encryption and decryption operations. Introduce the principle of least privilege to ensure users only have the minimum set of permissions necessary to complete their work, reducing potential security risks.

[0118] 2) Multi-Factor Authentication

[0119] For sensitive encryption and decryption operations, require users to pass multi-factor authentication (MFA) such as passwords combined with biometrics or one-time tokens to enhance the security of identity verification.

[0120] 3) Operation Audit and Logging

[0121] Enable detailed audit logs to record detailed information of all encryption and decryption operations, including operators, time, used keys, operation data, etc. Regularly review audit logs to promptly detect and investigate any unusual or suspicious behavior.

[0122] 4) Automated Monitoring and Anomaly Detection

[0123] Use the above-mentioned anomaly detection methods to monitor encryption and decryption operations in real time, quickly identify abnormal behavior that deviates from established patterns. Set thresholds and behavior patterns, and when the monitored operations exceed the normal range, the system automatically triggers an alarm and takes response measures.

[0124] 5) Key Management and Lifecycle Control

[0125] Implement a centralized key management system to strictly manage the generation, distribution, use, rotation, and destruction of keys. Define key lifecycle policies to ensure regular key updates and reduce security threats caused by key leaks.

[0126] By implementing the above measures, the security and compliance of encryption and decryption operations can be ensured, while improving management efficiency and response capabilities. This will help build a more robust security protection system to protect sensitive data from unauthorized access and potential security threats.

[0127] Therefore, the present application provides a mobile storage hardware protection method based on anti-injection technology, which can effectively deal with various security threats and prevent malicious behavior injection to protect data security by comprehensively and real-time monitoring data flow and implementing automatic defense mechanism according to monitoring results. At the same time, the method has strong adaptability, compatibility and abnormal data detection performance, etc., providing more powerful technical support for mobile storage hardware protection.

[0128] The various embodiments described in this specification are presented for the purpose of illustrating the principles of the application and its best mode of operation. Each of the embodiments described in this specification are presented for the purpose of illustrating the various aspects of the application, and the embodiments are not intended to limit the scope of the application.

[0129] The principles and implementations of the present application are described in the above embodiments, which are used to help understand the method and core idea of the present application. Meanwhile, for those skilled in the art, the specific implementation and application range of the present application can be changed according to the idea of the present application. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A mobile storage hardware protection method based on counter-injection technology, characterized in that, The method comprises the following steps: S1, when data transmission is performed between mobile storage hardware and a host, a data stream is captured through an interception mechanism for real-time monitoring, and user operation in the interception process is implemented without sensing; Wherein, by developing an interception agent or a driver, comprehensively monitoring the data stream, the transparency and compatibility of the interception mechanism are enhanced, by introducing deep packet inspection technology, applying state detection firewall, data verification, and establishing a feedback and repair mechanism, the accuracy and integrity of the data stream are improved; S2, multi-dimensional features of the data stream are extracted and analyzed, and compared with a normal data transmission benchmark mode to detect and determine whether there is abnormal behavior, if the determination result is yes, an automatic defense mechanism is triggered for protection; S3, the automatic defense mechanism includes a first defense measure based on the security threat degree of the abnormal behavior and a second defense measure based on the security threat category of the abnormal behavior and a preset serialization rule; S4, through permission management, audit log, automatic monitoring and key management, encryption and decryption operations are realized.

2. The mobile storage hardware protection method based on the anti-injection technology according to claim 1, characterized in that, In step S1: The deep packet inspection technology checks the header information and payload information of the data packet, and analyzes the surface features and application layer content of the data packet in real time, filters malicious traffic, and realizes deep detection by deploying a deep packet inspection system on the transmission path between the mobile storage hardware and the host; The application of the state detection firewall identifies and tracks the state of each data stream by configuring firewall rules, dynamically monitors the network connection state, prevents unauthorized and suspicious data access, and realizes intelligent filtering of data; The data verification performs integrity check on the data packet at each stage of data transmission, generates a hash value of the key data using a hash algorithm, and verifies the integrity and consistency of the data by comparing the checksum of the data packet with the hash value after data transmission is completed; The feedback and repair mechanism is established, and the abnormal processing mechanism and data repair are started through the comparison result of the data verification.

3. The mobile storage hardware protection method based on the anti-injection technology according to claim 2, characterized in that, The specific implementation process of step S2 is: The data size, transmission speed, data format, protocol type, port number, destination address and timestamp of the data packet are extracted to obtain the multi-dimensional features and perform behavior analysis, and potential malicious behavior is comprehensively identified; Using machine learning algorithm, clustering analysis is performed on historical data to construct a dynamically updated normal data transmission benchmark mode, and based on the importance of different features, feature weights are assigned by learning the normal data transmission benchmark mode; The multi-dimensional features are compared with the normal data transmission benchmark mode to determine whether there is abnormal behavior, if the determination result is yes, the automatic defense mechanism is triggered.

4. The mobile storage hardware protection method based on the anti-injection technology according to claim 3, characterized in that, The specific implementation process of the first defense measure is: Using an anomaly detection algorithm, the multi-dimensional features and the normal data transmission benchmark mode are calculated to obtain an anomaly score, the anomaly score is compared with a set anomaly threshold, and according to the comparison result, the corresponding first defense measure is triggered, and the formula of the anomaly detection algorithm is: where A(d) is the anomaly score of data stream d, f i is the actual value of feature i, is the mean value of feature i in the normal data transmission reference pattern, n is the total number of features; When the anomaly score is greater than the anomaly threshold, the abnormal behavior is determined, and according to the security threat level of the abnormal behavior, the corresponding first defense measure is triggered, and the rule definition formula of the security threat level is: Wherein, τ1 is a serious abnormal behavior, τ2 is a moderate abnormal behavior, and τ3 is a slight abnormal behavior; When the security threat level is a serious abnormal behavior, the affected device or network is immediately isolated, when the security threat level is a moderate abnormal behavior, the data transmission is interrupted, and when the security threat level is a slight abnormal behavior, the record and further monitoring are performed.

5. The mobile storage hardware protection method based on the anti-injection technology according to claim 4, characterized in that, The second defense measure is specifically implemented as follows: The security threat of the abnormal behavior is classified, including malicious software intrusion, unauthorized access and data leakage, three second defense measures are developed for the three security threat categories, each second defense measure includes four levels, the four levels of each second defense measure are sorted, and the second defense measure is executed according to the preset serialization rule; Wherein, the three second defense measures include a second defense measure a corresponding to the malicious software intrusion, a second defense measure b corresponding to the unauthorized access, and a second defense measure c corresponding to the data leakage.

6. The mobile storage hardware protection method based on the anti-injection technology according to claim 5, characterized in that: The second defense measure a includes a level a1 for recording events and malicious software features to a security log, a level a2 for displaying warning information on a terminal and notifying a system administrator, a level a3 for isolating an infected terminal and limiting network access, and a level a4 for restarting the terminal in a security mode and performing a complete system scan; The second defense measure b includes a level b1 for recording suspicious login attempts to a security log, a level b2 for sending warning information to an account owner and a system administrator, a level b3 for temporarily locking the account and prohibiting further login attempts, and a level b4 for starting network monitoring and tracking the source of suspicious activities; The second defense measure c includes a level c1 for recording data transmission activities to a security log and marking as high risk, a level c2 for limiting the transmission of sensitive data and notifying the data owner, a level c3 for interrupting network connection and performing data leakage evaluation, and a level c4 for clearing the cache of sensitive data and encrypting the affected system.

7. The mobile storage hardware protection method based on the anti-injection technology according to claim 6, characterized in that, The serialization rule of the second defense measure is: When the abnormal behavior is detected as a malicious software intrusion, and an unauthorized process is found to attempt to modify a system file, the second defense measure a is triggered, the second defense measure a is sequentially protected in the order of the level a1, the level a2, the level a3 and the level a4, and if the malicious software activity does not stop within 30 minutes after the level a2 ends, the level a3 is upgraded, and if the level a3 successfully isolates the malicious software and does not recur for 24 hours, the level a1 is downgraded for monitoring. When detecting that the abnormal behavior is unauthorized access, and finding non-standard time account login activity, triggering the second defense measure b, the second defense measure b is protected in order of the level b1, the level b2, the level b3, the level b4, if the unauthorized access attempt has not stopped within 1 hour after the level b2, it is upgraded to the level b3, if no further unauthorized access is found after the account is locked and after the security review, it is downgraded to the level b1 for monitoring; When detecting that the abnormal behavior is data leakage, and finding sensitive data transmitted through the network to unauthorized destination, triggering the second defense measure c, the second defense measure c is protected in order of the level c1, the level c2, the level c3, the level c4, if the data leakage risk has not been reduced after the level c2, it is upgraded to the level c3, if the data leakage risk is controlled and no further data leakage is confirmed through security review, it is downgraded to the level c1 for monitoring.

8. The mobile storage hardware protection method based on the anti-injection technology according to claim 7, characterized in that, The implementation process of the encryption and decryption operations is: The permission management makes the user have the minimum permission set by using the role access control and the minimum permission principle, and combines the multi-factor authentication to reduce the security risk; The audit log finds and investigates the suspicious behavior by recording the detailed information of the encryption and decryption operations and regularly reviewing; The key management realizes the generation, distribution, use, rotation and destruction of the key by using the key management system, and defines the key life cycle strategy to make the key update regularly.

Images