Implementation system and method for USB flash disk encryption

Abstract

The invention relates to the technical field of data security, in particular to a USB flash disk encryption implementation system and method. The system comprises a data partition management module used for forming a common data partition and a hidden encryption partition; the transparent encryption and decryption module is realized based on a file system filter driver and is used for encrypting and decrypting the hidden encryption partition data in real time; the identity authentication module is used for verifying user identity information and dynamically mounting the hidden encryption partition after the user identity information passes the verification; and the security isolation module is used for establishing a security data transmission channel and monitoring an access state, and automatically unloading the hidden encryption partition when a condition is met. The method comprises the steps of partition creation, request interception, identity verification, dynamic mounting, real-time encryption and decryption and automatic unloading. According to the invention, security level-to-level management and transparent encryption and decryption of U disk data are realized, and the problems of poor compatibility and complex operation in the prior art are solved.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and more specifically, to a system and method for implementing USB flash drive encryption. Background Technology

[0002] In the field of mobile storage device security, both domestically and internationally, hardware encryption and software encryption are the two main technical approaches. Hardware encryption, implemented through built-in encryption chips, has been developed earlier and is relatively mature. Software encryption, on the other hand, relies on encryption programs running on USB flash drives or host computers, and is characterized by low cost and high flexibility. In recent years, with the popularization of mobile office work, the demand for encrypted USB flash drives that combine security and ease of use has continued to grow, and technological development has shown a trend from single encryption to comprehensive security protection, and from hardware dependence to a combination of hardware and software.

[0003] Existing USB flash drive encryption technologies have several significant shortcomings. Hardware-based encryption solutions require dedicated encryption chips, significantly increasing costs, and the varying compatibility between chips from different manufacturers limits their widespread application. While pure software encryption solutions are lower in cost, they often require the installation of specific drivers or client software on the host machine, leading to compatibility issues across different operating systems and severely impacting ease of use. Some solutions employ full-disk encryption, failing to provide a flexible public data exchange area while ensuring security. Traditional partition mounting methods typically require re-inserting the USB flash drive to recognize the encrypted partition, resulting in a cumbersome process and poor user experience. Furthermore, existing technologies generally lack dynamic awareness of the usage environment and cannot automatically adjust access permissions based on security conditions, posing a risk of data leakage.

[0004] Therefore, this paper proposes a USB flash drive encryption system and method to address the above problems. The technical issues to be solved are: how to overcome the poor compatibility and complex operation of existing USB flash drive encryption technologies; how to achieve secure and convenient data protection without the need for dedicated hardware; and how to provide multi-layered data security without affecting normal use. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art, embodiments of the present invention provide a USB flash drive encryption system and method to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a USB flash drive encryption system, comprising: A data partition management module created in the USB flash drive storage space is used to form ordinary data partitions and hidden encrypted partitions, wherein the hidden encrypted partitions are invisible by default when the USB flash drive is connected to a computing device; a transparent encryption / decryption module, which is implemented based on a file system filter driver and communicates with the data partition management module, is used to perform real-time encryption and decryption operations on the data in the hidden encrypted partitions; an identity authentication module, which is communicated with both the transparent encryption / decryption module and the data partition management module, is used to dynamically mount the hidden encrypted partitions to make them visible and usable to the user after verifying the user's identity information; and a security isolation module, which is communicated with both the identity authentication module and the transparent encryption / decryption module, is used to establish a secure data transmission channel after the hidden encrypted partitions are mounted, monitor the access status of the hidden encrypted partitions, and automatically unmount the hidden encrypted partitions to restore them to an invisible state when preset conditions are met.

[0007] Furthermore, the data partition management module includes a partition configuration unit, which adopts a USB combined device structure model, configures the ordinary data partition as a driverless device, and configures the hidden encrypted partition as a device that needs to be successfully verified by the identity authentication module before it can be mounted.

[0008] Furthermore, the transparent encryption / decryption module includes a driver interception unit and an encryption / decryption operation unit; the driver interception unit is implemented based on a file system filter driver and is located between the file system layer and the storage device layer, used to intercept file input / output requests targeting the hidden encrypted partition; the encryption / decryption operation unit is connected to the driver interception unit and is used to perform real-time encryption / decryption processing on the data involved in the file input / output requests using a symmetric encryption algorithm.

[0009] Furthermore, the identity authentication module includes an authentication information management unit and a dynamic mounting unit; the authentication information management unit is used to process authentication information input by the user, the authentication information including password, fingerprint feature data or a combination thereof; the dynamic mounting unit is connected to the authentication information management unit and is used to send instructions to the operating system after successful authentication to dynamically load the drive letter corresponding to the hidden encrypted partition without having to unplug and replug the USB flash drive.

[0010] Furthermore, the identity authentication module also includes a communication port unit, which is established between the USB flash drive and the computing device for transmitting authentication status information and mounting control commands.

[0011] Furthermore, the security isolation module includes an access monitoring unit and an automatic unloading unit; the access monitoring unit is used to monitor the read and write operation status of the hidden encrypted partition; the automatic unloading unit is connected to the access monitoring unit and is used to automatically unload the hidden encrypted partition when the time without access activity exceeds a preset threshold, or when a user manually exits the connection, or when the computing device is connected to an insecure network environment.

[0012] A method for implementing USB flash drive encryption includes the following steps: S1: Create a regular data partition and a hidden encrypted partition in the USB flash drive storage space, wherein the hidden encrypted partition is invisible by default when the USB flash drive is connected to the computing device; S2: Intercept file input / output requests for the hidden encrypted partition using the file system filter driver; S3: Verify the user's identity information, and after successful verification, dynamically mount the hidden encrypted partition to make it visible and usable to the user; S4: After the hidden encrypted partition is mounted, the data involved in the read and write operations is encrypted and decrypted in real time through the file system filter driver; S5: Monitor the access status of the hidden encrypted partition, and automatically unload the hidden encrypted partition to restore it to an invisible state when the preset conditions are met; The state control definition in step S5 is as follows: in, This indicates the mount status of the hidden encrypted partition. Indicates the user's authentication status. This indicates the idle time during which the partition has no access activity. This indicates the preset maximum allowed idle time threshold. This indicates the security status of the network environment.

[0013] Furthermore, S1 includes: configuring the USB flash drive partition using a USB combined device structure model, so that the ordinary data partition can be directly accessed as a driverless device, and the hidden encrypted partition can only be mounted after successful identity authentication.

[0014] Furthermore, the real-time encryption and decryption process for the data involved in the read and write operations in S4 is defined by the following formula: in, This represents the ciphertext after encrypting the i-th data block. This represents the plaintext of the i-th data block before encryption. This indicates a symmetric encryption algorithm using key k. This represents the perturbation sequence associated with the storage location, where L represents the length of the perturbation sequence. This means that a different randomization factor is generated for each data block.

[0015] Furthermore, S5 includes: monitoring the read and write operation activity status of the hidden encrypted partition; automatically unloading the hidden encrypted partition when the time without access activity exceeds a preset threshold, or when a user manually exits the connection, or when the computing device is connected to an insecure network environment.

[0016] The technical effects and advantages of this invention are as follows: Compared to existing technologies, this invention creates a dual-partition structure within the USB flash drive storage space, consisting of a regular data partition and a hidden encrypted partition. Employing a USB modular device architecture model, the regular partition is configured as a driverless device, while the hidden partition requires authentication before mounting, thus achieving hierarchical data security management. This solution establishes the partition structure through a data partition management module, and dynamically mounts the hidden partition after the authentication module verifies the user's identity. This ensures that the USB flash drive only displays the regular partition in the unauthenticated state, and access to the encrypted partition is only possible after authentication. This approach guarantees the security of sensitive data while retaining the convenient exchange function of regular data. It eliminates the need for encryption at the entire USB flash drive level, reducing system resource consumption and improving efficiency. Furthermore, it avoids access barriers caused by driver compatibility issues when used on different computers.

[0017] Compared to existing technologies, this invention intercepts file input / output requests to the hidden encrypted partition through a transparent encryption / decryption module based on a file system filter driver, and uses a symmetric encryption algorithm to perform real-time encryption and decryption on the data involved in read / write operations. This solution establishes a processing channel between the file system layer and the storage device layer through a driver interception unit. The encryption / decryption unit automatically encrypts and decrypts data passing through this channel. The user is unaware of the encryption process, and the operation experience is no different from that of a regular USB flash drive. This avoids the cumbersome steps of manually encrypting and decrypting files required by traditional encryption software, reducing the user's operational burden. Simultaneously, it ensures the persistent encrypted state of data on the storage medium. Even if the USB flash drive is lost or stolen, the data stored in the hidden encrypted partition remains secure, effectively preventing the risk of data leakage due to unauthorized access. Attached Figure Description

[0018] Figure 1 This is a diagram of the overall system architecture of the present invention.

[0019] Figure 2 This is a flowchart illustrating the identity authentication and dynamic mounting process of the present invention.

[0020] Figure 3This is a flowchart illustrating the security monitoring and automatic uninstallation process of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] As attached Figures 1 to 3 The following is a detailed implementation of a USB flash drive encryption system and method: Example 1: USB flash drive encryption system and method based on dual-partition dynamic management and security isolation This embodiment details a USB flash drive encryption system, the core of which lies in achieving hierarchical data security protection through dynamic partition management and intelligent security strategies. When the USB flash drive of this invention is connected to a computing device (such as a laptop running a Windows operating system), its data partition management module begins to operate. This module creates and manages two independent logical partitions at the physical level of the USB flash drive's storage space: a regular data partition and a hidden encrypted partition. This process is implemented using a USB combined device structure model through a partition configuration unit, which enumerates the USB flash drive as two independent devices on the host side. The regular data partition is configured as a driverless, high-capacity storage device that can be immediately recognized and mounted by the operating system, allowing users to read and write regular files in this partition as if using a regular USB flash drive. The hidden encrypted partition, on the other hand, is configured as a device that requires a specific driver to be recognized. Before authentication, this partition is completely invisible to the operating system and the user, and its drive letter will not appear in File Explorer, thus achieving initial isolation at the physical connection level.

[0023] When a user needs to access sensitive data in a hidden, encrypted partition, the authentication module is activated. The user double-clicks the authentication client program in the root directory of the USB drive. This program establishes secure communication with the USB drive firmware through the communication port unit of the authentication module. The authentication information management unit prompts the user to enter a preset password and verifies its hash value. After successful password verification, the authentication status variable... A value of 1 indicates successful authentication. Next, the dynamic mount unit sends a plug-and-play event trigger command to the operating system kernel, simulating a signal indicating a new USB storage device has been connected to the system. Upon receiving this signal, the operating system automatically loads and mounts the hidden encrypted partition without requiring the user to unplug and replug the USB drive, assigning it a new drive letter and making it visible and usable to the user. At this point, the user can see and access this newly appeared drive in File Explorer.

[0024] While the hidden encrypted partition is mounted and visible, the security isolation module continues to operate to ensure that security is not compromised by the partition becoming visible. The access monitoring unit of the security isolation module monitors all read and write operations on the partition in real time. Its core control logic is defined by the following state determination formula: in, This represents the current mount status of the hidden encrypted partition. 1 indicates that it is mounted (visible), and 0 indicates that it is not mounted (hidden). This represents the authentication status, and its value comes from the authentication result of the authentication module. This represents the idle time the partition has experienced since the last access operation. This value is continuously calculated and updated by the access monitoring unit. It is the preset maximum allowed idle time threshold, for example, set to 5 minutes (300 seconds). This indicates the security status of the network environment. Its value is dynamically determined by the security isolation module by querying the network configuration of the computing device (e.g., whether it is connected to a trusted Wi-Fi network or whether a firewall is enabled). 1 indicates security and 0 indicates insecurity.

[0025] As long as all the above conditions are met (i.e., the result of the logical AND operation is true). The value remains 1, and the partition remains mounted. If any condition is not met, such as a user leaving causing access interruption, then... Exceed Or the computing device is connected to a public network that has been marked as insecure, making... It becomes 0; or the user actively logs out, making it... The state determination formula is reset to 0. The system will immediately switch to 0. At this point, the automatic unmount unit is triggered, forcing the operating system to unmount the encrypted partition's drive letter and reconfigure it to its initial inactive state. The partition instantly disappears from the user's view, all access channels are cut off, and the data is restored to its protected, hidden state. This comprehensive judgment mechanism based on multiple factors ensures the dynamism and adaptability of the security policy, greatly enhancing the proactiveness of data protection.

[0026] Example 2: Transparent Encryption / Decryption Process Based on File System Filter Driver This embodiment details the real-time, transparent encryption and decryption process of the data within the hidden encrypted partition after it has been successfully mounted, based on Embodiment 1 described above. The core of this process is the transparent encryption and decryption module, which, as a software middleware layer, is seamlessly embedded into the operating system's storage stack.

[0027] The core of the transparent encryption / decryption module is the driver interception unit, which is implemented based on file system filter driver technology, specifically using the Minifilter framework on the Windows platform. Once loaded, this unit resides between the file system layer (such as NTFS) and the storage device layer (disk driver), intercepting all input / output request packets sent to or originating from the hidden encrypted partition. When a user creates or modifies a file (e.g., a file named "DesignDoc.docx") in the mounted hidden encrypted partition and performs a save operation, the operating system generates a series of write requests. These requests, along with the plaintext data they carry, are inevitably captured by the driver interception unit before reaching the physical storage medium.

[0028] The captured write requests and corresponding plaintext data are not directly sent. The driver interception unit forwards these data streams to the closely connected encryption / decryption unit for processing. The encryption / decryption unit does not encrypt the entire file as a single unit; instead, it uses a block-based processing method to improve efficiency and security. It divides the file data stream into a series of fixed or variable-length data blocks, for example, each data block is 4KB, aligned with the disk sector size. For the i-th plaintext data block... The encryption / decryption unit performs the following transformation formula to generate the corresponding ciphertext data block. : in, It is the i-th encrypted data block that will be generated and written to the physical storage medium of the USB flash drive. This represents the plaintext of the i-th data block before encryption. This uses a symmetric encryption algorithm function (such as AES-256) with key k. Key k is not stored directly from the user's password; instead, it is generated by processing the user's password using a standard key derivation function. This step performs high-strength encryption on the initially obfuscated data. This represents the perturbation sequence associated with the storage location, where L represents the length of the perturbation sequence. This is a randomization factor generated independently for each data block. This factor can be generated using a secure random number generator. XORing the encrypted data ensures that even if two data blocks are completely identical after the previous processing steps, their final ciphertext will remain the same. It also varies greatly depending on the random factor, which provides extremely high semantic security and can effectively resist known plaintext attacks and ciphertext analysis.

[0029] The encrypted data block sequence obtained after processing by the above formula The data is reassembled and sent to the storage device driver by the driver interception unit, ultimately being written to the physical flash memory of the USB drive. The entire process is completed instantly in the background, without the user's awareness, providing an experience completely identical to writing a file to a regular partition.

[0030] When a user needs to read the "DesignDoc.docx" file, a reverse and equally transparent process is triggered. The driver interception unit intercepts read requests from the operating system to the hidden encrypted partition. Encrypted data blocks are then read from the physical media. It is sent to the encryption / decryption unit. The encryption / decryption unit performs the inverse operation of the encryption formula: in, yes The corresponding decryption function. Through this inverse operation, the plaintext data block... The data is precisely restored. These restored plaintext blocks are then sequentially submitted to the upper-level file system and applications. For users and applications, they access a normal, unencrypted file; the encryption and decryption process is perfectly hidden, achieving "transparent" access while ensuring data confidentiality at the storage level. This block-based encryption mode, combining positional perturbation and randomization, significantly enhances encryption strength while maintaining high performance, making it extremely difficult for attackers to deduce any useful information from the ciphertext even if they directly analyze the storage medium.

[0031] Finally, the following points should be noted: First, in the description of this application, it should be noted that, unless otherwise specified and limited, the terms "installation", "connection", and "linkage" should be interpreted broadly, and can be mechanical or electrical connections, or internal connections between two components, or direct connections. "Up", "down", "left", "right", etc. are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may change. Secondly: The accompanying drawings of the embodiments disclosed in this invention only involve the structures involved in the embodiments disclosed in this invention. Other structures can refer to the general design. In the absence of conflict, the same embodiment and different embodiments of this invention can be combined with each other. In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A USB disk encryption system, characterized in that, Comprise: The data partition management module created in the U disk storage space is used for forming a common data partition and a hidden encrypted partition, wherein the hidden encrypted partition is in an invisible state by default when the U disk accesses a computing device; a transparent encryption and decryption module in communication connection with the data partition management module, the transparent encryption and decryption module is realized based on a file system filtering driver, and is used for performing real-time encryption and decryption operation on data in the hidden encrypted partition; an identity authentication module in communication connection with the transparent encryption and decryption module and the data partition management module, used for dynamically mounting the hidden encrypted partition to make it visible and available to a user after verifying that user identity information is passed; and a security isolation module in communication connection with the identity authentication module and the transparent encryption and decryption module, used for establishing a secure data transmission channel after the hidden encrypted partition is mounted, and monitoring an access state of the hidden encrypted partition, and automatically unmounting the hidden encrypted partition to make it return to an invisible state when a preset condition is met.

2. The U disk encryption system according to claim 1, characterized in that, The data partition management module comprises a partition configuration unit, the partition configuration unit adopts a USB combination device structure model, and the common data partition is configured as a driver-free device, and the hidden encrypted partition is configured as a device that needs to be mounted after the identity authentication module is successfully verified.

3. The U disk encryption system of claim 1, wherein, The transparent encryption and decryption module comprises a drive interception unit and an encryption and decryption operation unit; the drive interception unit is realized based on a file system filtering driver, is arranged between a file system layer and a storage device layer, and is used for intercepting a file input and output request for the hidden encrypted partition; the encryption and decryption operation unit is connected with the drive interception unit, and is used for performing real-time encryption and decryption processing on data related to the file input and output request by using a symmetric encryption algorithm.

4. The U disk encryption system of claim 1, wherein, The identity authentication module comprises an authentication information management unit and a dynamic mounting unit; the authentication information management unit is used for processing authentication information input by a user, and the authentication information comprises a password, fingerprint feature data or a combination thereof; The dynamic mounting unit is connected with the authentication information management unit, and is used for sending an instruction to an operating system after authentication is passed, and dynamically loading a disk symbol corresponding to the hidden encrypted partition without needing to plug and unplug the U disk.

5. The U disk encryption system of claim 4, wherein, The identity authentication module further comprises a communication port unit, the communication port unit is established between the U disk and the computing device, and is used for transmitting authentication state information and mounting control instructions.

6. The U disk encryption system according to claim 1, characterized in that, The security isolation module comprises an access monitoring unit and an automatic unmounting unit; the access monitoring unit is used for monitoring a read and write operation activity state of the hidden encrypted partition; and the automatic unmounting unit is connected with the access monitoring unit, and is used for automatically unmounting the hidden encrypted partition when it is detected that a time without access activity exceeds a preset threshold, or a user manual exit instruction is received, or it is detected that the computing device is connected to an insecure network environment.

7. A U disk encryption implementation method, characterized in that, Comprise the following steps: S1: a common data partition and a hidden encrypted partition are created in a U disk storage space, wherein the hidden encrypted partition is in an invisible state by default when the U disk accesses a computing device; S2: a file input and output request for the hidden encrypted partition is intercepted through a file system filtering driver; S3: verifying the user identity information, and dynamically mounting the hidden encrypted partition to be visible and available to the user after the verification is passed; S4: after the mounting of the hidden encrypted partition, the data involved in the read-write operation is processed by the file system filtering driver for real-time encryption and decryption; S5: monitoring the access state of the hidden encrypted partition, and automatically unmounting the hidden encrypted partition to restore the invisible state when the preset condition is met; wherein the state control in step S5 is defined as follows: wherein, represents a mounting state of a hidden encrypted partition, represents a user identity authentication state, represents an idle time of a partition with no access activity, represents a preset maximum allowed idle time threshold, represents a network environment security state.

8. The U disk encryption implementation method according to claim 7, characterized in that, The S1 comprises: configuring the U disk partition by adopting a USB combination device structure model, so that the normal data partition can be directly accessed as a driver-free device, and the hidden encrypted partition needs to be mounted after the identity authentication verification is successful.

9. The U disk encryption implementation method according to claim 7, characterized in that, The process of the real-time encryption and decryption processing of the data involved in the read-write operation in the S4 is defined by the following formula: wherein, denotes the ciphertext of the i-th data block after encryption, denotes the plaintext of the i-th data block before encryption, denotes a symmetric encryption algorithm using a key k, denotes a perturbation sequence related to the storage location, L denotes the length of the perturbation sequence, denotes that a different randomization factor is generated for each data block.

10. The U disk encryption implementation method according to claim 7, characterized in that, The S5 comprises: monitoring the read-write operation activity state of the hidden encrypted partition; automatically unmounting the hidden encrypted partition when it is detected that the time without access activity exceeds a preset threshold, or a user manual exit instruction is received, or it is detected that the computing device is connected to an insecure network environment.

Images