Multi-level verification method and device for mobile storage and storage medium
By employing a multi-level scanning and step-by-step verification method, the problem of mobile storage devices being infected with malware in industrial control systems was solved. This improved scanning accuracy and speed, enhanced security, prevented malware infection, and avoided system performance degradation and compatibility issues.
Patent Information
- Application Number
- CN202380100345.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-08-31
- Publication Date
- 2026-02-17
AI Technical Summary
Existing technologies are insufficient to effectively detect and prevent malware infection via mobile storage devices in industrial control systems, which can lead to production disruptions, and existing solutions may affect system performance and compatibility.
A multi-level scanning method is adopted, which obtains multi-level scanning results of mobile storage through a central security monitoring system, verifies each level and provides access permissions, prevents malware from bypassing basic checks, and improves scanning accuracy and speed.
It improves the scanning accuracy and speed of mobile storage devices, enhances security, prevents malware infection, and avoids system performance degradation and compatibility issues.
Smart Images
Figure CN121548818A_ABST
Abstract
Description
A method, apparatus and storage medium for multi-level verification of mobile storage
[0001] This invention relates to the field of information security, and in particular to a method, apparatus and storage medium for multi-level verification of mobile storage.
[0002] Mobile storage or data exchange within industrial control systems can pose a significant threat. Even if industrial control systems are physically or logically isolated from the internet and IT networks, malware or Trojans can exploit mobile storage to infect target systems within these systems. Numerous security incidents and production disruptions have occurred due to malware infecting industrial control systems via mobile storage devices.
[0003] Several methods or systems for managing mobile storage devices have been proposed to control the use of mobile storage in OT (Operation Technology) systems. USB control software can restrict the use of mobile storage devices, allowing only processed devices to be used on the target system. However, this software requires an agent to be installed on the target system to control the use of external interfaces and to check and determine whether the mobile storage device is compatible. This may lead to compatibility issues and degrade the performance of the target system. In some scenarios, it may even affect the normal operation of OT devices.
[0004]
[0005] To achieve the above objectives, this invention proposes a multi-level verification method, apparatus, and storage medium for mobile storage, which can improve the scanning accuracy of mobile storage devices, increase the speed of mobile storage in use, prevent malicious software from bypassing basic checks, and improve security.
[0006] This invention proposes a multi-level verification method for mobile storage, comprising: acquiring multi-level scan results; when mobile storage is used, the central security monitoring system acquires the multi-level scan results of the mobile storage; verifying the multi-level scan results, determining whether the mobile storage has been scanned and whether the multi-level scan results are normal based on the multi-level scan results; if not, prohibiting the use of the mobile storage and triggering an alarm; performing step-by-step verification, providing usage permissions for the mobile storage level by level, and scanning the mobile storage based on the scanning rules corresponding to the usage permissions to obtain the current scan result; determining whether the part of the multi-level scan results corresponding to the current scan result matches the current scan result; if yes, providing the next level of usage permissions; if not, locking the mobile storage and triggering an alarm. Through multi-level step-by-step verification, multi-level malware scanning strategies can be performed, improving scanning speed and accuracy.
[0007] In one implementation, before the removable storage is used, a scanning system performs a multi-level scan on the removable storage to obtain the multi-level scan results, and then stores the multi-level scan results in the central security monitoring system. This scanning system avoids consuming the resources of the actual system for virus scanning.
[0008] This invention discloses a multi-level verification device for mobile storage, comprising: a multi-level scan result acquisition module, configured to acquire multi-level scan results of the mobile storage when it is used by a central security monitoring system; a multi-level scan result verification module, configured to determine whether the mobile storage has been scanned and whether the multi-level scan results are normal based on the multi-level scan results; if not, prohibiting the use of the mobile storage and triggering an alarm; and a step-by-step verification module, configured to: progressively grant usage permissions to the mobile storage, and scan the mobile storage based on the scanning rules corresponding to the usage permissions to obtain the current scan result; determine whether the part of the multi-level scan results corresponding to the current scan result matches the current scan result; if yes, granting the next level of usage permissions; if not, locking the mobile storage and triggering an alarm. Through multi-level step-by-step verification, multi-level malware scanning strategies can be performed, improving scanning speed and accuracy.
[0009] In one implementation, before the removable storage is used, a scanning system performs a multi-level scan on the removable storage to obtain the multi-level scan results, and then stores the multi-level scan results in the central security monitoring system. This scanning system avoids consuming the resources of the actual system for virus scanning.
[0010] An electronic device according to an embodiment of the present invention includes: at least one processor; and a memory coupled to the at least one processor, the memory being used to store instructions that, when executed by the at least one processor, cause the processor to perform the method described above.
[0011] The present invention provides a computer-readable storage medium storing computer instructions, which, when executed, perform the methods described in any of the above embodiments.
[0012] An embodiment of the present invention provides a computer program product, which includes a computer program that, when executed by a processor, implements the method described in any of the above embodiments.
[0013] The following figures are intended only to illustrate and explain the invention and do not limit the scope of the invention.
[0014] Figure 1 is a flowchart illustrating a multi-level verification method 100 for mobile storage according to an embodiment of the present invention.
[0015] Figure 2 is a schematic diagram of the structure of a mobile storage multi-level verification device 200 according to an embodiment of the present invention.
[0016] Figure 3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention.
[0017] The annotations in the attached figures are explained as follows:
[0018] To provide a clearer understanding of the technical features, objectives, and effects of the present invention, specific embodiments of the present invention will now be described with reference to the accompanying drawings.
[0019] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and therefore the invention is not limited to the specific embodiments disclosed below.
[0020] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.
[0021] In some OT (Operational Technology) management processes, mobile storage devices need to be scanned for malware on a dedicated host before being used in the OT system. However, it is difficult to check whether the mobile storage device has been scanned in the OT system beforehand. In many scenarios, operators or engineers may fail to scan due to a lack of security awareness, or in some emergency situations, they may directly use any mobile storage in the OT system. These violations pose a significant threat and are not easily detected.
[0022] Before using mobile storage in an OT system, you can check the scanning status of the mobile storage, but it is difficult to perform a status scan of the entire mobile storage in a short time, which may affect the user experience.
[0023] Therefore, to provide a more optimized mobile storage scanning method, in this embodiment of the invention, when the mobile storage is used, the central security monitoring system obtains multi-level scanning results of the mobile storage; based on the multi-level scanning results, it is determined whether the mobile storage has been scanned and whether the multi-level scanning results are normal; if not, the use of the mobile storage is prohibited and an alarm is triggered; usage permissions for the mobile storage are granted level by level, and the mobile storage is scanned based on the scanning rules corresponding to the usage permissions to obtain the current scanning result; it is determined whether the part of the multi-level scanning results corresponding to the current scanning result matches the current scanning result; if yes, the next level of usage permission is granted; if not, the mobile storage is locked and an alarm is triggered. The technical solution in this embodiment of the invention can improve the scanning accuracy of mobile storage devices, increase the speed of mobile storage use, prevent malicious software from bypassing basic checks, and improve security.
[0024] Figure 1 is a flowchart illustrating a multi-level verification method 100 for mobile storage according to an embodiment of the present invention. As shown in Figure 1, the method 100 may include:
[0025] Step S101: Obtain multi-level scan results. When the mobile storage is used, the central security monitoring system obtains the multi-level scan results of the mobile storage.
[0026] In one implementation, before the mobile storage is used, the mobile storage is scanned at multiple levels by a scanning system to obtain the multi-level scan results, and the multi-level scan results are stored in the central security monitoring system.
[0027] Specifically, the scanning system can update its malware database via an update server provided by an anti-malware vendor over the internet. The scanning system then sends the scan results and security status information to a central security monitoring system. If the removable storage is free of malware and passes the malware scan, the scanning system generates a multi-level result summary and obtains the removable storage ID. Multi-level scanning can be customized by the administrator based on performance and scan time requirements. In addition to performing a full malware scan using multiple anti-malware engines, multi-level scanning also performs various checks to detect potential file modifications on the removable storage.
[0028] In one embodiment, the multi-level scanning results further include:
[0029] Level 1: Last update time, scan time, and disk usage;
[0030] Level 2; Executable file hash value, file modification log, and number of files;
[0031] Level 3: Hash values of critical files and modification times of any potentially infected files.
[0032] Step S102: Verify the multi-level scan results. Based on the multi-level scan results, determine whether the removable storage has been scanned and whether the multi-level scan results are normal. If not, prohibit the use of the removable storage and issue an alarm.
[0033] Specifically, when mobile storage is used in an OT device, a trust analysis is performed by requesting the scan result status with the mobile storage ID.
[0034] Step S103: Verify step by step, grant access permissions to the mobile storage step by step, and scan the mobile storage based on the scanning rules corresponding to the access permissions to obtain the current scan result; determine whether the part of the multi-level scan result corresponding to the current scan result matches the current scan result; if yes, grant access permissions to the next level; if no, lock the mobile storage and issue an alarm.
[0035] Specifically, when a removable storage device is used in an OT device, a status check is performed according to a multi-level policy. If the removable storage device passes the first-level policy's quick scan, it can be identified and used by the OT device with limited permissions. Then, during idle time, second-level and third-level scans will be performed according to the multi-level policy. However, it can only be accessed with limited permissions until the entire scan is completed.
[0036] In one implementation, the usage rights include:
[0037] Level 1: Lists all files, cannot access any executable files or files that may be infected by malware, and cannot automatically execute any applications or scripts;
[0038] Level 2: Lists all files, allows copying and editing of files that are unlikely to be infected by malware, prohibits access to any executable files or files that may be infected by malware, and prevents the automatic execution of any applications or scripts;
[0039] Level 3: Lists all files, allows copying and editing executable files, allows copying and editing files that are unlikely to be infected by malware, does not allow access to any executable files or files that may be infected by malware, and does not allow automatic execution of any applications or scripts.
[0040] In one implementation, the scanning rule corresponding to the usage permission further includes:
[0041] Level 1: Last update time, scan time, and disk usage;
[0042] Level 2; Executable file hash value, file modification log, and number of files;
[0043] Level 3: Hash values of critical files and modification times of any potentially infected files.
[0044] In one embodiment, after the mobile storage passes the step-by-step verification, the method further includes: granting the mobile storage full access rights.
[0045] Figure 2 is a schematic diagram of a mobile storage multi-level verification device 200 according to an embodiment of the present invention. As shown in Figure 2, the device 200 may include:
[0046] The multi-level scan result acquisition module 201 is configured to acquire the multi-level scan results of the mobile storage by the central security monitoring system when the mobile storage is used.
[0047] In one implementation, before the mobile storage is used, the mobile storage is scanned at multiple levels by a scanning system to obtain the multi-level scan results, and the multi-level scan results are stored in the central security monitoring system.
[0048] Specifically, the scanning system can update its malware database via an update server provided by an anti-malware vendor over the internet. The scanning system then sends the scan results and security status information to a central security monitoring system. If the removable storage is free of malware and passes the malware scan, the scanning system generates a multi-level result summary and obtains the removable storage ID. Multi-level scanning can be customized by the administrator based on performance and scan time requirements. In addition to performing a full malware scan using multiple anti-malware engines, multi-level scanning also performs various checks to detect potential file modifications on the removable storage.
[0049] In one embodiment, the multi-level scanning results further include:
[0050] Level 1: Last update time, scan time, and disk usage;
[0051] Level 2; Executable file hash value, file modification log, and number of files;
[0052] Level 3: Hash values of critical files and modification times of any potentially infected files.
[0053] The multi-level scan result verification module 202 is configured to determine whether the mobile storage has been scanned and whether the multi-level scan results are normal based on the multi-level scan results; if not, the use of the mobile storage is prohibited and an alarm is triggered.
[0054] Specifically, when mobile storage is used in an OT device, a trust analysis is performed by requesting the scan result status with the mobile storage ID.
[0055] The step-by-step verification module 203 is configured to provide access permissions to the mobile storage step by step, and scan the mobile storage based on the scanning rules corresponding to the access permissions to obtain the current scan result; determine whether the part of the multi-level scan result corresponding to the current scan result matches the current scan result; if yes, provide access permissions to the next level; if no, lock the mobile storage and issue an alarm.
[0056] Specifically, when a removable storage device is used in an OT device, a status check is performed according to a multi-level policy. If the removable storage device passes the first-level policy's quick scan, it can be identified and used by the OT device with limited permissions. Then, during idle time, second-level and third-level scans will be performed according to the multi-level policy. However, it can only be accessed with limited permissions until the entire scan is completed.
[0057] In one implementation, the usage rights include:
[0058] Level 1: Lists all files, cannot access any executable files or files that may be infected by malware, and cannot automatically execute any applications or scripts;
[0059] Level 2: Lists all files, allows copying and editing of files that are unlikely to be infected by malware, prohibits access to any executable files or files that may be infected by malware, and prevents the automatic execution of any applications or scripts;
[0060] Level 3: Lists all files, allows copying and editing executable files, allows copying and editing files that are unlikely to be infected by malware, does not allow access to any executable files or files that may be infected by malware, and does not allow automatic execution of any applications or scripts.
[0061] In one implementation, the scanning rule corresponding to the usage permission further includes:
[0062] Level 1: Last update time, scan time, and disk usage;
[0063] Level 2; Executable file hash value, file modification log, and number of files;
[0064] Level 3: Hash values of critical files and modification times of any potentially infected files.
[0065] In one embodiment, the step-by-step verification module 203 is further configured to: after the mobile storage passes the step-by-step verification, grant the mobile storage full access rights.
[0066] The present invention also proposes an electronic device 300. Figure 3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention. As shown in Figure 3, the electronic device 300 includes a processor 310 and a memory 320, wherein the memory 320 stores instructions, wherein when the instructions are executed by the processor 310, they implement the method 100 described above.
[0067] The present invention also proposes a computer-readable storage medium having computer instructions stored thereon, which, when executed, perform the methods described above.
[0068] The present invention also proposes a computer program product, including a computer program that, when executed by a processor, performs the methods described above.
[0069] Some aspects of the methods and apparatus of this invention can be executed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The aforementioned hardware or software may be referred to as a "data block," "module," "engine," "unit," "component," or "system." The processor may be one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLCs), field-programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, or combinations thereof. Furthermore, aspects of this invention may be embodied as computer products located on one or more computer-readable media, including computer-readable program code. For example, computer-readable media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, magnetic tapes, etc.), optical discs (e.g., compact discs (CDs), digital multifunction discs (DVDs), etc.), smart cards, and flash memory devices (e.g., cards, sticks, key drives, etc.).
[0070] Flowcharts are used herein to illustrate the operations performed by the method according to embodiments of this application. It should be understood that the preceding operations are not necessarily performed in exact order. Instead, the steps can be processed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more steps may be removed from them.
[0071] It should be understood that although this specification is described according to various embodiments, not every embodiment contains only one independent technical solution. This way of describing the specification is only for clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.
[0072] The above description is merely an illustrative embodiment of the present invention and is not intended to limit the scope of the invention. Any equivalent changes, modifications, and combinations made by those skilled in the art without departing from the concept and principles of the present invention should fall within the scope of protection of the present invention.
Claims
A mobile storage multi-level check method (100), characterized in that, The method comprises: obtaining multi-level scanning results (S101), when a mobile storage is used, obtaining the multi-level scanning results of the mobile storage by a central security monitoring system; checking the multi-level scanning results (S102), judging whether the mobile storage has been scanned and whether the multi-level scanning results are normal based on the multi-level scanning results; if not, prohibiting the use of the mobile storage and alarming; checking step by step (S103), providing the use permission of the mobile storage step by step, and scanning the mobile storage based on the scanning rules corresponding to the use permission to obtain a current scanning result; judging whether the part in the multi-level scanning results corresponding to the current scanning result matches the current scanning result; if yes, providing the use permission of the next level; if not, locking the mobile storage and alarming. The method of claim 1, wherein Before the mobile storage is used, the multi-level scanning results are obtained by scanning the mobile storage by a scanning system, and the multi-level scanning results are stored to the central security monitoring system. The method according to claim 2, characterized in that The multi-level scanning results further comprise: first level: last update time, scanning time and disk occupancy; second level: hash value of executable file, file modification log and file quantity; third level: hash value of key file and modification time of any possible infected file. The method of claim 1, wherein The use permission comprises: first level: listing all files, not being able to access any executable file or file possibly infected by malicious software, and not being able to automatically execute any application or script; second level: listing all files, copying and editing file not possibly infected by malicious software, not being able to access any executable file or file possibly infected by malicious software, and not being able to automatically execute any application or script; third level: listing all files, copying and editing executable file, copying and editing file not possibly infected by malicious software, not being able to access any executable file or file possibly infected by malicious software, and not being able to automatically execute any application or script. The method of claim 1, wherein The scanning rules corresponding to the use permission further comprise: first level: last update time, scanning time and disk occupancy; second level: hash value of executable file, file modification log and file quantity; third level: hash value of key file and modification time of any possible infected file. The method of claim 1, after said moving the storage by said stepwise checking, the method further comprising: All use permissions of the mobile storage are provided. A mobile storage multi-level check device (200), characterized in that, The device comprises: a multi-level scanning result acquisition module (201) configured to acquire multi-level scanning results of the mobile storage by the central security monitoring system when the mobile storage is used; a multi-level scanning result verification module (202) configured to determine whether the mobile storage has been scanned and whether the multi-level scanning results are normal based on the multi-level scanning results; if not, the use of the mobile storage is prohibited and an alarm is given; a level-by-level verification module (203) configured to provide use permissions of the mobile storage level by level, and scan the mobile storage based on scanning rules corresponding to the use permissions to obtain a current scanning result; determine whether the part of the multi-level scanning results corresponding to the current scanning result matches the current scanning result; if yes, the use permission of the next level is provided; if not, the mobile storage is locked and an alarm is given. The apparatus of claim 7, wherein Before the mobile storage is used, the mobile storage is scanned by a scanning system to obtain the multi-level scanning results, and the multi-level scanning results are stored in the central security monitoring system. The apparatus of claim 8, wherein The multi-level scanning results further comprise: first level: last update time, scanning time and disk occupancy; second level: hash value of executable file, file modification log and file quantity; third level: hash value of key file and modification time of any possible infected file. The apparatus of claim 7, wherein The use permissions comprise: first level: list all files, cannot access any executable file or file possibly infected by malware, and cannot automatically execute any application or script; second level: list all files, copy and edit files not possibly infected by malware, cannot access any executable file or file possibly infected by malware, and cannot automatically execute any application or script; third level: list all files, copy and edit executable files, copy and edit files not possibly infected by malware, cannot access any executable file or file possibly infected by malware, and cannot automatically execute any application or script. The apparatus of claim 7, wherein The scanning rules corresponding to the use permissions further comprise: first level: last update time, scanning time and disk occupancy; second level: hash value of executable file, file modification log and file quantity; third level: hash value of key file and modification time of any possible infected file. The device according to claim 7, wherein the level-by-level verification module (203) is further configured to provide all use permissions of the mobile storage after the mobile storage passes the level-by-level verification. An electronic device (300) comprising: at least one processor (310); and a memory (320) coupled with the at least one processor (310), the memory (320) being configured to store instructions that, when executed by the at least one processor (310), cause the processor (310) to perform the method according to any one of claims 1-6. A computer readable storage medium having stored thereon computer instructions which, when executed, perform the method according to any one of claims 1-6. A computer program product, characterized in that A computer program comprising computer program elements which, when executed by a processor, carry out the method according to any one of claims 1-6. A computer program comprising computer program elements which, when executed by a processor, carry out the method according to any one of claims 1-6.