USB device fine granularity control method and device, storage medium and program product

Abstract

The invention relates to a USB device fine granularity management and control method and device, a storage medium and a program product. The method comprises the steps that a kernel maintains device information and permission information of a USB device through a linked list; when the file system is mounted, acquiring equipment information of the USB equipment through sbkernmount, and storing the equipment information in the security domain of the super block; and based on the equipment information and the authority information of the USB equipment, managing and controlling the USB equipment. According to the invention, the authority management and control granularity of the USB equipment is expanded, and the use authority, the write authority and the execution authority of the USB equipment can be managed and controlled; one USB device is uniquely identified through the pid, the vid and the serial, and the management and control granularity is refined to a single USB device individual.

Description

Technical Field

[0001] This invention relates to the field of USB device management technology, and more specifically to fine-grained management methods, devices, storage media, and software products for USB devices. Background Technology

[0002] With the rapid development of information technology, USB devices, with their plug-and-play functionality, high-speed transmission, and wide compatibility, have become an indispensable peripheral connection method in Linux systems. From basic keyboards and mice to storage media such as USB flash drives and external hard drives, and then to office equipment such as printers, scanners, and cameras, USB interfaces cover almost all types of peripheral connection needs. However, the widespread use of USB devices has also brought significant security challenges. On the one hand, the portability of USB storage devices makes them one of the main channels for data leakage. Unauthorized USB flash drives or external hard drives connected to Linux systems may pose a threat to system security through malware propagation, data theft, or system damage. On the other hand, the universality of the USB interface also allows attackers to bypass traditional security mechanisms and directly launch physical layer attacks on the system using counterfeit devices (such as USB keyboard emulators and HID attack devices).

[0003] Currently, Linux systems manage USB devices, such as USBguard, primarily using the following technologies: Static control based on file permissions: restrict user access to devices by modifying the permissions of USB device files in the / dev directory or setting ACLs (access control lists); Dynamic management based on udev rules: Use the udev mechanism to write rule files and automatically set permissions or execute scripts when a device is inserted; Kernel module-based blacklists and whitelists: Disabling devices by loading or unloading specific USB driver modules (such as USB-storage).

[0004] The limitations of existing technologies are mainly reflected in the following aspects: the control permissions are limited, and they can only control the usage permissions of USB devices, but cannot control the write permissions and execution permissions of USB storage devices in a fine-grained manner. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method for fine-grained control of USB devices, comprising the following steps: Step S1: The kernel maintains the device information and permission information of USB devices through a linked list; Step S2: When the kernel mounts the file system, it obtains the device information of the USB device through sb_kern_mount and stores it in the security domain of the superblock; Step S3: The kernel manages USB devices based on their device information and permission information; Step S2 includes: Step S21: When the kernel mounts the file system, it implements sb_kern_mount, obtains the block device data of the mounted device through the superblock associated with this file system mount operation, and further obtains the struct device data; Step S22: Iterate through the parent device of the attached device using the struct device data and check if its bus is USB. If it is USB, then the attached device is a USB device. Step S23: Obtain the struct USB_interface data corresponding to the USB device through the struct device data; Step S24: Obtain the device information of the USB device from the struct USB_interface data and store it in the security field of the superblock; Device information includes PID, VID, and serial: PID is a product identifier assigned by the manufacturer, VID is a globally unique identifier assigned to the registered manufacturer, and serial is a unique serial number written by the manufacturer during device production.

[0006] Step S1 includes: Step S11: Distribute device information and permission information of the controlled USB devices through off-core tools; Step S12: By using the kernel-external interaction file, save the device information and permission information of the USB device in the configuration file outside the kernel, and synchronize it with the kernel; Step S13: The kernel receives the device information and permission information of the USB device and maintains it through a linked list.

[0007] The permission information for USB devices includes usage permissions, write permissions, and execute permissions.

[0008] Specifically, regarding usage permissions, control points are added during the device driver binding process at the underlying device framework driver in the kernel to interrupt the USB device driver binding process, thereby enabling the control of USB device usage permissions.

[0009] Regarding usage permissions, the kernel manages them using the following strategies: Step S31: Obtain the device information of the connected USB device through the struct device, and obtain the permission information based on the device information; Step S32: Obtain its usage permissions from the permission information; Step S33: If the usage permission is disabled, interrupt the binding of the USB device driver and prevent the USB device from being connected; if the usage permission is allowed, do not perform control.

[0010] Specifically, regarding write permissions, a control point is added to the kernel's system call `do_mount`, and the `flags` parameter of the `do_mount` function is modified to enable mounting USB devices as read-write or read-only.

[0011] Specifically, the kernel manages execution permissions using the following strategies: Step S3a: Obtain USB device information in the superblock security domain to which the USB device belongs; Step S3b: Check the execution permissions of the USB device and decide whether to allow or block execution.

[0012] The present invention further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, characterized in that the processor executes the computer program to implement the steps of any of the methods described above.

[0013] The present invention further provides a computer-readable storage medium having a computer program stored thereon, characterized in that the computer program, when executed by a processor, implements the steps of the method described in any of the preceding claims.

[0014] The present invention further provides a computer program product, comprising a computer program, characterized in that, when the computer program is executed by a processor, it implements the steps of the method described in any of the above-mentioned embodiments.

[0015] This invention expands the granularity of permission control for USB devices, enabling control over usage permissions, write permissions, and execution permissions of USB devices; it uniquely identifies a USB device using PID, VID, and Serial, achieving fine-grained control down to the individual USB device. Attached Figure Description

[0016] Figure 1 The following is a flowchart illustrating the interaction process of fine-grained USB data management in this invention.

[0017] Figure 2 The flowchart of the kernel's check during file system mounting in this invention. Detailed Implementation

[0018] To gain a better understanding of the technical solution and beneficial effects of the present invention, the technical solution of the present invention and its beneficial effects are described in detail below with reference to the accompanying drawings.

[0019] The fine-grained control method for USB devices of the present invention involves the following key element conventions and explanations.

[0020] 1. PID: Product identifier assigned by the manufacturer.

[0021] 2. VID: A globally unique identifier assigned to a registered manufacturer to identify the equipment manufacturer.

[0022] 3. serial: A unique serial number written by the manufacturer during equipment production to distinguish different physical devices of the same model.

[0023] 4. Superblock: The super_block structure in the Linux kernel stores file system metadata, such as block size, total number of blocks, number of free blocks, file system type, etc.

[0024] 5. sb_kern_mount: A key function in the Linux kernel related to file system mounting. As an LSM (Linux Security Module) security hook implementation, it is used to obtain information about USB devices and store it in the superblock when the file system is mounted.

[0025] 6. Block device: The block_device structure in the Linux kernel represents core data structures such as hard disks, SSDs, and CD-ROMs. It can represent the entire physical device or a partition on the device.

[0026] 7. struct device: The core structure of the device model in the Linux kernel, used to uniformly represent all hardware or virtual devices in the system.

[0027] 8. struct USB_device: In the Linux kernel, this represents the entire USB physical device and includes information such as device descriptor, vendor ID, product ID, and serial number.

[0028] 9. struct USB_interface: A logical functional unit in the Linux kernel that represents a USB device (such as the video stream interface and audio interface of a USB camera).

[0029] 10. LSM: Linux Security Module.

[0030] The fine-grained management method for USB devices of the present invention is divided into three parts: interaction of fine-grained USB management data, kernel check during file system mounting, and kernel USB device management function. The following describes the process of fine-grained USB management data interaction, kernel check during file system mounting, and kernel USB device management function, respectively.

[0031] 1. Interaction of fine-grained USB control data Please combine Figure 1 As shown, the main steps include the following: Step S11: Distribute the device information and permission information of the USB devices to be managed (corresponding) through the off-core tool. Figure 1 The document "issuing fine-grained USB control data" states that USB device information includes the PID, VID, and serial number mentioned above, and permission information includes usage permissions, write permissions, and execute permissions. Specific USB devices to be controlled and their specific permission information can be configured by users through external tools. Step S12: Through the kernel-internal and external interaction files, save the device information and permission information of the USB devices that need to be managed in the application layer configuration file outside the kernel, and synchronize it to the kernel; Step S13: The kernel receives the device information and permission information of the USB device and maintains it through a linked list.

[0032] Therefore, in this invention, the kernel is used to maintain the device information and permission information of USB devices. It uniquely identifies a USB device through PID, VID, and serial information, and its permissions include usability, writeability, and execution permissions. It implements the core functions of fine-grained management of USB devices, including permission checks when a USB device is connected, permission checks when a USB storage device is mounted, and permission checks when executing files on a USB storage device.

[0033] 2. The kernel checks when mounting the file system. In the Linux kernel, `struct device` is the core base class of the device model. USB devices are integrated with this model through a hierarchical structure (device → configuration → interface → endpoint). Each interface in a USB device is ultimately abstracted into a `struct device` instance to achieve unified management and driver binding. Therefore, as long as the `struct device` data is available, the various data in the USB device's hierarchical structure can be obtained, and its USB device information can be acquired for management and inspection.

[0034] Please combine Figure 2 As shown, the main steps include the following: Step S21: When the file system is mounted, the kernel implements the LSM hook sb_kern_mount, obtains the block device data of the mounted device through the superblock associated with this file system mount operation, and further obtains the struct device data; Step S22: Iterate through the parent device of the attached device using the struct device data and check if its bus is USB. If it is USB, then the attached device is a USB device. Step S23: Obtain the struct USB_interface data corresponding to the USB device through the struct device data (corresponding to...) Figure 2 (USB interface data) Step S24: Obtain the device information (pid, vid, and serial) of the USB device from the struct USB_interface data and store it in the security field of the superblock.

[0035] 3. Kernel USB device management function Kernel management of USB devices involves controlling the usage, write, and execution permissions of USB devices. The key technology lies in finding the corresponding control points in the kernel to prevent the access of USB devices, control the permissions after the USB storage device is mounted, and prevent the execution of files.

[0036] 3-1. Usage Permissions By adding a control hook during the device driver binding process at the underlying device framework driver level in the Linux kernel, the normal access and recognition of USB devices can be prevented by interrupting the USB device driver binding process. The specific execution includes the following steps: Step S31: Obtain the device information of the connected USB device through the struct device, and obtain the permission information based on the device information; Step S32: Obtain its usage permissions from the permission information; Step S33: If the usage permission is disabled, the binding of the USB device driver will be interrupted, preventing the USB device from being connected; if the usage permission is allowed, no control will be performed, and the USB device will be connected normally.

[0037] 3-2. Write permissions By adding a control hook to the Linux kernel system call do_mount, permission checks can be performed when the device is mounted. By modifying the flags parameter of the do_mount function, it is possible to control whether the USB storage device is read-only or read-write after it is mounted.

[0038] Because the system calls do_mount and sb_kern_mount are different checkpoints, the system call do_mount can only get the name of the mounted device and cannot directly get the USB device information stored in the superblock data. Therefore, the system call do_mount needs to retrieve the device information again. Thus, when the kernel performs write permission control, it specifically includes the following steps.

[0039] Step S31: Obtain the block device data (block_device) by the mounted device name, and further obtain the struct device data.

[0040] Step S3m: Iterate through the parent devices of the attached device using the struct device data, and check if its bus is USB. If it is USB, then the attached device is a USB device.

[0041] Step S3n: Obtain the struct USB_interface data corresponding to the USB device through the struct device data.

[0042] Step S3o: Obtain the device information (pid, vid, and serial) of the USB device from the struct USB_interface data, and check the write permissions of the USB device.

[0043] Step S3p: Modify the mount parameter of the system call do_mount to determine whether the mount is read-write or read-only.

[0044] 3-3. Execution Permissions This invention extends the implementation of execution permissions for USB devices through kernel LSM hooks. The kernel LSM provides corresponding hooks to manage file execution, but the key technical challenge lies in how to distinguish whether the currently executing file is on a USB storage device or another storage device. This invention also provides a hook, `sb_kern_mount`, which retrieves block device information from the superblock data during file system mounting. This allows for further checks to determine if it is a USB device, and the USB device information (pid, vid, serial) is stored in the superblock's security domain (the specific implementation steps have been detailed in Part 2 above). Therefore, when managing file execution on a USB device, the USB device information stored in the superblock data can be directly accessed for execution control. Step S3a: Obtain USB device information in the superblock security domain to which the USB device belongs; Step S3b: Check the execution permissions of the USB device and decide whether to allow or block execution.

[0045] The core of this invention, a fine-grained management method for USB devices based on the Linux system, is to implement a mechanism that can effectively manage USB devices on the system. This invention manages the underlying driver logic of USB devices at the kernel level, and the application layer issues policies to manage permissions for USB devices based on their PID, VID, and serial information, including usage permissions, write permissions, and execute permissions. This enables a customizable and configurable fine-grained management mechanism for USB devices.

[0046] Although the present invention has been described using the above preferred embodiments, it is not intended to limit the scope of protection of the present invention. Any changes and modifications made by those skilled in the art to the above embodiments without departing from the spirit and scope of the present invention shall still fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be defined by the claims.

Claims

1. A method for fine-grained control of USB devices, characterized in that, Includes the following steps: Step S1: The kernel maintains the device information and permission information of USB devices through a linked list; Step S2: When the kernel mounts the file system, it obtains the device information of the USB device through sb_kern_mount and stores it in the security domain of the superblock; Step S3: The kernel manages USB devices based on their device information and permission information; Step S2 includes: Step S21: When the kernel mounts the file system, it implements sb_kern_mount, obtains the block device data of the mounted device through the superblock associated with this file system mount operation, and further obtains the struct device data; Step S22: Iterate through the parent device of the attached device using the struct device data and check if its bus is USB. If it is USB, then the attached device is a USB device. Step S23: Obtain the struct USB_interface data corresponding to the USB device through the struct device data; Step S24: Obtain the device information of the USB device from the struct USB_interface data and store it in the security field of the superblock; Device information includes PID, VID, and serial: PID is a product identifier assigned by the manufacturer, VID is a globally unique identifier assigned to the registered manufacturer, and serial is a unique serial number written by the manufacturer during device production.

2. The fine-grained control method for USB devices as described in claim 1, characterized in that, Step S1 includes: Step S11: Distribute device information and permission information of the controlled USB devices through off-core tools; Step S12: By using the kernel-external interaction file, save the device information and permission information of the USB device in the configuration file outside the kernel, and synchronize it with the kernel; Step S13: The kernel receives the device information and permission information of the USB device and maintains it through a linked list.

3. The fine-grained control method for USB devices as described in claim 1, characterized in that, The permission information for a USB device includes usage permissions, write permissions, and execute permissions.

4. The fine-grained control method for USB devices as described in claim 3, characterized in that, Regarding usage permissions, control points are added during the device driver binding process at the underlying device framework driver in the kernel to interrupt the USB device driver binding process, thereby enabling the control of USB device usage permissions.

5. The fine-grained control method for USB devices as described in claim 4, characterized in that, The kernel manages usage permissions using the following strategies: Step S31: Obtain the device information of the connected USB device through the struct device, and obtain the permission information based on the device information; Step S32: Obtain its usage permissions from the permission information; Step S33: If the usage permission is disabled, interrupt the binding of the USB device driver and prevent the USB device from being connected; If the usage permission is allowed, no control will be implemented.

6. The fine-grained control method for USB devices as described in claim 3, characterized in that, To address write permissions, a control point is added to the kernel's system call `do_mount`, and the `flags` parameter of the `do_mount` function is modified to enable mounting USB devices as read-write or read-only.

7. The fine-grained control method for USB devices as described in claim 3, characterized in that, The kernel manages execution permissions using the following strategies: Step S3a: Obtain USB device information in the superblock security domain to which the USB device belongs; Step S3b: Check the execution permissions of the USB device and decide whether to allow or block execution.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1-7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1-7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1-7.

Images