Equipment security authentication and storage hiding method and device for presetting root certificate at driving end, and medium

Abstract

The invention provides an equipment security authentication and storage hiding method and device for presetting a root certificate at a driving end, and a medium, and belongs to the technical field of data security. The method comprises the following steps: firstly, initializing a storage device into a USB Bulk non-storage device, installing a special drive with a preset root certificate in a host, and only allowing an instruction of passing signature verification to be issued; and when the equipment leaves a factory, an asymmetric key pair is built in, and the public key is used for encrypting the unique identifier of the host and completing binding authentication of the equipment and the host. After the user inputs the password, the application program is encrypted through the session key and transmitted to the equipment; and after the verification is successful, the device dynamically reconstructs a USB descriptor and a protocol, triggers the system to re-identify, switches the Bulk device into a large-capacity storage device, activates a hardware encryption engine, and switches a partition mode as required. According to the method, the storage space is effectively hidden, active attack and malicious instruction injection risks are reduced, and the equipment security is enhanced.

Description

TECHNICAL FIELD

[0001] The application relates to a device security authentication and storage concealment method, device and medium with preset root certificate at a drive end, and belongs to the technical field of data security. BACKGROUND

[0002] With the development of diversified storage devices, the importance of data security is increasingly valued. The current mainstream storage devices generally adopt the BOT (Bulk-Only Transport) protocol stack, and the standardized data batch transmission mode thereof guarantees the device compatibility, but the security architecture thereof has the following defects: Device identity is exposed to risk: the BOT device declares itself as a storage device to the host through a device identifier (such as VID / PID), an attacker can quickly identify the device type through bus enumeration, and directly sends SCSI commands to bypass the operating system, so that the data can be brute-forced after physical contact with the device.

[0003] Protocol reversibility: CBW / CSW control packets and user data transmission are not encrypted, and an attacker can directly capture the SCSI instruction sequence through a USB protocol analysis tool; in the BOT protocol, even if the data is encrypted, the attacker can still launch a destructive attack against the timing characteristics of CBW / CSW interaction and protocol logic vulnerabilities. SUMMARY

[0004] The application aims to provide a device security authentication and storage concealment method, device and medium with preset root certificate at a drive end, which reduces the opportunity of being actively attacked by the device through a dynamic concealment and drive security authentication mechanism of the storage device, and effectively prevents malicious instruction injection.

[0005] To achieve the above-mentioned purpose, the application realizes the following technical scheme: A device security authentication and storage concealment method with preset root certificate at a drive end, comprising the following steps: Initialize the storage device as a Bulk non-storage class device, so that the operating system cannot automatically identify it as a storage device, and realize device concealment; Install a special driver on the host, the driver is preset with a root certificate, and verifies the digital signature of all Bulk operation requests, and only allows the requests with verified signature to be issued to the device; The device generates an asymmetric key pair at the time of factory shipment, and stores the public key and the private key in the device chip; the application acquires the device public key, encrypts the unique identifier of the host, and sends it to the device, the device decrypts and verifies the unique identifier of the host, and completes the binding; The user inputs a password, the application program sends the password encrypted by a session key to the device via the driver, the device verifies the password, dynamically reconstructs the USB device descriptor and protocol, triggers the operating system to re-identify the device, switches the Bulk device to a mass storage device, and activates the hardware encryption engine to switch to a specified partition mode according to the instruction.

[0006] Preferably, the special driver is installed on the host, the driver is pre-installed with a root certificate, and the digital signature of all Bulk operation requests is verified, and only the requests with verified signature are allowed to be sent to the device, and the specific steps include: Import the root certificate into the trusted storage area of the system, and load it into the memory security area during driver initialization; The application program generates a digital signature for the request data containing a timestamp or random number using a private key, and attaches the signature to the Bulk operation request; The driver intercepts all Bulk operation requests, extracts the signature field, verifies the validity of the signature using the pre-installed root certificate, and rejects the request and records the log if the verification fails.

[0007] Preferably, the asymmetric key pair generated by the device is a national SM2 algorithm key pair, and the private key is prohibited from external access.

[0008] Preferably, the host unique identifier includes the host CPU serial number.

[0009] Preferably, the device switching step supports switching to multiple partition modes, including CDROM, read-only mode, single-partition mode, and multi-partition mode.

[0010] Preferably, when the number of password verification errors reaches a threshold, the device is locked and initialization is triggered, the original hardware encryption key is destroyed and a new hardware encryption key is generated.

[0011] A device security authentication and storage concealment system with a pre-installed root certificate on the driver side, comprising: The device side is configured to initially enumerate as a Bulk non-storage class device, and dynamically switch to a USB BOT mass storage device after receiving an authorization instruction; The host side is installed with a special driver, the driver is pre-installed with a pre-installed root certificate, and is used for digital signature verification of Bulk operation requests from the application layer; The binding module is used to establish a binding relationship between the device and the host, and the binding information is stored in the non-volatile storage area of the device side; The switching control module controls the device to switch from the Bulk mode to at least one storage partition mode in response to the user login verification success.

[0012] The application has the advantages that the application reduces the chances of active attacks on the device by means of the dynamic concealment and driving of the security authentication mechanism of the storage device, effectively prevents malicious instruction injection, and effectively solves the problems of illegal access, data leakage and device abuse by using the device only on a machine installed with a special driver and a certificate chain and binding with the host, thereby improving the security and reliability of data storage and being suitable for mobile storage, industrial control and other scenarios with high security requirements. BRIEF DESCRIPTION OF DRAWINGS

[0013] The accompanying drawings are included to provide a further understanding of the application, and constitute a part of the specification, illustrate the application, and are used to explain the application together with the embodiments of the application, and do not constitute a limitation on the application.

[0014] Figure 1 The application is a method flowchart.

[0015] Figure 2 The application is a system structure schematic diagram. DETAILED DESCRIPTION

[0016] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the application.

[0017] Embodiment 1 As shown in the following table, a device security authentication and storage concealment method with a driving end preset root certificate is provided. Figure 1 When the device is powered on and identified as a Bulk non-storage class device, the firmware end realizes the switching from Bulk to BOT after the login instruction is verified, and triggers the operating system to reread the device, thereby realizing the dynamic switching to a storage device. The scheme also supports switching to various partition modes, such as switching to CDROM, read-only, single-partition, multi-partition and the like, thereby effectively ensuring the data storage security.

[0018] Specifically, the following steps are included. S1: initializing the storage device as a Bulk non-storage class device, so that the operating system cannot automatically identify the device as a storage device, and realizing device concealment; S2: installing a special driver on the host, the driver being preset with a root certificate and verifying the digital signature of all Bulk operation requests, and only allowing the requests with verified signatures to be issued to the device; S3: The device generates an asymmetric key pair at the factory, and stores the public key and the private key in the device chip; the application program acquires the device public key, encrypts the host unique identifier, and sends it to the device, the device decrypts and verifies the host unique identifier, and completes the binding; S4: The user inputs a password, the application program encrypts the password using a session key, and sends it to the device through the driver; after the device verifies that the password is correct, it dynamically reconstructs the USB device descriptor and protocol, triggers the operating system to re-identify the device, switches the Bulk device to a large-capacity storage device, and activates the hardware encryption engine, and switches to the specified partition mode according to the instructions.

[0019] As a refinement of the above embodiment, the special driver is installed on the host, the driver is preloaded with a root certificate, and the digital signature of all Bulk operation requests is verified, only requests with verified signatures are allowed to be sent to the device, and the specific steps include: S201: Import the root certificate into the trusted storage area of the system, and load it into the memory security area during driver initialization; S202: The application program generates a digital signature using a private key on request data containing a timestamp or random number, and attaches the signature to the Bulk operation request; S203: The driver intercepts all Bulk operation requests, extracts the signature field, verifies the validity of the signature using the preloaded root certificate, and rejects the request and records the log if the verification fails.

[0020] The mandatory signature and verification mechanism of the Bulk operation request requires that all Bulk requests must carry a digital signature, and the driver verifies the legality of the signature before receiving the request to prevent malicious instructions from being injected into the device. This module mainly includes three parts: certificate management, application layer signature generation, and driver layer signature verification.

[0021] Certificate management Import the root certificate into the trusted storage (such as the "Trusted Root Certificate Authority" of the Windows Certificate Manager) of the system to ensure that the driver can identify the legitimate issuer.

[0022] Certificate embedding and loading: Embed the root certificate (.der format) issued by the CA into the read-only data segment of the driver code, and call the function to load the certificate into the memory security area during driver initialization.

[0023] Application layer signature generation The application program generates a signature using a private key on request data (containing a timestamp or random number) before initiating a Bulk operation, and attaches the signature to the request.

[0024] Driver filtering and signature verification Upon initial device use, the device interface and driver service name are defined using an .inf file, and the dedicated driver is installed manually by specifying the driver path through the Device Manager. The driver first intercepts all Bulk operation requests (including Read / Write / IOCTL) sent from the upper layer and performs driver filtering. The data signature field is extracted from the request's additional data segment. Then, the driver loads the pre-configured root certificate and calls the system API interface to verify the signature's validity. If signature verification fails, a custom error code is returned and logged in the system log to prevent malicious commands from being sent to the device. If driver signature verification succeeds, the request continues to be sent to the device.

[0025] As a refinement of the above embodiments, during the device manufacturing stage, the device generates an SM2 asymmetric key pair and writes the public and private keys into the chip's on-chip storage area, with the private key being restricted from external access.

[0026] The application first obtains the device's public key and uses it to encrypt the host's unique identifier, such as the CPU serial number. The encrypted data is then sent to the device via the driver. Upon receiving the data, the device decrypts it using its private key to obtain the original host data. The device then checks if any recorded information exists on the chip. If no record exists, the host information is stored in a specific area of ​​the device chip, and a "binding complete" message is returned. If a record exists, the decrypted data is matched against the record information. If they do not match, a "bound to another device" message is returned; if they match, the device is usable.

[0027] As a refinement of the above embodiments, before the application communicates with the device, a session key is first generated. The user-entered password is encrypted with the session key and sent to the device via the driver. After successful password verification on the device side, the USB device identifier and protocol are dynamically reconstructed in the firmware layer of the main control chip, triggering the system to re-identify the device, switch the Bulk device to a mass storage device, and activate the hardware encryption engine. Hardware encryption uses the SM4 hardware accelerator to encrypt and decrypt data in real time. If the device-side password verification is successful, the device can switch from Bulk to single partition, multi-partition, read-only, CDROM, etc., according to the issued partition mode switching instructions. If the device-side password verification fails and the number of incorrect password attempts reaches a threshold, the device will be locked and initialization will be triggered, destroying the original hardware encryption key and generating a new hardware encryption key. The previous partition data will no longer be usable.

[0028] Example 2 like Figure 2 As shown, a device security authentication and storage concealment system with pre-configured root certificates on the driver side includes: On the device side, it is initially enumerated as a Bulk non-storage device, and dynamically switches to a USBBOT mass storage device after receiving an authorization command; On the host side, a dedicated driver is installed, which has a built-in root certificate for digital signature verification of Bulk operation requests from the application layer. The binding module is used to establish a binding relationship between the device and the host. The binding information is stored in the non-volatile storage area on the device. Switch control module: In response to successful user login verification, control device switches from Bulk mode to at least one storage partition mode.

[0029] Example 3 This disclosure also provides a device security authentication and storage concealment apparatus for a driver-side pre-configured root certificate, including a processor and a memory. Optionally, the apparatus may further include a communication interface and a bus. The processor, communication interface, and memory can communicate with each other via the bus. The communication interface can be used for information transmission. The processor can invoke logical instructions in the memory to execute the device security authentication and storage concealment method for a driver-side pre-configured root certificate described in the above embodiments.

[0030] Furthermore, the logical instructions in the aforementioned memory can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.

[0031] Memory, as a computer-readable storage medium, can be used to store software programs and computer-executable programs, such as program instructions / modules corresponding to the methods in the embodiments of this disclosure. The processor executes functional applications and data processing by running the program instructions / modules stored in the memory, thereby implementing the device security authentication and storage concealment method with pre-configured root certificates on the driver side as described in the above embodiments.

[0032] The memory may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the terminal device. Furthermore, the memory may include high-speed random access memory and may also include non-volatile memory.

[0033] This disclosure provides a computer-readable storage medium storing computer-executable instructions configured to execute the aforementioned device security authentication and storage concealment method for a pre-set root certificate in the driver.

[0034] The aforementioned computer-readable storage medium may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

[0035] The technical solutions of this disclosure can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes one or more instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in this disclosure. The aforementioned storage medium can be a non-transitory storage medium, including: a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and other media capable of storing program code. It can also be a transient storage medium.

[0036] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for device security authentication and storage concealment of a drive-end preset root certificate, characterized in that, The method comprises the following steps: The storage device is initialized as a Bulk non-storage class device, so that the operating system cannot automatically identify it as a storage device, and the device is hidden; A special driver is installed on the host, the driver is preset with a root certificate, and the digital signature of all Bulk operation requests is verified, and only the requests with verified signature are allowed to be sent to the device; The device generates an asymmetric key pair at the factory, and stores the public key and the private key in the device chip; The application program acquires the device public key, encrypts the host unique identifier, and sends it to the device, the device decrypts and verifies the host unique identifier, and completes the binding; The user inputs a password, the application program encrypts the password using a session key, and sends it to the device through the driver; after the device verifies the password, it dynamically reconstructs the USB device descriptor and protocol, triggers the operating system to re-identify the device, switches the Bulk device to a large-capacity storage device, and activates the hardware encryption engine, and switches to the specified partition mode according to the instruction.

2. The method of claim 1, wherein the device security authentication and storage concealment method of driving end preset root certificate is characterized in that, The special driver is installed on the host, the driver is preset with a root certificate, and the digital signature of all Bulk operation requests is verified, and only the requests with verified signature are allowed to be sent to the device, and the specific steps include: Import the root certificate into the trusted storage area of the system, and load it into the memory security area during driver initialization; The application program uses the private key to generate a digital signature for the request data containing the timestamp or random number, and appends the signature to the Bulk operation request; The driver program intercepts all Bulk operation requests, extracts the signature field, verifies the validity of the signature using the preset root certificate, and rejects the request and records the log if the verification fails.

3. The method of claim 1, wherein the device security authentication and storage concealment method of driving end preset root certificate is characterized in that, The asymmetric key pair generated by the device is a SM2 algorithm key pair, and the private key is prohibited from being accessed externally.

4. The method of claim 1, wherein the device security authentication and storage concealment method of driving end preset root certificate is characterized in that, The host unique identifier includes the host CPU serial number.

5. The method of claim 1, wherein the device security authentication and storage concealment method of driving end preset root certificate is characterized in that, The device switching step supports switching to multiple partition modes, including CDROM, read-only mode, single-partition mode, and multi-partition mode.

6. The method of claim 1, wherein the device security authentication and storage concealment method of driving end preset root certificate is characterized in that, When the number of password verification errors reaches a threshold, the device is locked and an initialization is triggered, the original hardware encryption key is destroyed, and a new hardware encryption key is generated.

7. A system for secure authentication and storage of a device with a pre-root certificate, comprising: a device having a pre-root certificate; a server having a root certificate; and a client having a root certificate, wherein the server and the client are configured to authenticate the device using the pre-root certificate and the root certificate. The method of any one of claims 1-6 comprises: The device end is configured to be initially enumerated as a Bulk non-storage class device, and dynamically switched to a USB BOT large-capacity storage device after receiving an authorization instruction; The host end is installed with a special driver, the driver is built-in with a preset root certificate, and is used for digital signature verification of Bulk operation requests from the application layer; The binding module is used to establish a binding relationship between the device and the host, and the binding information is stored in the non-volatile storage area of the device end; The switching control module controls the device to switch from the Bulk mode to at least one storage partition mode in response to the user login verification success.

8. A device security authentication and storage concealment apparatus for driving an end-prepared root certificate, comprising a processor and a memory storing program instructions, characterized in that, The processor is configured to execute the device security authentication and storage hiding method with the preset root certificate of the driver end as claimed in any one of claims 1-7 when running the program instructions.

9. A computer readable storage medium characterized by, A computer program is stored thereon, which is executed by a processor to implement the device security authentication and storage hiding method with the preset root certificate of the driver end as claimed in any one of claims 1-7.

Images