USB endpoint cache data processing method and system based on MCU

Abstract

The invention discloses an MCU-based USB endpoint cache data processing method and system, and the method comprises the steps: obtaining code data of a to-be-processed file, carrying out the code detection of the code data to obtain low-dimensional spatial data, storing the low-dimensional spatial data in USB equipment, obtaining a USB descriptor and a USB data transmission type of the USB equipment, and carrying out the data transmission of the to-be-processed file through the USB descriptor and the USB data transmission type; the USB transmission control type of the USB device is determined according to the USB descriptor and the data transmission type, the encryption and decryption algorithm of the low-dimensional spatial data is determined, the to-be-processed file is stored in the USB device based on the encryption and decryption algorithm and the USB transmission control type, and the data sent by the USB interface is encrypted, so that the data transmission security is effectively ensured, and the method and the device are suitable for various application scenes. And more communication transmission data is supported, so that the integrity and timeliness of data transmission are improved.

Description

Technical Field

[0001] This invention belongs to the field of data transmission technology, and in particular relates to a USB endpoint cache data processing method system based on MCU. Background Technology

[0002] Currently, computer technology has penetrated all walks of life and encompasses all aspects of daily life. People are accustomed to storing information on storage devices for convenient information exchange at any time. However, this has also brought about network security issues. Methods such as electronic eavesdropping and electronic fraud pose serious threats to people's information and property security. USB (Universal Serial Bus) holds a clear advantage among computer peripheral interfaces. Due to its high data transmission stability, USB has been increasingly used in industrial applications, developing and utilizing non-standard devices to communicate with standard devices through the USB interface to perform specific functions. The USB flash drive, as a typical USB device, is already widely used in the general public.

[0003] However, each USB endpoint has its own independently distributed buffer location, with a fixed buffer size and a fixed physical address. Different endpoints are used for communication in different USB protocols; a larger endpoint is chosen for large-scale communication, and a smaller endpoint is chosen for smaller-scale communication. When multiple endpoints are used simultaneously, two or more endpoint buffers are required. Since using multiple different endpoints simultaneously requires larger physical buffer space and larger buffer addresses, data storage security is also compromised. Therefore, there is an urgent need to provide a MCU-based USB endpoint buffer data processing method to solve the aforementioned technical problems. Summary of the Invention

[0004] In view of this, the present invention provides a USB endpoint cache data processing method and system based on MCU, which can encrypt the data sent by the USB interface, effectively ensuring the security of data transmission, and is applicable to a variety of application scenarios. The specific technical solution adopted is as follows.

[0005] In a first aspect, the present invention provides a USB endpoint cache data processing method based on an MCU, comprising the following steps: Obtain the code data of the file to be processed, and perform code detection on the code data to obtain low-dimensional space data; The low-dimensional spatial data is stored in a USB device, and the USB descriptor and USB data transfer type of the USB device are obtained. The USB transfer control type of the USB device is determined based on the USB descriptor and data transfer type, and the encryption / decryption algorithm for the low-dimensional space data is determined accordingly. The file to be processed is stored on the USB device based on the encryption / decryption algorithm and the USB transfer control type.

[0006] As a preferred embodiment of the above technical solution, the code data of the file to be processed is obtained, and code detection is performed on the code data to obtain low-dimensional space data, including: The TF-IDF-like algorithm is used to evaluate the impact of malicious applications in different families in the Android app store containing the same security threat method. Here, TF is defined as the frequency of a certain threat method appearing in a certain malicious program family, and IDF is defined as the ratio of the total number of all threat functions in all malicious family categories to the total number of times a certain threat method appears in each family, and the logarithm is calculated. Let 's' represent a feature after N-gram processing. Analogous to two families of malware on Android, we can use... Indicate, then TF is defined as the frequency of feature s in two different classes of samples. IDF represents the ratio of the total number of occurrences of all features in all classes to the total number of occurrences of feature s in normal and malicious samples, calculated as its logarithm. The corresponding expression is: (1) in, Indicates all The total number of times all features appear; Corresponding to TF, it represents a certain category. The frequency of feature s in the middle, with a value range of 1. ,but: (2) in, Represents a category The total number of times all features appear in the text. Represents a category The total number of times feature s appears in the middle. Represents all categories If the total number of features s is given, then: (3) If feature s appears in normal samples but not in abnormal samples, then let the normal sample feature s be... Corresponding .

[0007] As a preferred embodiment of the above technical solution, the feature difference is defined as the absolute value d of the difference between the weights of the same feature s in two classes of samples, and multiple d values ​​are obtained, the same as the number of features. The corresponding calculation expression is as follows: (4) Sort the d values ​​in descending order, select features with high dissimilarity based on the preset number of features r after dimensionality reduction, and train the model. The dimensionality reduction process includes the following steps: The model is trained based on the distance between the feature weights of normal and malicious samples; a larger distance indicates greater discriminative power between the features of the two classes. Input: Normal and malicious samples after N-gram processing, with low-dimensional space dimension r; The feature sets of normal samples and malicious samples are merged to obtain the feature set before dimensionality reduction; Calculate feature weights And calculate the feature difference degree d and sort in descending order; Select the r features with the largest differences, and obtain the data for all samples under r features; Obtain data for all samples under r features and output low-dimensional data D.

[0008] As a preferred embodiment of the above technical solution, the low-dimensional spatial data is stored in a USB device, and the USB descriptor and USB data transfer type of the USB device are obtained, including: USB descriptors are used to describe the attributes of USB devices. The host can obtain relevant information about the USB device and set relevant configurations for the device through the USB descriptor. The USB descriptor includes device, configuration, interface, endpoint, and string. According to the USB protocol, USB data transmission is divided into bulk, isochronous, interrupt, and control. The USB data transmission process includes one or more transactions. The control transmission consists of an establishment process, a data process, and a status process. During the establishment process, the host sends a token packet with PID SETUP to the device, then sends a DATA0 data packet to the device, and finally waits for the device to return a handshake packet. During the data transmission process, the host sends an IN token packet to the device to notify the device to send data. The device then returns a data packet, which is converted between DATA0 and DATA0. Finally, the host returns a handshake packet. During the state process, the host sends an OUT token packet to the device to notify the device to receive data. Then, the host sends 0 bytes of data to the device as a state response. Note that the DATA1 packet is used during the state process. Finally, the host waits for the device to return a handshake packet. Bulk transfers are divided into bulk output transactions and bulk input transactions. Each transaction contains a token packet, a data packet, and a handshake packet. In a bulk input transaction, the host sends an IN token packet, then waits for the device to return a data packet, and finally the host returns a handshake packet. In a bulk output transaction, the host sends an OUT token packet, then sends a data packet to the device, and finally waits for the device to return a handshake packet. Interrupted transmission is used for small data transmissions. The host obtains the query interval from the description information of the interrupt endpoint and performs a data transmission within this interval. Isochronous transmission is used for large data transmissions. Isochronous transmission includes token packets and data packets.

[0009] As a preferred embodiment of the above technical solution, when a device is plugged into the USB interface, the integrator will detect a high-level signal, and the hub will inform the host that a USB device has been detected. After confirming that a USB device has been plugged in, the USB bus will reset and set the default address 0. The host sends a USB standard request to the control endpoint of the USB device via the USB device's default address. The USB device returns a device descriptor and waits for the host's status response. Here, the USB standard request is the device descriptor. The host then sends a set address request to the USB device. After receiving the request, the USB device waits for the host to send the new address data. When it receives the address data, it returns a handshake response to the host and saves the new address. The host sends a request to obtain configuration descriptors to the new address, and then the USB device sends the set of configuration descriptors to the host and waits for the host's response; The host sets the corresponding configuration for the USB device using the configuration information, and the non-zero endpoints of the USB device begin to be used.

[0010] As a preferred embodiment of the above technical solution, the USB transmission control type of the USB device is determined based on the USB descriptor and data transmission type, and the encryption / decryption algorithm for the low-dimensional space data is determined, including: The USB transmission control types include control transmission type, interrupt transmission type, and real-time transmission type. Control transmission is the setting process of the USB device when the USB device is connected to the host. The control transmission includes at least two transaction phases: control establishment transaction and control status transaction. The control transmission transaction includes the transmission of tag packets, data packets, and handshake packets. Interrupt transmission consists of two parts: input and output transactions, used to transmit interrupted data. It is divided into three phases: the first phase transmits tag packets, the second phase transmits data packets, and the third phase transmits handshake packets. In the tag packet phase, the input transaction is an input tag packet (IN) sent by the host, and the output transaction is an output tag packet (OUT) sent by the host. In the data packet phase, the received tag packets are analyzed by the slave device, and the parsed commands are processed accordingly. In the handshake phase, if the data is correctly received by the host, the host sends an ACJ acknowledgment packet to the slave device; erroneous data packets are handled by directly entering the idle state. When the host is ready to receive data, it actively sends an input transaction marker packet. The device returns a DATA0 or DATA1 data packet. If it cannot return a data packet, it returns NAK or STALL. NAK indicates that the USB device is not ready to immediately transmit data to the host, while STALL indicates that the host needs to send an interrupt to activate the suspended port. When the handshake phase successfully transmits data, the host sends an ACK to confirm, ends the transmission of the entire transaction, and enters an idle state.

[0011] As a preferred embodiment of the above technical solution, the AES encryption algorithm is used to encrypt the file to be processed. The AES encryption algorithm includes the S-box substitution algorithm, the row shift algorithm, and the column hybrid algorithm. The S-box substitution algorithm transforms an input eight-bit binary number into another eight-bit binary number as the output. This involves first converting the eight-bit binary number into a characteristic polynomial, and then finding the modulus of the characteristic polynomial. The inverse of the multiplication is then transformed by affine transformation of the result of the substitution of the inverse of the multiplication. The row shift algorithm divides 128 bits of data into a 4x4 matrix, and then cyclically shifts the second row of the matrix one byte to the left, the third row two bytes to the left, and the fourth row three bytes to the left. The column-mixing algorithm is based on the modulus. Below a given word Multiplication, assuming the input word for the transformation is 'a' and the output is 'b', then... Its expression is: (5). As a preferred embodiment of the above technical solution, the AES encryption algorithm further includes a key expansion algorithm. The key expansion algorithm comprises two parts: round key expansion and round key selection. It divides the 128-bit data into a 4x4 matrix, initialized with four characters. , , , It needs to be expanded , , , ..., , , , ; The extended algorithm is ,in Detection during expansion subscript ,like If it is a multiple of 4, then proceed. Before operation conduct Function substitution, where It is a four-byte input, four-byte output function.

[0012] As a preferred embodiment of the above technical solution, the initial 128-bit key is expanded to 11 128-bit keys. After key expansion, the plaintext information is grouped into groups of 128 bits each. After grouping, each group of 128-bit plaintext is encrypted. The encryption process includes: Initial key addition: Perform modulo-2 addition on a finite field with the 128-bit plaintext and the initial 128-bit key to obtain a 128-bit result; S-box substitution: Substitute each byte with an S-box based on the 128-bit intermediate result to obtain a 16-byte result. Row shift: Write 16 bytes of data into a 4x4 state matrix, and then perform a row shift transformation on the state matrix; Column blending: Perform column blending transformation on a character-by-character basis to obtain a 4-character transformation result; Key addition: A modulo-2 addition operation is performed on a 128-bit intermediate variable and an extended 128-bit key. The 128-bit transformation result is output to obtain the ciphertext to complete the encryption. The decryption process is the reverse of the encryption process.

[0013] Secondly, the present invention also provides a MCU-based USB endpoint cache data processing system, applied to the aforementioned MCU-based USB endpoint cache data processing method, comprising: The data acquisition module is used to acquire the code data of the file to be processed, and to perform code detection on the code data to obtain low-dimensional space data; The data processing module is used to store the low-dimensional spatial data in a USB device and obtain the USB descriptor and USB data transfer type of the USB device. The data encryption / decryption module is used to determine the USB transmission control type of the USB device based on the USB descriptor and data transmission type, and to determine the encryption / decryption algorithm for the low-dimensional space data. A data storage module is used to store the file to be processed in the USB device based on the encryption / decryption algorithm and the USB transfer control type.

[0014] This invention provides a USB endpoint cache data processing method and system based on an MCU. It acquires the code data of the file to be processed, performs code detection on the code data to obtain low-dimensional space data, stores the low-dimensional space data on a USB device, and acquires the USB descriptor and USB data transfer type of the USB device. Based on the USB descriptor and data transfer type, it determines the USB transmission control type of the USB device and determines the encryption / decryption algorithm for the low-dimensional space data. Based on the encryption / decryption algorithm and the USB transmission control type, it stores the file to be processed on the USB device and encrypts the data sent through the USB interface, effectively ensuring the security of data transmission. This method is applicable to various application scenarios and supports more communication data transmissions, thereby improving the integrity and timeliness of data transmission. Attached Figure Description

[0015] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 A flowchart of the MCU-based USB endpoint cache data processing method provided by the present invention; Figure 2 The structural block diagram of the MCU-based USB endpoint cache data processing system provided by the present invention; Figure 3 This is a schematic diagram of the USB data transmission principle provided by the present invention. Figure 4 This is an example diagram of the mixed storage content distribution provided by the present invention. Detailed Implementation

[0017] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0018] See Figure 1 This invention provides a USB endpoint cache data processing method based on an MCU, comprising the following steps: S1: Obtain the code data of the file to be processed, and perform code detection on the code data to obtain low-dimensional space data; S2: Store the low-dimensional spatial data in a USB device, and obtain the USB descriptor and USB data transfer type of the USB device; S3: Determine the USB transmission control type of the USB device based on the USB descriptor and data transfer type, and determine the encryption / decryption algorithm for the low-dimensional space data; S4: Store the file to be processed in the USB device based on the encryption / decryption algorithm and the USB transfer control type.

[0019] In this embodiment, code data of the file to be processed is obtained, and code detection is performed on the code data to obtain low-dimensional space data. This includes: using the TF-IDF-like algorithm to evaluate the impact of malicious applications from different families in the Android app store containing the same method that poses a security threat. Here, TF is defined as the frequency of a certain threat method appearing in a certain malware family, and IDF is defined as the ratio of the total number of all threat functions in all malware family categories to the total number of times a certain threat method appears in each family, and the logarithm is calculated. 's' represents a feature after N-gram processing. The normal data set and the malicious dataset are analogized to two malware families in Android. Indicate, then TF is defined as the frequency of feature s in two different classes of samples. IDF represents the ratio of the total number of occurrences of all features in all classes to the total number of occurrences of feature s in normal and malicious samples, calculated as its logarithm. The corresponding expression is: (1) in, Indicates all The total number of times all features appear; Corresponding to TF, it represents a certain category. The frequency of feature s in the middle, with a value range of 1. ,but: (2) in, Represents a category The total number of times all features appear in the text. Represents a category The total number of times feature s appears in the middle. Represents all categories If the total number of features s is given, then: (3) If feature s appears in normal samples but not in abnormal samples, then let the normal sample feature s be... Corresponding .

[0020] It should be noted that the feature difference is defined as the absolute value d of the difference between the weights of the same feature s in two classes of samples, and multiple d values ​​are obtained, the same as the number of features. The corresponding calculation expression is: (4) Sort the d values ​​in descending order, select features with high dissimilarity based on the preset number of features r after dimensionality reduction, and train the model. The dimensionality reduction process includes the following steps: The model is trained based on the distance between the feature weights of normal and malicious samples; a larger distance indicates greater discriminative power between the features of the two classes. Input: Normal and malicious samples after N-gram processing, with low-dimensional space dimension r; The feature sets of normal samples and malicious samples are merged to obtain the feature set before dimensionality reduction; Calculate feature weights And calculate the feature difference degree d and sort in descending order; Select the r features with the largest differences, and obtain the data for all samples under r features; Obtain data for all samples under r features and output low-dimensional data D.

[0021] The process involves processing all samples using N-grams to obtain the features of individual samples. The union of these features yields the features of the entire dataset. The frequency of each feature in each sample is then counted, ultimately constructing a bag-of-words model. The Term Frequency-Inverse Document Frequency (TF-IDF) model is used to calculate the weight of each sample's feature. TF-IDF is widely used due to its simplicity and effectiveness as a statistical method for assessing the importance of a feature word to a document. Its main idea is that if a feature word appears multiple times in one document but less frequently in others, it is considered to effectively express the core content of the document and can be used as a keyword for that document. The TF-IDF calculation expression is as follows: ,in, This represents the ratio of the number of times feature i appears in the j-th sample to the total number of times the feature appears in that sample, where N represents the total number of code segments involved in training. This represents the number of samples that exhibit the i-th feature. This represents the importance of the i-th feature to the j-th sample. Using an N-gram model to extract features allows for unified processing of obfuscated and unobfuscated codes, eliminating the need to convert obfuscated codes to unobfuscated codes and effectively improving the algorithm's detection efficiency.

[0022] It should be understood that each data transmission is sent by the host, and the device can only passively receive it. The token packet's role is for the host to inform the device how to respond. The synchronization field is unique to each packet; it uses a fixed value of 00000001 to indicate that the high-speed USB serial interface engine is about to begin data transmission, followed by the packet identifier (PID). The packet identifier identifies the packet type, supporting four token packets (SETUP, IN, OUT, and SOF). The lower 4 bits represent the packet type as defined by the USB protocol, and the higher 4 bits are the inverted version of the lower 4 bits. The address field specifies the USB device's address; it is a seven-bit field containing up to 127 device addresses. By acquiring the code data of the file to be processed and performing code detection on the code data to obtain low-dimensional space data, the low-dimensional space data is stored in a USB device. The USB descriptor and USB data transfer type of the USB device are obtained, and the USB transmission control type of the USB device is determined based on the USB descriptor and data transfer type. The encryption and decryption algorithm of the low-dimensional space data is also determined. Based on the encryption and decryption algorithm and the USB transmission control type, the file to be processed is stored in the USB device, and the data sent by the USB interface is encrypted, effectively ensuring the security of data transmission. It is suitable for various application scenarios and supports more communication data transmission, thereby improving the integrity and timeliness of data transmission.

[0023] Optionally, the low-dimensional spatial data is stored in a USB device, and the USB descriptor and USB data transfer type of the USB device are obtained, including: USB descriptors are used to describe the attributes of USB devices. The host can obtain relevant information about the USB device and set relevant configurations for the device through the USB descriptor. The USB descriptor includes device, configuration, interface, endpoint, and string. According to the USB protocol, USB data transmission is divided into bulk, isochronous, interrupt, and control. The USB data transmission process includes one or more transactions. The control transmission consists of an establishment process, a data process, and a status process. During the establishment process, the host sends a token packet with PID SETUP to the device, then sends a DATA0 data packet to the device, and finally waits for the device to return a handshake packet. During the data transmission process, the host sends an IN token packet to the device to notify the device to send data. The device then returns a data packet, which is converted between DATA0 and DATA0. Finally, the host returns a handshake packet. During the state process, the host sends an OUT token packet to the device to notify the device to receive data. Then, the host sends 0 bytes of data to the device as a state response. Note that the DATA1 packet is used during the state process. Finally, the host waits for the device to return a handshake packet. Bulk transfers are divided into bulk output transactions and bulk input transactions. Each transaction contains a token packet, a data packet, and a handshake packet. In a bulk input transaction, the host sends an IN token packet, then waits for the device to return a data packet, and finally the host returns a handshake packet. In a bulk output transaction, the host sends an OUT token packet, then sends a data packet to the device, and finally waits for the device to return a handshake packet. Interrupted transmission is used for small data transmissions. The host obtains the query interval from the description information of the interrupt endpoint and performs a data transmission within this interval. Isochronous transmission is used for large data transmissions. Isochronous transmission includes token packets and data packets.

[0024] In this embodiment, when a device is plugged into the USB interface, the integrator will detect a high-level signal, and the hub will inform the host that a USB device has been detected. After confirming that a USB device has been plugged in, the USB bus will reset and set the default address 0. The host sends a USB standard request to the control endpoint of the USB device via the USB device's default address. The USB device returns a device descriptor and waits for the host's status response. Here, the USB standard request is the device descriptor. The host then sends a set address request to the USB device. After receiving the request, the USB device waits for the host to send the new address data. When it receives the address data, it returns a handshake response to the host and saves the new address. The host sends a request to obtain configuration descriptors to the new address, and then the USB device sends the set of configuration descriptors to the host and waits for the host's response; The host sets the corresponding configuration for the USB device using the configuration information, and the non-zero endpoints of the USB device begin to be used.

[0025] It should be noted that determining the USB transfer control type of the USB device based on the USB descriptor and data transfer type, and determining the encryption / decryption algorithm for the low-dimensional space data, includes: The USB transmission control types include control transmission type, interrupt transmission type, and real-time transmission type. Control transmission is the setting process of the USB device when the USB device is connected to the host. The control transmission includes at least two transaction phases: control establishment transaction and control status transaction. The control transmission transaction includes the transmission of tag packets, data packets, and handshake packets. Interrupt transmission consists of two parts: input and output transactions, used to transmit interrupted data. It is divided into three phases: the first phase transmits tag packets, the second phase transmits data packets, and the third phase transmits handshake packets. In the tag packet phase, the input transaction is an input tag packet (IN) sent by the host, and the output transaction is an output tag packet (OUT) sent by the host. In the data packet phase, the received tag packets are analyzed by the slave device, and the parsed commands are processed accordingly. In the handshake phase, if the data is correctly received by the host, the host sends an ACJ acknowledgment packet to the slave device; erroneous data packets are handled by directly entering the idle state. When the host is ready to receive data, it actively sends an input transaction marker packet. The device returns a DATA0 or DATA1 data packet. If it cannot return a data packet, it returns NAK or STALL. NAK indicates that the USB device is not ready to immediately transmit data to the host, while STALL indicates that the host needs to send an interrupt to activate the suspended port. When the handshake phase successfully transmits data, the host sends an ACK to confirm, ends the transmission of the entire transaction, and enters an idle state.

[0026] Specifically, the endpoint number indicates the endpoint from which data is sent; CRC checksum is used for cyclic redundancy check of the address field and endpoint number; EOP is used at the end of each packet as a packet terminator; the data packet is used for data transmission; the packet identifier (PID) indicates different data packet types and supports four types; the data field contains the transmitted data; and CRC checksum is used to check the accuracy of the data. The handshake packet indicates whether the data has been acknowledged by the other party. Unlike the two packets mentioned above (establishment packet and data packet), it does not have as many fields, consisting only of a synchronization field, packet identifier (PID), and EOP. The packet identifier (PID) of the handshake packet mainly has three types: ACK, NAK, and STALL. ACK indicates that the host or device can receive data; NAK can only be used by devices, indicating that the device is not ready to receive; STALL can also only be used by devices, indicating that the device cannot execute the host's request.

[0027] Specifically, the device descriptor consists of: one device descriptor for each device, and multiple configuration descriptors under a device descriptor. This descriptor is used to configure the device, ensuring that the host can correctly access the device; a configuration descriptor contains the device's configuration information; an interface descriptor defines the number and information of the device's interfaces and is sent to the host along with the configuration descriptor when the host requests it; an endpoint descriptor defines the device's endpoint types and is sent to the host along with the configuration descriptor; and a string descriptor, which is usually optional and used to describe the manufacturer and product information.

[0028] Optionally, the file to be processed is encrypted using the AES encryption algorithm, which includes the S-box substitution algorithm, row shift algorithm, and column hybrid algorithm. The S-box substitution algorithm transforms an input eight-bit binary number into another eight-bit binary number as the output. This involves first converting the eight-bit binary number into a characteristic polynomial, and then finding the modulus of the characteristic polynomial. The inverse of the multiplication is then transformed by affine transformation of the result of the substitution of the inverse of the multiplication. The row shift algorithm divides 128 bits of data into a 4x4 matrix, and then cyclically shifts the second row of the matrix one byte to the left, the third row two bytes to the left, and the fourth row three bytes to the left. The column-mixing algorithm is based on the modulus. Below a given word Multiplication, assuming the input word for the transformation is 'a' and the output is 'b', then... Its expression is: (5). In this embodiment, the AES encryption algorithm further includes a key expansion algorithm, which comprises two parts: round key expansion and round key selection. The 128-bit data is divided into a 4x4 matrix and initialized with four keys. , , , It needs to be expanded , , , ..., , , , ; The extended algorithm is ,in Detection during expansion subscript ,like If it is a multiple of 4, then proceed. Before operation conduct Function substitution, where It is a four-byte input, four-byte output function.

[0029] It should be noted that the initial 128-bit key is expanded into 11 128-bit keys. After key expansion, the plaintext information is grouped into 128-bit groups. After grouping, each 128-bit plaintext group is encrypted. The encryption process includes: Initial key addition: Perform modulo-2 addition on a finite field with the 128-bit plaintext and the initial 128-bit key to obtain a 128-bit result; S-box substitution: Substitute each byte with an S-box based on the 128-bit intermediate result to obtain a 16-byte result. Row shift: Write 16 bytes of data into a 4x4 state matrix, and then perform a row shift transformation on the state matrix; Column blending: Perform column blending transformation on a character-by-character basis to obtain a 4-character transformation result; Key addition: A modulo-2 addition operation is performed between a 128-bit intermediate variable and an expanded 128-bit key, outputting a 128-bit transformation result to obtain the ciphertext, thus completing the encryption. Decryption is the reverse process of encryption. The AES algorithm, used in this encryption system, is a block cipher algorithm that typically encrypts 128 bits of data, ultimately obtaining the encrypted data through 10 rounds of iteration.

[0030] See Figure 2 The present invention also provides a MCU-based USB endpoint cache data processing system, applied to the above-mentioned MCU-based USB endpoint cache data processing method, comprising: The data acquisition module is used to acquire the code data of the file to be processed, and to perform code detection on the code data to obtain low-dimensional space data; The data processing module is used to store the low-dimensional spatial data in a USB device and obtain the USB descriptor and USB data transfer type of the USB device. The data encryption / decryption module is used to determine the USB transmission control type of the USB device based on the USB descriptor and data transmission type, and to determine the encryption / decryption algorithm for the low-dimensional space data. A data storage module is used to store the file to be processed in the USB device based on the encryption / decryption algorithm and the USB transfer control type.

[0031] In one feasible embodiment, such as Figure 3 As shown, with a fixed 1KB cache, it can support access from nine endpoints (eight 64B endpoints and one 512B endpoint). This limits applications to the largest single endpoint (512B) while the others only support 64B. The improved version allows for CPU-based rewriting of the endpoint cache registers, enabling flexible configuration and combinations of the number and size of USB endpoints. This allows for a complete redistribution of the 1KB cache, such as one endpoint supporting 1KB communication, or two endpoints supporting 64B + 960B communication, up to a maximum of 960B, which is significantly faster than the fixed maximum of 512B. Other flexible configurations are also possible, such as ensuring the total size of three endpoints does not exceed 1KB, and the number of endpoints can be arbitrarily chosen.

[0032] It should be noted that, as Figure 4As shown, the CPU (host) writes commands to the cache control module via the bus, allocating size configurations for each endpoint. The cache control module has multiple sets of registers to ensure the cache size configuration information is preserved. After receiving the configuration information, the cache control module remains in an active state. When data flows into the USB, it determines and identifies the cache write pointer based on the configuration information to confirm which endpoint is being written to and the data size of that endpoint. Then, based on the comparison, it generates the specific physical address of the cache and writes it into the cache storage module. When data needs to flow out, the cache control module compares the configuration information with the cache read pointer comparison module to obtain the required specific physical address, and then outputs the data from the cache storage module, retrieving the endpoint size storage information.

[0033] In all examples shown and described herein, any specific values ​​should be interpreted as merely exemplary and not as limitations; therefore, other examples of exemplary embodiments may have different values.

[0034] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0035] The above-described embodiments are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention.

Claims

1. A USB endpoint buffer data processing method based on an MCU, characterized in that, Includes the following steps: Obtain the code data of the file to be processed, and perform code detection on the code data to obtain low-dimensional space data; The low-dimensional spatial data is stored in a USB device, and the USB descriptor and USB data transfer type of the USB device are obtained. The USB transfer control type of the USB device is determined based on the USB descriptor and data transfer type, and the encryption / decryption algorithm for the low-dimensional space data is determined accordingly. The file to be processed is stored on the USB device based on the encryption / decryption algorithm and the USB transfer control type.

2. The MCU-based USB endpoint cache data processing method according to claim 1, characterized in that, Obtain the code data of the file to be processed, and perform code detection on the code data to obtain low-dimensional space data, including: The TF-IDF-like algorithm is used to evaluate the impact of malicious applications in different families in the Android app store containing the same security threat method. Here, TF is defined as the frequency of a certain threat method appearing in a certain malicious program family, and IDF is defined as the ratio of the total number of all threat functions in all malicious family categories to the total number of times a certain threat method appears in each family, and the logarithm is calculated. Let 's' represent a feature after N-gram processing. Analogous to two families of malware on Android, we can use... Indicate, then TF is defined as the frequency of feature s in two different classes of samples. IDF represents the ratio of the total number of occurrences of all features in all classes to the total number of occurrences of feature s in normal and malicious samples, calculated as its logarithm. The corresponding expression is: （1） in, Indicates all The total number of times all features appear; Corresponding to TF, it represents a certain category. The frequency of feature s in the middle, with a value range of 1. ,but: （2） in, Represents a category The total number of times all features appear in the text. Represents a category The total number of times feature s appears in the middle. Represents all categories If the total number of features s is given, then: （3） If feature s appears in normal samples but not in abnormal samples, then let the normal sample feature s be... Corresponding .

3. The MCU-based USB endpoint cache data processing method according to claim 2, characterized in that, The feature dissimilarity is defined as the absolute value d of the difference between the weights of the same feature s in two classes of samples, and multiple d values ​​are obtained, the same as the number of features. The corresponding calculation expression is: （4） Sort the d values ​​in descending order, select features with high dissimilarity based on the preset number of features r after dimensionality reduction, and train the model. The dimensionality reduction process includes the following steps: The model is trained based on the distance between the feature weights of normal and malicious samples; a larger distance indicates greater discriminative power between the features of the two classes. Input: Normal and malicious samples after N-gram processing, with low-dimensional space dimension r; The feature sets of normal samples and malicious samples are merged to obtain the feature set before dimensionality reduction; Calculate feature weights And calculate the feature difference degree d and sort in descending order; Select the r features with the largest differences, and obtain the data for all samples under r features; Obtain data for all samples under r features and output low-dimensional data D.

4. The MCU-based USB endpoint cache data processing method according to claim 1, characterized in that, The low-dimensional spatial data is stored in a USB device, and the USB descriptor and USB data transfer type of the USB device are obtained, including: USB descriptors are used to describe the attributes of USB devices. The host can obtain relevant information about the USB device and set relevant configurations for the device through the USB descriptor. The USB descriptor includes device, configuration, interface, endpoint, and string. According to the USB protocol, USB data transmission is divided into bulk, isochronous, interrupt, and control. The USB data transmission process includes one or more transactions. The control transmission consists of an establishment process, a data process, and a status process. During the establishment process, the host sends a token packet with PID SETUP to the device, then sends a DATA0 data packet to the device, and finally waits for the device to return a handshake packet. During the data transmission process, the host sends an IN token packet to the device to notify the device to send data. The device then returns a data packet, which is converted between DATA0 and DATA0. Finally, the host returns a handshake packet. During the state process, the host sends an OUT token packet to the device to notify the device to receive data. Then, the host sends 0 bytes of data to the device as a state response. Note that the DATA1 packet is used during the state process. Finally, the host waits for the device to return a handshake packet. Bulk transfers are divided into bulk output transactions and bulk input transactions. Each transaction contains a token packet, a data packet, and a handshake packet. In a bulk input transaction, the host sends an IN token packet, then waits for the device to return a data packet, and finally the host returns a handshake packet. In a bulk output transaction, the host sends an OUT token packet, then sends a data packet to the device, and finally waits for the device to return a handshake packet. Interrupt transmission is used for small data transmissions. The host obtains the query interval from the description information of the interrupt endpoint and performs a data transmission within this interval. Isochronous transmission is used for large data transmissions. Isochronous transmission includes two transmission methods: token packets and data packets.

5. The MCU-based USB endpoint cache data processing method according to claim 4, characterized in that, Also includes: When a device is plugged into the USB port, the integrator will detect a high-level signal, and the hub will inform the host that a USB device has been detected. After confirming that a USB device has been plugged in, the USB bus will reset and set the default address 0. The host sends a USB standard request to the control endpoint of the USB device via the USB device's default address. The USB device returns a device descriptor and waits for the host's status response. Here, the USB standard request is the device descriptor. The host then sends a set address request to the USB device. After receiving the request, the USB device waits for the host to send the new address data. When it receives the address data, it returns a handshake response to the host and saves the new address. The host sends a request to obtain configuration descriptors to the new address, and then the USB device sends the set of configuration descriptors to the host and waits for the host's response; The host sets the corresponding configuration for the USB device using the configuration information, and the non-zero endpoints of the USB device begin to be used.

6. The MCU-based USB endpoint cache data processing method according to claim 1, characterized in that, The USB transfer control type of the USB device is determined based on the USB descriptor and data transfer type, and the encryption / decryption algorithm for the low-dimensional space data is determined, including: The USB transmission control types include control transmission type, interrupt transmission type, and real-time transmission type. Control transmission is the setting process of USB devices when a USB device is connected to the host. Control transmission includes at least two transaction phases: control establishment transaction and control status transaction. Control transmission transactions include the transmission of tag packets, data packets, and handshake packets. Interrupt transmission consists of two parts: input and output transactions, used to transmit interrupted data. It is divided into three phases: the first phase transmits tag packets, the second phase transmits data packets, and the third phase transmits handshake packets. In the tag packet phase, the input transaction is an input tag packet (IN) sent by the host, and the output transaction is an output tag packet (OUT) sent by the host. In the data packet phase, the received tag packets are analyzed by the slave device, and the parsed commands are processed accordingly. In the handshake phase, if the data is correctly received by the host, the host sends an ACJ acknowledgment packet to the slave device; erroneous data packets are handled by directly entering the idle state. When the host is ready to receive data, it actively sends an input transaction marker packet. The device returns a DATA0 or DATA1 data packet. If it cannot return a data packet, it returns NAK or STALL. NAK indicates that the USB device is not ready to immediately transmit data to the host, while STALL indicates that the host needs to send an interrupt to activate the suspended port. When the handshake phase successfully transmits data, the host sends an ACK to confirm, ends the transmission of the entire transaction, and enters an idle state.

7. The MCU-based USB endpoint cache data processing method according to claim 6, characterized in that, The file to be processed is encrypted using the AES encryption algorithm, which includes the S-box substitution algorithm, row shift algorithm, and column hybrid algorithm. The S-box substitution algorithm transforms an input eight-bit binary number into another eight-bit binary number as the output. This involves first converting the eight-bit binary number into a characteristic polynomial, and then finding the modulus of the characteristic polynomial. The inverse of the multiplication is then transformed by affine transformation of the result of the substitution of the inverse of the multiplication. The row shift algorithm divides 128 bits of data into a 4x4 matrix, and then cyclically shifts the second row of the matrix one byte to the left, the third row two bytes to the left, and the fourth row three bytes to the left. Column-mixed algorithms are based on the modulus Below a given word Multiplication, assuming the input word for the transformation is 'a' and the output is 'b', then... Its expression is: (5)。 8. The MCU-based USB endpoint cache data processing method according to claim 7, characterized in that, The AES encryption algorithm also includes a key expansion algorithm, which consists of two parts: round key expansion and round key selection. The 128-bit data is divided into a 4x4 matrix and initialized with four keys. , , , It needs to be expanded , , , ..., , , , ; The extended algorithm is ,in Detection during expansion subscript ,like If it is a multiple of 4, then proceed. Before operation conduct Function substitution, where It is a four-byte input, four-byte output function.

9. The MCU-based USB endpoint cache data processing method according to claim 8, characterized in that, The initial 128-bit key is expanded into 11 separate 128-bit keys. After key expansion, the plaintext information is grouped into 128-bit groups. Each group of 128-bit plaintext is then encrypted. The encryption process includes: Initial key addition: Perform modulo-2 addition on a finite field with the 128-bit plaintext and the initial 128-bit key to obtain a 128-bit result; S-box substitution: Substitute each byte with an S-box based on the 128-bit intermediate result to obtain a 16-byte result. Row shift: Write 16 bytes of data into a 4x4 state matrix, and then perform a row shift transformation on the state matrix; Column blending: Perform column blending transformation on a character-by-character basis to obtain a 4-character transformation result; Key addition: A modulo-2 addition operation is performed on a 128-bit intermediate variable and an extended 128-bit key. The 128-bit transformation result is output to obtain the ciphertext to complete the encryption. The decryption process is the reverse of the encryption process.

10. A USB endpoint buffer data processing system based on an MCU, characterized in that, The method for processing USB endpoint buffered data based on an MCU as described in any one of claims 1-9 includes: The data acquisition module is used to acquire the code data of the file to be processed, and to perform code detection on the code data to obtain low-dimensional space data; The data processing module is used to store the low-dimensional spatial data in a USB device and obtain the USB descriptor and USB data transfer type of the USB device. The data encryption / decryption module is used to determine the USB transmission control type of the USB device based on the USB descriptor and data transmission type, and to determine the encryption / decryption algorithm for the low-dimensional space data. A data storage module is used to store the file to be processed in the USB device based on the encryption / decryption algorithm and the USB transfer control type.

Images