Method for supporting read-only of high-speed USB storage device based on SPICE protocol

Abstract

The application relates to a method for supporting read-only of high-speed USB storage equipment based on a SPICE protocol, and the method is characterized in that the method comprises the following steps: S100, a spice-gtk cross-compilation environment is built, usbredir, spice-gtk and virt-viewer source codes are acquired, and corresponding environment parameters are configured; S200, the usbredir source code is modified to realize equipment identification; S300, the usbredir header file and the dynamic library are compiled based on the modified usbredir source code, the spice-gtk is compiled and linked with the usbredir header file and the dynamic library, and the new spice-gtk dynamic library is generated; and S400, when the remote-viewer is used to connect a virtual machine, the new spice-gtk dynamic library is loaded. The main purpose of the application is to solve the scene of prohibiting the high-speed USB storage equipment from writing data in a cloud desktop scene.

Description

Technical Field

[0001] This invention relates to the field of cloud desktop technology, and more specifically to a method for supporting read-only access to high-speed USB storage devices based on the SPICE protocol. Background Technology

[0002] SPICE (Simple Protocol for Independent Computing Environments) is an open-source remote desktop protocol widely used in KVM virtualization cloud desktop scenarios.

[0003] In cloud desktop applications based on the SPICE protocol, the native SPICE protocol already supports the pass-through of terminal USB storage devices to virtual machines via the usbredir channel and a dedicated USB channel. This allows virtual machines to directly read and write USB devices plugged into the terminal, thereby enabling file transfer to or from the virtual machine to the terminal. However, in organizations and industries with strict controls and high security requirements, copying files from the virtual machine to USB storage devices is usually prohibited. The native SPICE protocol does not support setting USB storage devices to read-only mode; while read-only restrictions can be implemented for traditional USB storage devices, high-speed USB storage devices use more advanced protocols and cannot be subject to such restrictions.

[0004] Therefore, a method based on the SPICE protocol to support read-only operation of high-speed USB storage devices was proposed to solve the above problems. Summary of the Invention

[0005] The main objective of this invention is to provide a method for supporting read-only access to high-speed USB storage devices based on the SPICE protocol, which solves the problem of prohibiting write data to high-speed USB storage devices in cloud desktop scenarios.

[0006] To achieve the above objectives, this invention provides a method for supporting read-only access to high-speed USB storage devices based on the SPICE protocol, comprising the following steps: S100: Set up the spice-gtk cross-compilation environment, obtain the source code of usbredir, spice-gtk, and virt-viewer, configure the compilation toolchain, and complete the deployment and verification of the dependency environment; S200: Modify the usbredir source code to achieve read-only control and high-speed device identification of USB storage devices; S300: Compiles the modified usbredir source code to generate usbredir header files and dynamic libraries, compiles spice-gtk and links usbredir header files and dynamic libraries to generate a new spice-gtk dynamic library; S400: When using remote-viewer to connect to a virtual machine, load the new spice-gtk dynamic library and configure read-only mode environment variables through parameters to achieve read-only control of USB storage devices passed to the virtual machine.

[0007] Preferably, step S100 specifically includes: S110: Obtain the source code packages for usbredir, spice-gtk, and virt-viewer from the official open-source website; S120: Configure mingw64-gcc and gcc compilation toolchain, and install the dependency packages required for source code compilation; S130: Compile and build the usbredir, spice-gtk, and virt-viewer installation packages respectively to verify the availability of the cross-compilation environment.

[0008] In a further preferred embodiment, step S200 specifically includes: S210: Modify the usbredirhost.c file located in the usbredirhost directory within the usbredir directory; S220: Add the usb_read_only variable to the usbredirhost structure, and complete the initialization of the structure and the reading of environment variables in the usbredirhost initialization process; S230: Added a custom function usbredirhost_send_response to intercept write operations and return a write protection response to the virtual machine (guest); S240: Add packet listening and judgment logic to the usbredirhost_bulk_packet function as the core entry point for read-only interception; S250: After completing all code modifications, verify the logical link between the usbredirhost_bulk_packet function and the usbredirhost_send_response function to ensure that the entire process of write operation interception, device judgment, and write protection response sending can be executed normally.

[0009] Preferably, step S230 includes: Define the usbredirhost_send_response function, whose input parameters include a pointer to the usbredirhost structure, a pointer to the data packet to be processed, and the length of the data packet; In the usbredirhost_send_response function, a packet analysis algorithm is used to determine whether the current USB device is a low-speed device or a high-speed device. Based on the device type, construct a write-protected response data packet in the corresponding protocol format, and set the corresponding data bits of the response data packet to write-protected status; The write-protected response data packet is sent back through the SPICEUSB channel, and finally the write-protected response is sent to the virtual machine (guest), so that the virtual machine recognizes the USB device as read-only.

[0010] More preferably, step S240 includes: In the usbredirhost_bulk_packet function, wait for and listen for bulk data packets sent from the SPICEUSB channel; When the bulk packet arrives, the first step is to check whether the current data packet is a write operation instruction issued by the virtual machine; If the detection result is a non-write operation, then execute the normal packet processing procedure, and end the processing of the current data packet after completion; If the detection result is a write operation, then further check whether the usb_read_only variable in the usbredirhost structure is true; If the usb_read_only variable indicates that read-only mode is not enabled, then the normal packet processing flow is executed, and the current packet processing ends upon completion. If the result of the usb_read_only variable detection is that read-only mode is enabled, then the usbredirhost_send_response function added in step S230 is called to execute the write protection interception process.

[0011] In a further preferred embodiment, step S300 specifically includes: S310: Compile the modified usbredir source code from step S200 to generate the corresponding usbredir header file and dynamic library file; S320: When compiling the spice-gtk source code, specify the paths to the usbredir header file and dynamic library file generated by S310, complete the linking of spice-gtk and the modified usbredir dynamic library, and generate a new spice-gtk dynamic library.

[0012] Preferably, in step S400, when the terminal connects to the SPICE protocol virtual machine through the remote-viewer client, the environment variable value corresponding to usb_read_only is set by the startup parameters, and the new spice-gtk dynamic library generated in step S300 is loaded first, so that the USB storage device passed through to the virtual machine is mounted in read-only mode.

[0013] Preferably, the method supports Windows and Linux operating systems.

[0014] Preferably, high-speed USB storage devices include USB storage devices based on USB 3.0, USB 3.1, and USB 3.2 protocols, while low-speed USB storage devices include USB storage devices based on the USB 2.0 protocol.

[0015] The beneficial effects of this invention are as follows: This invention implements read-only control over high-speed USB 3.0 and above storage devices based on the UAS protocol. It is fully compatible, supporting both low-speed USB 2.0 storage devices based on the BOT protocol and high-speed USB storage devices based on the UAS protocol. It is also compatible with both Windows and Linux, the two major terminal operating systems, making it widely applicable without requiring separate development of control solutions for different devices and systems. This invention offers flexible deployment and strong compatibility. It only modifies the usbredir source code and spice-gtk dynamic library on the terminal side, without altering the cloud-based spice-server, QEMU, or the internal systems of the virtual machine. It does not affect other functions of the native SPICE protocol and can seamlessly integrate with existing standard SPICE cloud desktop architectures, resulting in low modification costs and strong feasibility. The invention offers flexible control modes. The read-only mode can be configured via environment variables, allowing for flexible enabling or disabling of read-only control according to scenario requirements without recompiling the source code, thus meeting the differentiated security control needs of different scenarios. Attached Figure Description

[0016] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0017] Figure 1 This is a schematic diagram of the overall structure of USB pass-through based on the open-source SPICE protocol; Figure 2 This is a flowchart illustrating the process of writing data to a USB device based on the open-source SPICE protocol. Figure 3 This is a flowchart illustrating the code for supporting read-only USB storage devices based on the SPICE protocol in this invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Many specific details are set forth in the following description to provide a thorough understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0019] like Figure 1 As shown below, the implementation principle of USB pass-through under the SPICE protocol is explained: First, a SPICE connection is established between the spice-gtk component on the client side and the spice-server component on the host side, creating a dedicated SPICEUSB channel. Then, the SPICE client remote-viewer calls libusb (the USB device access library) to detect the USB device inserted into the client's USB port. After the user selects the USB device to be passed through, the client opens the USB device via libusb, and the libusbredirhost library (the USB redirection host control library) reads the device descriptor, calls libusbredirparser (the USB redirection protocol parsing library) to package it into a usbredir protocol message, and sends it to the cloud server through the pre-established SPICEUSB channel. The QEMU virtualization component and spice-server on the cloud host receive the message, parse the usbredir protocol data using libusbredirparser, create the corresponding virtual USB device instance, and notify the USB controller of the virtual machine guest. Finally, the virtual machine system detects the "new USB device inserted," completing the pass-through mounting of the USB device.

[0020] like Figure 2 As shown below, the implementation principle of writing data to a USB device under the SPICE protocol is explained: When a virtual machine application initiates a write operation to a virtual USB device, the virtual machine USB driver constructs a URB. The QEMU-emulated USB controller captures the URB and hands it over to libusbredirparser (the USB redirection protocol parsing library) in the spice-server. libusbredirparser serializes the URB into usbredir packets, and then the packets are sent to the client through the SPICEUSB channel.

[0021] After the SPICE client receives the data packet sent by the spice-server through the USB channel, libusbredirhost (i.e., the USB redirection host control library) calls libusbredirparser to unpack it into a URB data structure, and finally calls libusb to write the data to the physical USB storage device.

[0022] After successful data writing, libusbredirhost packages and returns a response, which is then sent to the spice-server via USB. The spice-server calls libusbredirparser to parse the URB and complete the URB, then notifies the virtual machine and the corresponding application on the virtual machine.Figure 2 The "GuestAPP" received a successful data write result.

[0023] Based on the implementation principle of writing data to a USB device under the SPICE protocol, the implementation idea of ​​this embodiment is as follows: on the spice-gtk side, when usbredirhost receives a data packet sent by spice-server, it constructs a write protection response data packet and returns it directly to the virtual machine (guest), so that the virtual machine recognizes the USB storage device as read-only.

[0024] The specific implementation steps of this invention are as follows: S100: Setting up the spice-gtk cross-compilation environment includes the following steps: S110: Obtain the source code for usbredir, spice-gtk, and virt-viewer from the official website and open-source websites; S120: Configure mingw64-gcc and gcc, and install the corresponding dependency packages; S130: Verify the compilation environment by compiling and building the usbredir, spice-gtk, and virt-viewer packages.

[0025] S200: Modify the usbredir source code, such as Figure 3 As shown, the specific steps include the following: S210: Modify the usbredirhost.c file located in the usbredirhost directory within the usbredir directory.

[0026] S220: Add the usb_read_only variable to the usbredirhost structure, and complete the initialization of the structure and the reading of environment variables in the usbredirhost initialization process.

[0027] S230: A new custom function, usbredirhost_send_response, has been added to intercept write operations and return a write-protected response to the virtual machine (guest). The specific steps include: Define the usbredirhost_send_response function, whose input parameters include a pointer to the usbredirhost structure, a pointer to the data packet to be processed, and the length of the data packet; In the usbredirhost_send_response function, a packet analysis algorithm is used to determine whether the current USB device is a low-speed device or a high-speed device. Based on the device type, construct a write-protected response data packet in the corresponding protocol format, and set the corresponding data bits of the response data packet to write-protected status; The write-protected response data packet is sent back through the SPICEUSB channel, and finally a write-protected response is sent to the virtual machine (guest), so that the guest recognizes the USB device as being in a read-only state.

[0028] S240: Add packet listening and judgment logic to the usbredirhost_bulk_packet function as the core entry point for read-only interception, specifically including the following steps: In the usbredirhost_bulk_packet function, wait for and listen for bulk data packets sent from the SPICEUSB channel; When the bulk packet arrives, the first step is to check whether the current data packet is a write operation instruction issued by the virtual machine; If the detection result is "No" (not a write operation), then the normal packet processing flow is executed, and the current packet processing ends upon completion. If the detection result is "yes" (write operation), then further check whether the usb_read_only variable in the usbredirhost structure is true; If the result of the usb_read_only variable detection is "no" (read-only mode is not enabled), then the normal packet processing flow is executed, and the current packet processing ends after completion; If the result of the usb_read_only variable detection is "yes" (read-only mode is enabled), then the usbredirhost_send_response function added in step S230 is called to execute the write protection interception process.

[0029] S250: After completing all code modifications, verify the logical link between the usbredirhost_bulk_packet function and the usbredirhost_send_response function to ensure that the entire process of write operation interception, device judgment, and write protection response sending can be executed normally.

[0030] S300: Compile spice-gtk and link the modified usbredir library, specifically including the following steps: S310: Compile the modified usbredir source code to generate header files and dynamic libraries; S320: When compiling spice-gtk, link the above usbredir header file and dynamic library to generate a new spice-gtk dynamic library.

[0031] S400. Start remote-viewer using the new dynamic library, as shown below: When using remote-viewer to connect to the virtual machine, set read-only environment variables and load the new spice-gtk dynamic library compiled from S300.

[0032] After the terminal USB storage device is passed through to the virtual machine through the above steps, the virtual machine (guest) will receive a write protection response, recognize the device as read-only, and will not be able to perform write operations.

[0033] Additionally, it should be noted that the terminal operating systems supported by this invention are Windows and Linux systems; it supports high-speed USB storage devices of USB 3.0, USB 3.1, and USB 3.2, and is compatible with low-speed USB 2.0 devices.

[0034] Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

Claims

1. A method for supporting read-only access to high-speed USB storage devices based on the SPICE protocol, characterized in that: Includes the following steps: S100: Set up the spice-gtk cross-compilation environment, obtain the source code of usbredir, spice-gtk, and virt-viewer, configure the compilation toolchain, and complete the deployment and verification of the dependency environment; S200: Modify the usbredir source code to achieve read-only control and high-speed device identification of USB storage devices; S300: Compiles and generates usbredir header files and dynamic libraries based on the modified usbredir source code, compiles spice-gtk and links usbredir header files and dynamic libraries, and generates a new spice-gtk dynamic library; S400: When using remote-viewer to connect to a virtual machine, load the new spice-gtk dynamic library and configure the environment variables for read-only mode through parameters to achieve read-only control of USB storage devices passed to the virtual machine; Step S200 specifically includes: S210: Modify the usbredirhost.c file located in the usbredirhost directory within the usbredir directory; S220: Add the usb_read_only variable to the usbredirhost structure, and complete the initialization of the structure and the reading of environment variables in the usbredirhost initialization process; S230: Added a custom function usbredirhost_send_response to intercept write operations and return a write protection response to the virtual machine; S240: Add packet listening and judgment logic to the usbredirhost_bulk_packet function as the core entry point for read-only interception; S250: After completing all code modifications, verify the logical link between the usbredirhost_bulk_packet function and the usbredirhost_send_response function to ensure that the entire process of write operation interception, device judgment, and write protection response sending can be executed normally.

2. The method for supporting read-only access to high-speed USB storage devices based on the SPICE protocol according to claim 1, characterized in that, Step S100 specifically includes: S110: Obtain the source code packages for usbredir, spice-gtk, and virt-viewer from the official open-source website; S120: Configure mingw64-gcc and gcc compilation toolchain, and install the dependency packages required for source code compilation; S130: Compile and build the usbredir, spice-gtk, and virt-viewer installation packages respectively to verify the availability of the cross-compilation environment.

3. The method for supporting read-only access to high-speed USB storage devices based on the SPICE protocol according to claim 1, characterized in that, Step S230 includes: Define the usbredirhost_send_response function, whose input parameters include a pointer to the usbredirhost structure, a pointer to the data packet to be processed, and the length of the data packet; In the usbredirhost_send_response function, a packet analysis algorithm is used to determine whether the current USB device is a low-speed device or a high-speed device. Based on the device type, construct a write-protected response data packet in the corresponding protocol format, and set the corresponding data bits of the response data packet to write-protected status; The write-protected response data packet is sent back through the SPICEUSB channel, and finally the write-protected response is sent to the virtual machine, so that the virtual machine recognizes the USB device as read-only.

4. The method for supporting read-only access to high-speed USB storage devices based on the SPICE protocol according to claim 1, characterized in that, Step S240 includes: In the usbredirhost_bulk_packet function, wait for and listen for bulk data packets sent from the SPICEUSB channel; When the bulk packet arrives, the first step is to check whether the current data packet is a write operation instruction issued by the virtual machine; If the detection result is a non-write operation, then execute the normal packet processing procedure, and end the processing of the current data packet after completion; If the detection result is a write operation, then further check whether the usb_read_only variable in the usbredirhost structure is true; If the usb_read_only variable indicates that read-only mode is not enabled, then the normal packet processing flow is executed, and the current packet processing ends upon completion. If the result of the usb_read_only variable detection is that read-only mode is enabled, then the usbredirhost_send_response function added in step S230 is called to execute the write protection interception process.

5. The method for supporting read-only access to high-speed USB storage devices based on the SPICE protocol according to claim 1, characterized in that, Step S300 specifically includes: S310: Compile the modified usbredir source code from step S200 to generate the corresponding usbredir header file and dynamic library file; S320: When compiling the spice-gtk source code, specify the paths to the usbredir header file and dynamic library file generated by S310, complete the linking of spice-gtk and the modified usbredir dynamic library, and generate a new spice-gtk dynamic library.

6. The method for supporting read-only access to high-speed USB storage devices based on the SPICE protocol according to claim 1, characterized in that, In step S400, when the terminal connects to the SPICE protocol virtual machine through the remote-viewer client, the environment variable value corresponding to usb_read_only is set by the startup parameters, and the new spice-gtk dynamic library generated in step S300 is loaded first, so that the USB storage device passed through to the virtual machine is mounted in read-only mode.

7. The method for supporting read-only access to high-speed USB storage devices based on the SPICE protocol according to claim 1, characterized in that, The method supports Windows and Linux operating systems.

8. The method for supporting read-only access to high-speed USB storage devices based on the SPICE protocol according to claim 1, characterized in that, High-speed USB storage devices include USB storage devices based on the USB 3.0, USB 3.1, and USB 3.2 protocols, while low-speed USB storage devices include USB storage devices based on the USB 2.0 protocol.

Images