Secure USB flash disk system and method based on sector level encryption and strategy linkage

Abstract

The invention discloses a safe USB flash disk system and method based on sector-level encryption and strategy linkage. The system comprises a manufacturing tool layer, an encryption kernel layer, a client management layer and a background service layer. The manufacturing tool layer is used for U disk medium detection, partition and encryption parameter configuration and key seed and strategy template configuration so as to realize the manufacturing of the safe U disk; the encryption kernel layer is used for providing sector-level encryption and a user-defined file system so as to support volume management, key derivation and cross-platform driving; the client management layer is used for completing user authentication, volume mounting, security policy synchronization, file operation and local log recording so as to realize security login and policy linkage; wherein the security policy is issued through a matched client; the background service layer is used for centrally managing strategies, issuing authorization, receiving logs and providing alarms and audits; the method has the beneficial effects that the method can be quickly deployed on a common USB flash disk and supports strategy linkage.

Description

Technical Field

[0001] This invention belongs to the field of data security technology, specifically relating to a secure USB flash drive system and method based on sector-level encryption and policy linkage. Background Technology

[0002] With the increasing prevalence of mobile work, USB flash drives remain the primary medium for enterprise data exchange. However, traditional solutions have the following shortcomings:

[0003] 1. High hardware costs: Customized encrypted USB drives rely on proprietary chips, resulting in high procurement and maintenance costs;

[0004] 2. Weak cross-platform capability: The encryption schemes provided by mainstream operating systems have poor compatibility with platforms such as Linux and macOS;

[0005] 3. Insufficient policy linkage: Existing products focus more on static encryption and lack the ability to coordinate with terminal security policies, keyword recognition, and log auditing.

[0006] 4. Lack of operation and maintenance tools: There is a lack of full lifecycle support tools such as creation, health monitoring, and password recovery.

[0007] Therefore, in the security practices of large enterprises and government agencies, there is a need for a unified solution that can be quickly deployed on ordinary USB flash drives, supports multi-terminal policy linkage, and provides comprehensive auditing capabilities. Summary of the Invention

[0008] In view of the technical defects mentioned in the background art, the purpose of this invention is to provide a secure USB flash drive system and method based on sector-level encryption and policy linkage, aiming to at least solve one of the technical problems in the related art to a certain extent.

[0009] To achieve the above objectives, in a first aspect, embodiments of the present invention provide a secure USB flash drive system based on sector-level encryption and policy linkage, the system comprising a creation tool layer, an encryption kernel layer, a client management layer, and a backend service layer;

[0010] The creation tool layer is used for USB flash drive media detection, configuring partition and encryption parameters, configuring key seeds and policy templates, and generating creation logs to achieve the creation of secure USB flash drives; wherein, the policy template includes permissions and controls, and the parameters are written to sectors;

[0011] The encryption kernel layer is used to provide sector-level encryption and a custom file system to support volume management, key derivation, and cross-platform drivers.

[0012] The client management layer is used to complete user authentication, volume mounting, security policy synchronization, file operations, and local log recording to achieve secure login and policy linkage; wherein, the security policy is issued through the client used in conjunction with the application.

[0013] The backend service layer is used for centralized management of policies, issuance of authorizations, receipt of logs, and provision of alarms and auditing.

[0014] As a specific implementation of this application, the encryption kernel layer uses a dynamic key derivation algorithm to combine the user password, device unique identifier, sector index and random factor to generate a sector key, thereby achieving fine-grained encryption.

[0015] As one specific implementation of this application, the client management layer includes a login and guardian module, a secure file management module, and a policy and audit module;

[0016] The login and guardian module is used to complete user authentication, single instance control, background guardian and automatic volume mounting;

[0017] The secure file management module is used to provide an adapted file operation interface, execute policy judgment, result prompts, and operation logs;

[0018] The policy and audit module is used to load and cache security policies, perform keyword recognition, permission verification, log reporting and event tracking, and automatically block access in case of anomalies.

[0019] As a specific implementation of this application, the backend service layer is also used to aggregate and analyze the uploaded logs, and supports real-time alarms, approval workflows, compliance reports, and historical traceability.

[0020] As one specific implementation of this application, the client management layer further includes a support tool module, which is used for password conversion, media health detection, dependency release and signing tools to ensure the lifecycle maintenance of the secure USB flash drive; and

[0021] When a user forgets their password, a temporary recovery password is generated through a password conversion tool and used after approval, with the entire process being traceable.

[0022] As one specific implementation of this application, the system collaborates with the policy server through a secure channel to achieve device registration, policy synchronization, and log transmission.

[0023] The configuration file uses a verification mechanism to prevent tampering, policy data is distributed through shared memory and message queues, and logs are stored both locally and on the server and support digital signatures.

[0024] As a specific implementation of this application, the strategy linkage includes: comprehensively judging based on identity permissions, file attributes, keyword matching, time and location, and approval status conditions, and refining it to file operations such as reading, writing, copying, and exporting.

[0025] Secondly, embodiments of the present invention also provide a method based on sector-level encryption and policy linkage, applied to a secure USB flash drive system based on sector-level encryption and policy linkage as described in the first aspect, the method comprising the following steps:

[0026] Create a secure USB drive;

[0027] A sector-level encryption layer is constructed in the encrypted area of ​​the secure USB flash drive, and volume management, key derivation, and cross-platform drivers are implemented in conjunction with a custom file system;

[0028] Perform identity authentication, load security policies, and mount the encrypted volume;

[0029] Based on the policy, file operations and audit records are executed, and logs are reported to the backend and alarms are handled.

[0030] As a specific implementation of this application, the step of performing file operations and auditing records according to the policy specifically includes:

[0031] Users operate in the file management interface, identify the source / target area, decide whether to encrypt or allow based on the policy, perform keyword recognition on sensitive content, and allow, block or initiate approval based on the recognition results, and write to the audit log.

[0032] As one specific implementation of this application, the keyword recognition includes:

[0033] It supports multi-template and multi-language keyword matching, and provides advanced configurations including sensitivity rating, hit threshold and context analysis.

[0034] This invention employs a four-layer architecture—a tool layer, an encryption kernel layer, a client management layer, and a backend service layer—to achieve low-cost deployment. Security capabilities can be implemented using a standard USB flash drive, eliminating the need for dedicated hardware. The encryption kernel layer provides sector-level encryption and a custom file system to support volume management, key derivation, and cross-platform drivers, enhancing cross-platform capabilities. Policy linkage enables collaborative work between security policies, keyword detection, and log auditing, meeting enterprise compliance requirements. Furthermore, supporting tool modules ensure long-term stable operation. Attached Figure Description

[0035] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below.

[0036] Figure 1 This is a schematic diagram of a secure USB flash drive system based on sector-level encryption and policy linkage provided in an embodiment of the present invention;

[0037] Figure 2 This is a flowchart illustrating the process of creating a secure USB flash drive, as provided in an embodiment of the present invention.

[0038] Figure 3 This is an interface diagram of a secure USB flash drive parameter setting provided in an embodiment of the present invention;

[0039] Figure 4 This is a flowchart of file operation and auditing provided in an embodiment of the present invention;

[0040] Figure 5 This is an interface diagram of a security policy configuration provided in an embodiment of the present invention;

[0041] Figure 6 This is a flowchart of a method based on sector-level encryption and policy linkage provided in an embodiment of the present invention. Detailed Implementation

[0042] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0043] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0044] It should be noted that, unless otherwise stated, the technical terms used in this embodiment have the common meaning as understood in the relevant technical field.

[0045] Please refer to Figures 1 to 4 The present invention provides a secure USB flash drive system based on sector-level encryption and policy linkage. The system includes a creation tool layer, an encryption kernel layer, a client management layer, and a background service layer.

[0046] The creation tool layer is used for USB flash drive media detection, configuring partition and encryption parameters, configuring key seeds and policy templates, and generating creation logs to achieve the creation of secure USB flash drives; wherein, the policy template includes permissions and controls, and the parameters are written to sectors;

[0047] The encryption kernel layer is used to provide sector-level encryption and a custom file system to support volume management, key derivation, and cross-platform drivers.

[0048] The client management layer is used to complete user authentication, volume mounting, security policy synchronization, file operations, and local log recording to achieve secure login and policy linkage; wherein, the security policy is issued through the client used in conjunction with the application.

[0049] The backend service layer is used for centralized management of policies, issuance of authorizations, receipt of logs, and provision of alarms and auditing.

[0050] In this embodiment, refer to Figure 2 and Figure 3 USB flash drive creation process: A creation wizard is built to complete media identification, partition planning, encryption parameter setting, departmental authorization, log generation, and server registration; resulting in a secure USB flash drive output; the creation process supports batch operations and template import; since the parameters are written in the sectors, they are effective no matter where the USB flash drive is plugged in.

[0051] Figure 2 The media compatibility strategy refers to determining whether the inserted USB flash drive meets the requirements for creating a bootable installation USB flash drive.

[0052] It also includes writing a unique identifier and key seed, configuring encryption algorithms and policy templates, generating production logs and reports, and uploading them to the policy server for filing.

[0053] The permissions and controls include options such as selecting that the security assistant can only be opened on computers where it is running normally, requiring a password, and opening the security browser when the security USB drive is inserted.

[0054] The encryption kernel layer uses a dynamic key derivation algorithm to combine user passwords, device unique identifiers, sector indexes, and random factors to generate sector keys, thereby achieving fine-grained encryption.

[0055] The backend service layer is also used to aggregate and analyze uploaded logs, and supports real-time alerts, approval processes, compliance reports, and historical traceability.

[0056] In this embodiment, the creation tool layer is equipped with a secure USB flash drive creation module, the encryption kernel layer is equipped with an encryption and file system module, and the client management layer includes a login and protection module, a secure file management module, and a policy and audit module.

[0057] The login and guardian module is used to complete user authentication, single instance control, background guardian and automatic volume mounting;

[0058] The secure file management module is used to provide an adapted file operation interface, execute policy judgment, result prompts, and operation logs;

[0059] The policy and audit module is used to load and cache security policies, perform keyword recognition, permission verification, log reporting and event tracking, and automatically block access in case of anomalies.

[0060] The client-side management layer also deploys a support tool module, which is used for:

[0061] Password conversion, media health checks, dependency release and signing tools ensure the lifecycle maintenance of secure USB drives; and

[0062] When a user forgets their password, a temporary recovery password is generated through a password conversion tool and used after approval, with the entire process being traceable.

[0063] Specifically, the secure USB flash drive creation module: through the creation wizard, it completes media identification, partition planning, encryption parameter setting, department authorization, log generation, and server registration.

[0064] Encryption and File System Module: Constructs a sector-level encryption layer in the USB flash drive's encryption area, and combines a custom file system to implement file metadata management, space allocation, bad sector bypass, and cross-platform driver interface; achieves multi-platform support through the cross-platform driver interface: provides unified encrypted access capabilities on Windows, Linux, and macOS.

[0065] Login and Guardian Module: Deploys a login program and a resident guardian service on the terminal to achieve media identification, single instance control, identity authentication, policy synchronization, volume mounting and status monitoring;

[0066] The login and mounting process is as follows: User inserts secure USB drive → Guardian service captures event → Starts login interface → Identity authentication → Verifies policy and validity period → Mounts encrypted volume → Synchronizes policy → Prompts user to use.

[0067] Secure File Management Module: Provides a file operation interface similar to Windows Explorer, enabling policy judgment, result prompts, and operation logging; offers tree-like directories, list views, drag-and-drop functionality, and search capabilities based on a graphical interface, and introduces policy prompts, approval entry points, and log viewing features.

[0068] Policy and Audit Module: Retrieves security policies and keyword templates from the backend, provides local caching, sensitive information identification, operation judgment, encrypted log storage, and backend reporting, and supports compliance auditing and traceability.

[0069] Support tools module: Provides operation and maintenance tools such as password transformation, sector health detection, dependency library management, and signature release to ensure that the entire system lifecycle is manageable and controllable.

[0070] The strategy linkage includes: combining identity permissions, file attributes, keyword matching, time and location, and approval status conditions for comprehensive judgment, and refining it to file operations such as reading, writing, copying, and exporting;

[0071] In this embodiment, the interaction between secure USB flash drive login and policy linkage involves:

[0072] When a user inserts a secure USB drive, the daemon process detects the media, launches the login interface, and determines whether the identity authentication is successful; if not, access is denied and a log is recorded.

[0073] If so, synchronize the policy, verify the validity period, and mount the encrypted volume;

[0074] File management loading strategy, execute file operation requests;

[0075] Determine whether the policy is triggered (here, the policy refers to the file-related control and audit policies configured in the linkage tool);

[0076] No → Allow passage and record in the normal log;

[0077] Yes → Block / apply for approval, record audit logs, and then the backend receives and issues an alert.

[0078] Reference Figure 4 Perform file operations and audit logs, specifically including:

[0079] Users operate in the file management interface to identify the source / target area, decide whether to encrypt or allow it according to the policy, perform keyword recognition on sensitive content, and allow, block or initiate approval based on the recognition results, and write to the audit log.

[0080] Figure 4 The hit-or-miss strategy refers to the configuration control strategy of the linkage tool;

[0081] The system collaborates with the policy server through a secure channel to achieve device registration, policy synchronization, and log transmission.

[0082] The configuration file employs a verification mechanism to prevent tampering, policy data is distributed via shared memory and message queues, and logs are stored both locally and on the server and support digital signatures; here, policy data refers to the security policy mentioned during linkage.

[0083] Reference Figure 5 The security policy includes configuration options such as basic options and read / write controls, as detailed below. Figure 5 As shown.

[0084] During implementation, policy configuration includes partition size, algorithm, access permissions, keyword templates, approval rules, log levels, etc., and supports template-based management and remote updates.

[0085] Key management: By combining dynamic derivation with the device's unique identifier, multi-layer protection is achieved for volume keys, sector keys, and file keys, and regular rotation is supported.

[0086] Log data: Local storage employs a tiered encryption and space rotation strategy, while backend storage supports retrieval and long-term archiving. Critical logs are appended with digital signatures.

[0087] Anomaly Handling: Provides local prompts, background alarms, and emergency manuals for situations such as login failures, media abnormalities, and policy expiration.

[0088] Sector-level dynamic encryption: Combining PBKDF2 / HMAC-SHA256 or national cryptographic algorithms, independent keys are generated based on user passwords, device sequences, sector indices, random factors, and other elements to achieve fine-grained encryption.

[0089] Multi-strategy linkage: It comprehensively judges conditions such as identity permissions, file attributes, keyword matching, time and location, and approval status, and refines them to read, write, copy, export and other operations.

[0090] Keyword recognition: Supports multi-template and multi-language keyword matching, and provides advanced configurations such as sensitivity grading, hit threshold, and context analysis.

[0091] Auditing and Traceability: Operation logs are linked to information such as user, device, time, and file fingerprints, which can be quickly retrieved in the background and audit reports can be generated.

[0092] The corresponding audit and alarm process is as follows: Local logs are recorded in real time → the data is reported to the backend on a scheduled or real-time basis → the backend analyzes and generates events → alarms are notified to the administrator → audit reports are generated.

[0093] Media health check process: Periodically call the check tool → perform read / write comparison on sectors → count the number of failures → output a health report → remind the administrator to replace or back up.

[0094] Furthermore, during implementation, the following methods are also adopted:

[0095] 1. Multi-factor authentication: Adding secondary authentication methods such as fingerprint, face recognition, and dynamic password to the login process to further enhance the strength of identity verification;

[0096] 2. Cloud-based audit integration: Synchronize log data to the cloud-based security audit platform to achieve centralized cross-regional supervision and big data analysis;

[0097] 3. Portable terminal adaptation: Expands support for mobile terminals and embedded devices, providing lightweight drivers and management interfaces;

[0098] 4. Fine-grained encryption and decryption strategy: Set differentiated encryption algorithms and approval requirements for different file types, business departments, and risk levels.

[0099] In the deployment practice of a certain classified research and development unit:

[0100] The security administrator uses a creation tool to batch initialize department-specific security USB drives and synchronizes the creation records to the backend.

[0101] After employees insert a USB drive into the terminal, they enter a password through the login interface and load the latest policy. The system then automatically mounts the encrypted volume.

[0102] During file operations, if an attempt is made to export a sensitive file to a regular partition, the system will immediately block it, prompt an approval request, and simultaneously upload an alert.

[0103] The operations and maintenance department runs a health monitoring tool weekly to obtain media health reports and arranges media replacement when necessary.

[0104] When a user forgets their password, a temporary recovery password is generated through a password conversion tool and used after approval. The entire process is traceable.

[0105] The above solution employs a four-layer architecture—a tool layer, an encryption kernel layer, a client management layer, and a backend service layer—to achieve low-cost deployment. Security capabilities can be implemented using a standard USB flash drive, eliminating the need for dedicated hardware. The encryption kernel layer provides sector-level encryption and a custom file system to support volume management, key derivation, and cross-platform drivers, enhancing cross-platform capabilities. Policy linkage enables collaborative work between security policies, keyword detection, and log auditing, meeting enterprise compliance requirements. Supporting tool modules ensure long-term stable operation. This solution is suitable for scenarios such as enterprise endpoint protection, confidential data transmission, and compliance management.

[0106] Based on the same inventive concept, this invention also provides a method based on sector-level encryption and policy linkage, applied to the secure USB flash drive system based on sector-level encryption and policy linkage described in the first aspect, with reference to... Figure 6 The method includes the following steps:

[0107] S101, Create a secure USB flash drive;

[0108] S102, construct a sector-level encryption layer in the encrypted area of ​​the secure USB flash drive, and combine it with a custom file system to implement volume management, key derivation and cross-platform driver;

[0109] S103, perform identity authentication, load security policies and mount encrypted volumes;

[0110] S104 executes file operations and audit records according to the policy, and reports logs to the backend and handles alarms.

[0111] The process for creating a secure USB drive includes: the administrator selects a policy template → inserts a blank USB drive → the tool detects the hardware → sets partitions and policies → writes a unique identifier → generates logs and files them → outputs the secure USB drive.

[0112] The document operations and audit logs executed according to the policy specifically include:

[0113] Users operate in the file management interface, identify the source / target area, decide whether to encrypt or allow based on the policy, perform keyword recognition on sensitive content, and allow, block or initiate approval based on the recognition results, and write to the audit log.

[0114] Furthermore, the keyword recognition includes:

[0115] It supports multi-template and multi-language keyword matching, and provides advanced configurations including sensitivity rating, hit threshold and context analysis.

[0116] It should be noted that for a more detailed description of the workflow of the method embodiments, please refer to the aforementioned system embodiments section, which will not be repeated here.

[0117] The entire technical solution is based on ordinary USB flash drives to quickly build encrypted, secure, manageable and controllable mobile storage media; it enables unified sector-level encrypted access across platforms; and it works in conjunction with terminal security policies, keyword recognition, and log auditing; thus providing a full-process support solution for creation, login, use, and testing.

[0118] In the embodiments provided in this application, it should be understood that the disclosed methods and systems can also be implemented in other ways. The system embodiments described above are merely illustrative. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the figures. For example, two consecutive blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and combinations of blocks in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified functions or actions, or using a combination of dedicated hardware and computer instructions.

[0119] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0120] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A secure USB flash drive system based on sector-level encryption and policy linkage, characterized in that, The system includes a tool layer, an encryption kernel layer, a client management layer, and a backend service layer; The creation tool layer is used for USB flash drive media detection, configuring partition and encryption parameters, configuring key seeds and policy templates, and generating creation logs to achieve the creation of secure USB flash drives; wherein, the policy template includes permissions and controls, and the parameters are written to sectors; The encryption kernel layer is used to provide sector-level encryption and a custom file system to support volume management, key derivation, and cross-platform drivers. The client management layer is used to complete user authentication, volume mounting, security policy synchronization, file operations, and local log recording to achieve secure login and policy linkage; wherein, the security policy is issued through the client used in conjunction with the application. The backend service layer is used for centralized management of policies, issuance of authorizations, receipt of logs, and provision of alarms and auditing.

2. The system as described in claim 1, characterized in that, The encryption kernel layer uses a dynamic key derivation algorithm to combine user passwords, device unique identifiers, sector indexes, and random factors to generate sector keys, thereby achieving fine-grained encryption.

3. The system as described in claim 2, characterized in that, The client management layer includes a login and protection module, a secure file management module, and a policy and audit module; The login and guardian module is used to complete user authentication, single instance control, background guardian and automatic volume mounting; The secure file management module is used to provide an adapted file operation interface, execute policy judgment, result prompts, and operation logs; The policy and audit module is used to load and cache security policies, perform keyword recognition, permission verification, log reporting and event tracking, and automatically block access in case of anomalies.

4. The system as described in claim 2, characterized in that, The backend service layer is also used to aggregate and analyze uploaded logs, and supports real-time alerts, approval processes, compliance reports, and historical traceability.

5. The system as described in any one of claims 1 to 4, characterized in that, The client management layer also includes a support tool module, which is used for: Password conversion, media health detection, dependency release and signing tools ensure the lifecycle maintenance of secure USB drives; as well as When a user forgets their password, a temporary recovery password is generated through a password conversion tool and used after approval, with the entire process being traceable.

6. The system as described in claim 5, characterized in that, The system collaborates with the policy server through a secure channel to achieve device registration, policy synchronization, and log transmission. The configuration file uses a verification mechanism to prevent tampering, policy data is distributed through shared memory and message queues, and logs are stored both locally and on the server and support digital signatures.

7. The system as described in claim 6, characterized in that, The strategy linkage includes: comprehensively judging based on identity permissions, file attributes, keyword matching, time and location, and approval status conditions, and refining it to file operations such as reading, writing, copying, and exporting.

8. A method based on sector-level encryption and policy linkage, characterized in that, The method applied to the secure USB flash drive system based on sector-level encryption and policy linkage as described in claim 2 includes the following steps: Create a secure USB drive; A sector-level encryption layer is constructed in the encrypted area of ​​the secure USB flash drive, and volume management, key derivation, and cross-platform drivers are implemented in conjunction with a custom file system; Perform identity authentication, load security policies, and mount the encrypted volume; Based on the policy, file operations and audit records are executed, and logs are reported to the backend and alarms are handled.

9. The method as described in claim 8, characterized in that, The document operations and audit logs executed according to the policy specifically include: Users operate in the file management interface, identify the source / target area, decide whether to encrypt or allow based on the policy, perform keyword recognition on sensitive content, and allow, block or initiate approval based on the recognition results, and write to the audit log.

10. The method as described in claim 9, characterized in that, The keyword identification includes: It supports multi-template and multi-language keyword matching, and provides advanced configurations including sensitivity rating, hit threshold and context analysis.

Images