A method for generating a USB device fingerprint

Abstract

This application relates to a method for generating a USB device fingerprint, comprising: obtaining the serial number, padding model, plug-and-play identifier, and device driver firmware signature of a target USB device; performing a verification operation on the serial number, padding model, plug-and-play identifier, and device driver firmware signature; and generating a device fingerprint of the target USB device based on the serial number, padding model, plug-and-play identifier, and device driver firmware signature if the verification operation passes. Therefore, the technical solution of this application performs a verification operation on the obtained serial number, padding model, plug-and-play identifier, and device driver firmware signature. This verification operation can prevent security vulnerabilities caused by malicious tampering of the serial number, padding model, plug-and-play identifier, or device driver firmware signature from the source, avoiding counterfeit USB devices from bypassing system access control and illegally accessing business systems using tampered false information, thereby reducing the risk of malicious attacks on the system.

Description

Technical Field

[0001] This application relates to the field of terminal peripheral identification technology, and in particular to a method for generating fingerprints for USB devices. Background Technology

[0002] With the development of the internet, various functional USB devices have been widely used in office, production, and daily life scenarios. However, the widespread use of these devices has also brought potential threats to system security. Malicious attackers may use unauthorized USB devices to implant malware, steal sensitive data, or tamper with system configurations, posing a serious challenge to personal information security and the protection of core corporate data.

[0003] Currently, mainstream systems primarily defend against USB device-related attacks through USB device fingerprinting mechanisms, thereby strengthening system security. Specifically, mainstream systems obtain the serial number information of USB devices on a trusted list. Next, they generate a unique fingerprint identifier for each trusted USB device based on the obtained serial number information. Finally, the mainstream system saves this unique fingerprint identifier and interacts with its corresponding trusted USB device based on this fingerprint identifier.

[0004] However, in practical applications, this mechanism has significant security vulnerabilities. The serial number information of USB devices can be modified. In this situation, generating a unique fingerprint solely based on the USB device's serial number is insufficient to effectively distinguish between legitimate, trusted USB devices and counterfeit USB devices. Counterfeit USB devices could modify their own serial number information and use the same serial number to evade control, impersonating trusted USB devices to access the system, greatly increasing the security risk of system attacks. Summary of the Invention

[0005] This application provides a method for generating fingerprints for USB devices, aiming to solve the technical problem of system attacks caused by malicious tampering with the serial number information of USB devices.

[0006] In a first aspect, embodiments of this application provide a method for generating a fingerprint for a USB device, comprising: Obtain the serial number, padding model, plug-and-play identifier, and device driver firmware signature of the target USB device; Perform verification operations on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature; If the verification operation passes, the device fingerprint of the target USB device is generated based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature.

[0007] Optionally, obtaining the serial number, padding model, plug-and-play identifier, and device driver firmware signature of the target USB device includes: Obtain the serial number, padding model, plug-and-play identifier, and device driver firmware signature of the target USB device from the system registry.

[0008] Optionally, the verification operation on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature includes: Perform a consistency verification on the serial number; Perform validity verification on the filled model and the plug-and-play identifier; Perform anti-tamper verification on the device driver firmware signature.

[0009] Optionally, performing consistency verification on the sequence number includes: Obtain the first parent identifier prefix of the target USB device from the first registry path in the system registry; Determine whether the sequence number is consistent with the prefix of the first parent identifier; If so, the consistency verification passes; If not, the consistency verification fails.

[0010] Optionally, before determining whether the sequence number is consistent with the first parent identifier prefix, the method further includes: Obtain the second parent identifier prefix of the target USB device from the second registry path in the system registry; The step of determining whether the sequence number is consistent with the prefix of the first parent identifier includes: Determine whether the sequence number, the first parent identifier prefix, and the second parent identifier prefix are consistent.

[0011] Optionally, before determining whether the sequence number, the first parent identifier prefix, and the second parent identifier prefix are consistent, the method further includes: Obtain the mount information of the target USB device from the third registry path of the system registry; Extract the target serial number from the mounting information; The step of determining whether the sequence number, the first parent identifier prefix, and the second parent identifier prefix are consistent includes: Determine whether the sequence number, the first parent identifier prefix, the second parent identifier prefix, and the target sequence number are consistent.

[0012] Optionally, performing tamper-proof verification on the device driver firmware signature includes: Obtain the hardware identifier of the target USB device; Verify whether the device driver firmware signature is bound to the hardware identifier; If so, the anti-tampering verification is successful; If not, the anti-tampering verification will fail.

[0013] Optionally, if the verification operation passes, a device fingerprint of the target USB device is generated based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature, including: If the verification operation passes, a device fingerprint generation algorithm is used to generate the device fingerprint of the target USB device based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature.

[0014] Optionally, if the verification operation passes, a device fingerprint generation algorithm is used to generate the device fingerprint of the target USB device based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature, including: If the verification operation passes, a hash algorithm is used to generate the device fingerprint of the target USB device based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature.

[0015] Optionally, before generating the device fingerprint of the target USB device based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature if the verification operation passes, the method further includes: Obtain the device type of the target USB device; If the verification operation passes, a device fingerprint of the target USB device is generated based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature, including: If the target USB device is a storage device and the verification operation is successful, then the device fingerprint of the target USB device is generated based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature.

[0016] Secondly, embodiments of this application also provide a USB device fingerprint generation apparatus, which includes a unit for performing the above-described method.

[0017] Thirdly, embodiments of this application also provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0018] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the above-described method.

[0019] This application provides a method for generating a USB device fingerprint. The method includes: obtaining the serial number, padding model, Plug and Play identifier, and device driver firmware signature of a target USB device; performing a verification operation on the serial number, padding model, Plug and Play identifier, and device driver firmware signature; and if the verification operation passes, generating the device fingerprint of the target USB device based on the serial number, padding model, Plug and Play identifier, and device driver firmware signature. Therefore, this application obtains the serial number, padding model, Plug and Play identifier, and device driver firmware signature of the target USB device. Then, a verification operation is performed on the serial number, padding model, Plug and Play identifier, and device driver firmware signature. Finally, if the verification operation passes, the device fingerprint of the target USB device is generated based on the serial number, padding model, Plug and Play identifier, and device driver firmware signature. Thus, this application's technical solution performs a verification operation on the obtained serial number, padding model, Plug and Play identifier, and device driver firmware signature. This verification process can block security vulnerabilities caused by malicious tampering of serial numbers, model numbers, plug-and-play identifiers, or device driver firmware signatures at the source. It prevents counterfeit USB devices from bypassing system access control and illegally accessing business systems by using tampered false information, thereby reducing the risk of the system being attacked maliciously. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0023] Figure 1 A schematic flowchart illustrating a method for generating fingerprints on a USB device, provided in an embodiment of this application; Figure 2A schematic block diagram of a USB device fingerprint generation apparatus provided in this application embodiment; Figure 3 A computer device provided in an embodiment of this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] The following disclosure provides numerous different embodiments or examples for implementing various structures of this application. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of this application. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.

[0026] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0027] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0028] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0029] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."

[0030] To address the technical problem in the prior art where the serial number information of USB devices is maliciously tampered with, leading to system attacks, this application provides a USB device fingerprint generation device that can prevent the serial number information of USB devices from being maliciously tampered with.

[0031] Figure 1 This is a flowchart illustrating a method for generating a fingerprint for a USB device, provided in an embodiment of this application. In one embodiment, the method includes steps S101-S103.

[0032] S101. Obtain the serial number, padding model, plug-and-play identifier, and device driver firmware signature of the target USB device.

[0033] In one embodiment, S101 specifically includes the following steps: S1011.

[0034] S1011. Obtain the serial number, padding model, plug-and-play identifier, and device driver firmware signature of the target USB device from the system registry.

[0035] It should be noted that the system registry can be the Windows system registry or the system registry of other systems, such as the ISO system registry. This application does not impose any restrictions.

[0036] When a target USB device is plugged into the system for the first time or not, corresponding device information will be generated in the system registry. This device information includes, but is not limited to, the target USB device's serial number, padding model, plug-and-play identifier, and device driver firmware signature.

[0037] S102. Perform verification operations on the serial number, padding model, plug-and-play identifier, and device driver firmware signature.

[0038] In one embodiment, S102 specifically includes the following steps: S1021-S1023.

[0039] S1021. Perform consistency verification on the serial number.

[0040] It should be noted that the process of performing consistency verification on the serial number will be described in detail in the later embodiments of this application. Therefore, it will not be repeated here.

[0041] In addition, this application embodiment performs a validity verification on the serial number. Specifically, it determines whether the length of the serial number meets the validity requirements, and / or whether the serial number contains illegal characters. If the length of the serial number does not meet the validity requirements, or if the serial number contains illegal characters, the validity verification of the serial number fails, and vice versa.

[0042] S1022. Perform validity verification on the fill model and plug-and-play identifier.

[0043] Specifically, in this embodiment, it is determined whether the length of the filler model meets the legal requirements and whether there are illegal characters in the filler model. If the length of the filler model does not meet the legal requirements, or if there are illegal characters in the filler model, the validity verification of the filler model fails.

[0044] It should be noted that the validity verification of the plug-and-play identifier is the same as or similar to the validity verification of the fill-in model. This application will not elaborate further on this.

[0045] For example, in this embodiment, the padding model and plug-and-play identifier can be obtained from HKLM\SYSTEM\CurrentControlSet\Enum\USB\VID_0781&PID_5588\AA0B1C2D3E4F5678. The padding model is VID_0781, and the plug-and-play identifier is PID_5588. If the padding model contains illegal characters, such as "@%#", the validity verification of the padding model will fail.

[0046] S1023. Perform anti-tamper verification on the device driver firmware signature.

[0047] It should be noted that the process of performing anti-tampering verification on the device driver firmware signature will be described in detail in the later embodiments of this application. This application will not repeat it here.

[0048] S103. If the verification operation is successful, generate the device fingerprint of the target USB device based on the serial number, padding model, plug and play identifier and device driver firmware signature.

[0049] When the serial number passes the consistency verification, the padding model and plug-and-play identifier pass the validity verification, and the device driver firmware signature passes the anti-tampering verification, the device fingerprint of the target USB device is generated by integrating the information from the four dimensions of the serial number, padding model, plug-and-play identifier and device driver firmware signature in this application embodiment.

[0050] This application provides a method for generating a USB device fingerprint. The method includes: obtaining the serial number, padding model, Plug and Play identifier, and device driver firmware signature of a target USB device; performing a verification operation on the serial number, padding model, Plug and Play identifier, and device driver firmware signature; and if the verification operation passes, generating the device fingerprint of the target USB device based on the serial number, padding model, Plug and Play identifier, and device driver firmware signature. Therefore, this application obtains the serial number, padding model, Plug and Play identifier, and device driver firmware signature of the target USB device. Then, a verification operation is performed on the serial number, padding model, Plug and Play identifier, and device driver firmware signature. Finally, if the verification operation passes, the device fingerprint of the target USB device is generated based on the serial number, padding model, Plug and Play identifier, and device driver firmware signature. Thus, this application's technical solution performs a verification operation on the obtained serial number, padding model, Plug and Play identifier, and device driver firmware signature. This verification process can block security vulnerabilities caused by malicious tampering of serial numbers, model numbers, plug-and-play identifiers, or device driver firmware signatures at the source. It prevents counterfeit USB devices from bypassing system access control and illegally accessing business systems by using tampered false information, thereby reducing the risk of the system being attacked maliciously.

[0051] In one embodiment, S1021 specifically includes the following steps: 10211-10215 10211. Obtain the first parent identifier prefix of the target USB device from the first registry path in the system registry.

[0052] The first parent identifier prefix is ​​the parent identifier prefix of the target USB device. Specifically, in this embodiment, the serial number of the target USB device, AA0B1C2D3E4F5678&0, is obtained from HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum. Therefore, the serial number of the target USB device, AA0B1C2D3E4F5678, can be extracted from the obtained information. Next, in this embodiment, the parent identifier prefix of the target USB device is obtained from HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR\Disk&Ven_SanDisk&Prod_Extreme&Rev_1.00\AA0B1C2D3E4F5678&0. The first parent identifier prefix is ​​AA0B1C2D3E4F5678. It should be noted that in this embodiment, padding characters, such as "&0", in the parent identifier prefix of the target USB device need to be removed in order to obtain the true parent identifier prefix of the target USB device.

[0053] 10212. Determine whether the sequence number is consistent with the prefix of the first parent identifier; if yes, execute S10213; if no, execute S10214.

[0054] 10213. Then the consistency verification is successful.

[0055] 10214. Then the consistency verification fails.

[0056] It should be noted that the sequence number consistency verification is only considered successful if the sequence number is exactly equal to the prefix of the first parent identifier. Otherwise, the sequence number consistency verification fails.

[0057] In one embodiment, prior to 10212, the method further includes 10215.

[0058] 10215. Obtain the second parent identifier prefix of the target USB device from the second registry path in the system registry.

[0059] The second parent identifier prefix is ​​the parent identifier prefix of the target USB device. In this application example, the second parent identifier prefix is ​​obtained as AA0B1C2D3E4F5678 from HKLM\SYSTEM\CurrentControlSet\Enum\USB\VID_0781&PID_5588\AA0B1C2D3E4F5678.

[0060] The above 10212 also specifically includes the following steps: 102121.

[0061] 102121. Determine whether the serial number, the first parent identifier prefix, and the second parent identifier prefix are consistent.

[0062] The sequence number passes consistency verification if the sequence number, the first parent identifier prefix, and the second parent identifier prefix are completely identical. Otherwise, the sequence number fails consistency verification.

[0063] It should be noted that, typically, the registry information of the target USB device in the system can be modified. In this embodiment, to prevent the serial number of the target USB device from being altered, thus allowing a counterfeit USB device to successfully bypass control and access the system, a serial number consistency verification operation is added. This operation significantly reduces the risk of a counterfeit USB device successfully accessing the system.

[0064] In one embodiment, prior to step 102121 above, the method further includes: AB.

[0065] A. Obtain the mount information of the target USB device from the third registry path in the system registry.

[0066] B. Extract the target serial number from the mount information.

[0067] The above 102121 also specifically includes the following steps: a a. Determine whether the serial number, the first parent identifier prefix, the second parent identifier prefix, and the target serial number are consistent.

[0068] It should be noted that steps A through B will be explained in detail below.

[0069] When a target USB device is connected to the system, mount information for the target USB device is generated in the system registry. This mount information includes the target USB device's serial number. In this embodiment, the target serial number is extracted from the target USB device's mount information, and it is determined whether the serial number, the first parent identifier prefix, the second parent identifier prefix, and the target serial number are consistent. If the serial number, the first parent identifier prefix, the second parent identifier prefix, and the target serial number are consistent, the serial number consistency verification passes. Otherwise, the serial number consistency verification fails.

[0070] In one embodiment, S1023 further includes the following steps: S10231-S10234.

[0071] S10231, Obtain the hardware identifier of the target USB device.

[0072] The hardware identifier of the target USB device is the HardwareID of the target USB device.

[0073] S10232. Verify whether the device driver firmware signature and hardware identifier are bound together.

[0074] S10233 indicates that the anti-tampering verification has passed.

[0075] S10234 indicates that the anti-tampering verification failed.

[0076] It should be noted that S10232-S10234 will be explained in detail below.

[0077] In this embodiment, WinVerifyTrust or CryptCATAdmin verification tools are used to verify whether the hardware identifier bound to the device driver firmware signature is equal to the hardware identifier of the target USB device. If yes, the anti-tampering verification passes. If no, the anti-tampering verification fails.

[0078] In one embodiment, S103 specifically includes the following steps: S1031.

[0079] S1031. If the verification operation is successful, the device fingerprint generation algorithm is used to generate the device fingerprint of the target USB device based on the serial number, padding model, plug and play identifier and device driver firmware signature.

[0080] Preferably, in this embodiment of the application, a hash algorithm is used to generate the device fingerprint of the target USB device based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature.

[0081] In one embodiment, prior to S103 above, the method further includes S104.

[0082] S104. Obtain the device type of the target USB device.

[0083] The device type can be a storage device or a non-storage device. In this embodiment, the device type of the target USB device is obtained from the system registry.

[0084] The aforementioned S103 also specifically includes: S1032.

[0085] S1032. If the target USB device is a storage device and the verification operation is successful, then generate the device fingerprint of the target USB device based on the serial number, padding model, plug and play identifier and device driver firmware signature.

[0086] In this embodiment, the main purpose is to prevent counterfeit USB devices from accessing the system and stealing data. Therefore, when the target USB device is a storage device and the verification operation is successful, a device fingerprint of the target USB device is generated based on the serial number, padding model, plug-and-play identifier, and device driver firmware signature.

[0087] See Figure 2 , Figure 2 This is a schematic block diagram of a USB device fingerprint generation apparatus provided in an embodiment of this application. Corresponding to the above-described USB device fingerprint generation method, this application also provides a USB device fingerprint generation apparatus. This USB device fingerprint generation apparatus includes a unit for executing the above-described USB device fingerprint generation method, and can be configured in terminals such as desktop computers, tablet computers, and laptops. Specifically, the USB device fingerprint generation apparatus includes: The acquisition unit 201 is used to acquire the serial number, padding model, plug-and-play identifier and device driver firmware signature of the target USB device. Execution unit 202 is used to perform verification operations on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature; The generation unit 203 is used to generate a device fingerprint of the target USB device based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature if the verification operation passes.

[0088] In one embodiment, the acquisition unit 201 is specifically used for: Obtain the serial number, padding model, plug-and-play identifier, and device driver firmware signature of the target USB device from the system registry.

[0089] In one embodiment, the execution unit 202 is specifically used for: Perform a consistency verification on the serial number; Perform validity verification on the filled model and the plug-and-play identifier; Perform anti-tamper verification on the device driver firmware signature.

[0090] In one embodiment, the execution unit 202 is specifically used for: Obtain the first parent identifier prefix of the target USB device from the first registry path in the system registry; Determine whether the sequence number is consistent with the prefix of the first parent identifier; If so, the consistency verification passes; If not, the consistency verification fails.

[0091] In one embodiment, the execution unit 202 is specifically used for: Obtain the second parent identifier prefix of the target USB device from the second registry path in the system registry; The step of determining whether the sequence number is consistent with the prefix of the first parent identifier includes: Determine whether the sequence number, the first parent identifier prefix, and the second parent identifier prefix are consistent.

[0092] In one embodiment, the execution unit 202 is specifically used for: Obtain the mount information of the target USB device from the third registry path of the system registry; Extract the target serial number from the mounting information; The step of determining whether the sequence number, the first parent identifier prefix, and the second parent identifier prefix are consistent includes: Determine whether the sequence number, the first parent identifier prefix, the second parent identifier prefix, and the target sequence number are consistent.

[0093] In one embodiment, the execution unit 202 is specifically used for: Obtain the hardware identifier of the target USB device; Verify whether the device driver firmware signature is bound to the hardware identifier; If so, the anti-tampering verification is successful; If not, the anti-tampering verification will fail.

[0094] In one embodiment, the generation unit 203 is specifically used for: If the verification operation passes, a device fingerprint generation algorithm is used to generate the device fingerprint of the target USB device based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature.

[0095] In one embodiment, the generation unit 203 is specifically used for: If the verification operation passes, a hash algorithm is used to generate the device fingerprint of the target USB device based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature.

[0096] In one embodiment, the device further includes: Device type acquisition unit 204 is used to acquire the device type of the target USB device; The generation unit 203 is specifically used for: If the target USB device is a storage device and the verification operation is successful, then the device fingerprint of the target USB device is generated based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature.

[0097] like Figure 3 As shown, this application provides a computer device including a processor 31, a communication interface 32, a memory 33, and a communication bus 34. The processor 31, the communication interface 32, and the memory 33 communicate with each other through the communication bus 34. The memory 33 is used to store computer programs. In one embodiment of this application, when the processor 31 executes the program stored in the memory 33, it implements a control method for generating a USB device fingerprint provided in any of the foregoing method embodiments.

[0098] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program may be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0099] Therefore, embodiments of this application also provide a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of a USB device fingerprint generation method as provided in any of the foregoing method embodiments.

[0100] The storage medium is a physical, non-transient storage medium, such as a USB flash drive, external hard drive, read-only memory (ROM), magnetic disk, or optical disk, or any other physical storage medium capable of storing program code. The computer-readable storage medium can be non-volatile or volatile.

[0101] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0102] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0103] The steps in the methods of this application embodiment can be adjusted, merged, or deleted according to actual needs. The units in the apparatus of this application embodiment can be merged, divided, or deleted according to actual needs. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0104] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0105] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0106] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Since these modifications and variations fall within the scope of the claims and their equivalents, this application also intends to include these modifications and variations.

[0107] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for generating fingerprints on a USB device, characterized in that, include: Obtain the serial number, padding model, plug-and-play identifier, and device driver firmware signature of the target USB device; Perform verification operations on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature; If the verification operation passes, the device fingerprint of the target USB device is generated based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature.

2. The method according to claim 1, characterized in that, The process of obtaining the serial number, padding model, plug-and-play identifier, and device driver firmware signature of the target USB device includes: Obtain the serial number, padding model, plug-and-play identifier, and device driver firmware signature of the target USB device from the system registry.

3. The method according to claim 2, characterized in that, The verification operation performed on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature includes: Perform a consistency verification on the serial number; Perform validity verification on the filled model and the plug-and-play identifier; Perform anti-tamper verification on the device driver firmware signature.

4. The method according to claim 3, characterized in that, The process of performing consistency verification on the serial number includes: Obtain the first parent identifier prefix of the target USB device from the first registry path in the system registry; Determine whether the sequence number is consistent with the prefix of the first parent identifier; If so, the consistency verification passes; If not, the consistency verification fails.

5. The method according to claim 4, characterized in that, Before determining whether the sequence number is consistent with the first parent identifier prefix, the method further includes: Obtain the second parent identifier prefix of the target USB device from the second registry path in the system registry; The step of determining whether the sequence number is consistent with the prefix of the first parent identifier includes: Determine whether the sequence number, the first parent identifier prefix, and the second parent identifier prefix are consistent.

6. The method according to claim 5, characterized in that, Before determining whether the sequence number, the first parent identifier prefix, and the second parent identifier prefix are consistent, the method further includes: Obtain the mount information of the target USB device from the third registry path of the system registry; Extract the target serial number from the mounting information; The step of determining whether the sequence number, the first parent identifier prefix, and the second parent identifier prefix are consistent includes: Determine whether the sequence number, the first parent identifier prefix, the second parent identifier prefix, and the target sequence number are consistent.

7. The method according to claim 3, characterized in that, The step of performing tamper-proof verification on the device driver firmware signature includes: Obtain the hardware identifier of the target USB device; Verify whether the device driver firmware signature is bound to the hardware identifier; If so, the anti-tampering verification is successful; If not, the anti-tampering verification will fail.

8. The method according to claim 1, characterized in that, If the verification operation passes, a device fingerprint of the target USB device is generated based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature, including: If the verification operation passes, a device fingerprint generation algorithm is used to generate the device fingerprint of the target USB device based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature.

9. The method according to claim 8, characterized in that, If the verification operation passes, a device fingerprint generation algorithm is used to generate the device fingerprint of the target USB device based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature, including: If the verification operation passes, a hash algorithm is used to generate the device fingerprint of the target USB device based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature.

10. The method according to any one of claims 1 to 9, characterized in that, Before generating the device fingerprint of the target USB device based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature if the verification operation passes, the method further includes: Obtain the device type of the target USB device; If the verification operation passes, a device fingerprint of the target USB device is generated based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature, including: If the target USB device is a storage device and the verification operation is successful, then the device fingerprint of the target USB device is generated based on the serial number, the padding model, the plug-and-play identifier, and the device driver firmware signature.

Images