A hardware-level whitelist-based key management method and system

Abstract

This invention relates to the field of information security technology, and in particular to a key control method and system based on a hardware-level whitelist. After the keyboard interface is connected, the method first reads a preset key whitelist configuration and stores it in the keyboard's built-in on-chip non-volatile memory. Then, it triggers the keyboard's hardware lock bit, physically disabling the external read / write channels of the on-chip non-volatile memory and disabling the virtual keyboard. Next, it drives the keyboard's built-in microcontroller to perform a keyboard matrix scan to acquire the currently triggered original key signals in real time. Finally, it drives the keyboard to compare the original key signals with the key whitelist configuration stored in the on-chip non-volatile memory to determine if the original key signals are compliant. If compliant, the keyboard converts the original key signals into standard input messages and uploads them to the host. If not compliant, the keyboard's built-in microcontroller discards the original key signals at the hardware firmware level.

Description

Technical Field

[0001] This invention relates to the field of information security technology. More specifically, this invention relates to a method and system for key control based on a hardware-level whitelist. Background Technology

[0002] In classified intranet scenarios where information input or modification permissions are strictly controlled, in order to prevent unauthorized personnel from exceeding their authority to input or maliciously execute sensitive commands, such as batch deletion / copying / screenshotting / modification, it is usually necessary to control and filter the input of keyboard peripherals connected to the intranet terminal.

[0003] To achieve the above effect, Chinese patent application CN102890641A discloses a method for process behavior control. This method primarily intercepts call to callback functions via message hooks in the underlying driver of the operating system, and then delegates the decision to the application layer to allow or deny keyboard messages. Essentially, this technology is more akin to a virus detection software improvement strategy and has the following drawbacks: Firstly, the virus database needs to be updated regularly to ensure that the above functions can be performed normally. The update process may require an internet connection or offline updates via USB flash drive, which can easily provide opportunities for malicious intruders. Therefore, under the above conditions, the reliability of its function implementation is somewhat lacking. Secondly, in the event of an automated hardware injection attack, the aforementioned system-level interception can only prevent "malicious software from reading the keyboard," but cannot identify the physical source of the input. When attackers use malicious scripts to forge keystrokes to simulate input, because these instructions are completely disguised as legitimate keyboard signals at the protocol layer, the host operating system's driver layer will treat them as legitimate user operations and allow them all, thus further exacerbating the unreliability of the above methods. Therefore, existing system-level interception technologies suffer from unreliability and security issues. Summary of the Invention

[0004] To address the unreliability and security issues in the prior art, this invention discloses a key control method and system based on a hardware-level whitelist.

[0005] In a first aspect, this invention discloses a key control method based on a hardware-level whitelist, comprising: In response to the keyboard interface access, the preset key whitelist configuration is read and stored in the keyboard's built-in on-chip non-volatile memory. The hardware lock bit of the keyboard is triggered, which physically closes the external read / write channel of the on-chip non-volatile memory and disables the virtual keyboard. The built-in microcontroller of the driver keyboard performs keyboard matrix scanning to acquire the raw key signals that are currently triggered in real time; The keyboard driver compares the original key signals with the key whitelist configuration stored in the on-chip non-volatile memory to determine whether the original key signals are compliant. If so, the keyboard driver converts the raw key signals into standard input messages and uploads them to the host. If not, the microcontroller built into the keyboard discards the original key signals at the hardware firmware level.

[0006] Beneficial effects: When the keyboard is connected to the host computer during initial use, the host computer retrieves the key whitelist configuration and stores it in the keyboard's built-in on-chip non-volatile memory to update the keyboard's hardware configuration. Then, the keyboard's hardware lock bit is triggered to prevent external read / write channels from modifying the keyboard's configuration. At the same time, the virtual keyboard function is disabled, ensuring that keyboard signal input can only be performed by the physical keyboard configured with the whitelist, achieving the first layer of hardware protection. Next, when the physical keyboard performs a key input action, it drives the keyboard's built-in microcontroller to perform a keyboard matrix scan to obtain the currently triggered original key signals in real time. During this process, the microcontroller compares the original key signals with the key whitelist configuration stored in the on-chip non-volatile memory to determine which key inputs match the whitelist configuration and transmit them to the host computer, thus achieving the second layer of hardware protection. Compared to existing technologies, the method of this invention establishes at least two layers of hardware-level security. It does not require regular updates to the virus database. By establishing a unique physical keyboard input and a whitelist configuration embedded in the keyboard MCU, the host only receives standard input messages that are entered through the unique physical keyboard and pass compliance verification. There is no need to perform host system-level scanning and interception, resulting in stronger reliability and security.

[0007] Preferably, the keyboard driver compares the original key signals with the key whitelist configuration stored in the on-chip non-volatile memory, including: In the microcontroller's running memory, the button whitelist configuration is parsed into a two-dimensional bitmap matrix; where the bit offset in the two-dimensional bitmap matrix maps to the row and column coordinates of the physical matrix, and the bit state is used to represent allow or block. Locate the row and column coordinates of the triggered key; The memory address offset is calculated based on the row and column coordinate values; Perform a logical AND operation between the memory address offset and the two-dimensional bitmap matrix; If the calculation result is true, the original button signal is deemed compliant. If the calculation result is false, the original button signal is deemed to be in violation.

[0008] Preferably, the original key signals include single key signals and key sequence combinations; the microcontroller built into the keyboard performs keyboard matrix scanning, including: If multiple physical buttons are detected to be triggered simultaneously within any matrix scan cycle, extract all single button signals in the current scan frame and convert them into a set of concurrent buttons; The concurrent key set is decomposed into multiple single key signals and / or several key sorting combinations.

[0009] Preferably, comparing the original key signal with the key whitelist configuration stored in the on-chip non-volatile memory further includes: A single key signal and / or key sequence combination are sent to a comparison script based on a key whitelist configuration for comparison. If at least one single button signal or button sequence combination is deemed to be in violation, a single violation veto will be executed.

[0010] Preferably, the predefined process for configuring the button whitelist includes: Open the visual interaction configuration interface and configure the set of valid keys in the visual interaction configuration interface; the set of valid keys includes independent or combined definitions of letters, numbers and function keys; Convert the set of valid key presses into a comparison script.

[0011] Preferably, a preset auditing system is used to monitor the configuration records of the visual interactive configuration interface in real time.

[0012] Preferably, after converting the original key signals into standard input messages and uploading them to the host, the method of the present invention further includes: Calculate the time interval between the current standard input message and the last standard input message; If the time interval is less than the preset interval threshold, the current standard input message is masked and recorded in the audit log.

[0013] Preferably, if the time interval is less than a preset interval threshold, the keyboard matrix scan is interrupted.

[0014] Preferably, after triggering the hardware lock bit of the keyboard, if a write or read message pointing to the on-chip non-volatile memory exists, the method of the present invention further includes: Trigger a message drop command and clear the receive buffer in the firmware's underlying protocol stack.

[0015] Secondly, the present invention discloses a key control system based on a hardware-level whitelist, including a processor and a memory. The memory stores computer program instructions, and when the computer program instructions are executed by the processor, the key control method based on a hardware-level whitelist described in the first aspect is implemented.

[0016] The beneficial effects of this invention are as follows: (1) Compared with the prior art, the method of the present invention establishes at least two layers of hardware-level security. It does not require regular updates to the virus database. By establishing a unique physical keyboard input and a whitelist configuration for the keyboard MCU, the host only receives standard input messages that are input by a unique physical keyboard and pass compliance verification. There is no need to perform host system-level interception, which has stronger reliability and security.

[0017] (2) Compared with the prior art, the method of the present invention will convert the whitelist configuration into a bitmap. When the keyboard MCU performs key input verification, it does not need to use the lookup table method for verification. Instead, it directly converts the two-dimensional coordinates of the key into memory address offset (one bit) and then performs a logical AND operation with the two-dimensional bitmap matrix to achieve efficient and reliable verification. Attached Figure Description

[0018] The above and other objects, features, and advantages of exemplary embodiments of the present invention will become readily apparent upon reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of the invention are illustrated by way of example and not limitation, and like or corresponding reference numerals denote like or corresponding parts, wherein: Figure 1 This is a flowchart of the key control method based on hardware-level whitelist in Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of the key control system based on hardware-level whitelist in Embodiment 2 of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0021] Example 1 like Figure 1 As shown, this embodiment discloses a key control method based on a hardware-level whitelist, including: S10: In response to the keyboard interface access, read the preset key whitelist configuration and store the key whitelist configuration in the keyboard's built-in on-chip non-volatile memory.

[0022] In this embodiment, the keyboard is used in a classified intranet scenario where information input or modification permissions are strictly controlled. At the hardware configuration level, the following conditions must be met: the main controller must use a 32-bit high-security MCU to support whitelist configuration implantation and key information comparison; the interface uses the 2.0 standard HID keyboard protocol; the on-chip non-volatile memory uses external, unreadable, and non-replicable on-chip Flash; wired communication is used, and Bluetooth, TF cards, and USB flash drive access are not supported. The factory-installed lock bit is in the "unlocked" state. Once the lock bit changes to "locked," it cannot be written to again and can only be reset by returning to the factory using a key.

[0023] It should be noted that the above-mentioned predefined process for configuring the button whitelist includes: S100: Bring up the visual interactive configuration interface and configure the set of valid buttons in the visual interactive configuration interface.

[0024] The valid key set includes individual or sequential combinations of letters, numbers, and function keys. In the visual interactive configuration interface, administrators can perform whitelist configuration operations only after successful human authentication. This involves selecting keys or combinations to allow or disallow input and defining the validity period of the key whitelist configuration.

[0025] It should be noted that the above-mentioned valid key combination should include "Alt+F4", "Ctrl+A+Delete", or other shortcut combinations that are destructive to files / systems. During the administrator's whitelist configuration process, an auditing system must be mounted on the internal network. Each operation performed by the administrator will be recorded in the auditing system's audit log for compliance configuration monitoring.

[0026] S101: Convert the set of valid key presses into a comparison script.

[0027] The above conversion process can rely on template scripts defined based on the image-text mapping relationship to convert the selected image information into script output.

[0028] By following the steps S100-S101 above, the button whitelist configuration can be completed efficiently and reliably.

[0029] Specifically, after the host in the aforementioned classified intranet scenario connects to the keyboard with the above configuration, it first reads the key whitelist configuration, then records it into the keyboard's built-in on-chip non-volatile memory. After the recording is completed, the state of the keyboard lock position changes from "unlocked" to "locked".

[0030] S20: Triggers the hardware lock bit of the keyboard, which physically disables the external read / write channel of the on-chip non-volatile memory and disables the virtual keyboard.

[0031] Specifically, when the keyboard lock state changes from "unlocked" to "locked," if there are still write or read messages pointing to the on-chip non-volatile memory, the firmware's underlying protocol stack running in the microcontroller triggers a message discard command and clears the receive buffer—a "one-time entry, key locked" anti-tampering mechanism. Simultaneously, the virtual keyboard is disabled to prevent malicious background programs from using it to implant or modify information. This establishes the first layer of hardware protection, effectively improving the reliability and security of the method in this embodiment.

[0032] It should be further added that the key encryption method mentioned above for key locking can use the SM3 or SM4 national cryptographic algorithms. These algorithms are extremely secure. With the current computing power level, it would take 10-20 years to crack a key generated by the SM3 or SM4 national cryptographic algorithms.

[0033] S30: Drives the built-in microcontroller of the keyboard to perform keyboard matrix scanning in real time to obtain the raw key signals that are currently triggered.

[0034] Specifically, the aforementioned original key signals include single key signals and key sequence combinations, and step S30 includes: S31: If multiple physical buttons are detected to be triggered simultaneously within any matrix scan cycle, extract all single button signals in the current scan frame and convert them into a set of concurrent buttons.

[0035] For example, if "Ctrl", "A" and "Delete" are pressed simultaneously during any matrix scan cycle, the concurrent key set is [Ctrl, A, Delete].

[0036] S32: Decompose the concurrent key set into multiple single key signals and / or several key sorting combinations.

[0037] Correspondingly, assuming the concurrent key set is [Ctrl, A, Delete], the specific combinations of multiple single key signals and several key sequences after decomposition are: "Ctrl", "A", "Delete", "Ctrl+A", "Ctrl+Delete" and "Ctrl+Delete+A".

[0038] The reason for disassembling and sorting the concurrent key set as described above is because: Hardware keyboards exhibit varying latency when keys are pressed. Due to differences in key wear, mechanical structure, and matrix scanning order, these latencyes often differ in length. Furthermore, when multiple keys are pressed simultaneously, the entire set of keys may not be within the whitelist configuration. Intruders can exploit this vulnerability to perform high-speed scanning timing interference or voltage glitches, thereby inducing whitelist verification to pass. This phenomenon is most pronounced in aging keyboards.

[0039] It needs further explanation that high-speed scan timing interference refers to an attacker injecting a high-frequency pulse sequence higher than 10MHz into the keyboard matrix circuit through an external device (such as an FPGA). This high-frequency pulse sequence far exceeds the MCU's default scan frequency (1-5kHz). The high-frequency pulses forcibly interfere with the MCU's scan cycle, causing it to fail to accurately capture the true state of the keys, potentially misjudging illegal key combinations as legitimate inputs within the whitelist. As for voltage glitches, this refers to injecting a brief voltage surge (±200mV / 10ns level glitches) into the power supply pins at the moment the MCU executes critical instructions, such as whitelist verification code, disrupting the transistor's voltage level and causing a verification execution error.

[0040] Therefore, by introducing the above steps S31-S32, multiple simultaneously pressed buttons can be disassembled or sorted and combined to assist in secondary verification, thereby further improving the security and reliability of the method in this embodiment.

[0041] S40: The driver keyboard compares the original key signals with the key whitelist configuration stored in the on-chip non-volatile memory to determine whether the original key signals are compliant. If yes, the driver keyboard converts the original key signals into standard input messages and uploads them to the host. If no, the microcontroller built into the driver keyboard discards the original key signals at the hardware firmware layer.

[0042] Through the above step S40, the microcontroller compares the original button signal with the button whitelist configuration stored in the on-chip non-volatile memory, and transmits the button input that matches the whitelist configuration to the host, thereby realizing the second layer of hardware protection.

[0043] Furthermore, the hardware layer comparison and judgment process in step S40 above is as follows: First, in the microcontroller's RAM, the button whitelist configuration is parsed into a two-dimensional bitmap matrix. The bit offsets in this matrix map to the row and column coordinates of the physical matrix, and the bit states indicate whether the button is allowed or blocked. Then, the row and column coordinates of the triggered button are located. Based on these coordinates, the memory address offset is calculated. Finally, a logical AND operation is performed between the memory address offset and the two-dimensional bitmap matrix. If the result is true, the original button signal is considered compliant; otherwise, it is considered non-compliant.

[0044] The hardware-level comparison and judgment process described above applies to both single-step and double-step verification. Single-step verification primarily targets a single key press or a set of concurrent key presses. If only a single key press occurs within a scan cycle, only one verification is performed.

[0045] Conversely, if there is a set of concurrent key presses, after being decomposed in step S32 above, the following steps need to be performed: S41: Send a single key signal and / or key sequence combination into a comparison script based on the key whitelist configuration for comparison.

[0046] S42: If at least one single key signal or key sequence combination is determined to be in violation, a violation veto will be executed.

[0047] For example, taking an office host used to store evidentiary documents as an example, generally, it is not allowed to delete or modify documents that have already been stored as evidence. That is, the "Delete" key belongs to the controlled input key in the key whitelist configuration. Since the concurrent key set is [Ctrl, A, Delete] and this key input is allowed, a veto is executed to prohibit key input, thereby further improving the security and reliability of the method in this embodiment.

[0048] Furthermore, after converting the original key signals into standard input messages and uploading them to the host, the method in this embodiment also includes: Calculate the time interval between the current standard input message and the last standard input message.

[0049] If the time interval is less than the preset interval threshold, the current standard input message is masked and recorded in the audit log.

[0050] It should be explained that simulated hardware input that mimics human behavior usually has extremely short intervals between key inputs, such as 1,000 keystrokes per minute, which far exceeds human physiological limits. Therefore, by introducing the aforementioned interval threshold, standard input messages generated by suspected non-biological (pseudo-hardware input script / AI robot) key input behavior are blocked to avoid such potential risks and disputes over liability.

[0051] In contrast, at the hardware level on the keyboard side, if the time interval is less than a preset interval threshold, the keyboard matrix scan is interrupted, thereby achieving hardware protection and improving the reliability of the method in this embodiment.

[0052] Unlike existing technologies, the method in this embodiment has at least the following advantages: Firstly, it has a triple protection or interception mechanism, including hardware locking, whitelist configuration, and secondary verification, making it impossible to input malicious commands by implanting viruses or background programs into the host, thus providing high security and reliability.

[0053] Secondly, when performing key input verification, the keyboard MCU does not need to use a lookup table method. Instead, it directly converts the two-dimensional coordinates of the key into memory address offsets and then performs a logical AND operation with the two-dimensional bitmap matrix. This has higher verification efficiency and is safer and more reliable.

[0054] Third, it is suitable for classified intranet scenarios where information input or modification permissions are strictly controlled.

[0055] Example 2 like Figure 2 As shown, this embodiment discloses a key control system based on a hardware-level whitelist, including a processor and a memory. The memory stores computer program instructions, and when the computer program instructions are executed by the processor, the key control method based on a hardware-level whitelist described in Embodiment 1 is implemented.

[0056] The system in this embodiment also includes other components well known to those skilled in the art, such as communication interfaces. Their settings and functions are known in the art, and therefore will not be described in detail here.

[0057] In this invention, the aforementioned memory can be any tangible medium containing or storing a program that can be used or combined with an instruction execution system, apparatus, or device. For example, a computer-readable storage medium can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc., or any other medium that can be used to store desired information and can be accessed by an application, module, or both. Any such computer storage medium can be part of a device or accessible to or connected to a device. Any application or module described in this invention can be implemented using computer-readable / executable instructions that can be stored or otherwise maintained by such a computer-readable medium.

[0058] In the description of this specification, "multiple" means at least two, such as two, three or more, etc., unless otherwise expressly and specifically defined.

[0059] While this specification has shown and described numerous embodiments of the invention, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Many modifications, alterations, and alternatives will occur to those skilled in the art without departing from the spirit and essence of the invention. It should be understood that various alternatives to the embodiments of the invention described herein may be employed in the practice of this invention.

Claims

1. A key control method based on hardware-level whitelist, characterized in that, include: In response to the keyboard interface access, the preset key whitelist configuration is read and stored in the keyboard's built-in on-chip non-volatile memory. Trigger the hardware lock bit of the keyboard to physically close the external read / write channel of the on-chip non-volatile memory and disable the virtual keyboard; The built-in microcontroller of the driver keyboard performs keyboard matrix scanning to acquire the raw key signals that are currently triggered in real time; The driver keyboard compares the original key signals with the key whitelist configuration stored in the on-chip non-volatile memory to determine whether the original key signals are compliant. If so, the keyboard driver converts the original key signals into standard input messages and uploads them to the host. If not, the microcontroller built into the keyboard discards the original key signals at the hardware firmware level.

2. The key control method based on hardware-level whitelist according to claim 1, characterized in that, The keyboard driver compares the original key signals with the key whitelist configuration stored in the on-chip non-volatile memory, including: In the microcontroller's running memory, the button whitelist configuration is parsed into a two-dimensional bitmap matrix; wherein, the bit offset in the two-dimensional bitmap matrix maps the row and column coordinates of the physical matrix, and the bit state is used to represent allow or block; Locate the row and column coordinates of the triggered key; The memory address offset is calculated based on the row and column coordinate values. Perform a logical AND operation between the memory address offset and the two-dimensional bitmap matrix; If the calculation result is true, the original button signal is deemed compliant. If the calculation result is false, the original button signal is determined to be in violation.

3. The key control method based on hardware-level whitelist according to claim 1, characterized in that, The original key signals include single key signals and key sequence combinations; the microcontroller built into the keyboard drives the keyboard to perform keyboard matrix scanning, including: If multiple physical buttons are detected to be triggered simultaneously within any matrix scan cycle, extract all single button signals in the current scan frame and convert them into a set of concurrent buttons; The concurrent key set is decomposed into multiple single key signals and / or several key sorting combinations.

4. The key control method based on hardware-level whitelist according to claim 3, characterized in that, The keyboard driver compares the original key signals with the key whitelist configuration stored in the on-chip non-volatile memory, and also includes: The single key signal and / or key sequence combination are sent to a comparison script based on the key whitelist configuration for comparison. If at least one single button signal or button sequence combination is deemed to be in violation, a single violation veto will be executed.

5. The key control method based on hardware-level whitelist according to claim 4, characterized in that, The predefined process for configuring the key whitelist includes: Open the visual interactive configuration interface and configure the set of valid keys in the visual interactive configuration interface; wherein, the set of valid keys includes independent or combined definitions of letters, numbers and function keys; The set of valid keys is converted into the comparison script.

6. The key control method based on hardware-level whitelist according to claim 5, characterized in that, A pre-set auditing system is used to monitor the configuration records of the visual interactive configuration interface in real time.

7. The key control method based on hardware-level whitelist according to claim 1, characterized in that, After converting the original key signals into standard input messages and uploading them to the host, the method further includes: Calculate the time interval between the current standard input message and the last standard input message; If the time interval is less than the preset time interval threshold, the current standard input message is masked and recorded in the audit log.

8. The key control method based on hardware-level whitelist according to claim 7, characterized in that, Also includes: If the time interval is less than a preset interval threshold, the keyboard matrix scan is interrupted.

9. The key control method based on hardware-level whitelist according to claim 1, characterized in that, After triggering the hardware lock bit of the keyboard, if a write or read message pointing to the on-chip non-volatile memory is present, the method further includes: Trigger a message drop command and clear the receive buffer in the firmware's underlying protocol stack.

10. A key control system based on a hardware-level whitelist, characterized in that, It includes a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the key control method based on a hardware-level whitelist as described in any one of claims 1-9 is implemented.

Images