A full-category intelligent electronic product hardware physical isolation anti-implantation, anti-stealth, anti-remote control system

Abstract

The application discloses a full-category intelligent electronic product hardware physical isolation anti-implantation, anti-stealing secret and anti-remote control system and belongs to the technical field of intelligent terminal security protection. The application divides terminal storage into a trusted working area and an external network isolation buffer area which are not communicated with each other by setting a physically isolated double-area storage architecture, forcibly isolates external network risk files, blocks virus cross-area implantation and diffusion from the source, configures an independent physical secret breaking button which is operated independently of the system, realizes one-key physical cutting of network, audio hardware, external ports and optical drives, and eliminates remote control, hidden camera and microphone, U disk copy and optical disc recording risks, and realizes all-dimension protection of application permission control, double mobile medium access verification, anti-recording screen and boot bottom layer self-checking by matching a hardware level bottom protection module. The application breaks through the technical defects of traditional software protection which is easy to be bypassed and has no bottom protection, all core protections are realized based on the hardware bottom layer, the protection is continuously effective under abnormal system conditions, can be widely adapted to full-category intelligent electronic products, and can block network stealing secret, medium transfer and artificial secret leakage from all directions, and has high security practicality and mass production application prospect.

Description

Technical Field

[0001] This invention belongs to the field of smart terminal hardware security protection technology, specifically involving a low-level hardware security protection system based on a hardware physical isolation architecture, compatible with all types of smart electronic products, capable of intercepting virus implantation, blocking remote control, preventing eavesdropping and filming, preventing leakage via USB flash drive transfer, and preventing leakage via CD burning. Background Technology

[0002] Currently, all smart terminal security solutions on the market are software-level protections, mainly including system permission control, virtual sandbox isolation, firewall software, antivirus software, and system encryption. These protection methods rely entirely on the operating system, which has significant technical flaws: once the terminal is infected by a virus or Trojan, or the device is rooted, jailbroken, or has its privileges elevated, the software protection mechanism can be bypassed, tampered with, disabled, or even destroyed.

[0003] Meanwhile, existing technologies cannot provide fallback protection against system failures. When the terminal system freezes, crashes, experiences a blue screen, or restarts due to infection, all software security mechanisms fail, allowing malicious programs to silently steal files, record the screen, listen to sounds, remotely control devices, and send confidential data back to the external network at the system's core.

[0004] More critically, existing security solutions suffer from extremely poor adaptability, lacking a unified architecture that can simultaneously cover multiple types of hardware devices, including computers, mobile devices, wearable devices, and IoT terminals. Furthermore, they lack control over high-frequency leakage media in traditional classified scenarios. Current protection only restricts USB drive access through simple software, failing to block data transfer via hardware. It also completely lacks hardware-level control over optical discs and CD-ROM burning media. Old-style classified hosts, industrial control equipment, and classified office equipment are highly susceptible to leakage of core classified information through blank CD burning. It also cannot prevent the import of viruses and Trojans from infected CDs. The industry has long lacked a truly physically isolated security architecture that is entirely hardware-based, system-independent, universally applicable across all terminals, mass-producible, and fully covers both USB drives and optical discs.

[0005] To address the pain points and industry gaps in existing technologies, this invention proposes a hardware physical isolation system for preventing implantation, theft, and remote control of all types of smart electronic products. Summary of the Invention

[0006] Purpose of the invention This invention aims to completely solve the technical problems of existing smart terminal software protection being bypassable, lacking hardware safeguards, missing protection dimensions, limited device compatibility, numerous vulnerabilities for data theft and leakage, and incomplete control over mobile storage media. It provides a fully hardware-based physically isolated underlying security protection architecture to achieve comprehensive closed-loop protection for all types of smart electronic products against virus implantation, remote control, eavesdropping, data leakage, USB flash drive data transfer leaks, and CD burning data leaks. Technical solution

[0007] A hardware-based physical isolation system for preventing implantation, data theft, and remote control of all types of smart electronic products. Compatible with desktop computers, laptops, mobile phones, tablets, smart wearable devices, portable smart terminals, smart office terminals, and IoT smart terminals, including: The dual-zone physically isolated storage module includes a physically completely isolated trusted working zone and an external network isolation buffer. The trusted working zone and the external network isolation buffer adopt independent hardware power supply and independent data addressing architecture, with no underlying hardware data communication channel. All file data downloaded from the external network, cached on the network, and received from the outside can only be stored in the external network isolation buffer through the firmware's underlying fixed path. The external network isolation buffer has no permission to read, traverse, or tamper with the data inside the trusted working zone. It only supports one-way migration of files from the external network isolation buffer to the trusted working zone after manual authorization by the user. An independent physical password disconnect button module is provided. The password disconnect button is an independent physical hardware button integrated into the terminal and operates independently of the terminal operating system. The button is set with two fixed physical positions: on and off. When switched to the off position, the hardware cuts off all network transmission channels, audio and video capture hardware, external expansion ports and remote control channels of the terminal, and freezes the terminal's data read and write and external network upload permissions. The hardware fallback protection module runs on the terminal's underlying firmware and is used to intercept the theft of secrets by unknown processes at the hardware level, control the access permissions of external devices, prohibit unauthorized screen recording and screen projection operations, and perform a low-level security self-check at startup to achieve full-scenario security protection for the terminal.

[0008] Furthermore, the dual-zone physical isolation storage module adopts a dual independent disk hardware structure for desktop computers and laptops, and a dual independent storage chip architecture for mobile phones, tablets, smart wearable devices, portable smart terminals, smart office terminals, and IoT smart terminals; the external network isolation buffer disables file auto-start, automatic decompression, and background running permissions by default, and has a hardware-level one-click shredding and clearing function, clearing data without residue and without recovery.

[0009] Furthermore, when the independent global physical disconnect button module is switched to the off position, it cuts off all network channels such as WiFi, Bluetooth, cellular network, NFC, and hotspot through hardware power-off, physically disconnects the power supply to the camera and microphone, and hardware locks all external ports such as USB, Type-C, and HDMI, as well as the power supply circuit of the optical drive, thereby blocking remote control, background eavesdropping, peripheral virus transfer, and data leakage channels.

[0010] Furthermore, the dual-zone physical isolation storage module, the independent global physical disconnect button module, and the hardware fallback protection module all operate independently of the terminal operating system. In abnormal states such as terminal system infection, crash, freeze, blue screen, and restart, the hardware isolation and physical disconnect protection mechanisms remain effective and are not affected by system permissions or malicious programs.

[0011] Furthermore, the system has pre-set hardware-level one-way data transmission rules. Under normal network conditions, only compliant data from the external network is allowed to be imported into the external network isolation buffer. The hardware blocks the external network upload, cloud synchronization, and silent back transmission of confidential data in the trusted work area, thus preventing the reverse leakage of confidential data.

[0012] Furthermore, for lightweight smart terminals such as mobile phones, tablets, smart wearable devices, and portable smart terminals, the hardware fallback protection module is equipped with APP hardware permission control function. At the underlying level, it locks the background recording, photo taking, location, contact reading, and file traversal permissions of unfamiliar applications, and intercepts the silent data theft behavior of applications. At the same time, it supports confidential mode and globally prohibits screenshot, screen recording, and screen projection operations.

[0013] Furthermore, the hardware fallback protection module includes a peripheral access control unit and a power-on self-test unit; the peripheral access control unit prohibits the automatic mounting and data reading of unfamiliar external devices, and only supports access to the terminal after manual authorization; the power-on self-test unit completes the detection and abnormal isolation and repair of system tampering, backdoor programs, and implanted viruses at the terminal BIOS / low-level firmware level.

[0014] Furthermore, the peripheral access control unit sets up a dedicated hardware verification mechanism for USB flash drives and portable hard drives; when no manual authorization is obtained from the user, the USB interface is only connected to power and the data transmission link is disconnected, so the USB flash drive cannot be mounted for reading and writing; after authorized access, only files in the USB flash drive are allowed to be imported unidirectionally into the external network isolation buffer, and the hardware prohibits files in the trusted working area from being written to the USB flash drive, so as to prevent confidential information from being leaked through the USB flash drive.

[0015] Furthermore, the peripheral access control unit adds an optical drive identification circuit to identify the optical drive and optical disc media; in the unauthorized state, the optical drive is only powered on and the read / write / burning link is closed, so the optical disc cannot read the content or perform the burning operation; when authorized, only the files in the optical disc are allowed to be imported unidirectionally into the external network isolation buffer, and the path for the trusted working area data to be burned to the blank optical disc is blocked at the hardware level to prevent the removal of confidential documents by burning the optical disc; in the confidential mode, the optical drive is completely powered off and becomes completely ineffective. Beneficial effects

[0016] This invention adopts a pure hardware physical isolation architecture, which runs completely independently of the operating system, solving the industry pain points of traditional software protection being easily bypassed and protection becoming zero after system failure. Protection continues to be effective even in the state of infection, crash, and blue screen.

[0017] A dual-zone physical isolation storage architecture and hardware unidirectional data flow rules are constructed to isolate and store risky data from the external network and prevent confidential data from being leaked back, thus blocking cross-zone virus implantation and silent data leakage from the source.

[0018] Equipped with a dedicated physical power-off button, this device allows for one-click physical power-off and locking of the entire network, audio-visual hardware, peripheral ports, and optical drives, completely eliminating the risks of remote control, eavesdropping, and media leaks.

[0019] It pioneered a hardware-level control logic for both USB flash drives and optical discs, setting exclusive verification and one-way transmission rules for both portable USB flash drives and optical disc burning devices, while blocking external media virus intrusion and vulnerabilities caused by manual copying and burning that could lead to data leaks.

[0020] It is compatible with all types of devices, including computers, mobile devices, wearable devices, and IoT terminals. It also features multi-dimensional protection such as APP permission control, anti-screen recording, and low-level self-check at startup, providing comprehensive protection and strong adaptability to various scenarios. Detailed Implementation

[0021] The overall architecture of this invention consists of three core modules: a dual-zone physically isolated storage module, an independent global physical password disconnect button module, and a hardware fallback protection module. All protection mechanisms are based on the underlying hardware firmware, independent of the operating system, and are not affected by the system's operating status.

[0022] The dual-zone physically isolated storage module rigidly divides terminal storage into a trusted working zone and an external network isolation buffer. The two zones are completely isolated at the hardware level, with independent power supply, independent data addressing, and no communication channels. Desktops and laptops use a dual-independent disk architecture, while lightweight terminals use a dual-independent storage chip architecture. All external network downloads, external transfers, and APP cache data are forcibly stored in the external network isolation buffer, prohibiting direct writing to the trusted working zone. The isolation zone, by default, prohibits programs from automatically starting, decompressing, or running in the background, preventing virus spread. Files can only be migrated unidirectionally into the working zone after manual user authorization. Confidential data in the working zone is prohibited from flowing out in the opposite direction, forming a hardware-level unidirectional security mechanism. Furthermore, the isolation zone supports one-click hardware shredding and clearing, making the data completely unrecoverable.

[0023] The independent, fully physical security button is an integrated hardware button on the device, independent of system bus control. In its active position, it ensures normal office use; in its deactivated position, it provides hardware-level complete power and connectivity shutdown, cutting off power to all networks, camera / recording hardware, USB, Type-C, HDMI, and optical drives, locking all data transmission and peripheral channels to achieve the highest level of physical security protection, remaining effective even in system malfunctions.

[0024] The hardware-based fallback protection module features process data theft interception, APP permission control, anti-screenshot and screen recording, peripheral device access control, and low-level self-test functions upon startup. The startup self-test can detect system backdoors and viruses at the firmware level, automatically isolating and repairing anomalies. For mobile devices, it locks various privacy permissions for unfamiliar applications at the low level, and globally disables screen capture and projection functions in confidential mode.

[0025] The peripheral access control unit implements dual-media dedicated hardware control: when a USB flash drive is connected, it is powered on but data is disconnected by default, and automatic mounting and operation are prohibited. It can only be read and written after manual authorization, and only USB flash drive files are allowed to be imported into the isolation area in one direction. It is prohibited to write confidential data from the work area to the USB flash drive; when an optical disc is connected, the read, write and burning channels are locked in the unauthorized state. After authorization, only optical disc data is allowed to be imported in one direction. The hardware permanently prohibits confidential materials from being burned to blank optical discs; in the confidential mode, the optical drive is directly powered off and becomes invalid, completely eliminating the leakage of optical discs and virus intrusion.

[0026] This invention features two modes: regular office mode and physical decryption mode. In regular mode, normal network-connected office work is conducted with controlled access to authorized media. In confidential scenarios, hardware decryption protection can be activated with one click, comprehensively blocking vulnerabilities for theft, leakage, and virus intrusion. Its security and stability are far superior to traditional software protection solutions. Attached Figure Description

[0027] Figure 1 Overall topology diagram of universal hardware protection for all terminals; Figure 2 : Structural diagram of an embodiment of physical isolation between dual independent hard drives in desktop / laptop computers; Figure 3 : Structural diagram of a dual-chip physical isolation implementation for lightweight terminals such as mobile phones / tablets / smart wearables / IoT devices.

[0028] Figure label: 1-Trusted working area, 2-External network isolation buffer, 3-Independent password disconnect button, 4-Network hardware module, 5-Camera and audio hardware, 6-USB peripheral port, 7-Peripheral hardware verification unit, 8-USB flash drive identification circuit, 9-Hardware shredding circuit, 10-Optical drive identification circuit, 11-Optical drive module.

Claims

1. A hardware-based physical isolation system for preventing implantation, data theft, and remote control in all categories of intelligent electronic products, characterized in that: Compatible with all categories of smart electronic products, including desktop computers, laptops, mobile phones, tablets, smart wearable devices, portable smart terminals, smart office terminals, and IoT smart terminals, including: The dual-zone physically isolated storage module includes a physically completely isolated trusted working zone and an external network isolation buffer. The trusted working zone and the external network isolation buffer adopt independent hardware power supply and independent data addressing architecture, with no underlying hardware data communication channel. All file data downloaded from the external network, cached on the network, and received from the outside can only be stored in the external network isolation buffer through the firmware's underlying fixed path. The external network isolation buffer has no permission to read, traverse, or tamper with the data inside the trusted working zone. It only supports one-way migration of files from the external network isolation buffer to the trusted working zone after manual authorization by the user. An independent physical password disconnect button module is provided. The password disconnect button is an independent physical hardware button integrated into the terminal and operates independently of the terminal operating system. The button is set with two fixed physical positions: on and off. When switched to the off position, the hardware cuts off all network transmission channels, audio and video capture hardware, external expansion ports and remote control channels of the terminal, and freezes the terminal's data read and write and external network upload permissions. The hardware fallback protection module runs on the terminal's underlying firmware and is used to intercept the theft of secrets by unknown processes at the hardware level, control the access permissions of external devices, prohibit unauthorized screen recording and screen projection operations, and perform a low-level security self-check at startup to achieve full-scenario security protection for the terminal.

2. The system according to claim 1, characterized in that, The dual-zone physical isolation storage module adopts a dual independent disk hardware structure for desktop computers and laptops, and a dual independent storage chip architecture for mobile phones, tablets, smart wearable devices, portable smart terminals, smart office terminals, and IoT smart terminals. The external network isolation buffer disables file auto-start, automatic decompression, and background running permissions by default, and has a hardware-level one-click shredding and clearing function, clearing data without residue and without recovery.

3. The system according to claim 1, characterized in that, When the independent global physical password cut-off button module is switched to the off position, it cuts off all network channels such as WiFi, Bluetooth, cellular network, NFC, and hotspot through hardware power-off, physically disconnects the power supply to the camera and microphone, and hardware locks all external ports such as USB, Type-C, and HDMI, as well as the power supply circuit of the optical drive, thereby blocking the channels for remote control, background eavesdropping, external device virus transfer, and data leakage.

4. The system according to claim 1, characterized in that, The dual-zone physically isolated storage module, the independent global physical disconnect button module, and the hardware fallback protection module all run independently of the terminal operating system. In abnormal states such as terminal system infection, crash, freeze, blue screen, and restart, the hardware isolation and physical disconnect protection mechanism continues to be effective and is not affected by system permissions or malicious programs.

5. The system according to claim 1, characterized in that, The system is pre-configured with hardware-level one-way data transmission rules. Under normal network conditions, only compliant data from the external network is allowed to be imported into the external network isolation buffer. The hardware blocks the external network upload, cloud synchronization, and silent back transmission of confidential data in the trusted work area, thus preventing the reverse leakage of confidential data.

6. The system according to claim 1, characterized in that, For lightweight smart terminals such as mobile phones, tablets, smart wearable devices, and portable smart terminals, the hardware fallback protection module is equipped with APP hardware permission control function. At the underlying level, it locks the background recording, photo taking, location, contact reading, and file traversal permissions of unfamiliar applications, and blocks silent data theft by applications. It also supports a confidential mode, which globally prohibits screenshot, screen recording, and screen projection operations.

7. The system according to claim 1, characterized in that, The hardware fallback protection module includes a peripheral access control unit and a power-on self-test unit. The peripheral access control unit prohibits the automatic mounting and data reading of unfamiliar external devices, and only supports access to the terminal after manual authorization. The power-on self-test unit completes the detection and abnormal isolation and repair of system tampering, backdoor programs, and implanted viruses at the terminal BIOS / low-level firmware level.

8. The system according to claim 7, characterized in that, The peripheral access control unit sets up a dedicated hardware verification mechanism for USB flash drives and portable hard drives; when no manual authorization is obtained from the user, the USB interface is only connected to power and the data transmission link is disconnected, and the USB flash drive cannot be mounted for reading and writing; after authorized access, only files in the USB flash drive are allowed to be imported unidirectionally into the external network isolation buffer, and the hardware prohibits files in the trusted working area from being written to the USB flash drive, so as to prevent confidential information from being leaked through the USB flash drive.

9. The system according to claim 7, characterized in that, The peripheral access control unit adds an optical drive identification circuit to identify the optical drive and optical disc media; in the unauthorized state, the optical drive is only powered on and the read / write / burning link is closed, so the optical disc cannot be read or burned; when authorized, only files in the optical disc are allowed to be imported into the external network isolation buffer in one direction, and the path for data in the trusted working area to be burned to the blank optical disc is blocked at the hardware level to prevent confidential documents from being taken away by burning optical discs; in the confidential mode, the optical drive is completely powered off and becomes completely ineffective.

Images