External protection device and method for protecting HID keyboard and mouse devices

Abstract

The objective of the present invention is to provide an external protection device and method for protecting HID keyboard and mouse devices. [Solution] The device proposes an external protection device for protecting HID keyboard / mouse devices, comprising an HID internal interface for connecting to an HID input interface of a device to be protected, an HID external interface for connecting to an external device, a transfer control module connected to the HID internal interface and the HID external interface, and a protocol analysis module for performing a protocol analysis of the external device connected to the HID external interface to determine whether the external device is a genuine HID keyboard / mouse device, and the transfer control module controls the connection or disconnection of the HID internal interface and the HID external interface based on the judgment result provided by the protocol analysis module in order to prevent an unauthorized HID keyboard / mouse device from connecting to the device to be protected. The present invention can prevent the destruction of the device to be protected due to the connection of an unauthorized HID keyboard / mouse device.

Description

[Technical field]

[0001] The present invention relates to the technical field of equipment security protection, and in particular to an external protection device and method for protecting HID keyboard and mouse devices. [Background technology]

[0002] In computer systems, such as industrial control systems, commercial systems, or office systems, the methods of unauthorized intrusion are becoming more and more hidden and complicated, so that the security protection of the system is becoming more and more important. One method of intrusion into a computer system is to insert a forged or modified user input device, such as a keyboard or a mouse, into the system's interface and transmit unauthorized code to the system to unauthorizedly read, write, or destroy the system.

[0003] In order to prevent users from destroying the system using a mouse or keyboard, Patent Document 1 proposes a method for auditing and controlling PS / 2 mouse and keyboard operations, particularly a method for auditing and controlling host PS / 2 mouse and keyboard operations. The PS / 2 mouse and keyboard protocols are mainly analyzed using a microcontroller, and information on mouse and keyboard movements is obtained without affecting host use, making it possible to control the on / off of the PS / 2 mouse and keyboard.

[0004] However, existing technologies cannot distinguish whether a mouse or keyboard connected to a system is an unauthorized mouse or keyboard, or an unauthorized device disguised as a mouse or keyboard, while the conventional technologies cannot audit or authenticate in real time the authenticity and operation of devices such as a mouse or keyboard connected to a corresponding interface unless audit software is installed in the protected device. Since unauthorized devices disguised as a mouse or keyboard can also generate normal keyboard or mouse operation data while transmitting unauthorized data, the conventional technologies cannot actually protect against access or unauthorized operation of unauthorized devices, and cannot record or audit normal operation.

[0005] In addition, current mice and keyboards do not generally use the PS / 2 interface, but rather use the more versatile USB interface which supports HID devices. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Chinese Patent No. ZL 201410564213.7 Publication Summary of the Invention [Problem to be solved by the invention]

[0007] Therefore, one aspect of the present invention aims to solve the problem that the conventional technology cannot effectively prevent unauthorized devices from disguising themselves as keyboards and mice to corrupt the system.

[0008] Another aspect of the present invention aims to solve the problem that keyboard, mouse communication protocols and operation actions cannot be recorded and audited if audit software cannot be installed on the protected device. [Means for solving the problem]

[0009] In order to achieve the above object, as a first aspect of the present invention, there is proposed an external protection device for protecting HID keyboard / mouse devices, comprising: an HID internal interface for connecting to an HID input interface of a device to be protected; an HID external interface for connecting to an external device; a transfer control module connected to the HID internal interface and the HID external interface, respectively; and a protocol analysis module for performing a protocol analysis of the external device connected to the HID external interface to determine whether the external device is a genuine HID keyboard / mouse device, and the transfer control module controls the connection or disconnection of the HID internal interface and the HID external interface based on the judgment result provided by the protocol analysis module in order to prevent an unauthorized HID keyboard / mouse device from connecting to the device to be protected.

[0010] According to a preferred embodiment of the present invention, controlling the connection or disconnection of the HID internal interface and the HID external interface based on the judgment result provided by the protocol analysis module includes controlling the disconnection of the HID internal interface and the HID external interface when the external device is determined to be an unauthorized HID keyboard / mouse device or a non-HID keyboard / mouse device after protocol analysis, and controlling the connection of the HID internal interface and the HID external interface when the external device is determined to be a genuine HID keyboard / mouse device after protocol analysis.

[0011] According to a preferred embodiment of the present invention, when the external device is an HID keyboard, the protocol analysis module is used to monitor and record input data of the HID keyboard, and when the input data includes data in a predetermined blacklist, the protocol analysis module instructs the transfer control module to control the disconnection of the HID internal interface and the HID external interface.

[0012] According to a preferred embodiment of the present invention, the external protection device further includes a video internal interface for connecting to a video output interface of a protected device, a video external interface for connecting to a video device, and a screen recording module connected to the video internal interface for recording video data output from the protected device.

[0013] According to a preferred embodiment of the present invention, the screen recording module is connected to the protocol analysis module and is under the control of the protocol analysis module, and when the protocol analysis module determines that the external device has performed a specific operation, it controls the screen recording module to perform a video data recording operation.

[0014] According to a preferred embodiment of the present invention, the external protection device further includes an image processing module respectively connected to the screen recording module and the protocol analysis module, for obtaining real-time video data from the screen recording module, analyzing the video data in real time, and, when the analysis result indicates that there is an abnormality in the video data, notifying the protocol analysis module to control disconnection of the HID internal interface and the HID external interface.

[0015] According to a preferred embodiment of the present invention, the real-time analysis includes extracting frame images from the video data, identifying the resulting frame images, and if the identification result includes a predetermined blacklist operation, generating an analysis result indicating that there is an anomaly in the video data.

[0016] According to a preferred embodiment of the present invention, the real-time analysis includes extracting frame images from the video data, calculating image features of the frame images, comparing them with image features of a specified image, and generating an analysis result indicating that there is an anomaly in the video data if the similarity between the image features of the frame images and the image features of the specified image is higher than a threshold.

[0017] Another aspect of the present invention proposes a device protection method for protecting a HID keyboard / mouse device, including the steps of: preparing an external protection device to take over an HID input interface of a protected device; performing a protocol analysis on an external device connected to the external protection device to determine whether the external device is a genuine HID keyboard / mouse device; and controlling a connection or disconnection between the external device and the protected device based on the determination result, thereby preventing an unauthorized HID keyboard / mouse device from connecting to the protected device.

[0018] According to a preferred embodiment of the present invention, controlling the connection or disconnection between the external device and the protected device based on the judgment result includes controlling the disconnection of the external device and the protected device when the external device is determined to be an unauthorized HID keyboard / mouse device or a non-HID keyboard / mouse device after protocol analysis, and controlling the connection of the external device and the protected device when the external device is determined to be a genuine HID keyboard / mouse device after protocol analysis.

[0019] According to a preferred embodiment of the present invention, when the external device is an HID keyboard, the method further includes a step of monitoring and recording input data of the HID keyboard, and a step of controlling disconnection of the external device from a protected device when the input data includes data in a predetermined blacklist.

[0020] According to a preferred embodiment of the present invention, the method further includes the step of monitoring data transfer between the external device and the protected device in real time, and interrupting data transfer from the protected device to the external device when it is detected that there is a risk in a USB IN transaction or data in a USB OUT transaction is present. Effect of the Invention

[0021] Compared with the prior art, the present invention has at least the following advantageous effects:

[0022] (1) The present invention has a transfer control module controlled by a protocol analysis module, which prevents unauthorized HID keyboard / mouse devices from being connected to a protected device, thereby solving the problem of unauthorized devices disguised as keyboards and mice and destroying the system, and strengthening protection of the system from unauthorized HID keyboard / mouse devices.

[0023] (2) The present invention has a keyboard input monitoring and recording module controlled by a protocol analysis module, so that unauthorized keyboard input operations can be effectively blocked.

[0024] (3) The present invention has a real-time screen recording module, which can realize real-time backup and monitoring of interface images, and can monitor the operation of HID keyboard and mouse devices in real time.

[0025] (4) Since the present invention has an image analysis module, it can analyze unauthorized operation of genuine HID keyboard and mouse devices in real time, and further improve the security of HID keyboard and mouse device connections. [Brief description of the drawings]

[0026] [Figure 1] 1 is a schematic diagram of an external protection device for protecting an HID keyboard and mouse device according to a first embodiment of the present invention; [Diagram 2] FIG. 5 is a schematic diagram of an external protection device for protecting an HID keyboard and mouse device according to a second embodiment of the present invention. [Diagram 3] FIG. 11 is a schematic diagram of an external protection device for protecting an HID keyboard and mouse device according to a third embodiment of the present invention. [Figure 4] 1 is a flowchart of an equipment protection method for protecting a HID keyboard and mouse device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0027] In order to make the objectives, technical means and advantages of the present invention clearer, the present invention will be described in more detail below with reference to the drawings in conjunction with specific embodiments.

[0028] In order to solve the problem that the conventional technology cannot effectively prevent unauthorized devices from destroying the system by disguising themselves as keyboards and mice, the present invention proposes an External Protective Device (EPD) for protecting HID keyboard and mouse devices. An External Protective Device is a physical device attached to a protected device, and by taking over a specific interface of the Protected Device (PD), an external device that needs to access the protected device can access it simply by connecting to the External Protective Device, thereby achieving the purpose of protecting the protected device without installing security protection software on the protected device.

[0029] HID devices, also known as Human Machine Interface Devices, are peripherals that allow humans to directly operate a computer. Unlike other devices such as external hard drives or wireless cards, HIDs usually have buttons or controls that allow information to be passed between the human and the computer. Most modern human machine interface devices use the Universal Serial Bus (USB) communication protocol. Before the name HID devices was used, there were only a limited number of protocols that could be used with computer equipment. Manufacturers were restricted to producing input devices that fell into narrow categories, forcing computer companies to write drivers for each new experimental input controller produced. HID devices were created to address this limitation and to facilitate the building of new types of input devices. HID devices contain pre-programmed data called HID descriptors, which are information that the device reports to the host when it is first connected. HID descriptors tell the computer what to do with each packet sent by the interface device. Essentially, these data provide "updates" to the host, informing the computer what input is required. Although much of the HID hardware is designed to allow the user to control the computer, the protocol is not limited to input. HID output can also be sent from a computer to a device, this communication capability is typically used to provide information such as status lights.

[0030] In the present invention, the HID keyboard / mouse device refers to a mouse or keyboard that meets the HID definition. The reason why many of the current keyboards, mice, and other devices are configured as HID keyboard / mouse devices is precisely due to the relatively universal characteristics of HID devices, which provides more convenient conditions for the connection of unauthorized HID keyboard / mouse devices. Therefore, the present invention proposes an external protection device for protecting HID keyboard / mouse devices. This external protection device includes at least an HID internal interface, an HID external interface, a transfer control module, and a protocol analysis module. The HID internal interface is used to connect to the HID input interface of the device to be protected, and the HID external interface is used to connect to an external device. Generally, the HID input interface is generally a USB interface, so the HID internal interface and the HID external interface of the present invention are generally interfaces that comply with the USB protocol. However, the HID internal interface and the HID external interface of the present invention do not exclude interface types that comply with other standard protocols.

[0031] The protected device in the present invention refers to a computer system having security requirements, such as an industrial control host, server, etc., and may also be other commercial or home computer devices. The present invention is not limited to the operating system used as long as the host, server, etc. of the protected device has a function of connecting an HID device and a corresponding hardware interface (HID input interface). For example, if the protected device has a USB interface for connecting to devices such as a keyboard and a mouse, the present invention can directly connect the HID internal interface of the external protection device of the present invention to the protected device through a USB connection cable. Preferably, there are multiple internal interfaces of the external protection device to connect to all HID input interfaces of the protected device to form comprehensive protection of the HID input interface.

[0032] When an external protection device is connected to all HID input interfaces of a protected device, the external protection device is equivalent to taking over the HID inputs of the protected device. If an external device (including a HID keyboard / mouse device or other device that may pose as a HID keyboard / mouse device) needs to be connected to the protected device for user input operation, it must be connected to the external protection device. Specifically, the external device is connected to the HID external interface of the external protection device, and usually the HID external interface is also an interface that complies with the USB standard protocol.

[0033] In order to perform safety monitoring of an external device connected to the external protection device of the present invention, the external protection device has several functional modules inside. In the present invention, a module refers to hardware or software having a specific function, or a combination of software and hardware. For example, a module may be a microcontroller in which a specific computer program is written, or a component having a specific function composed of a general-purpose processor that can read and execute a computer program and an associated control circuit. Here, different modules are only functionally distinct, and when specifically implemented, each may be implemented by different hardware or software, or may be implemented in the same hardware or the same software, or may be implemented partially by hardware and partially by software.

[0034] As described above, the external protection device of the present invention includes a transfer control module and a protocol analysis module. The transfer control module is connected to the HID internal interface and the HID external interface, respectively. The protocol analysis module is connected to the transfer control module and performs a protocol analysis on an external device connected to the HID external interface to determine whether the external device is a genuine HID keyboard / mouse device. The transfer control module controls the connection or disconnection of the HID internal interface and the HID external interface based on the determination result provided by the protocol analysis module in order to prevent an unauthorized HID keyboard / mouse device from connecting to the protected device. In addition, the transmission control module detects in real time whether the HID external interface is connected to an external device, and when it detects that an external device is connected, the protocol analysis module performs protocol analysis in real time to determine the authenticity of the external device, and based on the determination result, determines whether to connect the HID internal interface and the HID external interface, thereby preventing fake or unauthorized HID keyboard and mouse devices from connecting to the internal interface, fundamentally preventing unauthorized persons from gaining unauthorized access to the protected equipment by disguising or counterfeiting HID keyboard and mouse devices.

[0035] Specifically, the determination and control refers to controlling the disconnection of the HID internal interface and the HID external interface when the external device is determined to be an unauthorized HID keyboard / mouse device without or after protocol analysis, and controlling the connection of the HID internal interface and the HID external interface when the external device is determined to be a legitimate HID keyboard / mouse device after protocol analysis. In this way, only legitimate HID keyboard / mouse devices are allowed to connect to the protected device after protocol analysis.

[0036] Specifically, the protocol analysis process in the present invention is as follows.

[0037] (1) Device enumeration stage The USB device characteristics are described by the USB descriptor in the internal firmware of the USB device. After the USB device is plugged into the USB interface of a computer or other device, the USB controller of the computer or other device obtains the descriptor information of the USB device to determine how to access the USB device and load the corresponding driver. The USB descriptor includes the device descriptor (vendor ID, product ID (PID) and serial number information), configuration descriptor (number of configurations, currently used configuration ID, number of interfaces supported by the configuration descriptor), interface descriptor (interface subclass, interface protocol), endpoint descriptor, string descriptor, and HID class device that complies with the USB protocol further includes three descriptors: HID descriptor, report descriptor, and physical descriptor.

[0038] Therefore, the protocol analysis module of the present invention is connected to the transfer control module to obtain data conforming to the USB communication protocol transmitted from an external device connected to the HID external interface, and controls the device connected to the HID external interface by monitoring the communication process of the external device in real time.

[0039] When an external device is plugged into the HID external interface, the transfer control module starts USB device enumeration. During the USB device enumeration process, the transfer control module receives data for USB device enumeration sent from the external device and sends it to the protocol analysis module, which analyzes the data received from the transfer control module. If the data complies with the USB protocol, the protocol analysis module extracts the vendor ID, product ID (PID) and serial number information, the number of configurations, the currently used configuration ID, the number of interfaces supported by the configuration descriptor, interface number, interface class, interface subclass, interface protocol, etc. according to the USB protocol specification.

[0040] According to the USB protocol specification, the type of the HID device is defined in the interface descriptor. According to the present invention, the protocol analysis module determines the type of the external device based on the information in the interface descriptor, and if it is determined that the external device is neither a HID device nor a USB composite device (a device having HID and other USB characteristics, such as a USB storage + HID class device), the protocol analysis module sends a command to the transfer control module to block the connection of the external device.

[0041] (2) Device use stage According to the USB specification, the transmission type of the HID device is interrupt transfer. The token packet of the transaction to be transmitted is issued by the USB host, that is, all USB transactions (Setup transaction, IN transaction, OUT transaction) are controlled by the USB host.

[0042] Since the HID device is an input device, the direction of the flow of non-control data can only be from the HID device to the host. In order to solve the problem that the keyboard, mouse communication protocol and operation behavior cannot be recorded and audited when the audit software cannot be installed in the protected device, the protocol analysis module of the present invention monitors the data transfer between the external device and the protected device in real time, monitors the interrupt transfer, performs the USB IN transaction, and strictly reviews the USB OUT transaction (i.e., allows the data transfer from the external device as a USB device to the protected device, and strictly reviews the data transfer from the protected device to the external device). If it is determined that the data of the USB IN transaction has a risk according to the predetermined rules, it suspends the data transfer between the external device and the protected device. At the same time, if the data of the USB OUT transaction is monitored, it also suspends the data transfer between the external device and the protected device.

[0043] If it is determined that the external device is a HID keyboard, the protocol analysis module of the present invention also monitors and records the input data of the HID keyboard, and if the input data includes data in a predetermined blacklist, the protocol analysis module instructs the transfer control module to control the disconnection of the HID internal interface and the HID external interface. The data in the blacklist is, for example, an operation command harmful to a computer (such as a command to connect to a network, transfer data, or execute a specific program).

[0044] In order to solve the problem that keyboard and mouse communication protocols and operation operations cannot be recorded and audited when audit software cannot be installed in the protected device, according to a preferred embodiment of the present invention, the external protection device also has the functions of screen recording and video monitoring. This function is to prevent unauthorized persons from using a genuine HID keyboard and mouse device to perform unauthorized operations. In other words, after a genuine external HID keyboard and mouse device is connected to the protected device through the external protection device of the present invention, personnel's operations on the mouse, keyboard, etc. (such as deleting data, formatting memory, copying files, etc.) may cause serious risks to the system.

[0045] For this reason, on the one hand, the external protection device of the present invention can also include a video interface, and the video interface includes a video internal interface and a video external interface. The video internal interface is connected to the video output interface of the protected device, and the video external interface is connected to the video device. Therefore, the present invention can obtain the video output data output by the protected device and display it through a video external device. The video interface is, for example, a VGA interface, an HDMI interface, etc., and the video device can be an independent display or a display integrated into the external protection device. Therefore, the user can monitor the user's operation on the protected device through the video device.

[0046] Meanwhile, the external protection device of the present invention may also include a screen recording module connected to the video internal interface for recording video data output by the protected device. The screen recording module is essentially a video storage module, which can store images displayed on the screen as video, and can selectively compress and store in a predetermined video format when stored. The stored video data can be called up as backup data when needed for later analysis, and can also be periodically sent to a corresponding control center for daily analysis.

[0047] In a preferred embodiment, in order to save video storage space, the screen recording module is connected to and controlled by the protocol analysis module. Thus, when the protocol analysis module determines that the external device has performed a specific operation, it controls the screen recording module to perform a video data recording operation. Typically, the protocol analysis module can control the screen recording module to perform the recording operation only when a mouse, keyboard, or other HID keyboard-mouse device is in motion.

[0048] In a more preferred embodiment, the external protection device of the present invention further comprises a real-time image analysis module for detecting unauthorized operations performed by a genuine HID keyboard and mouse device in real time. Specifically, the external protection device of the present invention further comprises an image processing module respectively connected to the screen recording module and the protocol analysis module, for acquiring real-time video data from the screen recording module, analyzing the video data in real time, and notifying the protocol analysis module to control disconnection of the HID internal interface and the HID external interface when the analysis result indicates that the video data is abnormal.

[0049] As a real-time analysis method, a frame image is extracted from the video data, the acquired frame image is OCR-recognized, and if the OCR recognition result contains a predetermined blacklist text, an analysis result is generated indicating that the video data is abnormal. For example, if the text in the OCR recognition window contains "delete", "copy", or a specific software name, it is determined that the video data is abnormal. Another real-time analysis method is to extract a frame image from the video data, calculate image features of the frame image, compare it with image features of a predetermined image, and if the similarity between the image features of the frame image and the image features of the predetermined image is higher than a threshold, an analysis result is generated indicating that the video data is abnormal. The predetermined image is, for example, a typical interface that appears when a computer is destroyed, such as a shutdown interface, a restart interface, a command line interface, etc.

[0050] The present invention will be further described below through specific examples. The specific examples are merely some specific examples for implementing the present invention, and their functions are mainly to describe possible embodiments of the present invention, but do not indicate that the present invention can be implemented only in the form of specific examples, and it should be understood that the technical means of the specific examples should not be directly interpreted as the scope of protection claimed by the present invention.

[0051] Example 1 FIG. 1 is a schematic diagram of an external protection device for protecting an HID keyboard / mouse device according to a first embodiment of the present invention. As shown in FIG. 1, the external protection device 1 has a first HID internal interface 101 and a second HID internal interface 102, which are respectively connected to a first HID input interface 201 and a second HID input interface 202 of a device to be protected. The external protection device 1 further has a first HID external interface 111 and a second HID external interface 112. The first HID external interface 111 and the second HID external interface 112 are respectively used to connect to external devices, and here, as an example, are respectively connected to a mouse 3 having a USB interface and a keyboard 4 having a USB interface. The external protection device 1 includes a protocol analysis module 12 and a transfer control module 13, which are realized as a hardware module having information processing capabilities in this embodiment. Specifically, the protocol analysis module can be configured as a programmable device, and the transfer control module includes a controlled electronic switch.

[0052] However, those skilled in the art will appreciate that the protocol analysis module 12 and the transport control module 13 can be combined into a single piece of hardware, or both can be implemented by software modules executed by a processor having general-purpose processing capabilities.

[0053] As shown in Fig. 1, the transmission control module 13 is connected to the first HID internal interface, the second HID internal interface, the first HID external interface, and the second HID external interface, respectively, and controls the connection or disconnection between the first HID internal interface and the first HID external interface, and the connection or disconnection between the second HID internal interface and the second HID external interface, respectively. The protocol analysis module 12 is connected to the connection end and the control end of the transmission control module 13 (only one line in the figure represents the connection relationship, and does not indicate that there is only one connection line here), and the protocol analysis module 12 reads information of the first HID external interface and the second HID external interface from the connection end, and sends a command to the control end to control the operation of the corresponding electronic switch inside the transmission control module 13. The protocol analysis module 12 performs protocol analysis on the external devices (referring to the mouse 3 and keyboard 4 in the figure) connected to the two HID external interfaces based on the information provided by the first HID external interface 111 and the second HID external interface 112, and determines whether the external devices are genuine HID keyboard-mouse devices.

[0054] The transmission control module 13 controls the connection or disconnection of each of the HID internal interfaces and the HID external interface according to a command (representing a judgment result) input from the control end by the protocol analysis module 12, thereby preventing an unauthorized HID keyboard / mouse device from connecting to the protected device. Here, since the protocol analysis module is connected to the input end of the transmission control module, when the transmission control module 13 detects that the HID external interface is connected to an external device, the protocol analysis module 12 performs a protocol analysis in real time to judge the authenticity of the external device, and based on the judgment result, determines whether to connect the HID internal interface and the HID external interface, thereby preventing a fake or unauthorized HID keyboard / mouse device from connecting to the internal interface, fundamentally preventing an unauthorized person from illegally accessing the protected device by posing as or counterfeiting an HID keyboard / mouse device.

[0055] When the protocol analysis module 12 determines whether the external device is a genuine HID keyboard and mouse device, the actions performed are as follows:

[0056] When an external device is plugged into the HID external interface, the transfer control module 13 starts USB device enumeration. Through USB protocol analysis during the device enumeration process, the protocol analysis module 12 can extract vendor ID, product ID (PID) and serial number information, the number of configurations, the currently used configuration ID, the number of interfaces supported by the configuration descriptor, interface number, interface class, interface subclass, interface protocol, etc. in the USB protocol specification from the protocol data.

[0057] According to the USB protocol specification, the type of a HID device is defined in the interface descriptor. The protocol analysis module 12 first checks the bDeviceClass, bDeviceSubClass, and bDeviceProtocol values ​​of the device descriptor, and only if the three values ​​are evenly equal to 3, the USB device meets the device requirements of the HID class.

[0058] The protocol analysis module 12 also extracts relevant content in the interface descriptor and checks it based on the following content:

[0059] In the interface descriptor, the value of blnterfaceClass must be 0x03, and the value of blnterfaceSubClass must be 0 or 1, where 1 indicates that the HID device is a Boot Device (generally meaningful for a PC, it means that the BIOS can recognize the HID device being used at boot time, only a standard mouse or keyboard can be called a Boot Device), and 0 indicates that the HID device is a device that can only be recognized and used after the operating system has started. The possible values ​​of blnterfaceProtocol mean: 1 is Keyboard, 2 is Mouse.

[0060] When the protocol analysis module determines that the external device is an HID keyboard, it monitors and records the input data of the HID keyboard, and if the input data contains data in a predetermined blacklist, the protocol analysis module instructs the transfer control module to control the disconnection of the HID internal interface and the HID external interface. Data in the blacklist is, for example, an operation command that is harmful to a computer (such as a command to connect to a network, transfer data, or execute a specific program).

[0061] Example 2 FIG. 2 is a schematic diagram of an external protection device for protecting an HID keyboard and mouse device according to a second embodiment of the present invention. As shown in FIG. 2, the difference from the first embodiment is that the external protection device 1 of the second embodiment further includes a video internal interface 103, a video external interface 113, and a screen recording module 14. The video internal interface 103 is connected to the video output interface 203 of the device to be protected, and the video external interface 113 is connected to the display 5. The video interface in this embodiment is a VGA interface, but can be replaced by an HDMI interface or the like in other embodiments. In other embodiments, the display 5 can be a display screen integrated into the external protection device 1. A user can monitor the user's operation on the device to be protected through the display 5.

[0062] 2, the screen recording module 14 is connected to the video internal interface 103 and is used to record the video data output from the protected device. The screen recording module 14 can be configured as a storage controller with a mass storage function, and can store the image displayed on the screen as a video. It is also preferable that the image can be selectively compressed during storage and stored in a predetermined video format.

[0063] Furthermore, in this embodiment 2, in order to save video storage space, the control end of the screen recording module 14 is connected to the protocol analysis module 12 to be controlled by the protocol analysis module. The protocol analysis module 12 performs the recording operation only when it determines that the external device has performed an operation such as a mouse, keyboard, etc. In other embodiments, other conditions for starting or stopping recording can also be set.

[0064] FIG. 3 is a schematic diagram of an external protection device for protecting a HID keyboard and mouse device according to the third embodiment of the present invention. This embodiment is an improvement based on the second embodiment. As shown in FIG. 3, the external protection device of the third embodiment further includes a real-time image analysis module 15 for detecting unauthorized operations performed by a genuine HID keyboard and mouse device in real time. The real-time image analysis module 15 is connected to the screen recording module 14 and the protocol analysis module 12, respectively, and is used to obtain real-time video data from the screen recording module 14, analyze the video data in real time, and when the analysis result indicates that the video data is abnormal, the protocol analysis module 12 notifies the protocol analysis module to control the disconnection of the HID internal interface and the HID external interface. In this embodiment, the image analysis module 15 is implemented by an independent hardware module, but in other embodiments, it can be integrated into the protocol analysis module 12, or the image analysis module 15 and the protocol analysis module 12 can be integrated into a main control module. It should be noted that, like the other modules, the image analysis module 15 may be implemented as software, i.e., a software module that can be executed by any hardware capable of processing information within the external protection device.

[0065] As described above, the image analysis module 15 can perform image analysis in various ways, and since it is connected to the screen recording module, it can perform real-time analysis by acquiring interface images of the protected device acquired and recorded by the screen recording module in real time. The present invention is not limited to a specific analysis method, and is preferably an image analysis method that supports updates or upgrades. As an example, a real-time analysis method is to extract frame images from the video data, perform OCR recognition on the acquired frame images, and generate an analysis result indicating that the video data is abnormal if the OCR recognition result contains a predetermined blacklist text. For example, if the text in the OCR recognition window contains "delete", "copy", or a specific software name, it is determined that the video data is abnormal. Another method of real-time analysis is to extract frame images from the video data, calculate image features of the frame images, compare them with image features of a predetermined image, and generate an analysis result indicating that the video data is abnormal if the similarity between the image features of the frame images and the image features of the predetermined image is higher than a threshold. The predetermined image is, for example, a typical interface that appears when a computer is destroyed, such as a shutdown interface, a restart interface, a command line interface, etc.

[0066] As can be seen from the above embodiment, the present invention has a transmission control module controlled by a protocol analysis module, so that the problem that an unauthorized HID keyboard / mouse device cannot be connected to a protected device and an unauthorized device cannot be effectively prevented from destroying the system by disguising it as a keyboard or mouse is solved, and the protection of the system against unauthorized HID keyboard / mouse devices is strengthened. The present invention also backs up and monitors the operation of the HID keyboard / mouse device in real time through a real-time screen recording module. In particular, the present invention can prevent unauthorized operation of a genuine HID keyboard / mouse device through real-time analysis of the image analysis module, and further improve the security of the connection of the HID keyboard / mouse device. The above means solves the problem that the keyboard / mouse communication protocol and operation behavior cannot be recorded and audited if the audit software cannot be installed in the protected device.

[0067] 4 is a flowchart of a device protection method for protecting a HID keyboard and mouse device according to an embodiment of the present invention. As shown in FIG. 4, the method of the present invention includes the following steps:

[0068] S1: Step of preparing an external protection device to take over the HID input interface of the protected device.

[0069] One of the objectives of the method of the present invention is to protect the protected device and prevent unauthorized devices from destroying the system by disguising themselves as keyboards and mice. As mentioned above, an external protective device (EPD) is a physical device attached to the protected device, and takes over a specific interface of the protected device (PD), so that an external device that needs to access the protected device can access it simply by connecting to the external protective device, and the purpose of protecting the protected device can be achieved without installing security protection software on the protected device. Usually, the HID input interface of the protected device is generally a USB interface, so the HID internal interface and HID external interface of the present invention are usually interfaces that comply with the USB protocol. However, the HID internal interface and HID external interface of the present invention do not exclude interface types that comply with other standard protocols.

[0070] S2: A step of performing a protocol analysis on an external device connected to the external protection device to determine whether the external device is a regular HID keyboard and mouse device.

[0071] Specifically, when an external device is plugged into the external protection device, the external protection device starts device enumeration. Through USB protocol analysis during the device enumeration process, the external protection device can extract vendor ID, product ID (PID), serial number information, number of configurations, currently used configuration ID, number of interfaces supported by the configuration descriptor, interface number, interface class, interface subclass, interface protocol, etc. in the USB protocol specification from the protocol data.

[0072] According to the USB protocol specification, the type of a HID device is defined in the interface descriptor. The protocol analysis module 12 first checks the bDeviceClass, bDeviceSubClass, and bDeviceProtocol values ​​of the device descriptor, and only if the three values ​​are all equal to 0, does the USB device meet the device requirements of the HID class.

[0073] The external protection device also extracts the relevant content in the interface descriptor and checks it based on the following content:

[0074] In the interface descriptor, the value of blnterfaceClass must be 0x03, and the value of blnterfaceSubClass must be 0 or 1, where 1 indicates that the HID device is a Boot Device (generally meaningful for a PC, it means that the BIOS can recognize the HID device being used at boot time, only a standard mouse or keyboard can be called a Boot Device), and 0 indicates that the HID device is a device that can only be recognized and used after the operating system has started. The possible values ​​of blnterfaceProtocol mean: 1 is Keyboard, 2 is Mouse.

[0075] S3: A step of controlling the connection or disconnection between the external device and the protected device based on the judgment result, thereby preventing an unauthorized HID keyboard / mouse device from connecting to the protected device.

[0076] Specifically, if the external device is determined to be an unauthorized HID keyboard / mouse device or a non-HID keyboard / mouse device after protocol analysis, the device controls the disconnection of the external device from the protected device, and if the external device is determined to be a genuine HID keyboard / mouse device after protocol analysis, the device controls the connection of the external device to the protected device.

[0077] According to the USB protocol specification, the type of the HID device is defined in the interface descriptor. According to the present invention, the external protection device determines the type of the external device based on the information in the interface descriptor, and if it determines that the external device is neither a HID device nor a USB composite device (a device having HID and other USB characteristics, such as a USB storage + HID class device), it sends a command to the transfer control module to block the connection of the external device.

[0078] According to a preferred embodiment of the present invention, the method of the present invention may further include step 4 of monitoring data transfer between the external device and the protected device in real time, and interrupting data transfer from the protected device to the external device when it is detected that there is a risk in the USB IN transaction or there is data in the USB OUT transaction.

[0079] The above specific examples further explain the objectives, technical means, and advantageous effects of the present invention, but it will be understood that the present invention is not inherently related to a specific computer, virtual device, or electronic device, and can be realized in various general-purpose devices. The above are only specific examples of the present invention, and are not intended to limit the present invention. Modifications, equivalent replacements, improvements, etc. made without departing from the spirit and principles of the present invention are also included in the scope of protection of the present invention. [Explanation of symbols]

[0080] 1 External protection device 3. Mouse 4. Keyboard 5. Display 12 Protocol Analysis Module 13 Transmission Control Module 14. Screen Recording Module 15 Real-time image analysis module 101 1HID internal interface 102 2HID internal interface 103 Video Internal Interface 111 1HID external interface 112 2HID external interface 113 Video external interface 201 1HID input interface 202 2HID input interface 203 Video Output Interface

Claims

1. an HID internal interface for connecting to an HID input interface of a protected device; an HID external interface for connecting to an external device; a transmission control module connected to the HID internal interface and the HID external interface, respectively; a protocol analysis module for performing a protocol analysis on the external device connected to the HID external interface to determine whether the external device is a regular HID keyboard / mouse device; An external protection device for protecting a HID keyboard and mouse device, comprising: The external protection device for protecting HID keyboard / mouse devices, wherein the transmission control module controls the connection or disconnection of the HID internal interface and the HID external interface based on the judgment result provided by the protocol analysis module to prevent an unauthorized HID keyboard / mouse device from connecting to the protected device.

2. Controlling the connection or disconnection between the HID internal interface and the HID external interface based on the determination result provided by the protocol analysis module, If the external device is determined to be an unauthorized HID keyboard / mouse device or a non-HID keyboard / mouse device after protocol analysis, controlling disconnection of the HID internal interface and the HID external interface; and If the external device is determined to be a regular HID keyboard / mouse device after protocol analysis, control a connection between the HID internal interface and the HID external interface.

2. The external protection device for protecting a HID keyboard and mouse device according to claim 1, comprising:

3. When the external device is an HID keyboard, the protocol analysis module is used to monitor and record input data of the HID keyboard; 2. The external protection device for protecting a HID keyboard and mouse device as claimed in claim 1, wherein if the input data includes data in a predetermined blacklist, the protocol analysis module instructs a transfer control module to control disconnection of the HID internal interface and the HID external interface.

4. a video internal interface for connecting to a video output interface of the protected device; a video external interface for connecting to a video device; a screen recording module connected to the video internal interface for recording video data output from the protected device; The external protection device for protecting a HID keyboard and mouse device according to any one of claims 1 to 3, further comprising:

5. the screen recording module is connected to the protocol analysis module and is controlled by the protocol analysis module; The external protection device for protecting a HID keyboard and mouse device as claimed in claim 4 , wherein the protocol analysis module controls the screen recording module to perform a recording operation of the video data when the protocol analysis module determines that the external device has performed a specific operation.

6. 5. The external protection device for protecting a HID keyboard and mouse device as claimed in claim 4, further comprising an image processing module respectively connected to the screen recording module and the protocol analysis module, for obtaining real-time video data from the screen recording module, analyzing the video data in real time, and notifying the protocol analysis module to control disconnection of the HID internal interface and the HID external interface when the analysis result indicates that there is an abnormality in the video data.

7. The real-time analysis includes: The external protection device for protecting a HID keyboard and mouse device as described in claim 6, further comprising: extracting frame images from the video data; identifying the obtained frame images; and if the identification result includes a predetermined blacklist operation, generating an analysis result indicating that there is an abnormality in the video data.

8. The real-time analysis includes:

7. The external protection device for protecting a HID keyboard and mouse device as described in claim 6, further comprising: extracting frame images from the video data, calculating image features of the frame images, comparing them with image features of a predetermined image, and generating an analysis result indicating that there is an abnormality in the video data if a similarity between the image features of the frame images and the image features of the predetermined image is higher than a threshold.

9. providing an external protection device to take over the HID input interface of the protected device; performing a protocol analysis on the external device connected to the external protection device to determine whether the external device is a regular HID keyboard and mouse device; controlling connection or disconnection between the external device and the protected device based on the determination result to prevent an unauthorized HID keyboard / mouse device from connecting to the protected device; The present invention relates to a device protection method for protecting a HID keyboard / mouse device, comprising:

10. Controlling a connection or disconnection between the external device and the protection target device based on the determination result If the external device is determined to be an unauthorized HID keyboard / mouse device or a non-HID keyboard / mouse device after protocol analysis, controlling disconnection of the external device and the protected device; and If the external device is determined to be a regular HID keyboard / mouse device after protocol analysis, control the connection between the external device and the protected device.

10. The equipment protection method for protecting an HID keyboard and mouse device according to claim 9, comprising:

11. If the external device is an HID keyboard, monitoring and recording input data of the HID keyboard; and and controlling disconnection of the external device and the protected device when the input data includes data in a predetermined blacklist.

10. The equipment protection method for protecting a HID keyboard and mouse device according to claim 9, further comprising:

12. 10. The device protection method for protecting a HID keyboard and mouse device as claimed in claim 9, further comprising the step of: monitoring data transfer between the external device and the protected device in real time; and interrupting data transfer from the protected device to the external device when it is detected that there is a risk in a USB IN transaction or data of a USB OUT transaction is present.

Images