Method, device, and electronic device for controlling communication between a USB device and a device to be protected

Abstract

To provide a method, apparatus, and electronic device for controlling communication between a USB device and a protected device. [Solution] The present invention relates to a method for controlling communication between a USB device and a device to be protected, which is applied to a USB access control device connected to the device to be protected via an interface. In this way, data in the device to be protected can be safely protected through the USB access control device externally attached to the device to be protected, data leakage in the device to be protected can be effectively prevented, and data security of the device to be protected can be ensured without installing security software in the device to be protected. For example, after a USB device is inserted into the USB access control device and authentication is successful, the USB access control device monitors communication data between the USB device and the device to be protected, determines the communication protocol type of the communication data between them according to the USB protocol specification, and then cuts off the communication between the USB device and the device to be protected according to the communication protocol type of the communication data.

Description

[Technical Field]

[0001] The present disclosure relates to the field of device communication control, and more particularly to a method, apparatus, electronic device, and computer-readable recording medium for controlling communication between a USB device and a protected device. [Background technology]

[0002] In recent years, computer and network technologies have developed rapidly, and networks have become much more widespread. While people are increasingly enjoying the convenience brought by networks, new threats to the data security of the computers people use in production and daily life have also arisen, such as the intrusion of general malicious code, virus / Trojan horse infections, DDoS attacks, information theft by hackers, unauthorized access, impersonation of legitimate users, destruction of data integrity, disruption of normal system operation, the spread of viruses using networks, and man-in-the-middle attacks.

[0003] Currently, there are many technical means to solve the problem of intranet computer network data security, such as installing and using network security products on hosts, such as black / white lists, traffic control software, firewalls, antivirus software, and intrusion detection systems. However, even with the above measures, various network security incidents still occur frequently.

[0004] Furthermore, for some specialized equipment, such as hosts equipped with specialized software control or engineering workstation / operator station equipment in certain industries, due to the specific nature of the system, there is no security protection software on the market suitable for such systems, or installing security software is likely to cause compatibility issues with the host's existing software, which may further affect performance.Furthermore, after these engineering workstation or operator station hosts go into production, their operating systems are generally not upgraded, and even after security software is installed, the anti-malware software version and malicious code library are often not updated in a timely manner, making it impossible to provide comprehensive security protection.

[0005] The above information disclosed in the Background section is intended solely to enhance understanding of the background of the present disclosure and may include information that does not constitute prior art already known to those skilled in the art. Summary of the Invention [Problem to be solved by the invention]

[0006] The present disclosure has been made in consideration of the above circumstances, and provides a method, apparatus, electronic device, and computer-readable recording medium for controlling communication between a USB device and a protected device, which can safely protect data in the protected device via a USB access control device externally attached to the protected device.

[0007] Other features and advantages of the present disclosure will be apparent from the following detailed description, or in part may be learned by practice of the present disclosure. [Means for solving the problem]

[0008] According to one aspect of the present disclosure, there is provided a method for controlling communication between a USB device and a protected device, the method being applied to a USB access control device connected to the protected device via an interface. The method includes the steps of: after the USB device is inserted into the USB access control device and authentication is successful, monitoring communication data between the USB device and the protected device; determining a communication protocol type of the communication data according to a USB protocol specification; and disconnecting communication between the USB device and the protected device according to the communication protocol type of the communication data.

[0009] Alternatively, the step of determining the communication protocol type of the communication data in accordance with the USB protocol specification includes the steps of: acquiring communication protocol information from the communication data in accordance with the USB protocol specification; and determining, based on the communication protocol information, that the communication protocol type of the communication data is a bulk transfer protocol.

[0010] Alternatively, the step of disconnecting communication between the USB device and the protected device according to the communication protocol type of the communication data includes the step of disconnecting communication between the USB device and the protected device if the communication protocol type of the communication data is a bulk transfer protocol.

[0011] Alternatively, the step of determining the communication protocol type of the communication data in accordance with the USB protocol specification includes the steps of: acquiring communication protocol information from the communication data in accordance with the USB protocol specification; and determining, based on the communication protocol information, that the communication protocol type of the communication data is an isochronous transfer protocol.

[0012] Alternatively, the step of disconnecting communication between the USB device and the protected device according to the communication protocol type of the communication data includes a step of checking a data flow direction of the communication data when the communication protocol type of the communication data is the isochronous transfer protocol, and a step of disconnecting communication between the USB device and the protected device when the data flow direction is from the protected device to the USB device.

[0013] Alternatively, the step of determining the communication protocol type of the communication data in accordance with the USB protocol specification includes the steps of: acquiring communication protocol information from the communication data in accordance with the USB protocol specification; and determining, based on the communication protocol information, that the communication protocol type of the communication data is an interrupt transfer protocol.

[0014] Alternatively, the step of disconnecting communication between the USB device and the protected device according to the communication protocol type of the communication data includes a step of checking a data flow direction of the communication data when the communication protocol type of the communication data is the interrupt transfer protocol, and a step of disconnecting communication between the USB device and the protected device when the data flow direction is from the protected device to the USB device.

[0015] Alternatively, determining the communication protocol type of the communication data in accordance with the USB protocol specification includes obtaining communication protocol information from the communication data in accordance with the USB protocol specification, and determining, based on the communication protocol information, that the communication protocol type of the communication data is a custom transfer protocol.

[0016] Alternatively, the step of disconnecting communication between the USB device and the protected device according to the communication protocol type of the communication data includes a step of determining whether the communication data is unanalyzable data if the communication protocol type of the communication data is the custom transfer protocol, and a step of disconnecting communication between the USB device and the protected device if the communication data is the unanalyzable data.

[0017] Alternatively, the method further comprises the step of sending a warning message to the protected device when communication between the USB device and the protected device is interrupted.

[0018] Alternatively, the method may further include a step of closing a switch disposed on the USB access control device before the USB access control device is powered on so that the USB device and the protected device can communicate normally, or a step of opening a switch disposed on the USB access control device after the USB access control device is powered on and triggering an enumeration mechanism of the USB device.

[0019] According to one aspect of the present disclosure, there is proposed a communication control device between a USB device and a protected device, which is applied to a USB access control device connected to the protected device via an interface, and includes: a monitoring module for monitoring communication data between the USB device and the protected device after the USB device is inserted into the USB access control device and authentication is successful; a communication protocol type determination module for determining the communication protocol type of the communication data in accordance with a USB protocol specification; and a control module for disconnecting the communication between the USB device and the protected device depending on the communication protocol type of the communication data.

[0020] According to one aspect of the present disclosure, there is proposed an electronic device comprising one or more processors and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned method.

[0021] According to one aspect of the present disclosure, a computer-readable recording medium is proposed, storing a computer program, which, when executed by a processor, implements the above method. [Effects of the Invention]

[0022] According to the disclosed method and apparatus for controlling communication between a USB device and a protected device, as well as the electronic device and computer-readable recording medium, the method is applied to a USB access control device connected to the protected device via an interface. In this way, data in the protected device can be securely protected through the USB access control device external to the protected device, effectively preventing data leakage within the protected device and ensuring data security of the protected device without installing security software on the protected device. For example, after a USB device is plugged into the USB access control device and authentication is successful, the USB access control device monitors the communication data between the USB device and the protected device, determines the communication protocol type of the communication data according to the USB protocol specification, and then disconnects the communication between the USB device and the protected device according to the communication protocol type of the communication data.

[0023] It is to be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present disclosure.

[0024] The above and other objects, features, and advantages of the present disclosure will become more apparent from detailed description of exemplary embodiments with reference to the drawings. The drawings depicted below are merely some embodiments of the present disclosure, and those skilled in the art can derive other drawings based on these drawings without any creative effort. [Brief explanation of the drawings]

[0025] [Figure 1] FIG. 1 is a schematic block diagram illustrating a USB device access control system according to an exemplary embodiment. [Figure 2] 1 is a flowchart illustrating a method for controlling communication between a USB device and a protected device according to an exemplary embodiment. [Figure 3] 1 is a schematic diagram illustrating a specific arrangement of a USB communication data analysis module in a USB access control device according to an exemplary embodiment. [Figure 4] 10 is a flowchart illustrating a method for controlling communication between a USB device and a protected device according to another exemplary embodiment. [Figure 5] 10 is a flowchart illustrating a method for controlling communication between a USB device and a protected device according to another exemplary embodiment. [Figure 6] 10 is a flowchart illustrating a method for controlling communication between a USB device and a protected device according to another exemplary embodiment. [Figure 7] 10 is a flowchart illustrating a method for controlling communication between a USB device and a protected device according to another exemplary embodiment. [Figure 8] FIG. 2 is a schematic diagram illustrating the connection relationship between a data transfer module and a USB communication data analysis module according to an exemplary embodiment. [Figure 9] FIG. 1 is a schematic diagram illustrating a network version of a USB device access control system according to an exemplary embodiment. [Figure 10] FIG. 2 is a schematic diagram of software deployed on an administrative workstation A according to an exemplary embodiment. [Figure 11] FIG. 2 is a schematic diagram illustrating the connection relationship between a USB communication data analysis module and a data transfer module in a USB registered device according to an exemplary embodiment. [Figure 12] FIG. 2 is a block diagram of a communication control device between a USB device and a protected device according to an exemplary embodiment. [Figure 13]FIG. 1 is a block diagram of an electronic device in accordance with an illustrative embodiment. [Figure 14] 1 is a block diagram of a computer-readable storage medium according to an exemplary embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0026] Exemplary embodiments will now be described in detail with reference to the accompanying drawings. However, the exemplary embodiments may be implemented in a variety of forms, and the present disclosure should not be construed as being limited to the examples described herein. On the contrary, the implementation examples are provided to more comprehensively and completely explain the technical means of the present disclosure and comprehensively convey the technical ideas of the exemplary embodiments to those skilled in the art. The same reference numerals in the accompanying drawings represent the same or similar components, and therefore repeated description of the components will be omitted.

[0027] It should be noted that the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. Numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure. However, one skilled in the art will recognize that the technical means of the present disclosure may be practiced or other methods, components, devices, steps, etc. may be employed without one or more of the specific details. In other instances, well-known methods, devices, implementations, or operations have not been shown or described in detail to avoid unnecessarily obscuring aspects of the present disclosure.

[0028] Some of the block diagrams shown in the accompanying drawings represent functional entities that do not necessarily correspond to physically separate entities, i.e., these functional entities may be implemented in software, in one or more hardware modules or integrated circuits, in different network and / or processor and / or microcontroller devices.

[0029] The flowcharts shown in the accompanying drawings are merely examples and do not necessarily include all contents and operations / steps, nor do they necessarily have to be performed in the order described. For example, some operations / steps can be separated, some operations / steps can be merged or partially merged, and the actual execution order may be changed according to actual circumstances.

[0030] In this specification, terms such as first, second, and third may be used to describe various components, but it will be understood that these components should not be limited by these terms. These terms are used to distinguish one component from another. Thus, a first component described below may be referred to as a second component without departing from the teachings of the concepts of the present disclosure. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0031] It will be understood by those skilled in the art that the accompanying drawings are only schematic diagrams of exemplary embodiments, and the modules or flows in the accompanying drawings are not necessarily required to implement the present disclosure, and therefore are not intended to be used to limit the protection scope of the present disclosure.

[0032] FIG. 1 is a schematic block diagram illustrating a USB device access control system according to an exemplary embodiment.

[0033] 1, the USB device access control system 100 includes a USB access control device 110, a USB device 120, and a protected device 130. The USB access control device 110 is provided with two USB ports, USB port UA1 and USB port UA2. The number of USB ports can be increased depending on the actual application scenario.

[0034] In this embodiment, the USB access control device 110 and the USB device 120 can be connected via a USB port UA1. The USB access control device 110 and the protection target device 130 can be connected via a USB port UA2. The USB access control device 110 can be used to securely protect data in the protection target device 130. For example, when a USB device 120 is inserted into the USB port UA1 of the USB access control device 110, the USB access control device 110 can authenticate the USB device 120 according to the descriptor of the USB device 120. After the USB device is inserted into the USB access control device and authentication is successful, the USB access control device monitors communication data between the USB device and the protection target device, determines the communication protocol type of the communication data between them according to the USB protocol specifications, and then disconnects the communication between the USB device and the protection target device according to the communication protocol type of the communication data.

[0035] In this embodiment, the USB access control device 110 may be a security device with a data protection function. The USB device 120 may be an external storage device, an external HID device, etc. For example, the external storage device may be a USB flash drive, a portable storage device, etc. The external HID device may be a mouse, a keyboard, a controller, etc.

[0036] 2 is a flowchart illustrating a method for controlling communication between a USB device and a protected device according to an exemplary embodiment, which is applied to a USB access control device that is connected to the protected device via an interface.

[0037] As shown in FIG. 2, the method for controlling communication between a USB device and a protected device may include steps S210 to S230.

[0038] In step S210, after the USB device is inserted into the USB access control device and is successfully authenticated, the communication data between the USB device and the protected device is monitored.

[0039] In step S220, the communication protocol type of the communication data is determined according to the USB protocol specifications.

[0040] In step S230, communication between the USB device and the protection target device is cut off according to the type of communication protocol of the communication data.

[0041] This method can safely protect data in the protected device via a USB access control device externally connected to the protected device, effectively prevent data leakage within the protected device, and ensure data security for the protected device without installing security software on the protected device. For example, after a USB device is plugged into a USB access control device and authentication is successful, the USB access control device monitors the communication data between the USB device and the protected device, determines the communication protocol type of the communication data between them in accordance with the USB protocol specifications, and then disconnects the communication between the USB device and the protected device according to the communication protocol type of the communication data.

[0042] In some embodiments of the present invention, the type of communication protocol for communicating data between the USB device and the protected device may include one or more of a bulk transfer protocol, an isochronous transfer protocol, an interrupt transfer protocol, and a custom transfer protocol.

[0043] In some embodiments of the present invention, each communication protocol type can include a Setup transaction, an IN transaction, and an OUT transaction. Token packets for all transactions are issued by the USB host (e.g., the protected device). The basic principle of USB device communication data analysis and anomaly prevention is to restrict data input to a strict data output, i.e., to restrict the communication protocol type to the communication data flowing into the protected device based on the USB device access permission. For example, bulk transfers are prohibited, isochronous transfers are only permitted as IN transactions (i.e., from the USB device to the protected device), interrupt transfers can be performed as IN transactions, and OUT transactions must determine the data transfer direction (i.e., data transfers from the USB device to the protected device are permitted, but data transfers from the protected device to the USB device are prohibited).

[0044] In some embodiments of the present invention, when a USB device is plugged into a USB access control device, the USB device needs to be authenticated, and after the USB device is successfully authenticated, the USB device can communicate with the protected device. The USB device authentication process may be as follows: when a USB device is plugged into a USB access control device, a USB device descriptor is obtained, and the USB device descriptor is compared with the USB device registration information. If the USB device descriptor is the same as the USB device registration information, a switch located on the USB access control device is closed to allow the USB device to communicate with the protected device. Also, when the USB device communicates with the protected device, the USB device descriptor is continuously obtained, and the USB device descriptor is compared with the USB device registration information. If the USB device descriptor is different from the USB device registration information, a switch located on the USB access control device is opened.

[0045] Referring to FIG. 3, the USB access control device 110 may include an interface control module and a system control module. The interface control module has three USB ports: USB port UA1, USB port UA2, and USB port UB. USB port UA1 and USB port UA2 are external interfaces, and USB port UB is an internal interface. The external interface UA2 is connected to a corresponding USB port UC of the protected device 130. The external interface UA1 is used to connect one or more USB devices 120. The system control module has an internal interface, which is USB port UD. The UD of the system control module is electrically connected to the UB of the interface control module and is used to control security authentication of external devices connected to the external interface UA1 on the interface control module.

[0046] In this embodiment, two USB communication data analysis modules and two switches are also disposed within the interface control module. As shown in FIG. 3 , one end of the USB communication data analysis module is connected to the external interface UA1, the other end is connected to one end of the switch, and the other end of the switch is connected to the internal interface UB. Another USB communication data analysis module is connected to the external interface UA1, the other end is connected to one end of the switch, and the other end of the switch is connected to the external interface UA2. In this manner, the USB communication data analysis modules are connected in series, bypassing the connection between the external interface of the interface control module and the USB port of the protected device, and monitoring the descriptors and / or communication data of the USB device in real time within the direct connection path. The USB communication data analysis module is implemented based on USB protocol analysis and is used to analyze the descriptors and / or communication data of the USB device. For example, the USB communication data analysis module between the external interface UA1 and the internal interface UB is used to analyze the descriptors of the USB device 120. The USB communication data analysis module between the external interface UA1 and the external interface UA2 is used to analyze the descriptor of the USB device 120 and the communication data between the USB device 120 and the protected device 130.

[0047] Hereinafter, a method for controlling communication between a USB device and a protected device according to the type of communication protocol will be described in detail with reference to the embodiments shown in FIGS.

[0048] FIG. 4 is a flowchart illustrating a method for controlling communication between a USB device and a protected device according to another exemplary embodiment.

[0049] As shown in FIG. 4, the above step S220 may include step S410 and step S420.

[0050] In step S410, communication protocol information is obtained from the communication data in accordance with the USB protocol specifications.

[0051] In step S420, it is determined based on the communication protocol information that the communication protocol type of the communication data is a bulk transfer protocol.

[0052] In some embodiments of the present invention, if the communication protocol type of the communication data between the USB device and the protected device is a bulk transfer protocol, the communication between the USB device and the protected device can be cut off, thereby safely and timely protecting the data in the protected device.

[0053] 3, when the USB device 120 is inserted into the USB access control device 110 and successfully authenticated, the switch between the external interfaces UA1 and UA2 in the USB access control device 110 is closed, allowing the USB device 120 to communicate with the protected device 130. A USB communication data analysis module between the external interfaces UA1 and UA2 in the USB access control device 110 detects the communication protocol type of the data transmitted between the USB device 120 and the protected device 130 in real time. If the module detects that the communication protocol type is a bulk transfer protocol, the switch between the external interfaces UA1 and UA2 in the USB access control device 110 is opened, preventing the USB device 120 from communicating with the protected device 130. This method allows data in the protected device to be protected safely and in real time.

[0054] FIG. 5 is a flowchart illustrating a method for controlling communication between a USB device and a protected device according to another exemplary embodiment.

[0055] As shown in FIG. 5, the above step S220 may include step S510 and step S520.

[0056] In step S510, communication protocol information is obtained from the communication data in accordance with the USB protocol specifications.

[0057] In step S520, it is determined based on the communication protocol information that the communication protocol type of the communication data is the isochronous transfer protocol.

[0058] In some embodiments of the present invention, when the communication protocol type of the communication data between the USB device and the device to be protected is the isochronous transfer protocol, the data flow direction of the communication data is checked, and if the data flow direction is from the device to be protected to the USB device, the communication between the USB device and the device to be protected is cut off, thereby enabling data in the device to be protected to be protected safely and in a timely manner.

[0059] 3, when the USB device 120 is plugged into the USB access control device 110 and successfully authenticated, the switch between the external interfaces UA1 and UA2 in the USB access control device 110 is closed, allowing the USB device 120 to communicate with the protected device 130. At this time, a USB communication data analysis module between the external interfaces UA1 and UA2 in the USB access control device 110 detects in real time the communication protocol type of the data communicated between the USB device 120 and the protected device 130. If it detects that the communication protocol type is an isochronous transfer protocol, it determines the data direction of the communication data. If the data flow direction is from the protected device 130 to the USB device 120, the switch between the external interfaces UA1 and UA2 in the USB access control device 110 is opened, preventing the USB device 120 from communicating with the protected device 130. This method ensures secure, real-time protection of data in the protected device.

[0060] FIG. 6 is a flowchart illustrating a method for controlling communication between a USB device and a protected device according to another exemplary embodiment.

[0061] As shown in FIG. 6, the above step S220 may include step S610 and step S620.

[0062] In step S610, communication protocol information is obtained from the communication data in accordance with the USB protocol specifications.

[0063] In step S620, it is determined based on the communication protocol information that the communication protocol type of the communication data is an interrupt transfer protocol.

[0064] In some embodiments of the present invention, when the communication protocol type of the communication data between the USB device and the device to be protected is the interrupt transfer protocol, the data flow direction of the communication data is checked, and if the data flow direction is from the device to be protected to the USB device, the communication between the USB device and the device to be protected is cut off, thereby enabling data in the device to be protected to be protected safely and in a timely manner.

[0065] 3, after the USB device 120 is plugged into the USB access control device 110 and successfully authenticated, the switch between the external interfaces UA1 and UA2 in the USB access control device 110 is closed, allowing the USB device 120 to communicate with the protected device 130. At this time, the USB communication data analysis module between the external interfaces UA1 and UA2 in the USB access control device 110 detects the communication protocol type of the data communicated between the USB device 120 and the protected device 130 in real time. If it detects that the communication protocol type is an interrupt transfer protocol, it determines the data direction of the communication data. If the data flow direction is from the protected device 130 to the USB device 120, it opens the switch between the external interfaces UA1 and UA2 in the USB access control device 110, preventing the USB device 120 from communicating with the protected device 130. This method ensures secure, real-time protection of data in the protected device.

[0066] FIG. 7 is a flowchart illustrating a method for controlling communication between a USB device and a protected device according to another exemplary embodiment.

[0067] As shown in FIG. 7, the above step S220 may include step S710 and step S720.

[0068] In step S710, obtaining communication protocol information from the communication data according to the USB protocol specification.

[0069] In step S720, it is determined based on the communication protocol information that the communication protocol type of the communication data is a custom transfer protocol.

[0070] In some embodiments of the present invention, when the communication protocol type of the communication data between the USB device and the device to be protected is a custom transfer protocol, it is determined whether the communication data is unanalyzable data, and if the communication data is unanalyzable data, the communication between the USB device and the device to be protected is cut off, thereby enabling safe and timely protection of the data in the device to be protected.

[0071] 3, when the USB device 120 is inserted into the USB access control device 110 and successfully authenticated, the switch between the external interfaces UA1 and UA2 in the USB access control device 110 is closed, allowing the USB device 120 to communicate with the protected device 130. At this time, a USB communication data analysis module between the external interfaces UA1 and UA2 in the USB access control device 110 detects in real time the communication protocol type of the data communicated between the USB device 120 and the protected device 130. If the communication protocol type is determined to be a custom transfer protocol, it determines whether the communication data is unanalyzable data. If the communication data is unanalyzable data, the switch between the external interfaces UA1 and UA2 in the USB access control device 110 is opened, preventing the USB device 120 from communicating with the protected device 130. This method enables secure, real-time protection of data in the protected device.

[0072] According to the above embodiment, the method further includes the step of sending a warning message to the protected device when the communication between the USB device and the protected device is cut off. Referring to Figure 3, when the USB access control device 110 opens the switch between the external interface UA1 and the external interface UA2, it sends a warning message to the protected device 130 to alert the person in charge of the protected device 130.

[0073] According to the aforementioned embodiment, the method further includes a step of closing a switch disposed in the USB access control device 110 before the USB access control device 110 is powered on so that the USB device 120 and the protected device 130 can communicate normally, or a step of opening a switch disposed in the USB access control device 110 after the USB access control device 110 is powered on to trigger an enumeration mechanism of the USB device 120. Referring to Fig. 3, when the USB device 120 is plugged into the USB access control device 110 and before the USB access control device 110 is powered on, a switch between the external interface UA1 and the external interface UA2 in the USB access control device 110 is closed so that the USB device 120 and the protected device 130 can communicate normally, thereby realizing the power-off bypass function of the USB access control device 110. Conversely, when the USB device 120 is plugged into the USB access control device 110 and the USB access control device 110 is powered on, the switch between the external interface UA1 and the external interface UA2 in the USB access control device 110 is opened to trigger the enumeration mechanism of the USB device 120, i.e., authenticate the USB device 120.

[0074] The enumeration mechanism of a USB device, that is, the authentication process of a USB device, will be described in detail through the following embodiments.

[0075] 3 , when a USB device 120 is plugged into the direct-connected external interface UA1 and connected to the USB port UC of the protected device, the plugged USB device 120 is powered on and enters a device recognition process, i.e., an enumeration process, according to the USB specification. For example, when the USB device 120 is plugged into the external interface UA1 of the USB access control device 110, the switch between the internal interface UB and the external interface UA1 of the USB access control device 110 is closed. At this time, the system control module controls the USB communication data analysis module between the two to obtain a descriptor of the USB device 120 and compare it with the registration information of the USB device 120. If the descriptor of the USB device 120 is the same as the registration information of the USB device 120, the switch (e.g., the switch between the external interface UA1 and the external interface UA2) disposed in the USB access control device 110 is closed to enable communication between the USB device 120 and the protected device 130. At this time, the USB device 120 is successfully authenticated, and the USB device 120 and the protected device 130 can communicate via communication data. During communication, the communication data between the USB device 120 and the protected device 130 is monitored via a USB communication data analysis module between the external interface UA1 and external interface UA2 of the USB access control device 110, and the communication data analysis module determines the communication protocol type of the communication data between the two devices in accordance with the USB protocol specifications. Then, the communication between the two devices is controlled according to the communication protocol type of the communication data. For example, by disconnecting the communication between the USB device 120 and the protected device 130, the data in the protected device 130 can be securely protected via the USB access control device 110 externally connected to the protected device 130, effectively preventing data leakage within the protected device 130. Data security for the protected device 130 can be ensured without installing security software on the protected device 130.

[0076] In addition, in an embodiment of the present invention, when the USB device 120 communicates with the protection target device 130, the USB communication data analysis module between the external interfaces UA1 and UA2 of the USB access control device 110 must continuously obtain a descriptor of the USB device 120 and continuously compare the descriptor of the USB device 120 with the registration information of the USB device 120. If the descriptor of the USB device 120 differs from the registration information of the USB device 120, a switch disposed in the USB access control device (for example, a switch between the external interfaces UA1 and UA2) is opened, and the USB device 120 and the protection target device 130 cannot communicate with each other, thereby safely protecting the data of the protection target device 130.

[0077] Specifically, after the USB device 120 is plugged into UA1 of the USB access control device 110, it is connected to the corresponding USB port on the protected device 130 via the internal connection of the USB access control device 110, the plugged-in USB device 120 is powered on, and according to the USB specification, it enters the device recognition process, i.e., the initial enumeration process of the USB device 120. Even after the initial enumeration is successful, the USB communication data analysis module must continue to obtain communication data between the USB device 120 and the protected device 130 in real time. The USB communication data analysis module running on the main control board analyzes the communication data between the USB device 120 and the protected device 130 in real time, extracts descriptors in the enumeration process (e.g., vendor ID, product identifier (PID) and serial number information, number of configurations, identification of the current configuration, number of interfaces supported by the configuration, interface number, interface class, interface subclass, interface protocol, etc.), and compares and collates them with the registered information. If a mismatch is found, the communication between the USB device 120 and the protected device 130 is terminated and a warning message is sent.

[0078] In some embodiments of the present invention, the descriptor of the USB device 120 may include one or more of a device descriptor, a configuration descriptor, an interface descriptor, and an HID descriptor.

[0079] According to the USB protocol specification, one USB device 120 has only one device descriptor, which includes the following table 1:

[0080] [Table 1]

[0081] According to the USB protocol specification, the USB device 120 can have at least one configuration descriptor, and the last item bNumConfigurations in the device descriptor limits the number of configuration descriptors. For example, if the USB device 120 selects one of the current configurations, the configuration descriptor information is as shown in Table 2, and bConfigurationValue is the identifier of the current configuration.

[0082] [Table 2]

[0083] The interface descriptor can be used to describe the status of an interface in the current configuration. For example, a single-function USB device 120 has one interface, such as a USB flash drive. A multi-function USB device 120 has multiple interfaces, such as a composite device that combines a mouse and keyboard, with each interface corresponding to one function. A USB device 120 can have multiple configurations, but only one configuration can be currently selected. If the device type bDeviceClass in the device descriptor is 0, this indicates that the interface descriptor is used to identify a class. In this case, the interface class, interface subclass, and interface protocol are used to describe the class to which this function of the USB device 120 belongs.

[0084] In some embodiments of the present invention, acquiring the descriptor of the USB device may further include sending a Get_Descriptor control packet to the USB device and receiving the device descriptor determined by the USB device according to the Get_Descriptor control packet. In this way, the USB access control device can request acquisition of the device descriptor of the USB device by sending a USB command (e.g., a Get_Descriptor control packet) to the USB device, so that the device descriptor of the USB device can be quickly acquired.

[0085] 3, when the USB device 120 is plugged into the external interface UA1 of the USB access control device 110, the system control module controls the USB communication data analysis module between the internal interface UB and the external interface UA1 to obtain the device descriptor of the USB device 120 and determine whether to close or open the switch arranged in the USB access control device 110 based on the device descriptor. Specifically, when the USB device 120 is plugged into the external interface UA1 of the USB access control device 110, the system control module sends a Get_Descriptor control packet to the USB device 120 via the USB communication data analysis module between the internal interface UB and the external interface UA1. The USB device 120 returns a device descriptor to the USB communication data analysis module based on the control packet, such as bDeviceClass, bDeviceSubClass, bDeviceProtocol, bLength, bDescriptorType, and bString in the device descriptor. In this case, the USB communication data analysis module compares the currently acquired device descriptor with the previously acquired registration information of the USB device 120, and can perform initial enumeration of the USB device 120 in this manner.

[0086] For example, the step of comparing the descriptor of the USB device 120 with the registration information of the USB device 120 includes the steps of comparing whether the bDeviceClass in the device descriptor is the same as the bDeviceClass in the registration information, comparing whether the bDeviceSubClass in the device descriptor is the same as the bDeviceSubClass in the registration information, comparing whether the bDeviceProtocol in the device descriptor is the same as the bDeviceProtocol in the registration information, comparing whether the bLength in the device descriptor is the same as the bLength in the registration information, comparing whether the bDescriptorType in the device descriptor is the same as the bDescriptorType in the registration information, and comparing whether the bString in the device descriptor is the same as the bString in the registration information.

[0087] In some embodiments of the present invention, if the bDeviceClass, bDeviceSubClass, bDeviceProtocol, bLength, bDescriptorType, and bString in the device descriptor match the bDeviceClass, bDeviceSubClass, bDeviceProtocol, bLength, bDescriptorType, and bString in the registration information, a switch disposed in the USB access control device 110 is closed. For example, the switch between the external interface UA1 and the external interface UA2 in the USB access control device 110 is closed.

[0088] In some embodiments of the present invention, if the bDeviceClass, bDeviceSubClass, bDeviceProtocol, bLength, bDescriptorType, and bString in the device descriptor are different from any of the bDeviceClass, bDeviceSubClass, bDeviceProtocol, bLength, bDescriptorType, and bString in the registration information, the switch disposed in the USB access control device 110 is opened. For example, the switch between the external interface UA1 and the external interface UA2 in the USB access control device 110 is opened. Note that if the device descriptor in the descriptor of the USB device 120 is different from the device descriptor in the registration information and the switch in the USB access control device 110 itself is open, it is kept open at this time.

[0089] In some embodiments of the present invention, acquiring the descriptor of the USB device may further include sending a Get_Descriptor_Configuration control packet to the USB device, and receiving the configuration descriptor determined by the USB device according to the Get_Descriptor_Configuration control packet. In this way, the USB access control device can request acquisition of the configuration descriptor of the USB device by sending a USB command (e.g., a Get_Descriptor_Configuration control packet) to the USB device, so that the configuration descriptor of the USB device can be quickly acquired.

[0090] 3 , when a USB device 120 is plugged into the external interface UA1 of the USB access control device 110, the system control module controls the USB communication data analysis module between the internal interface UB and the external interface UA1 to obtain a configuration descriptor for the USB device 120 and determine whether to close or open a switch disposed in the USB access control device 110 based on the configuration descriptor. Specifically, when the USB device 120 is plugged into the external interface UA1 of the USB access control device 110, the USB communication data analysis module between the internal interface UB and the external interface UA1 sends a Get_Descriptor_Configuration control packet to the USB device 120. The USB device 120 returns a configuration descriptor to the USB communication data analysis module based on the control packet, such as bNumInterfaces, bConfigurationValue, and wTotalLength in the configuration descriptor. In this case, the USB communication data analysis module compares the currently obtained configuration descriptor with the previously obtained registration information for the USB device 120, and thus performs initial enumeration of the USB device 120.

[0091] For example, the step of comparing the descriptor of USB device 120 with the registration information of USB device 120 includes the steps of comparing whether bNumInterfaces in the configuration descriptor is the same as bNumInterfaces in the registration information, comparing whether bConfigurationValue in the configuration descriptor is the same as bConfigurationValue in the registration information, and comparing whether wTotalLength in the configuration descriptor is the same as wTotalLength in the registration information.

[0092] In some embodiments of the present invention, if the bNumInterfaces, bConfigurationValue, and wTotalLength in the configuration descriptor match the bNumInterfaces, bConfigurationValue, and wTotalLength in the registration information, a switch disposed in the USB access control device 110 is closed. For example, the switch between the external interface UA1 and the external interface UA2 in the USB access control device 110 is closed.

[0093] In some embodiments of the present invention, if bNumInterfaces, bConfigurationValue, and wTotalLength in the configuration descriptor are different from any of bNumInterfaces, bConfigurationValue, and wTotalLength in the registration information, the switch disposed in the USB access control device 110 is opened. For example, the switch between the external interface UA1 and the external interface UA2 in the USB access control device 110 is opened. Note that if the configuration descriptor in the descriptor of the USB device 120 and the configuration descriptor in the registration information are different and the switch in the USB access control device 110 itself is open, it is kept open at this time.

[0094] In some embodiments of the present invention, acquiring the descriptor of the USB device may further include sending a Get_Descriptor_Configuration control packet to the USB device, and receiving an interface descriptor determined by the USB device according to the Get_Descriptor_Configuration control packet. In this way, the USB access control device can request acquisition of the interface descriptor of the USB device by sending a USB command (e.g., a Get_Descriptor_Configuration control packet) to the USB device, so that the interface descriptor of the USB device can be quickly acquired.

[0095] 3, when the USB device 120 is plugged into the external interface UA1 of the USB access control device 110, the system control module controls the USB communication data analysis module between the internal interface UB and the external interface UA1 to obtain the interface descriptor of the USB device 120 and determine whether to close or open the switch arranged in the USB access control device 110 based on the interface descriptor. Specifically, when the USB device 120 is plugged into the external interface UA1 of the USB access control device 110, the system control module sends a Get_Descriptor_Configuration control packet to the USB device 120 via the USB communication data analysis module between the internal interface UB and the external interface UA1. The USB device 120 returns an interface descriptor to the USB communication data analysis module based on the control packet, such as bInterfaceNumber, bInterfaceClass, bDeviceSubClass, and bInterfaceProtocol in the interface descriptor. In this case, the USB communication data analysis module compares the currently acquired interface descriptor with the previously acquired registration information of the USB device 120, and can perform initial enumeration of the USB device 120 in this manner.

[0096] For example, the step of comparing the descriptor of the USB device 120 with the registration information of the USB device 120 includes the steps of comparing whether the blnterfaceNumber in the interface descriptor is the same as the blnterfaceNumber in the registration information, comparing whether the blnterfaceClass in the interface descriptor is the same as the blnterfaceClass in the registration information, comparing whether the blnterfaceSubClass in the interface descriptor is the same as the blnterfaceSubClass in the registration information, and comparing whether the blnterfaceProtocol in the interface descriptor is the same as the blnterfaceProtocol in the registration information.

[0097] In some embodiments of the present invention, if the descriptor of the USB device 120 is the same as the registration information of the USB device 120, closing the switch arranged in the USB access control device 110 includes closing the switch arranged in the USB access control device 110 if the blnterfaceNumber, blnterfaceClass, blnterfaceSubClass, and blnterfaceProtocol in the interface descriptor match the blnterfaceNumber, blnterfaceClass, blnterfaceSubClass, and blnterfaceProtocol in the registration information. For example, closing the switch between the external interface UA1 and the external interface UA2 in the USB access control device 110.

[0098] In some embodiments of the present invention, when the descriptor of the USB device 120 differs from the registration information of the USB device 120, the step of opening the switch arranged in the USB access control device 110 includes the step of opening the switch arranged in the USB access control device 110 when blnterfaceNumber, blnterfaceClass, blnterfaceSubClass, and blnterfaceProtocol in the interface descriptor differ from any of blnterfaceNumber, blnterfaceClass, blnterfaceSubClass, and blnterfaceProtocol in the registration information. For example, opening the switch between the external interface UA1 and the external interface UA2 in the USB access control device 110. Note that when the interface descriptor in the descriptor of the USB device 120 differs from the interface descriptor in the registration information and the switch itself in the USB access control device 110 is open, it is kept open.

[0099] The above embodiment illustrates that the USB device descriptor can be a device descriptor, a configuration descriptor, or an interface descriptor. The USB device descriptor in the present invention may include a device descriptor, a configuration descriptor, and an interface descriptor. Referring to FIG. 3 , when a USB device 120 is plugged into the external interface UA1 of the USB access control device 110, a USB communication data analysis module between the external interface UA1 and the internal interface UB of the USB access control device 110 obtains the device descriptor, configuration descriptor, and interface descriptor of the USB device 120. For example, a USB command is sent to the USB device 120, and the USB device 120 returns the device descriptor, configuration descriptor, and interface descriptor according to the corresponding USB command. The USB communication data analysis module then compares the device descriptor, configuration descriptor, and interface descriptor with the device descriptor, configuration descriptor, and interface descriptor in the registration information of the USB device 120, i.e., performs initial enumeration of the USB device 120. If the device descriptor, configuration descriptor, and interface descriptor in the descriptor of the USB device 120 match the device descriptor, configuration descriptor, and interface descriptor in the registration information, the switch arranged in the USB access control device 110 is closed. For example, the switch between the external interface UA1 and the external interface UA2 in the USB access control device 110 is closed. Conversely, if the device descriptor, configuration descriptor, and interface descriptor in the descriptor of the USB device 120 differs from any of the device descriptor, configuration descriptor, and interface descriptor in the registration information, the switch arranged in the USB access control device 110 is opened. For example, the switch between the external interface UA1 and the external interface UA2 in the USB access control device 110 is opened. Note that if the device descriptor, configuration descriptor, and interface descriptor in the descriptor of the USB device 120 differs from the device descriptor, configuration descriptor, and interface descriptor in the registration information and the switch in the USB access control device 110 itself is open, it is kept open.

[0100] According to the technical solutions of the above embodiment, if the USB device 120 is an HID device, i.e., a Human Interface Device (HID), the descriptor of the USB device 120 may include an HID descriptor in addition to the above device descriptor, configuration descriptor, and interface descriptor. If the device descriptor, configuration descriptor, interface descriptor, and HID descriptor in the descriptor of the USB device 120 match the device descriptor, configuration descriptor, interface descriptor, and HID descriptor in the registration information, the switch disposed in the USB access control device 110 is closed. Conversely, if the device descriptor, configuration descriptor, interface descriptor, and HID descriptor in the descriptor of the USB device 120 differ from any of the device descriptor, configuration descriptor, interface descriptor, and HID descriptor in the registration information, the switch disposed in the USB access control device 110 is opened. Please note that if the device descriptor, configuration descriptor, and interface descriptor in the descriptor of the USB device 120 differ from the device descriptor, configuration descriptor, and interface descriptor in the registration information, and the switch in the USB access control device 110 itself is in the open state, it will remain in the open state.

[0101] 3 , after the initial enumeration of the USB device 120 is successful, the switch between the external interface UA1 and the external interface UA2 in the USB access control device 110 is closed, allowing the USB device 120 to communicate with the protected device 130. However, while using the USB device 120, the user may change the function of the USB device 120 through hidden functions of the USB device 120, such as by opening a hidden storage area or enabling a storage function. Such an operation may change the descriptor of the USB device 120, triggering a re-enumeration of the USB device 120 and preventing the user from opening other functions of the USB device 120 during use. To prevent this, the USB communication data analysis module analyzes the USB communication data between UA1 and UA2 in real time. If re-enumeration information is found while the USB device 120 is being used after the USB device 120 has been successfully authenticated, the communication between UA1 and UA2 is disconnected and an alert is triggered. For example, after the initial enumeration of the USB device 120 is successful, the switch between the external interface UA1 and the external interface UA2 in the USB access control device 110 is closed, allowing the USB device 120 to communicate with the protected device 130. During communication between the two, the USB communication data analysis module between the external interface UA1 and the external interface UA2 in the USB access control device 110 needs to obtain the descriptor of the USB device 120 in real time. If it detects that the descriptor of the USB device 120 has changed, the switch between the external interface UA1 and the external interface UA2 is opened, and the USB device is re-enumerated. This prevents a user from enabling storage or unauthorized functions of the USB device 120 during actual use, thereby circumventing data security monitoring and causing data leakage on the protected device 130. This enhances the protection of the protected device 130.

[0102] The method provided by the present invention can realize the takeover of each interface of the protected device 130 and ensure that devices using the USB interface or serial port of the protected device 130 can complete the process through the external terminal protection device (i.e., the USB access control device 110), thereby achieving the purpose of protecting the USB interface or serial port of the protected device 130 without installing security software on the protected device 130. For example, when using the USB device 120, the USB access control device 110 compares the descriptor information of the USB device 120 with the registration information of the USB device 120. If the comparison results are different, access to the USB device 120 is prohibited and use of the USB device 120 is discontinued.

[0103] Referring to FIG. 3, the USB communication data analysis module in the USB access control device 110 can be connected in series between the USB device 120 plugged in by the user and the protected device 130, and between the USB device 120 and the system control module in the USB access control device 110. Referring to FIG. 8, by transferring communication data via a data transfer module, the USB communication data analysis module can bypass the connections between the USB device 120 plugged in by the user and the protected device 130, and the system control module in the USB access control device 110. A switch, such as a programmable electronic switch, is provided between the USB device 120 plugged in by the user and the protected device 130, and a control program can control the connection / disconnection between the USB device 120 plugged in by the user and the protected device 130. The USB access control device 110 can be connected to a control center via a network port for centralized management, or can operate independently without a control center.

[0104] Referring to FIG. 9, USB devices require registration, i.e., device authentication, before use. Conventional device authentication only covers the vendor ID (VID), product ID (PID), and serial number information of a USB device. However, because the vendor ID, product ID (PID), and serial number information can be tampered with, this registration does not prevent users from using a USB device to pass the registration review and modifying the firmware information of the USB device to match the vendor ID, product ID (PID), and serial number of a malicious USB device with the information of a legitimate USB registered device. In the above scenario, the registration process in the present invention involves obtaining descriptor information for the USB device, verifying the access mode of the USB device, and loading the corresponding driver. USB descriptors include a device descriptor, a configuration descriptor, an interface descriptor, an endpoint descriptor, and a string descriptor. HID devices also include three descriptors: a HID descriptor, a report descriptor, and a physical descriptor.

[0105] Specifically, before a USB device is inserted into USB access control devices D and F, it must be inserted into the USB registration port UA of USB registered device C and undergo registration authentication. USB registered device C and management workstation B are connected via a USB port. For example, when a USB device is inserted into USB registered device C, the USB device's descriptor, i.e., registration information, can be obtained through a USB communication data analysis module in USB registered device C, and the USB device descriptor can be verified according to the USB protocol specifications. The successfully verified USB device descriptor is then sent to management workstation B via the USB communication port. Management workstation B can report the USB device registration information to management server A via the network, allowing management server A to centrally manage the USB device registration information. When a USB device is inserted into USB access control devices D and F, it can request management server A to obtain the USB device registration information. Therefore, after the USB device is inserted into USB access control devices D and F, the USB device registration information can be compared with the USB device descriptor. If they match, the USB device and the protected devices G and E will be able to communicate with each other. Conversely, if they do not match, the USB device and the protected devices G and E may not be able to communicate with each other.

[0106] In an embodiment of the present invention, the registration and authentication of a USB device can be realized by software or hardware. Fig. 9 shows the implementation of the registration and authentication of a USB device by hardware. For example, the registration and authentication of a USB device is realized by cooperation between a USB registered device C and an administrative workstation B. Fig. 10 shows the implementation of the registration and authentication of a USB device by software installed on the administrative workstation B. For example, a user inserts a USB device into a USB port of the administrative workstation, and the registration and authentication of the USB device is realized through the USB device registration module and USB communication data analysis module in the administrative workstation B.

[0107] When registering and authenticating a USB device, the registration software or hardware reads information such as the device descriptor, configuration descriptor, and interface descriptor of the USB device, and records the current USB interface descriptor information based on the currently used USB device configuration descriptor. This information includes the vendor ID, product identifier (PID), serial number information, number of configurations, current configuration identifier, number of interfaces supported by the configuration descriptor, interface number, interface class, interface subclass, interface protocol, etc. Based on this information, a unique identifier is generated as a genuine USB device mark.

[0108] If the USB device is a Human Interface Device (HID), given the current high volume of attacks against HID devices, the registration software or hardware will also collect HID descriptor information for the HID device. According to the USB protocol specification, the type definition of the HID device is included in the interface descriptor, and the USB device descriptor and configuration descriptor do not include HID device information.

[0109] 9 and 11, the USB communication data analysis module can connect the USB registered port and the USB communication port in a direct connection manner, or can use the data transfer module to realize a bypass connection to the communication line between the USB registered port and the USB communication port.

[0110] It will be understood by those skilled in the art that all or part of the steps for realizing the above-described embodiments can be realized as a computer program executed by a CPU. When the computer program is executed by the CPU, it performs the above-described functions defined by the above-described methods provided by the present disclosure. The program can be stored in a computer-readable recording medium, which can be a read-only memory, a magnetic disk, an optical disk, etc.

[0111] It should be noted that the above-mentioned drawings only schematically illustrate the processes included in the method according to the exemplary embodiments of the present disclosure and are not intended to be limiting. It is easily understood that the processes illustrated in the above-mentioned drawings do not indicate or limit the time order of these processes. It is also easily understood that these processes may be performed synchronously or asynchronously by multiple modules, for example.

[0112] The following are apparatus embodiments of the present disclosure, which can be used to implement method embodiments of the present disclosure. For details not disclosed in the apparatus embodiments of the present disclosure, please refer to the method embodiments of the present disclosure.

[0113] FIG. 12 is a block diagram of a communication control device between a USB device and a protected device according to an exemplary embodiment.

[0114] As shown in FIG. 12, the communication control device 200 between a USB device and a device to be protected includes a monitoring module 210, a communication protocol type determination module 220, and a control module 230.

[0115] Specifically, the monitoring module 210 is used to monitor communication data between the USB device and the device to be protected.

[0116] The communication protocol type determination module 220 is used to determine the communication protocol type of the communication data according to the USB protocol specification.

[0117] The control module 230 is used to cut off the communication between the USB device and the protected device according to the type of communication protocol of the communication data.

[0118] The communication control device 200 between the USB device and the protected device can safely protect the data of the protected device via a USB access control device attached externally to the protected device, effectively preventing data leakage within the protected device, and ensuring data security of the protected device without installing security software on the protected device. For example, after a USB device is plugged into the USB access control device and authentication is successful, the USB access control device monitors the communication data between the USB device and the protected device, determines the communication protocol type of the communication data between them in accordance with the USB protocol specifications, and then disconnects the communication between the USB device and the protected device in accordance with the communication protocol type of the communication data.

[0119] According to one embodiment of the present invention, the communication control device 200 between the USB device and the protected device can be used to realize the communication control method between the USB device and the protected device described in the above embodiment.

[0120] FIG. 13 is a block diagram of an electronic device in accordance with an exemplary embodiment.

[0121] An electronic device 300 according to an embodiment of the present disclosure will be described below with reference to Fig. 13. The electronic device 300 shown in Fig. 13 is merely an example and does not limit the functions and scope of use of the embodiment of the present disclosure.

[0122] 13, the electronic device 300 is embodied in the form of a general-purpose computing device. Components of the electronic device 300 include, but are not limited to, at least one processing unit 310, at least one storage unit 320, a bus 330 connecting different system components (including the storage unit 320 and the processing unit 310), a display unit 340, etc.

[0123] The storage unit stores program code that can be executed by the processing unit 310 to cause the processing unit 310 to perform steps according to various exemplary embodiments of the present disclosure herein. For example, the processing unit 310 can perform the steps illustrated in FIGS. 2-6.

[0124] The storage unit 320 may include a readable medium in the form of volatile memory, such as random access memory (RAM) 3201 and / or cache memory 3202 , and may also include read only memory (ROM) 3203 .

[0125] The storage unit 320 may also include a program / utility 3204 having a set (at least one) program module 3205, including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which, or some combination thereof, may be included to implement a network environment.

[0126] Bus 330 can represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.

[0127] The electronic device 300 may also communicate with one or more external devices 300 (e.g., a keyboard, a pointing device, a Bluetooth device, etc.) to allow a user to interact with the electronic device 300 and / or to communicate with any device (e.g., a router, a modem, etc.) that allows the electronic device 300 to communicate with one or more other computing devices. This communication may occur via an input / output (I / O) interface 350. The electronic device 300 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network such as the Internet) via a network adapter 360. The network adapter 360 may communicate with other modules of the electronic device 300 via a bus 330. While not shown, it will be apparent that other hardware and / or software modules may be used in conjunction with the electronic device 300, including, but not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, data backup storage systems, etc.

[0128] Through the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described herein can be realized by software, or by a combination of software and necessary hardware. Therefore, as shown in Figure 14, the technical means according to the embodiments of the present disclosure can be embodied in the form of a software product, and the software product (including some instructions) can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a portable storage device, etc.) or on a network, so that a computing device (which can be a personal computer, a server, a network device, etc.) executes the above method according to the embodiments of the present disclosure.

[0129] The software product may be implemented using any combination of one or more readable media. The readable medium may be a readable signal medium or a readable recording medium. The readable medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (non-exhaustive list) of readable recording media include an electrical connection having one or more conductors, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0130] The computer-readable medium may include a propagated data signal, either in baseband or as part of a carrier wave, having computer-readable program code loaded therein. Such propagated data signals may take various forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable medium may also be any readable medium other than a computer-readable recording medium, which may transmit, propagate, or transmit a program for use in or in connection with an instruction execution system, apparatus, or device. The program code contained in the computer-readable medium may be transmitted over any suitable medium, including, but not limited to, wireless, electrical wire, optical cable, RF, or the like, or any suitable combination thereof.

[0131] Computer program code for carrying out the operations of the present disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, and the like, as well as general process-based programming languages ​​such as "C" or similar programming languages. The program code may run entirely on the user computing device, partially on the user computing device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the context of a remote computing device, the remote computing device may be connected to the user computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet Service Provider).

[0132] The computer-readable recording medium has one or more programs loaded thereon. When the one or more programs are executed by the device, the computer-readable recording medium can achieve the following functions: securely protecting data in the protected device via a USB access control device externally connected to the protected device, effectively preventing data leakage from the protected device, and ensuring data security for the protected device without installing security software on the protected device. For example, after a USB device is plugged into the USB access control device and authentication is successful, the USB access control device monitors the communication data between the USB device and the protected device, determines the communication protocol type of the communication data between them in accordance with the USB protocol specifications, and then disconnects the communication between the USB device and the protected device according to the communication protocol type of the communication data.

[0133] Those skilled in the art will understand that the above-mentioned modules can be distributed within an apparatus according to the description of the embodiments, or can be appropriately modified within one or more apparatuses that differ only from the present embodiment. The modules of the above-mentioned embodiments can be integrated into one module or further divided into multiple sub-modules.

[0134] Through the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described herein can be realized by software, or by a combination of software and necessary hardware. Therefore, the technical means according to the embodiments of the present disclosure can be embodied in the form of a software product, and the software product (including some instructions) can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a portable storage device, etc.) or on a network, so that a computing device (which can be a personal computer, a server, a network device, etc.) executes the method according to the embodiments of the present disclosure.

[0135] While exemplary embodiments of the present disclosure have been specifically shown and described, it is understood that the present disclosure is not limited to the details of construction, arrangement, or implementation set forth herein, but rather, the present disclosure is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. A method for controlling communication between a USB device and a protected device, the method being applied to a USB access control device connected to the protected device via an interface, comprising: monitoring, by the USB access control device, communication data between a USB device that has been inserted into the USB access control device and successfully authenticated, and the protection target device; determining a communication protocol type of the communication data by the USB access control device in accordance with a USB protocol specification; disconnecting the communication between the USB device and the protection target device by the USB access control device according to the type of communication protocol of the communication data; The step of determining the type of communication protocol of the communication data in accordance with the USB protocol specification includes: obtaining communication protocol information from the communication data in accordance with the USB protocol specification; determining, based on the communication protocol information, that the communication protocol type of the communication data is a custom transfer protocol; The step of disconnecting the communication between the USB device and the protection target device according to the communication protocol type of the communication data includes: If the communication protocol type of the communication data is the custom transfer protocol, determining whether the communication data is unanalyzable data; If the communication data is unanalyzable data, disconnecting communication between the USB device and the protected device. A method for controlling communication between a USB device and a device to be protected, comprising:

2. The step of determining a communication protocol type of the communication data in accordance with the USB protocol specifications includes: obtaining communication protocol information from the communication data in accordance with the USB protocol specification; and determining, based on the communication protocol information, that the communication protocol type of the communication data is a bulk transfer protocol. A method for controlling communication between the USB device according to claim 1 and a device to be protected.

3. The step of disconnecting the communication between the USB device and the protection target device according to the communication protocol type of the communication data includes: If the communication protocol type of the communication data is the bulk transfer protocol, disconnecting communication between the USB device and the protected device.

3. A method for controlling communication between a USB device and a device to be protected according to claim 2.

4. The step of determining a communication protocol type of the communication data in accordance with the USB protocol specifications includes: obtaining communication protocol information from the communication data in accordance with the USB protocol specification; and determining, based on the communication protocol information, that the communication protocol type of the communication data is an isochronous transfer protocol. A method for controlling communication between the USB device according to claim 1 and a device to be protected.

5. The step of disconnecting the communication between the USB device and the protection target device according to the communication protocol type of the communication data includes: If the communication protocol type of the communication data is the isochronous transfer protocol, confirming the data flow direction of the communication data; If the direction of the data flow is from the protected device to the USB device, disconnecting communication between the USB device and the protected device.

5. A method for controlling communication between a USB device and a device to be protected according to claim 4.

6. The step of determining a communication protocol type of the communication data in accordance with the USB protocol specifications includes: obtaining communication protocol information from the communication data in accordance with the USB protocol specification; and determining, based on the communication protocol information, that the communication protocol type of the communication data is an interrupt transfer protocol. A method for controlling communication between the USB device according to claim 1 and a device to be protected.

7. The step of disconnecting the communication between the USB device and the protection target device according to the communication protocol type of the communication data includes: If the communication protocol type of the communication data is the interrupt transfer protocol, confirming the data flow direction of the communication data; If the direction of the data flow is from the protected device to the USB device, disconnecting communication between the USB device and the protected device.

7. A method for controlling communication between a USB device and a device to be protected according to claim 6.

8. The method further includes a step of transmitting an alarm message to the protected device when communication between the USB device and the protected device is interrupted. A method for controlling communication between the USB device according to claim 1 and a device to be protected.

9. before the USB access control device is powered on, closing a switch disposed on the USB access control device to allow normal communication between the USB device and the protected device; or After the USB access control device is powered on, the method further includes opening a switch disposed on the USB access control device to trigger an enumeration mechanism of the USB device. A method for controlling communication between the USB device according to claim 1 and a device to be protected.

10. A communication control device between a USB device and a protected device, which is applied to a USB access control device connected to the protected device via an interface, a monitoring module for monitoring communication data between the USB device and the protected device after the USB device is plugged into the USB access control device and is successfully authenticated; a communication protocol type determination module for determining a communication protocol type of the communication data in accordance with a USB protocol specification; a control module for disconnecting communication between the USB device and the protected device in accordance with a communication protocol type of the communication data; The communication protocol type determination module: obtaining communication protocol information from the communication data in accordance with the USB protocol specification; determining, based on the communication protocol information, that the communication protocol type of the communication data is a custom transfer protocol; The control module for disconnecting the communication is If the communication protocol type of the communication data is the custom transfer protocol, determining whether the communication data is unanalyzable data; If the communication data is unanalyzable data, the communication between the USB device and the device to be protected is cut off. A communication control device between a USB device and a device to be protected.

11. one or more processors; a storage device for storing one or more programs, The one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method according to any one of claims 1 to 9. An electronic device characterized by:

12. Storing a computer program, which when executed by a processor, implements the method according to any one of claims 1 to 9 A computer-readable recording medium comprising:

Images