External protection device and method for protecting HID keyboard and mouse devices.

Abstract

The objective of the present invention is to provide an external protection device and method for protecting HID keyboard and mouse devices. [Solution] The device proposes an external protection device for protecting HID keyboard / mouse devices, comprising an HID internal interface for connecting to an HID input interface of a device to be protected, an HID external interface for connecting to an external device, a transfer control module connected to the HID internal interface and the HID external interface, and a protocol analysis module for performing a protocol analysis of the external device connected to the HID external interface to determine whether the external device is a genuine HID keyboard / mouse device, and the transfer control module controls the connection or disconnection of the HID internal interface and the HID external interface based on the judgment result provided by the protocol analysis module in order to prevent an unauthorized HID keyboard / mouse device from connecting to the device to be protected. The present invention can prevent the destruction of the device to be protected due to the connection of an unauthorized HID keyboard / mouse device.

Description

Technical Field

[0001] The present invention belongs to the technical field of device security protection, and particularly relates to an external protection device and method for protecting HID keyboard and mouse devices.

Background Art

[0002] In computer systems such as industrial control systems, commercial systems or office systems, the means of unauthorized intrusion are becoming increasingly concealed and complex, so the security protection of the system is being increasingly emphasized. One way to intrude into a computer system is to insert a disguised or modified user input device such as a keyboard or mouse into the system interface, send unauthorized code to the system to read, write or destroy the system illegally.

[0003] In order to prevent a user from destroying the system using a mouse or keyboard, Patent Document 1 proposes a method for auditing and controlling PS / 2 mouse and keyboard operations, particularly a method for auditing and controlling host PS / 2 mouse and keyboard operations. Mainly, a microcontroller analyzes the PS / 2 mouse and keyboard protocols, obtains the movement information of the mouse and keyboard without affecting the use of the host, and can also control the on and off of the PS / 2 mouse and keyboard.

[0004] However, existing technologies cannot distinguish whether a mouse or keyboard connected to a system is a genuine mouse or keyboard, or a fraudulent device disguised as a mouse or keyboard. Furthermore, conventional technologies cannot audit or authenticate the legitimacy and operation of devices such as mice and keyboards connected to the corresponding interface in real time unless auditing software is installed on the protected device. Since fraudulent devices disguised as mice and keyboards can generate normal keyboard and mouse operation data while exchanging fraudulent data, conventional technologies cannot actually protect against access or operation by fraudulent devices, nor can they record and audit normal operation.

[0005] Furthermore, current mice and keyboards generally do not use the PS / 2 interface, but rather the more versatile USB interface which supports HID devices. [Prior art documents] [Patent Documents]

[0006] [Patent Document 1] Chinese Patent No. ZL 201410564213.7 Publication [Overview of the Initiative] [Problems that the invention aims to solve]

[0007] Therefore, one aspect of the present invention aims to solve the problem that the prior art cannot effectively prevent unauthorized devices from disguising themselves as keyboards and mice and disrupting the system.

[0008] Another aspect of the present invention aims to solve the problem that when auditing software cannot be installed on the protected device, keyboard and mouse communication protocols and operation actions cannot be recorded and audited. [Means for solving the problem]

[0009] To achieve the above objective, as a first aspect of the present invention, an external protection device for protecting HID keyboard and mouse devices is proposed, comprising: an HID internal interface for connecting to the HID input interface of a device to be protected; an HID external interface for connecting to an external device; a transfer control module connected to the HID internal interface and the HID external interface, respectively; and a protocol analysis module for performing protocol analysis on an external device connected to the HID external interface to determine whether the external device is a legitimate HID keyboard and mouse device. The transfer control module controls the connection or disconnection of the HID internal interface and the HID external interface based on the determination result provided by the protocol analysis module in order to prevent an unauthorized HID keyboard and mouse device from connecting to the device to be protected.

[0010] According to a preferred embodiment of the present invention, controlling the connection or disconnection of the HID internal interface and the HID external interface based on the determination results provided by the protocol analysis module includes controlling the disconnection of the HID internal interface and the HID external interface if the external device is determined to be an unauthorized HID keyboard / mouse device or a non-HID keyboard / mouse device after protocol analysis, and controlling the connection of the HID internal interface and the HID external interface if the external device is determined to be a legitimate HID keyboard / mouse device after protocol analysis.

[0011] According to a preferred embodiment of the present invention, if the external device is a HID keyboard, the protocol analysis module is used to monitor and record input data from the HID keyboard, and if the input data includes data from a predetermined blacklist, the protocol analysis module instructs the transfer control module to control the disconnection of the HID internal interface and the HID external interface.

[0012] According to a preferred embodiment of the present invention, the external protection device further comprises a video internal interface for connecting to the video output interface of the protected device, a video external interface for connecting to a video device, and a screen recording module connected to the video internal interface for recording video data output from the protected device.

[0013] According to a preferred embodiment of the present invention, the screen recording module is connected to the protocol analysis module and is under the control of the protocol analysis module, and when the protocol analysis module determines that the external device has performed a specific operation, it controls the screen recording module to perform a video data recording operation.

[0014] According to a preferred embodiment of the present invention, the external protection device further comprises an image processing module connected to the screen recording module and the protocol analysis module, respectively, which acquires real-time video data from the screen recording module, analyzes the video data in real time, and, if the analysis results indicate an abnormality in the video data, notifies the protocol analysis module to control the disconnection of the HID internal interface and the HID external interface.

[0015] According to a preferred embodiment of the present invention, the real-time analysis includes extracting frame images from the video data, identifying the obtained frame images, and generating an analysis result indicating that there is an anomaly in the video data if the identification result includes a predetermined blacklist operation.

[0016] According to a preferred embodiment of the present invention, the real-time analysis includes extracting frame images from the video data, calculating the image features of the frame images, comparing them with the image features of a predetermined image, and generating an analysis result indicating that there is an anomaly in the video data if the similarity between the image features of the frame images and the image features of the predetermined image is higher than a threshold.

[0017] Another aspect of the present invention proposes a device protection method for protecting HID keyboard and mouse devices, which includes the steps of: providing an external protection device to take over the HID input interface of the device to be protected; performing a protocol analysis on an external device connected to the external protection device to determine whether the external device is a legitimate HID keyboard and mouse device; and controlling the connection or disconnection of the external device and the device to be protected based on the determination result to prevent an unauthorized HID keyboard and mouse device from connecting to the device to be protected.

[0018] According to a preferred embodiment of the present invention, controlling the connection or disconnection of the external device and the protected device based on the determination result includes controlling the disconnection of the external device and the protected device if the external device is determined to be an unauthorized HID keyboard / mouse device or a non-HID keyboard / mouse device after protocol analysis, and controlling the connection of the external device and the protected device if the external device is determined to be a legitimate HID keyboard / mouse device after protocol analysis.

[0019] According to a preferred embodiment of the present invention, if the external device is a HID keyboard, the method further includes the steps of monitoring and recording input data from the HID keyboard, and controlling the disconnection of the external device from the protected device if the input data includes data from a predetermined blacklist.

[0020] According to a preferred embodiment of the present invention, the method further includes monitoring data transfer between an external device and a protected device in real time, and interrupting data transfer from the protected device to the external device when it is detected that there is a risk in a USB IN transaction or that data exists in a USB OUT transaction. [Effects of the Invention]

[0021] Compared with the prior art, the present invention has at least the following advantageous effects.

[0022] (1) Since the present invention has a transfer control module controlled by a protocol analysis module, an illegal HID keyboard / mouse device cannot be connected to the protected device, solving the problem that an illegal device disguises as a keyboard or mouse to destroy the system, and strengthening the protection of the system from illegal HID keyboard / mouse devices.

[0023] (2) Since the present invention has a keyboard input monitoring / recording module controlled by a protocol analysis module, illegal keyboard input operations can be effectively blocked.

[0024] (3) Since the present invention has a real-time screen recording module, real-time backup and monitoring of the interface image can be realized, and the operations of HID keyboard / mouse devices can be monitored in real time.

[0025] (4) Since the present invention has an image analysis module, illegal operations of normal HID keyboard / mouse devices can be analyzed in real time, further improving the security of HID keyboard / mouse device connections.

Brief Description of the Drawings

[0026] [Figure 1] It is a schematic configuration diagram of an external protection device for protecting HID keyboard / mouse devices according to Embodiment 1 of the present invention. [Figure 2] It is a schematic configuration diagram of an external protection device for protecting HID keyboard / mouse devices according to Embodiment 2 of the present invention. [Figure 3] It is a schematic configuration diagram of an external protection device for protecting HID keyboard / mouse devices according to Embodiment 3 of the present invention. [Figure 4] It is a flowchart of a device protection method for protecting HID keyboard / mouse devices according to an embodiment of the present invention. [Modes for carrying out the invention]

[0027] To further clarify the object, technical means, and advantages of the present invention, the present invention will be described in more detail below with reference to the drawings and specific embodiments.

[0028] To address the problem that conventional technologies cannot effectively prevent unauthorized devices from disguising themselves as keyboards and mice to disrupt systems, the present invention proposes an External Protective Device (EPD) for protecting HID keyboard / mouse devices (Human Interface Devices of Keyboard or Mouse). An External Protective Device is a physical device attached externally to the protected device, and by taking over a specific interface of the protected device (PD), it allows external devices that need to access the protected device to do so simply by connecting to the External Protective Device. This achieves the objective of protecting the protected device without requiring the installation of security protection software on the protected device.

[0029] HID devices, also known as Human Interface Devices, are peripherals that allow humans to directly interact with computers. Unlike other devices such as external hard drives or wireless cards, HIDs typically have buttons or controls, enabling information exchange between humans and computers. Many modern human-machine interface devices use the Universal Serial Bus (USB) communication protocol. Before the term HID devices was used, the number of protocols available for computer equipment was limited. Manufacturers were restricted from producing input devices that fell into a narrow category, and computer companies were forced to create drivers every time a new experimental input controller was developed. HID devices address this limitation and facilitate the development of new types of input devices. HID devices contain pre-programmed data called HID descriptors, which are information that the device reports to the host when it first connects. HID descriptors tell the computer the purpose of each packet sent from the interface device. Essentially, this data provides the host with "updates" and informs the computer what input is needed. While much HID hardware is designed to allow users to control the computer, the protocols are not limited to input. HID output can also be sent from a computer to a device. This communication function is typically used to provide information such as status lights.

[0030] In this invention, an HID keyboard / mouse device refers to a mouse or keyboard that conforms to the HID definition. Many current keyboards, mice, and other devices are configured as HID keyboard / mouse devices precisely because of the relatively versatile nature of HID devices, which provides more convenient conditions for connecting unauthorized HID keyboard / mouse devices. Therefore, this invention proposes an external protection device for protecting HID keyboard / mouse devices. This external protection device includes at least an HID internal interface, an HID external interface, a transfer control module, and a protocol analysis module. The HID internal interface is used to connect to the HID input interface of the protected device, and the HID external interface is used to connect to an external device. Since the HID input interface is typically a USB interface, the HID internal and external interfaces of this invention are typically interfaces compliant with the USB protocol. However, the HID internal and external interfaces of this invention do not preclude interface types compliant with other standard protocols.

[0031] In this invention, the protected device refers to a computer system with security requirements, such as an industrial control host or server, but may also be other commercial or home computer equipment. This invention is not limited to the operating system used, as long as the host or server of the protected device has the ability to connect to HID devices and a corresponding hardware interface (HID input interface). For example, if the protected device has a USB interface for connecting to devices such as a keyboard or mouse, this invention allows the HID internal interface of the external protection device to be directly connected to the protected device via a USB connection cable. Preferably, the external protection device has multiple internal interfaces to connect to all HID input interfaces of the protected device, forming comprehensive protection for the HID input interfaces.

[0032] When an external protection device is connected to all HID input interfaces of the protected device, the external protection device is equivalent to taking over the HID inputs of the protected device. External devices (including HID keyboard / mouse devices or other devices that may impersonate HID keyboard / mouse devices) must be connected to the external protection device if they need to connect to the protected device for user input operations. Specifically, such external devices are connected to the HID external interface of the external protection device, which is usually also an interface that conforms to the USB standard protocol.

[0033] To perform safety monitoring of external devices connected to the external protection device of the present invention, the external protection device has several functional modules inside. In the present invention, a module refers to hardware or software having a specific function, or a combination of software and hardware. For example, a module may be a microcontroller on which a specific computer program is written, or it may be a component having a specific function consisting of a general-purpose processor capable of reading and executing the computer program, and associated control circuits. Here, different modules are distinguished only functionally, and in concrete implementation, each can be implemented with different hardware or software, can be implemented with the same hardware or the same software, or can be partially implemented with hardware and partially implemented with software.

[0034] As described above, the external protection device of the present invention comprises a transfer control module and a protocol analysis module. The transfer control module is connected to the HID internal interface and the HID external interface, respectively. The protocol analysis module is connected to the transfer control module and performs protocol analysis on external devices connected to the HID external interface to determine whether the external device is a legitimate HID keyboard / mouse device. To prevent unauthorized HID keyboard / mouse devices from connecting to the protected device, the transfer control module controls the connection or disconnection of the HID internal interface and the HID external interface based on the determination results provided by the protocol analysis module. Furthermore, the transfer control module detects in real time whether the HID external interface is connected to an external device. When it detects that an external device is connected, the protocol analysis module performs protocol analysis in real time to determine the legitimacy of the external device. Based on this determination, it decides whether to connect the HID internal interface and the HID external interface. This prevents fake or unauthorized HID keyboard / mouse devices from connecting to the internal interface, fundamentally preventing unauthorized access to the protected equipment by those without access privileges by impersonating or forging HID keyboard / mouse devices.

[0035] Specifically, the aforementioned determination and control means that if the external device is determined to be an unauthorized HID keyboard / mouse device without protocol analysis, or after protocol analysis, the system controls the disconnection of the HID internal interface and the HID external interface; and if the external device is determined to be a legitimate HID keyboard / mouse device after protocol analysis, the system controls the connection of the HID internal interface and the HID external interface. In this way, after protocol analysis, only legitimate HID keyboard / mouse devices are permitted to connect to the protected equipment.

[0036] Specifically, the protocol analysis process in this invention is as follows:

[0037] (1) Device Enumeration Stage USB device characteristics are described by the USB descriptor in the USB device's internal firmware. After a USB device is plugged into the USB interface of a computer or other device, the USB controller of the computer or other device retrieves the USB device's descriptor information to determine how to access the USB device and load the corresponding driver. The USB descriptor includes a device descriptor (vendor ID, product ID (PID), and serial number information), a configuration descriptor (number of configurations, currently used configuration ID, and number of interfaces supported by the configuration descriptor), an interface descriptor (interface subclass, interface protocol), an endpoint descriptor, and a string descriptor. HID class devices compliant with the USB protocol also include three additional descriptors: an HID descriptor, a report descriptor, and a physical descriptor.

[0038] Therefore, the protocol analysis module of the present invention, when connected to the transfer control module, acquires data transmitted from an external device connected on the HID external interface that conforms to the USB communication protocol, monitors the communication process of the external device in real time, and controls the connected device on the HID external interface.

[0039] When an external device is plugged into the HID external interface, the transfer control module initiates USB device enumeration. During the USB device enumeration process, the transfer control module receives data for USB device enumeration transmitted from the external device and sends it to the protocol analysis module, which analyzes the data received from the transfer control module. If the data conforms to the USB protocol, the protocol analysis module extracts vendor ID, product ID (PID) and serial number information, number of configurations, currently used configuration ID, number of interfaces supported by the configuration descriptor, interface number, interface class, interface subclass, interface protocol, etc., in accordance with the USB protocol specification.

[0040] According to the USB protocol specification, the type of HID device is defined in the interface descriptor. According to the present invention, the protocol analysis module determines the type of external device based on the information in the interface descriptor, and if it is determined that the external device is neither an HID device nor a USB composite device (a device having HID and other USB characteristics, for example, a USB storage + HID class device), the protocol analysis module sends a command to the transfer control module to block the connection of the external device.

[0041] (ii) Device usage stage According to the USB specification, the transmission type for HID devices is interrupt transfer. The token packets for transmitted transactions are issued by the USB Host, meaning that all USB transactions (Setup transactions, IN transactions, OUT transactions) are controlled by the USB Host.

[0042] Since HID devices are input devices, the direction of uncontrolled data flow can only be from the HID device to the host. To address the problem that keyboard and mouse communication protocols and operation actions cannot be recorded and audited when audit software cannot be installed on the protected device, the protocol analysis module of the present invention monitors data transfers between external devices and the protected device in real time, monitors interrupted transfers, executes USB IN transactions, and strictly reviews USB OUT transactions (i.e., permits data transfer from the external device as a USB device to the protected device and strictly reviews data transfers from the protected device to the external device). If the data in a USB IN transaction is determined to be at risk according to predetermined rules, the data transfer between the external device and the protected device is interrupted. At the same time, if the data in a USB OUT transaction is being monitored, the data transfer between the external device and the protected device is also interrupted.

[0043] If the external device is determined to be an HID keyboard, the protocol analysis module of the present invention also monitors and records the input data of the HID keyboard. If the input data contains data from a predetermined blacklist, the protocol analysis module instructs the transfer control module to control the disconnection of the HID internal interface and the HID external interface. The data in the blacklist may be, for example, operation commands that are harmful to the computer (e.g., commands to connect to a network, transfer data, or execute a specific program).

[0044] To address the problem of being unable to record and audit keyboard and mouse communication protocols and operation actions when audit software cannot be installed on the protected device, a preferred embodiment of the present invention provides an external protection device that also includes screen recording and video monitoring functions. This function is intended to prevent unauthorized persons from performing unauthorized operations using legitimate HID keyboard and mouse devices. In other words, even if a legitimate external HID keyboard and mouse device is connected to the protected device via the external protection device of the present invention, operations such as mouse and keyboard use by personnel (deleting data, formatting memory, copying files, etc.) could potentially cause significant risks to the system.

[0045] Therefore, on the one hand, the external protection device of the present invention may include a video interface, and the video interface includes an internal video interface and an external video interface. The internal video interface is connected to the video output interface of the protected device, and the external video interface is connected to a video device. Thus, the present invention can acquire video output data output by the protected device and display it via an external video device. The video interface is, for example, a VGA interface, an HDMI interface, etc., and the video device may be a separate display or a display integrated into the external protection device. Thus, the user can monitor the user's operations on the protected device through the video device.

[0046] On the other hand, the external protection device of the present invention may also include a screen recording module connected to the internal video interface for recording video data output by the protected device. The screen recording module is essentially a video storage module that can save images displayed on the screen as video, selectively compress them during saving, and save them in a predetermined video format. The saved video data can be retrieved as backup data when needed for subsequent analysis, and can also be periodically transmitted to a corresponding control center for daily analysis.

[0047] In a preferred embodiment, to save video storage space, the screen recording module is connected to and controlled by the protocol analysis module. Therefore, when the protocol analysis module determines that the external device has performed a specific operation, it controls the screen recording module to perform video data recording. Typically, the protocol analysis module can control the screen recording module to perform the recording operation only when a mouse, keyboard, or other HID keyboard / mouse device is in motion.

[0048] In a more preferred embodiment, the external protection device of the present invention further comprises a real-time image analysis module for detecting in real time any unauthorized operations performed by a legitimate HID keyboard / mouse device. Specifically, the external protection device of the present invention further comprises an image processing module connected to the screen recording module and the protocol analysis module, respectively, which acquires real-time video data from the screen recording module, analyzes the video data in real time, and, if the analysis results indicate an abnormality in the video data, notifies the protocol analysis module to control the disconnection of the HID internal interface and the HID external interface.

[0049] As a real-time analysis method, frame images are extracted from the video data, the acquired frame images are OCR-recognized, and if the OCR recognition result contains predetermined blacklist text, an analysis result indicating that there is an anomaly in the video data is generated. For example, if the text in the OCR recognition window contains "delete," "copy," or a specific software name, it is determined that there is an anomaly in the video data. Another method of real-time analysis is to extract frame images from the video data, calculate the image features of the frame images, compare them with the image features of a predetermined image, and if the similarity between the image features of the frame images and the image features of the predetermined image is higher than a threshold, an analysis result indicating that there is an anomaly in the video data is generated. The predetermined image is, for example, a typical interface that appears when a computer is destroyed, such as a shutdown interface, a restart interface, or a command line interface.

[0050] The present invention will be further described below through specific examples. These specific examples are merely some concrete examples for carrying out the present invention, and their operation is primarily to illustrate possible embodiments of the present invention. However, it should be understood that this does not mean that the present invention can only be carried out in the form of these specific examples, and that the technical means of the specific examples should not be directly interpreted as the scope of protection claimed by the present invention.

[0051] (Example 1) Figure 1 is a schematic diagram of an external protection device for protecting HID keyboard and mouse devices according to Embodiment 1 of the present invention. As shown in Figure 1, the external protection device 1 has a first HID internal interface 101 and a second HID internal interface 102 which are connected to the first HID input interface 201 and the second HID input interface 202 of the device to be protected, respectively. The external protection device 1 further has a first HID external interface 111 and a second HID external interface 112. The first HID external interface 111 and the second HID external interface 112 are used to connect to external devices, and here, as an example, they are connected to a mouse 3 having a USB interface and a keyboard 4 having a USB interface, respectively. The external protection device 1 also includes a protocol analysis module 12 and a transfer control module 13, which are implemented as hardware modules having information processing capabilities in this embodiment. Specifically, the protocol analysis module can be composed of a programmable device, and the transfer control module includes controlled electronic switches.

[0052] However, those skilled in the art will understand that the protocol analysis module 12 and the forwarding control module 13 can be combined into a single piece of hardware, or that both can be implemented as software modules executed by a general-purpose processor.

[0053] As shown in Figure 1, the transfer control module 13 is connected to the first HID internal interface, the second HID internal interface, the first HID external interface, and the second HID external interface, respectively, and controls the connection or disconnection of the first HID internal interface and the first HID external interface, and the connection or disconnection of the second HID internal interface and the second HID external interface, respectively. The protocol analysis module 12 is connected to the connection terminal and control terminal of the transfer control module 13 (only one line in the figure represents the connection relationship, not that there is only one connection line), and the protocol analysis module 12 reads information from the first HID external interface and the second HID external interface from the connection terminal and sends commands to the control terminal to control the operation of the corresponding electronic switches inside the transfer control module 13. Based on the information provided from the first HID external interface 111 and the second HID external interface 112, the protocol analysis module 12 performs protocol analysis on external devices connected to the two HID external interfaces (referring to mouse 3 and keyboard 4 in the figure) to determine whether the external devices are legitimate HID keyboard and mouse devices.

[0054] The transfer control module 13 controls the connection or disconnection of each HID internal interface and HID external interface according to commands (representing the judgment result) input from the control terminal by the protocol analysis module 12, thereby preventing unauthorized HID keyboard / mouse devices from connecting to the protected equipment. Here, since the protocol analysis module is connected to the input terminal of the transfer control module, when the transfer control module 13 detects that the HID external interface has been connected to an external device, the protocol analysis module 12 performs protocol analysis in real time to determine the legitimacy of the external device, and based on the judgment result, decides whether to connect the HID internal interface and the HID external interface. As a result, fake or unauthorized HID keyboard / mouse devices cannot connect to the internal interface, fundamentally preventing unauthorized access to the protected equipment by impersonating or forging HID keyboard / mouse devices.

[0055] When the protocol analysis module 12 determines whether an external device is a legitimate HID keyboard / mouse device, the following actions are performed:

[0056] When an external device is plugged into the HID external interface, the transfer control module 13 initiates USB device enumeration. Through USB protocol analysis during the device enumeration process, the protocol analysis module 12 can extract information from the protocol data, including the vendor ID, product ID (PID), and serial number information in the USB protocol specification, the number of configurations, the currently used configuration ID, the number of interfaces supported by the configuration descriptor, the interface number, the interface class, the interface subclass, the interface protocol, and so on.

[0057] According to the USB protocol specification, the type of HID device is defined in the interface descriptor. The protocol analysis module 12 first checks the bDeviceClass, bDeviceSubClass, and bDeviceProtocol values ​​of the device descriptor, and only if all three values ​​are equal to 3 does the USB device meet the device requirements for the HID class.

[0058] The protocol analysis module 12 also extracts relevant content from the interface descriptor and checks it based on the following:

[0059] In the interface descriptor, the value of blnterfaceClass must be 0x03, and the value of blnterfaceSubClass must be 0 or 1. If it is 1, the HID device is a boot device (generally meaningful for a PC, meaning that the BIOS can recognize the HID device being used at startup; only a standard mouse or keyboard can be called a boot device), and if it is 0, the HID device is a device that can only be recognized and used after the operating system has started. Meaning of possible values ​​for blnterfaceProtocol: 1 is Keyboard, 2 is Mouse.

[0060] Furthermore, when the protocol analysis module determines that an external device is a HID keyboard, it monitors and records the input data from the HID keyboard. If the input data contains data from a predetermined blacklist, the protocol analysis module instructs the transfer control module to disconnect the HID internal interface and the HID external interface. Data in the blacklist includes, for example, operational commands that are harmful to the computer (e.g., commands to connect to a network, transfer data, or execute a specific program).

[0061] (Example 2) Figure 2 is a schematic diagram of an external protection device for protecting an HID keyboard / mouse device according to Embodiment 2 of the present invention. As shown in Figure 2, the difference from Embodiment 1 is that the external protection device 1 of Embodiment 2 further comprises a video internal interface 103, a video external interface 113, and a screen recording module 14. The video internal interface 103 is connected to the video output interface 203 of the protected device, and the video external interface 113 is connected to the display 5. The video interface in this embodiment is a VGA interface, but it can be replaced with an HDMI interface or the like in other embodiments. Also, in other embodiments, the display 5 may be a display screen integrated into the external protection device 1. The user can monitor the user's operations on the protected device through the display 5.

[0062] As shown in Figure 2, the screen recording module 14 is connected to the internal video interface 103 and is used to record video data output from the protected device. The screen recording module 14 can be configured as a storage controller with large-capacity storage capabilities, and can save images displayed on the screen as videos. It is also preferable that the video can be selectively compressed during saving and saved in a predetermined video format.

[0063] Furthermore, in this embodiment 2, in order to save space on video storage, the control end of the screen recording module 14 is connected to the protocol analysis module 12 so that it is under the control of the protocol analysis module. The protocol analysis module 12 performs the recording operation only when it determines that the external device has performed an operation such as a mouse or keyboard. In other embodiments, other conditions for starting or stopping recording can also be set.

[0064] Figure 3 is a schematic configuration diagram of an external protection device for protecting HID keyboard and mouse devices according to Embodiment 3 of the present invention. This embodiment is an improvement over Embodiment 2. As shown in Figure 3, the external protection device of Embodiment 3 further includes a real-time image analysis module 15 for detecting unauthorized operations performed by a legitimate HID keyboard and mouse device in real time. The real-time image analysis module 15 is connected to the screen recording module 14 and the protocol analysis module 12, respectively, and is used to acquire real-time video data from the screen recording module 14, analyze the video data in real time, and, if the analysis result indicates an abnormality in the video data, notify the protocol analysis module 12 to control the disconnection of the HID internal interface and the HID external interface. In this embodiment, the image analysis module 15 is implemented as an independent hardware module, but in other embodiments, it may be integrated into the protocol analysis module 12, or the image analysis module 15 and the protocol analysis module 12 may be integrated into the main control module. Furthermore, like the other modules, the image analysis module 15 can also be implemented as a software module that can be executed by any hardware with information processing capabilities within the external protection device, i.e., software.

[0065] As described above, the image analysis module 15 can perform image analysis in various ways and, since it is connected to the screen recording module, it can perform real-time analysis by acquiring interface images of the protected device acquired and recorded by the screen recording module in real time. The present invention is not limited to specific analysis methods and preferably supports image analysis methods that support updates or upgrades. As an example, a real-time analysis method involves extracting frame images from the video data, performing OCR recognition on the acquired frame images, and generating an analysis result indicating that there is an abnormality in the video data if the OCR recognition result contains predetermined blacklist text. For example, if the text in the OCR recognition window contains "delete," "copy," or a specific software name, it is determined that there is an abnormality in the video data. Another method of real-time analysis involves extracting frame images from the video data, calculating the image features of the frame images, comparing them with the image features of a predetermined image, and generating an analysis result indicating that there is an abnormality in the video data if the similarity between the image features of the frame images and the image features of the predetermined image is higher than a threshold. The predetermined image is, for example, a typical interface that appears when a computer is destroyed, such as a shutdown interface, a restart interface, a command line interface, etc.

[0066] As can be seen from the above embodiments, the present invention has a transfer control module controlled by a protocol analysis module, so that unauthorized HID keyboard and mouse devices cannot connect to the protected equipment, solving the problem that unauthorized devices cannot effectively prevent the system from being disrupted by impersonating keyboards and mice, and thus strengthening the system's protection against unauthorized HID keyboard and mouse devices. The present invention also backs up and monitors the operation of HID keyboard and mouse devices in real time through a real-time screen recording module. More specifically, the present invention can also prevent unauthorized operation of legitimate HID keyboard and mouse devices through real-time analysis by an image analysis module, further improving the security of HID keyboard and mouse device connections. The above means solve the problem that keyboard and mouse communication protocols and operation behaviors cannot be recorded and audited when audit software cannot be installed in the protected equipment.

[0067] Figure 4 is a flowchart of a device protection method for protecting HID keyboard and mouse devices according to one embodiment of the present invention. As shown in Figure 4, the method of the present invention includes the following steps.

[0068] S1: A step to prepare an external protection device to take over the HID input interface of the protected device.

[0069] One of the objectives of the method of the present invention is to protect the protected device and prevent unauthorized devices from disrupting the system by disguising themselves as a keyboard or mouse. As mentioned above, an External Protective Device (EPD) is a physical device attached externally to the protected device, and by taking over a specific interface of the Protected Device (PD), it allows external devices that need to access the protected device to do so simply by connecting to the External Protective Device, thus achieving the objective of protecting the protected device without installing security protection software on the protected device. Typically, the HID input interface of the protected device is a USB interface, so the HID internal interface and HID external interface of the present invention are usually interfaces that conform to the USB protocol. However, the HID internal interface and HID external interface of the present invention do not preclude interface types that conform to other standard protocols.

[0070] S2: A step of performing a protocol analysis on an external device connected to the external protection device to determine whether the external device is a legitimate HID keyboard / mouse device.

[0071] Specifically, when an external device is plugged into the external protection device, the external protection device initiates device enumeration. Through USB protocol analysis during the device enumeration process, the external protection device can extract information from the protocol data, including the vendor ID, product ID (PID), and serial number information in the USB protocol specification, the number of configurations, the currently used configuration ID, the number of interfaces supported by the configuration descriptor, the interface number, the interface class, the interface subclass, and the interface protocol.

[0072] According to the USB protocol specification, the type of HID device is defined in the interface descriptor. The protocol analysis module 12 first checks the bDeviceClass, bDeviceSubClass, and bDeviceProtocol values ​​of the device descriptor, and only if all three values ​​are 0 does the USB device meet the device requirements for the HID class.

[0073] The external protection device also extracts relevant information from the interface descriptor and checks it based on the following:

[0074] In the interface descriptor, the value of blnterfaceClass must be 0x03, and the value of blnterfaceSubClass must be 0 or 1. If it is 1, the HID device is a boot device (generally meaningful for a PC, meaning that the BIOS can recognize the HID device being used at startup; only a standard mouse or keyboard can be called a boot device), and if it is 0, the HID device is a device that can only be recognized and used after the operating system has started. Meaning of possible values ​​for blnterfaceProtocol: 1 is Keyboard, 2 is Mouse.

[0075] S3: A step to prevent unauthorized HID keyboard / mouse devices from connecting to the protected device by controlling the connection or disconnection of the external device based on the judgment result.

[0076] Specifically, if the external device is determined to be an unauthorized HID keyboard / mouse device or a non-HID keyboard / mouse device after protocol analysis, the system controls the disconnection of the external device from the protected device. If the external device is determined to be a legitimate HID keyboard / mouse device after protocol analysis, the system controls the connection between the external device and the protected device.

[0077] According to the USB protocol specification, the type of HID device is defined in the interface descriptor. According to the present invention, the external protection device determines the type of external device based on the information in the interface descriptor, and if it is determined that the external device is neither an HID device nor a USB composite device (a device having HID and other USB characteristics, for example, a USB storage + HID class device), it sends a command to the transfer control module to block the connection of the external device.

[0078] According to a preferred embodiment of the present invention, the method of the present invention may further include step 4, which involves monitoring data transfer between an external device and a protected device in real time and interrupting data transfer from the protected device to the external device when it is detected that there is a risk in a USB IN transaction or that data exists in a USB OUT transaction.

[0079] While the above-described specific embodiments further illustrate the object, technical means, and advantageous effects of the present invention, it will be understood that the present invention is not inherently related to any particular computer, virtual device, or electronic device, and can be implemented in a variety of general-purpose devices. The above are merely specific embodiments of the present invention and are not intended to limit the present invention, and modifications, substitutions with equivalents, and improvements made without departing from the spirit and principles of the present invention are also included within the scope of protection of the present invention. [Explanation of Symbols]

[0080] 1 External protection device 3 mice 4 Keyboards 5 displays 12 Protocol Analysis Module 13 Transfer control module 14. Screen recording module 15. Real-time image analysis module 101 1HID internal interface 102 2HID Internal Interface 103 Video Internal Interface 111 1HID external interface 112 2HID External Interface 113 Video External Interface 201 1HID Input Interface 202 2HID Input Interface 203 Video Output Interfaces

Claims

1. An HID internal interface for connecting to the HID input interface of the protected device, An HID external interface for connecting to external devices, A transfer control module connected to the HID internal interface and the HID external interface, respectively, A protocol analysis module for performing protocol analysis on the external device connected to the HID external interface to determine whether the external device is a legitimate HID keyboard / mouse device, A video internal interface for connecting to the video output interface of the protected device, A video external interface for connecting to video equipment, A screen recording module connected to the aforementioned internal video interface for recording video data output from the protected device, and An external protection device for protecting HID keyboard and mouse devices, equipped with the following features: An external protection device for HID keyboard and mouse devices, wherein the transfer control module controls the connection or disconnection of the HID internal interface and the HID external interface based on the determination results provided by the protocol analysis module, in order to prevent unauthorized HID keyboard and mouse devices from connecting to the protected device.

2. Controlling the connection or disconnection of the HID internal interface and the HID external interface based on the determination results provided by the protocol analysis module is: If the external device is determined to be an invalid HID keyboard / mouse device or a non-HID keyboard / mouse device after protocol analysis, control the disconnection of the HID internal interface and the HID external interface, and If the external device is determined to be a legitimate HID keyboard / mouse device after protocol analysis, the connection between the HID internal interface and the HID external interface is controlled. An external protection device for protecting an HID keyboard / mouse device according to claim 1, including the above.

3. If the external device is an HID keyboard, the protocol analysis module is used to monitor and record the input data of the HID keyboard. If the input data includes data from a predetermined blacklist, the protocol analysis module instructs the transfer control module to control the disconnection of the HID internal interface and the HID external interface, as described in claim 1, for external protection of an HID keyboard / mouse device.

4. The screen recording module is connected to the protocol analysis module and is controlled by the protocol analysis module. The external protection device for protecting an HID keyboard / mouse device according to claim 1, wherein the protocol analysis module controls the screen recording module to perform the video data recording operation when it determines that the external device has performed a specific operation.

5. An external protection device for protecting an HID keyboard / mouse device according to claim 1, further comprising an image processing module connected to the screen recording module and the protocol analysis module, respectively, which acquires real-time video data from the screen recording module, analyzes the video data in real time, and, if the analysis results indicate an abnormality in the video data, notifies the protocol analysis module to control the disconnection of the HID internal interface and the HID external interface.

6. The aforementioned real-time analysis is, An external protection device for protecting an HID keyboard / mouse device according to claim 5, comprising extracting frame images from the video data, identifying the obtained frame images, and generating an analysis result indicating that there is an abnormality in the video data if the identification result includes a predetermined blacklist operation.

7. The aforementioned real-time analysis is, An external protection device for protecting an HID keyboard / mouse device according to claim 5, comprising extracting frame images from the video data, calculating the image features of the frame images, comparing them with the image features of a predetermined image, and generating an analysis result indicating that there is an abnormality in the video data if the similarity between the image features of the frame images and the image features of the predetermined image is higher than a threshold.

Images