Safe access method, safe access device, safe access electronic apparatus and safe access storage media for external storage devices

Abstract

A safe access method, a safe access device, a safe access electronic apparatus and a safe access storage media for external storage devices are provided. By reporting and processing without relying on real-time network connections, and still maintaining effective management of access to portable external storage devices even when there is no network or the network is unstable, thereby reducing potential risks and avoid frequent returns due to risky hardware and reduce the burden of network communications in the enterprise, immediately being disabled the portable external storage device once a digital certificate to be verified is found to be non-compliant, reducing a chance of spreading virus infection for improving the efficiency of information security management through quick response, and destroying the digital certificate to be verified to prevent the certificate from being stolen by others after confirming the safety of the external storage device, thus further ensuring the company's data security, the system and the method can effectively reduce misjudgment and ban of legitimate hardware through verification of digital certificates, and can achieve the effect of reducing the inconvenience caused by users frequently disabling legitimate devices.

Description

[Technical Field]

[0001] A method, apparatus, electronic device and storage medium for secure access to a storage device, particularly a method, apparatus, electronic device and storage medium for secure access to an external storage device. [Previous Technology]

[0002] External storage devices can easily connect to various devices, making them vulnerable to virus infection. Malicious software often spreads from one computer to another through external devices, especially when used in public computers (such as those in internet cafes and schools). Users may unknowingly copy infected files to their own devices, potentially leading to data loss, privacy breaches, and system crashes.

[0003] To ensure information security, many enterprises and organizations have adopted the technology of external storage device virus scanning and reporting. However, this virus reporting method is highly dependent on network connection. In the absence of network or when the network is unstable, virus infection cannot be reported in time, which increases the risk. Secondly, even if the network connection is normal, there may be delays in the reporting and feedback process, which makes it difficult to quickly locate infected devices and transmission paths. In addition, frequent reporting will also increase the burden on network communication in enterprises.

[0004] In summary, it can be seen that the prior art has long had the problem that reporting viruses through the network may increase the network load and that viruses cannot be reported in time when there is no network or the network is unstable. Therefore, it is necessary to propose improved technical means to solve this problem. [Summary of the Invention]

[0005] In view of the problems existing in the prior art, the present invention discloses a secure access method, apparatus, electronic device, and storage medium for an external storage device, wherein:

[0006] An embodiment of the present invention provides a secure access method for an external storage device, the method comprising: identifying whether an external storage device to be verified contains a digital credential to be verified; the external storage device to be verified includes an external storage device connected to a target terminal; when it is identified that the external storage device to be verified contains a digital credential to be verified, the digital credential to be verified is verified; if the verification of the digital credential to be verified is successful, the external storage device to be verified that has been successfully verified is marked as a secure external storage device, the secure external storage device is scanned, and the digital credential to be verified is destroyed; if the verification of the digital credential to be verified fails, the external storage device to be verified is disabled.

[0007] In one embodiment of the present invention, before the access request of the external storage device is detected, the method further includes: generating a digital certificate with a validity period through a digital certificate generation tool, which is denoted as an initial digital certificate; randomly generating a serial number and embedding the serial number into the initial digital certificate to obtain a target digital certificate; writing the target digital certificate into the target external storage device through a main program, and sending the certificate information of the target digital certificate to a target terminal, wherein the certificate information includes the validity period of the digital certificate and a one-time use identifier.

[0008] In one embodiment of the present invention, when it is detected that the external storage device to be verified has a digital certificate to be verified, the digital certificate to be verified is verified, including: reading the certificate information of the digital certificate to be verified through an agent program, verifying whether the current time is within the validity period of the digital certificate based on the certificate information of the target digital certificate received by the target terminal, and verifying whether the one-time use identifier has been used; if it is verified that the current time is within the validity period of the digital certificate and the one-time use identifier has not been used, then the one-time use identifier is marked as used, and a verification success message is displayed on the target terminal.

[0009] In one embodiment of the present invention, when it is identified that the external storage device to be verified has a digital certificate to be verified, the verification of the digital certificate to be verified further includes: if the verification shows that the current time is not within the validity period of the digital certificate, then a verification failure message is displayed on the target terminal; if the verification shows that the current time is within the validity period of the digital certificate and the one-time use identifier has been used, then a verification failure message is displayed on the target terminal; if it is identified that the external storage device to be verified is not the target external storage device, then a verification failure message is displayed on the target terminal.

[0010] In one embodiment of the present invention, destroying the digital certificate to be verified includes: recording destruction information of the digital certificate to be verified in the target terminal, the destruction information including destruction time and unique identification character; and destroying the digital certificate to be verified by a file destruction tool according to the destruction information using a fast overwrite method.

[0011] In one embodiment of the present invention, before identifying whether the external storage device to be inspected contains the digital certificate to be inspected, the method further includes: performing a virus scan on the external storage device to be inspected; if no virus is detected, checking whether the file system of the external storage device to be inspected is complete; if the file system of the external storage device to be inspected is complete, checking whether there are any suspicious files in the external storage device to be inspected; if there are no suspicious files in the external storage device to be inspected, encrypting sensitive data in the external storage device to be inspected; if there are suspicious files in the external storage device, issuing a risk warning message.

[0012] In one embodiment of the present invention, disabling an external storage device to be inspected includes: if the external storage device to be inspected is identified as a target external storage device, but the external storage device to be inspected does not have a digital certificate to be inspected, then the external storage device to be inspected is disabled; the external storage device to be inspected is scanned for viruses, and if a virus is detected, the external storage device to be inspected is disabled; the external storage device to be inspected is scanned for viruses, and if no virus is detected, but the file system of the external storage device to be inspected is found to be incomplete, then the external storage device to be inspected is disabled.

[0013] The secure access device for an external storage device provided in this embodiment of the invention includes: a digital credential recognition module for identifying whether the external storage device to be verified has a digital credential to be verified; the external storage device to be verified includes an external storage device connected to a target terminal; a verification module for verifying the digital credential to be verified when the external storage device to be verified is found to have a digital credential to be verified; marking the external storage device to be verified that has been successfully verified as a secure external storage device, scanning the secure external storage device, and destroying the digital credential to be verified; and disabling the external storage device to be verified if the verification of the digital credential to be verified fails.

[0014] This embodiment of the invention provides an electronic device, including a processor, a memory, and a communication bus; the communication bus is used to connect the processor and the memory; the processor is used to execute a computer program stored in the memory to implement the above-mentioned secure access method for external storage devices.

[0015] The method, apparatus, electronic device, and storage medium disclosed in this invention are as described above. The difference between this invention and the prior art is that this invention effectively reduces the misjudgment and false banning of legitimate hardware through digital certificate verification, thereby reducing the inconvenience caused to users by frequently disabling legitimate devices. This invention does not rely on real-time network connection for reporting and processing, and can still maintain effective management of access to external storage devices under conditions of no network or unstable network, reducing potential risks. Once the digital certificate to be verified is found to be non-compliant, the external storage device will be immediately disabled. The rapid response reduces the chance of virus infection spread and improves the efficiency of information security management. It can also avoid frequent reports from risky hardware, reducing the burden of network communication in the enterprise. After confirming the security of the external storage device, the digital certificate to be verified will be destroyed to prevent the certificate from being stolen by others, thereby further protecting the enterprise's data security.

Implementation Method

[0017] The features and implementation methods of the present invention will be described in detail below with reference to the drawings and embodiments. The content is sufficient to enable any person skilled in the art to easily and fully understand the technical means used by the present invention to solve the technical problem and to implement it accordingly, thereby achieving the effects that the present invention can achieve.

[0018] This invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this invention. It should be understood that the embodiments of this invention are only for illustrating the invention and not for limiting the scope of protection of this invention.

[0019] It should be noted that the drawings provided in the following embodiments are only schematic illustrations of the basic concept of the present invention. Therefore, the drawings only show the elements related to the present invention and are not drawn according to the number, shape and size of the elements in actual implementation. In actual implementation, the form, quantity and proportion of each element can be arbitrarily changed, and the layout of the elements may also be more complex.

[0020] Numerous details are explored in the following description to provide a more thorough explanation of embodiments of the invention. However, it will be apparent to those skilled in the art that embodiments of the invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the invention.

[0021] The embodiments of the present invention provide a secure access method for an external storage device, a secure access device for an external storage device, an electronic device, and a storage medium, which will be described in detail below.

[0022] Please refer to Figure 1, which shows a flowchart of a secure access method for an external storage device according to an embodiment of the present invention. As shown in Figure 1, the method includes at least steps S110 to S130, which are described in detail below:

[0023] Step S110: If the external storage device to be verified is identified as the target external storage device, then it is identified whether the external storage device to be verified has a digital certificate to be verified.

[0024] In one embodiment of the present invention, after receiving an access request from an external storage device to be verified, it is identified whether the external storage device to be verified is the target external storage device. As an example, the external storage device to be verified is a USB Flash Drive, also known as a USB flash drive. A USB flash drive is an external storage device that connects to devices such as computers via a USB interface and is widely used for data storage and transmission. By verifying the digital credentials of the external storage device to be verified, it is ensured that only authenticated devices can access the system, fundamentally reducing the risk of malicious hardware intrusion. After identifying the target external storage device, its digital credentials are first verified to ensure the legitimacy of its identity, further protecting the system environment from the threat of unknown viruses. The workflow of marking the external storage device to be verified as safe before performing a virus scan improves processing efficiency.

[0025] Step S120: When it is detected that there is a digital certificate to be verified in the external storage device to be verified, the digital certificate to be verified is verified.

[0026] Step S130: If the verification of the digital document to be verified is successful, the external storage device to be verified that has been successfully verified will be marked as a secure external storage device, the secure external storage device will be scanned, and the digital document to be verified will be destroyed; if the verification of the digital document to be verified fails, the external storage device to be verified will be disabled.

[0027] In the technical solution shown in "Figure 1", by verifying the digital credentials of the external storage device to be verified, it is ensured that only authenticated devices can access the system, fundamentally reducing the risk of malicious hardware intrusion. After identifying the target external storage device, its digital credentials are verified first to ensure the legitimacy of its identity, further protecting the system environment from the threat of unknown viruses. The workflow of marking the external storage device to be verified as safe before performing virus scanning improves processing efficiency. Through the verification of digital credentials, the false judgment and false banning of legitimate hardware are effectively reduced, thereby reducing the need for users to frequently disable legitimate devices. To avoid the inconvenience caused by relying on real-time network connections for reporting and processing, this invention does not depend on real-time network connections. It can still maintain effective management of access to external storage devices even in the absence of a network or under unstable network conditions, reducing potential risks. Once a non-compliant digital credential is detected, the external storage device will be immediately disabled. This rapid response reduces the chance of virus infection and improves the efficiency of information security management. It also avoids frequent reports from risky hardware, reducing the burden on network communication within the enterprise. After confirming the security of the external storage device, the digital credential to be verified will be destroyed to prevent it from being stolen by others, thereby further protecting the enterprise's data security.

[0028] In one embodiment of the present invention, before detecting an access request from an external storage device, the method further includes: generating a digital certificate with a validity period through a digital certificate generation tool, denoted as an initial digital certificate; randomly generating a serial number and embedding the serial number into the initial digital certificate to obtain a target digital certificate; writing the target digital certificate into the target external storage device through a main program, and sending the certificate information of the target digital certificate to the target terminal. The certificate information includes the validity period of the digital certificate and a one-time use identifier. Setting a validity period for the digital certificate can prevent the use of expired certificates, ensuring that only certificates within their validity period have the right to access and use the external storage device, thereby further enhancing the security of the system. The introduction of the one-time use identifier ensures that the certificate can only be used once after each connection, greatly reducing the possibility of certificate abuse and enhancing the security of data transmission.

[0029] As an example, the credential information of the target digital credential is sent to the target terminal, and the username of the target external storage device is also sent to the target terminal. When the external storage device to be verified is identified as the target external storage device, the digital credential verification is then performed.

[0030] As an example, a reliable digital credential generation tool or service is used to generate a unique digital credential. During the generation process, the validity period of the digital credential is set, for example, to expire in 24 hours. A one-time identifier, such as a randomly generated serial number or UUID, is embedded in the digital credential with the set expiration date to ensure that each credential can only be used once. This identifier is stored for subsequent verification. The main program writes the generated digital credential to a USB flash drive, ensuring the file is set to read-only to prevent modification. The validity period and one-time identifier information of the credential are published to authorized users through a secure channel, such as sending an email or a private message. After the user inserts the USB flash drive, the agent program reads the digital credential and verifies its validity and one-time identifier, checking whether the current time is within the validity period of the credential and whether the identifier has not been used. Once the digital credential to be verified and used, the one-time identifier is marked as used, preventing subsequent access requests. By generating an initial digital credential and embedding a serial number, it is possible to ensure that each target external storage device has a unique identity, enhancing the authentication and identification capabilities of the device and reducing the risk of forgery or abuse. Setting an expiration date for digital credentials can prevent the use of expired credentials and ensure that only credentials within their validity period are authorized to access and use external storage devices, thereby further enhancing system security. The introduction of one-time use identifiers ensures that credentials can only be used once after each connection, greatly reducing the possibility of credential abuse and enhancing the security of data transmission.

[0031] In one embodiment of the present invention, when it is identified that there is a digital certificate to be verified in the external storage device to be verified, the digital certificate to be verified is verified, including: reading the certificate information of the digital certificate to be verified through an agent program, verifying whether the current time is within the validity period of the digital certificate based on the certificate information of the target digital certificate received by the target terminal, and verifying whether the one-time use identifier has been used; if it is verified that the current time is within the validity period of the digital certificate and the one-time use identifier has not been used, the one-time use identifier is marked as used, and the verification success message is displayed on the target terminal.

[0032] As an example, the target terminal is a computer. A reliable digital certificate generation tool or service is used to generate a unique digital certificate. During the generation process, the validity period of the digital certificate is set, for example, to expire in 24 hours. A one-time identifier, such as a randomly generated serial number or UUID, is embedded in the digital certificate with the set validity period to ensure that each certificate can only be used once. This identifier is stored for subsequent verification. The main program writes the generated digital certificate to a USB flash drive and ensures that the file is set to read-only to prevent modification. The validity period and one-time identifier information of the certificate are published to authorized users through a secure channel, such as sending an email or a private message. After the user inserts the USB flash drive, the agent program reads the digital certificate and verifies its validity and one-time identifier. It checks whether the current time is within the validity period of the certificate and whether the identifier has not been used. Once the digital certificate to be verified is verified and used, the one-time identifier is marked as used, and subsequent access requests are blocked. Security is enhanced by controlling the content and distribution of data on the USB drive through the main program, while the agent program ensures that only authorized users can access the content of the USB drive. Data security is protected by controlling access permissions. The two work together to ensure the safe and effective use of the USB drive.

[0033] In one embodiment of the present invention, when it is identified that the external storage device to be verified has a digital certificate to be verified, the verification of the digital certificate to be verified further includes: if the verification shows that the current time is not within the validity period of the digital certificate, a verification failure message is displayed on the target terminal; if the verification shows that the current time is within the validity period of the digital certificate and the one-time use identifier has been used, a verification failure message is displayed on the target terminal; if it is identified that the external storage device to be verified is not the target external storage device, a verification failure message is displayed on the target terminal.

[0034] As an example, after the computer prompts a verification failure message, the USB flash drive to be verified is immediately disabled.

[0035] In one embodiment of the present invention, destroying a digital certificate to be verified includes: recording destruction information of the digital certificate to be verified in a target terminal, the destruction information including destruction time and unique identification characters; and destroying the digital certificate to be verified using a file destruction tool according to the destruction information and employing a fast overwrite method. By recording the destruction information of the digital certificate to be verified, it is ensured that each destruction operation is traceable, thereby enhancing the transparency and traceability of data management. Using a file destruction tool and employing a fast overwrite method to destroy digital certificates can effectively prevent recovery, ensuring that sensitive information cannot be recovered by malicious users or attackers, and improving information security.

[0036] As an example, before destruction, ensure that the digital credential has been verified and that the user has completed the required operation. Record the credential destruction information in the system, including the destruction time, the destroying user ID, and the credential's unique identifier. Use professional file destruction tools to completely delete the digital credential file on the USB drive. These tools typically overwrite file data to ensure it cannot be recovered. In the system database, update the credential's status to "destroyed" and disable the associated one-time identifier to prevent any subsequent use. Send a destruction notification to the relevant user or system administrator to confirm that the digital credential has been successfully destroyed and is no longer valid. Regularly perform security audits on the USB drive to ensure that destroyed credential data cannot be recovered and maintain the overall security of the system. By recording the destruction information of the digital credential to be verified, each destruction operation is traceable, thereby enhancing the transparency and traceability of data management. Using file destruction tools and adopting a fast overwrite method to destroy digital credentials can effectively prevent recovery, ensuring that sensitive information cannot be recovered by malicious users or attackers, and improving information security.

[0037] In one embodiment of the present invention, before identifying whether the external storage device to be inspected contains the digital certificate to be inspected, the method further includes: performing a virus scan on the external storage device to be inspected; if no virus is detected, checking whether the file system of the external storage device to be inspected is complete; if the file system of the external storage device to be inspected is complete, checking whether there are any suspicious files in the external storage device to be inspected; if there are no suspicious files in the external storage device to be inspected, encrypting sensitive data in the external storage device to be inspected; if there are suspicious files in the external storage device, issuing a risk warning message.

[0038] As an example, before identifying whether the external storage device to be verified contains the digital credentials to be verified, a reliable antivirus software, such as Norton or Kaspersky, should be used to perform a full scan of the USB drive to ensure that no viruses or malware are present on the USB drive. Use built-in system tools, such as the Windows "chkdsk" command, to check whether the file system of the USB drive is intact to avoid the risk of data leakage due to file system corruption. Enable "View hidden files" in File Explorer to check whether there are any unknown files or hidden files on the USB drive to ensure that there is no suspicious content. Right-click on the files on the USB drive to view their properties and confirm that there are no unknown "read-only" or "system" labels to prevent files from being tampered with or hidden. Check whether the USB drive uses secure password protection or encryption technology to enhance security.

[0039] In one embodiment of the present invention, disabling an external storage device to be inspected includes: if the external storage device to be inspected is identified as a target external storage device, but the external storage device to be inspected does not have a digital certificate to be inspected, then the external storage device to be inspected is disabled; if a virus is detected on the external storage device to be inspected, then the external storage device to be inspected is disabled; if a virus is not detected on the external storage device to be inspected, but the file system of the external storage device to be inspected is found to be incomplete, then the external storage device to be inspected is disabled.

[0040] As an example, after the verification fails, the software should mark the status of the USB flash drive as "disabled". The USB flash drive can be disabled in the following ways: by disabling it in the software interface, such as by disabling the USB flash drive according to the status prompt in the agent used to handle the verification and management operations related to the USB flash drive; by disabling it in the system device administrator, which means finding the USB flash drive directly in the computer's device administrator, right-clicking and selecting "disable"; or by disabling it through a script or command line, that is, by using a specific command line tool or script to automatically disable the USB flash drive.

[0041] Figure 2 shows a block diagram of a secure access device for an external storage device according to an exemplary embodiment of the present invention. Referring to Figure 2, a secure access device 200 for an external storage device according to an embodiment of the present invention includes: a digital credential identification module 210 and a verification module 220. The digital credential identification module is used to identify whether the external storage device to be verified has a digital credential to be verified; the external storage device to be verified includes an external storage device connected to a target terminal; the verification module is used to verify the digital credential to be verified when it is identified that the external storage device to be verified has a digital credential to be verified; and to mark the external storage device to be verified that has been successfully verified as a secure external storage device, and to scan the secure external storage device, and to destroy the digital credential to be verified; if the verification of the digital credential to be verified fails, the external storage device to be verified is disabled. By verifying digital credentials, false positives and false bans on legitimate hardware are effectively reduced, thereby minimizing the inconvenience caused to users by frequently disabling legitimate devices. This invention does not rely on real-time network connectivity for reporting and processing, and can maintain effective management of external storage device access even without network or with an unstable network, reducing potential risks. Once a non-compliant digital credential is detected, the external storage device will be immediately disabled, and the rapid response reduces the chance of virus infection spread, improves the efficiency of information security management, and avoids frequent reports from risky hardware, reducing the burden on network communications within the enterprise. After confirming the security of the external storage device, the digital credential to be verified will be destroyed to prevent the credential from being stolen by others, thereby further protecting the enterprise's data security.

[0042] In one embodiment of the present invention, the secure access device for the external storage device further includes a listening module 230, which is used to identify whether the external storage device to be verified is the target external storage device after listening to the access request of the external storage device to be verified.

[0043] In one embodiment of the present invention, the secure access device for the external storage device further includes a digital credential writing module 240, used to generate a digital credential with a validity period through a digital credential generation tool, denoted as an initial digital credential; randomly generate a serial number and embed the serial number into the initial digital credential to obtain a target digital credential; write the target digital credential into the target external storage device through the main program, and send the credential information of the target digital credential to the target terminal. The credential information includes the validity period of the digital credential and a one-time use identifier. Setting a validity period for the digital credential can prevent the use of expired credentials and ensure that only credentials within the validity period have the right to access and use the external storage device, thereby further strengthening the security of the system. The introduction of the one-time use identifier ensures that the credential can only be used once after each connection, greatly reducing the possibility of credential abuse and enhancing the security of data transmission.

[0044] As an example, a reliable digital credential generation tool or service is used to generate a unique digital credential. During the generation process, the validity period of the digital credential is set, for example, to expire in 24 hours. A one-time identifier, such as a randomly generated serial number or UUID, is embedded in the digital credential with the set expiration date to ensure that each credential can only be used once. This identifier is stored for subsequent verification. The main program writes the generated digital credential to a USB flash drive, ensuring the file is set to read-only to prevent modification. The validity period and one-time identifier information of the credential are published to authorized users through a secure channel, such as sending an email or a private message. After the user inserts the USB flash drive, the agent program reads the digital credential and verifies its validity and one-time identifier, checking whether the current time is within the validity period of the credential and whether the identifier has not been used. Once the digital credential to be verified and used, the one-time identifier is marked as used, preventing subsequent access requests. By generating an initial digital credential and embedding a serial number, it is possible to ensure that each target external storage device has a unique identity, enhancing the authentication and identification capabilities of the device and reducing the risk of forgery or abuse. Setting an expiration date for digital credentials can prevent the use of expired credentials and ensure that only credentials within their validity period are authorized to access and use external storage devices, thereby further enhancing system security. The introduction of one-time use identifiers ensures that credentials can only be used once after each connection, greatly reducing the possibility of credential abuse and enhancing the security of data transmission.

[0045] In one embodiment of the present invention, the verification module is used to read the certificate information of the digital certificate to be verified through the agent program, and verify whether the current time is within the validity period of the digital certificate based on the certificate information of the target digital certificate received by the target terminal, and verify whether the one-time use identifier has been used; if it is verified that the current time is within the validity period of the digital certificate and the one-time use identifier has not been used, the one-time use identifier is marked as used, and the verification success information is displayed on the target terminal.

[0046] As an example, the target terminal is a computer. A reliable digital credential generation tool or service is used to generate a unique digital credential. During the generation process, the validity period of the digital credential is set, for example, to expire in 24 hours. A one-time identifier, such as a randomly generated serial number or UUID, is embedded in the digital credential with the set validity period to ensure that each credential can only be used once. This identifier is stored for subsequent verification. The main program writes the generated digital credential to a USB flash drive and ensures that the file is set to read-only to prevent modification. The validity period and one-time identifier information of the credential are published to authorized users through a secure channel, such as sending an email or a private message. After the user inserts the USB flash drive, the agent program reads the digital credential and verifies its validity and one-time identifier. It checks whether the current time is within the validity period of the credential and whether the identifier has not been used. Once the digital credential to be verified is verified and used, the one-time identifier is marked as used, and subsequent access requests are blocked. Security is enhanced by controlling the content and distribution of data on the USB drive through the main program, while the agent program ensures that only authorized users can access the content of the USB drive. Data security is protected by controlling access permissions. The two work together to ensure the safe and effective use of the USB drive.

[0047] In one embodiment of the present invention, the verification module is used to prompt verification failure information on the target terminal if the current time is not within the validity period of the digital certificate; if the current time is within the validity period of the digital certificate and the one-time use identifier has been used, the module will prompt verification failure information on the target terminal; and if the external storage device to be verified is not the target external storage device, the module will prompt verification failure information on the target terminal.

[0048] In one embodiment of the present invention, the secure access device of the external storage device further includes a destruction module 250, used to record destruction information of the digital credential to be verified in the target terminal. The destruction information includes the destruction time and a unique identification character. Using a file destruction tool, the digital credential to be verified is destroyed using a fast overwrite method according to the destruction information. By recording the destruction information of the digital credential to be verified, it is ensured that each destruction operation is traceable, thereby enhancing the transparency and traceability of data management. Using a file destruction tool and employing a fast overwrite method to destroy the digital credential can effectively prevent recovery, ensuring that sensitive information cannot be recovered by malicious users or attackers, and improving information security.

[0049] As an example, before destruction, ensure that the digital credential has been verified and that the user has completed the required operation. Record the credential destruction information in the system, including the destruction time, the destroying user ID, and the credential's unique identifier. Use professional file destruction tools to completely delete the digital credential file on the USB drive. These tools typically overwrite file data to ensure it cannot be recovered. In the system database, update the credential's status to "destroyed" and disable the associated one-time identifier to prevent any subsequent use. Send a destruction notification to the relevant user or system administrator to confirm that the digital credential has been successfully destroyed and is no longer valid. Regularly perform security audits on the USB drive to ensure that destroyed credential data cannot be recovered and maintain the overall security of the system. By recording the destruction information of the digital credential to be verified, each destruction operation is traceable, thereby enhancing the transparency and traceability of data management. Using file destruction tools and adopting a fast overwrite method to destroy digital credentials can effectively prevent recovery, ensuring that sensitive information cannot be recovered by malicious users or attackers, and improving information security.

[0050] In one embodiment of the present invention, the verification module is used to perform virus scanning on the external storage device to be tested. If no virus is detected, the module checks whether the file system of the external storage device to be tested is complete. If the file system of the external storage device to be tested is complete, the module checks whether there are any suspicious files in the external storage device to be tested. If there are no suspicious files in the external storage device to be tested, the module encrypts sensitive data in the external storage device to be tested. If there are suspicious files in the external storage device, the module issues a risk warning message.

[0051] As an example, before identifying whether the external storage device to be verified contains the digital credentials to be verified, a reliable antivirus software, such as Norton or Kaspersky, is used to perform a full scan of the USB drive to ensure that no viruses or malware exist on the USB drive. The built-in tools of the system, such as the "chkdsk" command in Windows, are used to check whether the file system of the USB drive is intact to avoid the risk of data leakage due to file system corruption. The "view hidden files" function is enabled in File Explorer to check whether there are any unknown files or hidden files on the USB drive to ensure that there is no suspicious content. The files on the USB drive are right-clicked to view their properties to confirm that there are no unknown "read-only" or "system" labels to prevent files from being tampered with or hidden. The USB drive is checked to see if it uses secure password protection or encryption technology to enhance security.

[0052] In one embodiment of the present invention, the inspection module is used to disable the external storage device to be inspected if it is identified as the target external storage device, but the external storage device to be inspected does not have the digital certificate to be inspected; to perform virus scanning on the external storage device to be inspected, and if a virus is detected, the external storage device to be inspected is disabled; to perform virus scanning on the external storage device to be inspected, and if no virus is detected, but the file system of the external storage device to be inspected is found to be incomplete, the external storage device to be inspected is disabled.

[0053] As an example, after the verification fails, the software should mark the status of the USB flash drive as "disabled". The USB flash drive can be disabled in the following ways: by disabling it in the software interface, such as by disabling the USB flash drive according to the status prompt in the agent used to handle the verification and management operations related to the USB flash drive; by disabling it in the system device administrator, which means finding the USB flash drive directly in the computer's device administrator, right-clicking and selecting "disable"; or by disabling it through a script or command line, that is, by using a specific command line tool or script to automatically disable the USB flash drive.

[0054] It should be noted that the apparatus provided in the above embodiments and the method provided in the above embodiments belong to the same concept. The specific way in which each module and unit performs operations has been described in detail in the method embodiments, and will not be repeated here. In practical applications, the apparatus provided in the above embodiments can allocate the above functions to different functional modules as needed, that is, divide the internal structure of the apparatus into different functional modules to complete all or part of the functions described above. This is not a limitation here.

[0055] Please refer to Figure 3, which is a schematic diagram of an electronic device shown in an exemplary embodiment of the present invention. It should be noted that the electronic device 300 shown in Figure 3 is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0056] As shown in Figure 3, the electronic device 300 includes a processor 301, a memory 302 and a communication bus 303; the communication bus 303 is used to connect the processor 301 and the memory 302; the processor 301 is used to execute a computer program stored in the memory 302 to implement one or more methods as described in the above embodiments.

[0057] The electronic device provided by the present invention includes a processor, a memory, a transceiver, and a communication interface. The memory and the communication interface are connected to the processor and the transceiver and complete communication between them. The memory is used to store computer programs, the communication interface is used to perform communication, and the processor and the transceiver are used to run the computer programs, so that the electronic device performs the various steps of the above method.

[0058] In this embodiment, the memory may include random access memory (RAM) and may also include non-volatile memory, such as at least one disk memory.

[0059] The processor mentioned above can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic elements, discrete logic gates or transistor logic elements, or discrete hardware elements.

[0060] Although the embodiments disclosed in this invention are as described above, the content described is not intended to directly limit the scope of patent protection of this invention. Any modifications or refinements made in form and detail to the implementation of this invention by those skilled in the art, without departing from the spirit and scope disclosed herein, shall fall within the scope of patent protection of this invention. The scope of patent protection of this invention shall still be determined by the appended claims. [Simplified Explanation of the Diagram]

[0016] Figure 1 is a flowchart of the secure access method for the external storage device proposed in this invention. Figure 2 is a block diagram of the secure access device for the external storage device proposed in this invention. Figure 3 is a schematic diagram of the structure of an electronic device proposed in this invention.

Claims

1. A secure access method for an external storage device, the secure access method comprising at least the following steps: identifying whether a digital credential to be verified exists in the external storage device to be verified, the external storage device to be verified including an external storage device connected to a target terminal; when a digital credential to be verified is identified in the external storage device to be verified, verifying the digital credential to be verified; if the verification of the digital credential to be verified is successful, marking the successfully verified external storage device to be verified as a secure external storage device, scanning the secure external storage device, and destroying the digital credential to be verified; if the verification of the digital credential to be verified fails, identifying whether the external storage device to be verified is the target external storage device; If the external storage device to be verified is identified as the target external storage device, but the external storage device to be verified does not have the digital certificate to be verified, then the external storage device to be verified is disabled; and a virus scan is performed on the external storage device to be verified. If a virus is detected, the external storage device to be verified is disabled. If no virus is detected, but the file system of the external storage device to be verified is found to be incomplete, then the external storage device to be verified is disabled.

2. The secure access method for an external storage device as described in claim 1, wherein before the step of detecting an access request from the external storage device, the secure access method further includes the following steps: generating a digital certificate with a validity period through a digital certificate generation tool, denoted as an initial digital certificate; randomly generating a serial number and embedding the serial number into the initial digital certificate to obtain a target digital certificate; and writing the target digital certificate into the target external storage device through a main program, and sending the certificate information of the target digital certificate to a target terminal, wherein the certificate information includes the validity period of the digital certificate and a one-time use identifier.

3. The secure access method for an external storage device as described in claim 2, wherein when it is detected that the external storage device to be verified has a digital credential to be verified, the step of verifying the digital credential to be verified further includes reading the credential information of the digital credential to be verified through an agent program, verifying whether the current time is within the validity period of the digital credential based on the credential information of the target digital credential received by the target terminal, and verifying whether the one-time use identifier has been used; if it is verified that the current time is within the validity period of the digital credential and the one-time use identifier has not been used, then marking the one-time use identifier as used, and displaying a verification success message on the target terminal.

4. The secure access method for an external storage device as described in claim 2, wherein the step of verifying the digital credential to be verified when the external storage device to be verified is found to have a digital credential to be verified further includes the following steps: if the verification shows that the current time is not within the validity period of the digital credential, then a verification failure message is displayed on the target terminal; if the verification shows that the current time is within the validity period of the digital credential and the one-time use identifier has been used, then a verification failure message is displayed on the target terminal; and if the external storage device to be verified is not the target external storage device, then a verification failure message is displayed on the target terminal.

5. The secure access method for an external storage device as described in claim 1, wherein the step of destroying the digital credential to be verified comprises recording destruction information of the digital credential to be verified in the target terminal, and destroying the digital credential to be verified by a file destruction tool in accordance with the destruction information using a fast overwrite method, wherein the destruction information includes destruction time and unique identification character.

6. The secure access method for an external storage device as described in claim 1, wherein before the step of identifying whether the external storage device to be inspected contains the digital credential to be inspected, the secure access method further includes the following steps: performing a virus scan on the external storage device to be inspected; if no virus is detected, checking whether the file system of the external storage device to be inspected is intact; if the file system of the external storage device to be inspected is intact, checking whether there are any suspicious files in the external storage device to be inspected; if there are no suspicious files in the external storage device to be inspected, encrypting sensitive data on the external storage device to be inspected; and if there are suspicious files in the external storage device, issuing a risk warning message.

7. A secure access device for an external storage device, the secure access device comprising at least: a digital credential recognition module for recognizing whether the external storage device to be verified contains a digital credential to be verified, wherein the external storage device to be verified includes an external storage device connected to a target terminal; The verification module is used to verify the digital credentials to be verified when it is detected that the external storage device to be verified has such credentials, mark the external storage device to be verified as a secure external storage device, scan the secure external storage device, and destroy the digital credentials to be verified. If the verification of the digital credentials to be verified fails, and the external storage device to be verified is identified as the target external storage device but does not have such digital credentials, the module disables the external storage device to be verified and performs a virus scan on it. If a virus is detected, the external storage device to be verified is disabled; if no virus is detected, but the file system of the external storage device to be verified is found to be incomplete, the external storage device to be verified is disabled.

8. An electronic device comprising at least: one or more processors; and a storage device for storing one or more programs that, when executed by the one or more processors, cause the electronic device to implement the secure access method for an external storage device as claimed in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, the computer program being used to cause a computer to perform the secure access method for an external storage device as described in any one of claims 1 to 6.

Images