Multi-stage verification method and apparatus for mobile storage, and storage medium

Abstract

The present invention provides a multi-stage verification method and apparatus for mobile storage, and a storage medium. The method comprises: when mobile storage is used, acquiring, by a central security monitoring system, a multi-stage scanning result of the mobile storage; on the basis of the multi-stage scanning result, determining whether the mobile storage has been scanned, and whether the multi-stage scanning result is normal; if not, prohibiting use of the mobile storage and issuing an alert; providing a use permission for the mobile storage in stages, and scanning the mobile storage on the basis of a scanning rule corresponding to the use permission, to obtain a current scanning result; determining whether a portion in the multi-stage scanning result which corresponds to the current scanning result matches the current scanning result; if so, providing a next-stage use permission; and if not, locking the mobile storage and issuing an alert. A technical solution of an embodiment of the present invention can improve the scanning precision of a mobile storage device, increase the used mobile storage speed, prevent malicious software from bypassing basic inspection, and improve security.

Description

Mobile storage multi-level verification method, device and storage medium Technical Field

[0001] The present invention relates to the field of information security, and in particular to a mobile storage multi-level verification method, device and storage medium. Background Art

[0002] Removable storage or data exchange within industrial control systems (ICS) can pose a significant threat. Even if ICS systems are isolated from the internet and IT networks through physical or logical security measures, malware or Trojans can exploit removable storage to infect target systems within the ICS. Numerous security incidents have occurred due to malware infecting ICS systems through removable storage devices, leading to production interruptions.

[0003] Several mobile storage device management methods and systems have been proposed to control the use of removable storage in OT (Operation Technology) systems. USB control software can restrict the use of removable storage devices, allowing only properly managed devices to be used in the target system. However, this software requires the installation of an agent in the target system to control the use of external interfaces and to verify and determine whether removable storage devices can be used in the target system. This can lead to compatibility issues and degrade the performance of the target system. In some scenarios, it can even affect the normal operation of OT equipment.

[0004] Summary of the Invention

[0005] To achieve the above objectives, the present invention proposes a mobile storage multi-level verification method, device and storage medium, which can improve the scanning accuracy of mobile storage devices, increase the speed of mobile storage used, prevent malware from bypassing basic checks, and improve security.

[0006] A multi-level verification method for mobile storage proposed in an embodiment of the present invention includes: obtaining multi-level scanning results. When the mobile storage is in use, a central security monitoring system obtains the multi-level scanning results of the mobile storage; verifying the multi-level scanning results and, based on the multi-level scanning results, determining whether the mobile storage has been scanned and whether the multi-level scanning results are normal; if not, prohibiting the use of the mobile storage and issuing an alarm; verifying level by level, providing access permissions for the mobile storage at each level, and scanning the mobile storage based on the scanning rules corresponding to the access permissions to obtain the current scanning results; determining whether the portion of the multi-level scanning results corresponding to the current scanning result matches the current scanning result; if so, providing access permissions for the next level; if not, locking the mobile storage and issuing an alarm. Through multi-level, step-by-step verification, malware scanning with a multi-level strategy can be performed, improving scanning speed and accuracy.

[0007] In one embodiment, before the mobile storage is used, a scanning system performs a multi-level scan on the mobile storage to obtain the multi-level scan results, and stores the multi-level scan results in the central security monitoring system. The scanning system avoids occupying the actual system resources for antivirus scanning.

[0008] A mobile storage multi-level verification device proposed in an embodiment of the present invention includes: a multi-level scanning result acquisition module configured to: when the mobile storage is used, obtain the multi-level scanning results of the mobile storage by a central security monitoring system; a multi-level scanning result verification module configured to: determine whether the mobile storage has been scanned and whether the multi-level scanning results are normal based on the multi-level scanning results; if not, prohibit the use of the mobile storage and issue an alarm; a step-by-step verification module configured to: provide access permissions to the mobile storage step by step, and scan the mobile storage based on the scanning rules corresponding to the access permissions to obtain the current scanning results; determine whether the portion of the multi-level scanning results corresponding to the current scanning results matches the current scanning results; if so, provide the next level of access permissions; if not, lock the mobile storage and issue an alarm. Through multi-level step-by-step verification, multi-level malware scanning can be performed, improving scanning speed and accuracy.

[0009] In one embodiment, before the mobile storage is used, a scanning system performs a multi-level scan on the mobile storage to obtain the multi-level scan results, and stores the multi-level scan results in the central security monitoring system. The scanning system avoids occupying the actual system resources for antivirus scanning.

[0010] An electronic device proposed in an embodiment of the present invention includes: at least one processor; and a memory coupled to the at least one processor, wherein the memory is used to store instructions, and when the instructions are executed by the at least one processor, the processor executes the method described above.

[0011] An embodiment of the present invention provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed, the method described in any of the above embodiments is executed.

[0012] A computer program product provided in an embodiment of the present invention includes a computer program. When the computer program is executed by a processor, the method described in any one of the above embodiments is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The following drawings are only intended to illustrate and explain the present invention, and do not limit the scope of the present invention.

[0014] FIG1 is a flow chart of a mobile storage multi-level verification method 100 according to an embodiment of the present invention.

[0015] FIG2 is a schematic structural diagram of a mobile storage multi-stage verification device 200 according to an embodiment of the present invention.

[0016] Figure 3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention.

[0017] The following are the descriptions of the reference numerals: DETAILED DESCRIPTION

[0018] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, specific embodiments of the present invention are now described with reference to the accompanying drawings.

[0019] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0020] As used in this application and the claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not intended to refer to the singular but may include the plural. Generally speaking, the terms "comprises" and "include" only indicate the inclusion of the steps and elements specifically identified, and these steps and elements do not constitute an exclusive list. A method or apparatus may also include other steps or elements.

[0021] In some OT management processes, mobile storage devices must be scanned for malware on a dedicated host before being used in OT systems. However, it is difficult to verify whether mobile storage devices have been previously scanned in OT systems. In many scenarios, operators or engineers may fail to perform scans due to a lack of security awareness, or even directly use any mobile storage in OT systems in emergency situations. These violations pose a significant threat and are difficult to detect.

[0022] Before using mobile storage in an OT system, you can check the scanning status of the mobile storage. However, it is difficult to scan the status of the entire mobile storage in a short period of time, which may affect the user experience.

[0023] Therefore, to provide a more optimized mobile storage scanning method, in an embodiment of the present invention, when the mobile storage is used, the central security monitoring system obtains the multi-level scanning results of the mobile storage; based on the multi-level scanning results, it is determined whether the mobile storage has been scanned and whether the multi-level scanning results are normal; if not, the use of the mobile storage is prohibited and an alarm is issued; the use permissions of the mobile storage are provided step by step, and the mobile storage is scanned based on the scanning rules corresponding to the use permissions to obtain the current scanning results; it is determined whether the portion of the multi-level scanning results corresponding to the current scanning results matches the current scanning results; if so, the next level of use permissions is provided; if not, the mobile storage is locked and an alarm is issued. The technical solution in the embodiment of the present invention can improve the scanning accuracy of mobile storage devices, increase the speed of using mobile storage, prevent malware from bypassing basic checks, and improve security.

[0024] FIG1 is a flow chart of a mobile storage multi-level verification method 100 according to an embodiment of the present invention. As shown in FIG1 , the method 100 may include:

[0025] Step S101, obtaining a multi-level scanning result. When the mobile storage is used, the central security monitoring system obtains the multi-level scanning result of the mobile storage.

[0026] In one embodiment, before the mobile storage is used, a scanning system performs a multi-level scan on the mobile storage to obtain the multi-level scan result, and the multi-level scan result is stored in the central security monitoring system.

[0027] Specifically, the scanning system updates its malware database via an update server provided by the anti-malware vendor via the internet. The scanning system sends scan results and security status information to the central security monitoring system. If the removable storage device is malware-free and passes the malware scan, the scanning system generates a multi-level summary of the results and obtains the removable storage device ID. Multi-level scanning can be customized by the administrator based on performance and scan time requirements. In addition to performing a full-disk malware scan using multiple anti-malware engines, multi-level scanning also performs various checks to detect possible file modifications on the removable storage device.

[0028] In one embodiment, the multi-level scanning results further include:

[0029] First level: last update time, scan time and disk usage;

[0030] Level 2: hash value of executable files, file modification logs, and file counts;

[0031] Level 3: Hash values ​​of critical files and modification times of any potentially infected files.

[0032] Step S102 , verifying the multi-level scanning result, and determining whether the mobile storage has been scanned and whether the multi-level scanning result is normal based on the multi-level scanning result; if not, prohibiting the use of the mobile storage and issuing an alarm.

[0033] Specifically, when mobile storage is used in OT devices, a trust analysis is performed by requesting the scan result status with the mobile storage ID.

[0034] Step S103, verifying level by level, providing the use permission of the mobile storage level by level, and scanning the mobile storage based on the scanning rules corresponding to the use permission to obtain the current scanning result; judging whether the part corresponding to the current scanning result in the multi-level scanning result matches the current scanning result; if so, providing the use permission of the next level; if not, locking the mobile storage and alarming.

[0035] Specifically, when a removable storage device is used in an OT device, it undergoes a status check based on a multi-level policy. If the removable storage device passes the first-level policy's quick scan, it can be recognized and used by the OT device with limited permissions. It then undergoes the second and third-level scans based on the multi-level policy during idle time. However, until the full scan is complete, it can only be accessed with limited permissions.

[0036] In one embodiment, the usage rights include:

[0037] Level 1: List all files, cannot access any executable files or files that may be infected by malware, and cannot automatically execute any applications or scripts;

[0038] Level 2: List all files, copy and edit files that cannot be infected by malware, cannot access any executable files or files that may be infected by malware, and cannot automatically execute any applications or scripts;

[0039] Level 3: List all files, copy and edit executable files, copy and edit files that cannot be infected by malware, cannot access any executable files or files that can be infected by malware, and cannot automatically execute any applications or scripts.

[0040] In one embodiment, the scanning rules corresponding to the usage rights further include:

[0041] First level: last update time, scan time and disk usage;

[0042] Level 2: hash value of executable files, file modification logs, and file counts;

[0043] Level 3: Hash values ​​of critical files and modification times of any potentially infected files.

[0044] In one embodiment, after the mobile storage passes the level-by-level verification, the method further includes: providing full usage rights of the mobile storage

[0045] FIG2 is a schematic diagram of the structure of a mobile storage multi-level verification device 200 according to an embodiment of the present invention. As shown in FIG2 , the device 200 may include:

[0046] The multi-level scanning result acquisition module 201 is configured to acquire the multi-level scanning result of the mobile storage by the central security monitoring system when the mobile storage is used.

[0047] In one embodiment, before the mobile storage is used, a scanning system performs a multi-level scan on the mobile storage to obtain the multi-level scan result, and the multi-level scan result is stored in the central security monitoring system.

[0048] Specifically, the scanning system updates its malware database via an update server provided by the anti-malware vendor via the internet. The scanning system sends scan results and security status information to the central security monitoring system. If the removable storage device is malware-free and passes the malware scan, the scanning system generates a multi-level summary of the results and obtains the removable storage device ID. Multi-level scanning can be customized by the administrator based on performance and scan time requirements. In addition to performing a full-disk malware scan using multiple anti-malware engines, multi-level scanning also performs various checks to detect possible file modifications on the removable storage device.

[0049] In one embodiment, the multi-level scanning results further include:

[0050] First level: last update time, scan time and disk usage;

[0051] Level 2: hash value of executable files, file modification logs, and file counts;

[0052] Level 3: Hash values ​​of critical files and modification times of any potentially infected files.

[0053] The multi-level scanning result verification module 202 is configured to determine whether the mobile storage has been scanned and whether the multi-level scanning result is normal based on the multi-level scanning result; if not, prohibit the use of the mobile storage and issue an alarm.

[0054] Specifically, when mobile storage is used in OT devices, a trust analysis is performed by requesting the scan result status with the mobile storage ID.

[0055] The step-by-step verification module 203 is configured to provide the use permission of the mobile storage step by step, and scan the mobile storage to obtain the current scanning result based on the scanning rules corresponding to the use permission; determine whether the part corresponding to the current scanning result in the multi-level scanning result matches the current scanning result; if so, provide the next level of use permission; if not, lock the mobile storage and alarm.

[0056] Specifically, when a removable storage device is used in an OT device, it undergoes a status check based on a multi-level policy. If the removable storage device passes the first-level policy's quick scan, it can be recognized and used by the OT device with limited permissions. It then undergoes the second and third-level scans based on the multi-level policy during idle time. However, until the full scan is complete, it can only be accessed with limited permissions.

[0057] In one embodiment, the usage rights include:

[0058] Level 1: List all files, cannot access any executable files or files that may be infected by malware, and cannot automatically execute any applications or scripts;

[0059] Level 2: List all files, copy and edit files that cannot be infected by malware, cannot access any executable files or files that may be infected by malware, and cannot automatically execute any applications or scripts;

[0060] Level 3: List all files, copy and edit executable files, copy and edit files that cannot be infected by malware, cannot access any executable files or files that can be infected by malware, and cannot automatically execute any applications or scripts.

[0061] In one embodiment, the scanning rules corresponding to the usage rights further include:

[0062] First level: last update time, scan time and disk usage;

[0063] Level 2: hash value of executable files, file modification logs, and file counts;

[0064] Level 3: Hash values ​​of critical files and modification times of any potentially infected files.

[0065] In one embodiment, the step-by-step verification module 203 is further configured to: provide full usage rights of the mobile storage after the mobile storage passes the step-by-step verification.

[0066] The present invention also provides an electronic device 300. FIG3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention. As shown in FIG3 , the electronic device 300 includes a processor 310 and a memory 320. The memory 320 stores instructions, wherein the instructions, when executed by the processor 310, implement the method 100 described above.

[0067] The present invention further provides a computer-readable storage medium having computer instructions stored thereon. When the computer instructions are executed, the method described above is executed.

[0068] The present invention also provides a computer program product, comprising a computer program, which implements the above-mentioned method when executed by a processor.

[0069] Some aspects of the methods and apparatus of the present invention may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software may be referred to as "data blocks," "modules," "engines," "units," "components," or "systems." The processor may be one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLCs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, or combinations thereof. In addition, various aspects of the present invention may be embodied as computer products in one or more computer-readable media, the product including computer-readable program code. For example, computer-readable media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, tapes, etc.), optical disks (e.g., compact disks (CDs), digital versatile disks (DVDs), etc.), smart cards, and flash memory devices (e.g., cards, sticks, key drives, etc.).

[0070] Flowcharts are used herein to illustrate the operations performed by the methods according to the embodiments of the present application. It should be understood that the preceding operations are not necessarily performed in exact order. Instead, the various steps may be performed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.

[0071] It should be understood that although this specification is described according to various embodiments, not every embodiment contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

[0072] The above description is only an illustrative embodiment of the present invention and is not intended to limit the scope of the present invention. Any equivalent changes, modifications and combinations made by those skilled in the art without departing from the concept and principle of the present invention shall fall within the scope of protection of the present invention.

Claims

1. A mobile storage multi-level verification method (100), characterized in that: The method comprises: Acquiring multi-level scanning results (S101), when the mobile storage is used, the central security monitoring system acquires the multi-level scanning results of the mobile storage; Verifying the multi-level scanning result (S102), and determining whether the mobile storage has been scanned and whether the multi-level scanning result is normal based on the multi-level scanning result; If not, prohibit the use of the mobile storage and alert the police; Verify step by step (S103), provide the use permission of the mobile storage step by step, and scan the mobile storage to obtain the current scan result based on the scanning rule corresponding to the use permission; determine whether the part of the multi-level scan result corresponding to the current scan result matches the current scan result; If yes, the next level of usage permission is provided; if no, the mobile storage is locked and an alarm is sounded.

2. The method according to claim 1, characterized in that Before the mobile storage is used, a scanning system performs a multi-level scan on the mobile storage to obtain the multi-level scanning result, and the multi-level scanning result is stored in the central security monitoring system.

3. The method according to claim 2, characterized in that The multi-level scanning results further include: First level: last update time, scan time and disk usage; Level 2: hash values ​​of executable files, file modification logs, and file counts; Level 3: Hash values ​​of critical files and modification times of any potentially infected files.

4. The method according to claim 1, characterized in that: The usage rights include: Level 1: List all files, cannot access any executable files or files that may be infected by malware, and cannot automatically execute any applications or scripts; Level 2: List all files, copy and edit files that cannot be infected by malware, cannot access any executable files or files that may be infected by malware, and cannot automatically execute any applications or scripts; Level 3: List all files, copy and edit executable files, copy and edit files that cannot be infected by malware, cannot access any executable files or files that can be infected by malware, and cannot automatically execute any applications or scripts.

5. The method according to claim 1, characterized in that The scanning rules corresponding to the use rights further include: First level: last update time, scan time and disk usage; Level 2: hash values ​​of executable files, file modification logs, and file counts; Level 3: Hash values ​​of critical files and modification times of any potentially infected files.

6. The method according to claim 1, after the mobile storage passes the level-by-level verification, the method further comprises: Provide full usage rights of the mobile storage.

7. A mobile storage multi-level verification device (200), characterized in that: The device comprises: The module (201) for obtaining multi-level scanning results is configured to: when the mobile storage is used, obtain the multi-level scanning results of the mobile storage by the central security monitoring system; A multi-level scanning result verification module (202) is configured to: determine whether the mobile storage has been scanned and whether the multi-level scanning result is normal based on the multi-level scanning result; If not, prohibit the use of the mobile storage and alert the police; The step-by-step verification module (203) is configured to: provide the use authority of the mobile storage step by step, and scan the mobile storage to obtain the current scanning result based on the scanning rule corresponding to the use authority; determine whether the part of the multi-level scanning result corresponding to the current scanning result matches the current scanning result; If yes, the next level of usage permission is provided; if no, the mobile storage is locked and an alarm is sounded.

8. The device according to claim 7, characterized in that Before the mobile storage is used, a scanning system performs a multi-level scan on the mobile storage to obtain the multi-level scanning result, and the multi-level scanning result is stored in the central security monitoring system.

9. The device according to claim 8, characterized in that The multi-level scanning results further include: First level: last update time, scan time and disk usage; Level 2: hash values ​​of executable files, file modification logs, and file counts; Level 3: Hash values ​​of critical files and modification times of any potentially infected files.

10. The device according to claim 7, characterized in that The usage rights include: Level 1: List all files, cannot access any executable files or files that may be infected by malware, and cannot automatically execute any applications or scripts; Level 2: List all files, copy and edit files that cannot be infected by malware, cannot access any executable files or files that may be infected by malware, and cannot automatically execute any applications or scripts; Level 3: List all files, copy and edit executable files, copy and edit files that cannot be infected by malware, cannot access any executable files or files that can be infected by malware, and cannot automatically execute any applications or scripts.

11. The device according to claim 7, characterized in that The scanning rules corresponding to the use rights further include: First level: last update time, scan time and disk usage; Level 2: hash values ​​of executable files, file modification logs, and file counts; Level 3: Hash values ​​of critical files and modification times of any potentially infected files.

12. The device according to claim 7, wherein the step-by-step verification module (203) is further configured to: After the mobile storage passes the level-by-level verification, full usage rights of the mobile storage are provided.

13. An electronic device (300), comprising: at least one processor (310); as well as A memory (320) coupled to the at least one processor (310), the memory (320) being used to store instructions, which, when executed by the at least one processor (310), causes the processor (310) to perform the method according to any one of claims 1 to 6.

14. A computer-readable storage medium having computer instructions stored thereon, wherein the computer instructions, when executed, execute the method according to any one of claims 1 to 6.

15. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 6.

Images