CN101901559B - Safety control method for USB (Universal Serial Bus) interface - Google Patents
Safety control method for USB (Universal Serial Bus) interface Download PDFInfo
- Publication number
- CN101901559B CN101901559B CN 201010243069 CN201010243069A CN101901559B CN 101901559 B CN101901559 B CN 101901559B CN 201010243069 CN201010243069 CN 201010243069 CN 201010243069 A CN201010243069 A CN 201010243069A CN 101901559 B CN101901559 B CN 101901559B
- Authority
- CN
- China
- Prior art keywords
- usb
- interface
- intelligent switch
- switch device
- computing machine
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Landscapes
- Storage Device Security (AREA)
Abstract
The invention discloses a safety control method for a USB (Universal Serial Bus) interface. The safety control to the USB interface of a computer is carried out by adopting an intelligent switch device (10); one end of the intelligent switch device (10) is a USB interface of the computer (1) while the other end is a safety interface (5) of the computer. In addition, by adopting an intelligent switch device (20), the safety control to the USB interface of an external device is carried out; one end of the intelligent switch device (20) is a USB equipment interface (9) while the other end is an equipment safety interface (6). The invention has the following advantages: the computer and the external device make full use of the convenience and the high efficiency of the USB, and meanwhile, realize the safety control to the USB interface without depending on the computer software and the data encryption technology, so that the credibility of the USB data communication is ensured and the leakage of the important information of the computer and the external device via the USB interface is prevented.
Description
Technical field
The present invention relates to the computer security technique field, a kind of specifically USB interface method of controlling security.
Background technology
In the last few years, general-purpose serial bus USB (Universal Serial Bus) was because of its plug and play, characteristic such as hot-swappable, efficient, and range of application is very extensive.Meanwhile, the Information Security problem brought of computing machine USB interface is also more and more outstanding.A Portable USB storage products (as USB flash disk, MP3, portable hard drive, mobile phone, digital camera etc.), can be easily a large amount of significant data moment in the computing machine be stolen by USB interface, or import virus into computer-internal, computing machine is caused huge potential safety hazard.Therefore, it is very necessary that USB interface is carried out security control, particularly relating computer and concerning security matters USB device, and the safety issue of its USB interface is more outstanding.
Carry out security control for USB interface communication, certain research all arranged both at home and abroad, following several method is specifically arranged:
(1) physically directly removes USB interface.As the way of most of secret units, this way is the safest, but is put off easily by a slight risk, and USB interface can't be re-used forever.
(2) forbid the use of USB interface from BIOS, the option of forbidding the internal USB port is arranged among the BIOS of most of novel computer mainboards, this method has certain limitation, and not all mainboard all has such function.And, forbid that under BIOS port can all seal all USB mouths, will cause all USB device not use.
(3) utilize software to carry out the USB interface security control.Utilize software to control to flow through the data of USB port, thereby reach the purpose of USB interface communication security, this method is all more commonly used at home and abroad, and following a few class software is arranged usually: water [proof, computer equipment control system, special-purpose USB monitoring software.
Water [proof: the notion of water [proof by in soft main office at first propose, it is the important tool that is used for strengthening the infosystem internal security, it is in the internal network, is an Intranet supervisory system, can monitor the safety case of internal host at any time.Its critical function prevents illegal copies exactly.The user can not copy any information with any carrier under the situation without effectively mandate.Meanwhile, system will monitor the copy under the licensing status, and automatically copied content be put on record.This has played good protective action for the data by USB interface.The soft water [proof WaterBox of system and climb and reach climbing of scientific ﹠ technical corporation and reach water [proof during domestic water [proof software mainly contains.Similar software is abroad also arranged,, have two kinds of functions of fire wall and water [proof concurrently as the new edition SecureEXE software of SecureWave issue.A SecureEXE function wherein limits the user exactly and duplicates particular profile with portable memory device.
Computer equipment control system: be the special software that the various external units of computing machine are controlled.External software has enterprise's mobile security manager (EMSM) of Senfroce, it uses central authorities' control group policy to come the visit of supervisory computer user to various different channels, and sensitive data runs off from these channels, utilizes EMSM can realize the restriction of USB port.Domestic climb that to reach the computer equipment control system be a computer information safe security software, it can control computer various device, prevent computerized information by illegal copies, be applicable to the computing machine that various needs hold in close confidence or possess the computing machine of specific use.
USB monitoring software: be the software that USB interface is controlled specially.The USB Monitor a software that comes to this, it can tackle all data by the USB device access, and monitors in real time, supports data logging, the monitoring of a recorded programme project work stage, and in playing after a while.
Software control USB interface method can guarantee inner information security to a certain extent, prevents leakage of information.But also exist certain limitation.At first, these Control Software generally all are that the data by USB interface are tackled, and do not carry out high-level control.In addition, this class application software all belongs to consumer process, and the user with certain authority just can come bolt down procedure by the method for the process of killing, thereby breaks through the system of defense of system.
(4) utilize software or hardware that the USB transmission channel is encrypted control.In the process that the USB interface data input or output, embed an encrypting and decrypting operating process, thereby finish encryption the USB interface data communication.Promptly the data (if ciphertext form of the same type) that enter USB interface are decrypted, to encrypting from the data of USB interface output.The encryption control procedure of data is embedded in operating system nucleus, or is embedded in the external USB passage encryption equipment, realizes that inside computer system uses clear data, and what deposit memory device in all is encrypt data.Make data have automatic security control ability, can guarantee the confidentiality of data by the computing machine USB interface.But, go up from technology itself, data are encrypted can not stop the assailant to steal ciphertext, and well-known, all are the relative safeties for cracking cost (economic cost and time cost) based on cryptographic data security.Therefore, it is limited to utilize software or hardware the USB transmission channel to be encrypted the security of USB method of controlling security of control.
In addition, patent 2007100049039 proposes a kind of " U-disc virus prevention interface " method, before USB flash disk inserts the computing machine USB interface, autorun.inf file on the USB flash disk is deleted processing by USB switch and single-chip microcomputer, reach the purpose that computing machine is avoided the USB flash disk virus infections.This patent only is used to prevent USB flash disk virus, and is powerless to utilizing USB flash disk to carry out data theft.
Patent 20072012936 proposes a kind of " can prevent the computer interface safety feature that computer data is stolen ", limited part by physical construction is placed in the computer interface socket fully, limit arbitrary external device and insert among this computing machine socket, shifting out of this limited part also need be by the special-purpose releasing part of invention.Thereby this interface is used in restriction, reaches to prevent the protection computer data purpose that is stolen.This patent is essentially a kind of USB interface mechanical lock, and its safe reliability is limited.
Summary of the invention
The objective of the invention is to prevent that the USB external unit from by the computing machine USB interface, becoming security threat to calculation mechanism, the spy provides a kind of USB interface method of controlling security.
For reaching this purpose, the present invention adopts 10 pairs of USB interface of computer of an intelligent switch device to carry out security control, and intelligent switch device 10 1 ends are the computing machine usb 1, and the other end is a computer security interface 5; Also adopt the USB interface of 20 pairs of external units of an intelligent switch device to carry out security control, intelligent switch device 20 1 ends are USB device interface 9, and the other end is a device security interface 6; When the external unit that inserts on the computer security interface 5 based on safe interface 6, after intelligent switch device 10 is low level as if the handshake USBOK that perceives 6 computer security interfaces 5 and device security interfaces, then intelligent switch device 10 is just connected the power supply signal of computing machine usb 1 and the power supply signal of computer security interface 5, power to external unit, and then, computing machine and external unit just begin to use respectively intelligent switch device 10 and intelligent switch device 20 to carry out authentication mutually, after checking is passed through, intelligent switch device 10 is just connected the data line of computing machine usb 1 and the data line of computer security interface 5, intelligent switch device 20 is just connected the data line of USB device interface 9 and the data line of device security interface 6, make intelligent switch device 10,20 is closed fully, and external unit could carry out usb data communication with computing machine; Otherwise intelligent switch device 10,20 all is in off-state, and computing machine usb 1 and external unit USB interface 9 all by intelligent switch device safety isolation separately, ban use of; When computer security interface 5 did not insert external unit based on safe interface 6, intelligent switch device 10 was in off-state, thereby the computing machine usb 1 is carried out safe isolation, makes computing machine usb signal forbidding, realizes the security control to computing machine USB; When device security interface 6 not during access security interface 5, intelligent switch device 20 is in off-state, thereby USB device interface 9 is carried out safe isolation, makes external unit usb signal forbidding, realizes the security control to external unit USB.
The electric signal that computer security interface 5 is identical with having of device security interface 6: 1 handshake USBOK and 4 standard usb signals (the power supply signal Vcc of+5V, earth signal GND, data-signal D+, data-signal D-), totally 5 signals are formed.
The present invention has following beneficial effect: when making computing machine and external unit make full use of convenience, the high efficiency of USB, do not rely on the security control of computer software and data encryption technology realization to USB interface, guaranteed the credibility of usb data communication, prevented that important information leaks by USB interface in computing machine and the external unit.
Description of drawings
Fig. 1 is the computer security interface principle block diagram that the present invention is based on USB;
Wherein 1 is the computing machine USB interface, and 5 is the computer security interface, and 10 is intelligent switch device, comprises single-chip microcomputer 2, USB change-over switch 3 and power switch 4.
Fig. 2 is the theory diagram that the present invention is based on the device security interface of USB;
Wherein 6 is the device security USB interface, and 9 is the USB device interface, and 20 is intelligent switch device, comprises USB change-over switch 7, single-chip microcomputer 8.
Fig. 3 is a usb communication embodiment between computing machine provided by the invention and external unit.
Embodiment
Shown in Fig. 1-3, when computing machine and external unit use the inventive method to carry out usb data communication, only need standard usb signal in the computing machine is connected with computing machine usb 1 among the present invention, make computing machine finally only export computer security interface 5, just can realize the purpose of the security control of computing machine USB interface.Concrete preferred implementation is as follows, and the external unit usb signal is connected with USB device interface 9 in the embodiment, makes only output device safe interface 6 of external unit.
(1) computer booting carries out initialization: single-chip microcomputer 2 control power switches 4 are in off-state in the computer-internal intelligent switch device 10, and out-put supply is not to safe interface 5; It is vacant state with the data line of computer security interface 5 that single-chip microcomputer 2 is also controlled USB change-over switch 3, neither link to each other with the usb data line of single-chip microcomputer 2, do not link to each other yet, and link to each other with vacant the 3rd pair of selecting side on the USB change-over switch 3 with the data line of computing machine usb 1; The single-chip microcomputer 2 also USBOK signal of control computer safe interface 5 is a high level.
(2) single-chip microcomputer 2 is (external unit has been linked into computer security interface 5 by device security interface 6) after the low level if detect its USBOK signal, single-chip microcomputer 2 control power switches 4 make computing machine pass through safe interface 5 out-put supply signals to external unit to closure state.Otherwise external unit inserts the computing machine failure.
(3) after single-chip microcomputer 2 detects its USBOK signal and is low level, also control USB change-over switch 3 the usb data line of single-chip microcomputer 2 is connected with the data line of computer security interface 5.
(4) after external unit obtained power supply signal by interface 5, interface 6, the beginning initialization: single-chip microcomputer 8 control USB change-over switches 7 in its inner intelligent switch 20 were connected the usb data line of single-chip microcomputer 8 with the data line of device security interface 6.
(5) then single-chip microcomputer 2 by its usb data line, USB change-over switch 3, interface 5, interface 6 and USB change-over switch 7, with 8 pairs of single-chip microcomputers in the external unit each other identity verify.If not by checking, then external unit inserts the computing machine failure.
(6) authentication qualified after, single-chip microcomputer 2 control USB change-over switches 3 are connected the data line of computing machine usb 1 in the computing machine with the data line of computer security interface 5; Single-chip microcomputer 8 control USB change-over switches 7 are connected the data line of USB device interface 9 in the external unit with the data line of device security interface 6.
(7) then, the data communication that just can be undertaken based on USB by computer security interface 5, device security interface 6 between computing machine and external unit.
Therefore, have the computing machine of safe interface 5, only allow to have safe interface 6, and, could carry out usb data communication with it through the external unit of authentication after qualified.In convenience that has made full use of USB and high efficiency, also guarantee the credibility of usb data communication.
Claims (1)
1. USB interface method of controlling security, it is characterized in that: adopt one first intelligent switch device (10) that USB interface of computer is carried out security control, first intelligent switch device (10) one ends are computing machine USB interface (1), and the other end is a computer security interface (5); Also adopt one second intelligent switch device (20) that the USB interface of external unit is carried out security control, second intelligent switch device (20) one ends are equipment USB interface (9), and the other end is device security interface (6);
Described first intelligent switch device (10) comprising: first single-chip microcomputer (2), a USB change-over switch (3) and power switch (4); One end of first intelligent switch device (10) is computing machine USB interface (1), and the other end is computer security interface (5); In first intelligent switch device (10), 2 pairs of selecting sides of a USB change-over switch (3) of 3: 1 are connected with the data line of computing machine USB interface (1), the usb data line of first single-chip microcomputer (2) respectively, and other 1 pair of selecting side is vacant, is not connected with any circuit; Two control lines of first single-chip microcomputer (2) are connected with power switch (4), a USB change-over switch (3) respectively; The power supply signal of computing machine USB interface (1), first single-chip microcomputer (2), a USB change-over switch (3), power switch (4) is same power supply; The power supply signal of computer security interface (5) connects the output terminal of power switch (4), two data lines of computer security interface (5) connect the multiplexing end of 1 couple of USB change-over switch, and computer security interface (5) is gone up the USBOK signal and linked to each other with the 3rd control line of first single-chip microcomputer (2); And the earth signal GND of computing machine USB interface (1), first single-chip microcomputer (2), a USB change-over switch (3), power switch (4) and computer security interface (5) is same earth signal;
Described second intelligent switch device (20) comprising: the 2nd USB change-over switch (7) and second singlechip (8); One end of second intelligent switch device (20) is device security interface (6), and the other end is equipment USB interface (9); In second intelligent switch device (20), 2 pairs of selecting sides of 2: 1 the 2nd USB change-over switch (7) are connected with the data line of equipment USB interface (9), the usb data line of second singlechip (8) respectively, and the multiplexing end of 1 couple of the 2nd USB change-over switch (7) is connected with device security interface (6); The power supply signal of equipment USB interface (9), second singlechip (8), the 2nd USB change-over switch (7) and device security interface (6) is same power supply; Device security interface (6) is gone up the USBOK signal and is linked to each other with earth signal GND line; And the earth signal GND of equipment USB interface (9), second singlechip (8), the 2nd USB change-over switch (7) and device security interface (6) is same earth signal;
When computer security interface (5) go up to insert external unit based on device security interface (6), first intelligent switch device (10) is if perceive after handshake USBOK between computer security interface (5) and device security interface (6) is low level, then first intelligent switch device (10) is just connected the power supply signal of computing machine USB interface (1) and the power supply signal of computer security interface (5), power to external unit, and then, computing machine and external unit just begin to use respectively first intelligent switch device (10) and second intelligent switch device (20) to carry out authentication mutually, after checking is passed through, first intelligent switch device (10) is just connected the data line of computing machine USB interface (1) and the data line of computer security interface (5), second intelligent switch device (20) is just connected the data line of equipment USB interface (9) and the data line of device security interface (6), make first intelligent switch device (10), second intelligent switch device (20) is closed fully, and external unit could carry out usb data communication with computing machine; Otherwise first intelligent switch device (10), second intelligent switch device (20) all are in off-state, and computing machine USB interface (1) and external unit USB interface (9) all by intelligent switch device safety isolation separately, ban use of; When computer security interface (5) does not insert external unit based on device security interface (6), first intelligent switch device (10) is in off-state, thereby computing machine USB interface (1) is carried out safe isolation, make computing machine usb signal forbidding, realize security control computing machine USB; When device security interface (6) does not insert computer security interface (5), second intelligent switch device (20) is in off-state, thereby equipment USB interface (9) is carried out safe isolation, make external unit usb signal forbidding, realize security control external unit USB.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 201010243069 CN101901559B (en) | 2010-07-30 | 2010-07-30 | Safety control method for USB (Universal Serial Bus) interface |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 201010243069 CN101901559B (en) | 2010-07-30 | 2010-07-30 | Safety control method for USB (Universal Serial Bus) interface |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101901559A CN101901559A (en) | 2010-12-01 |
| CN101901559B true CN101901559B (en) | 2011-12-28 |
Family
ID=43227060
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN 201010243069 Expired - Fee Related CN101901559B (en) | 2010-07-30 | 2010-07-30 | Safety control method for USB (Universal Serial Bus) interface |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101901559B (en) |
Families Citing this family (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102737174A (en) * | 2011-09-23 | 2012-10-17 | 新奥特（北京）视频技术有限公司 | Method and system for verifying data validity in data security prevention and control |
| CN103020508B (en) * | 2011-09-23 | 2016-12-28 | 联想(北京)有限公司 | A kind of state switching method, device and terminal |
| CN106372494B (en) * | 2013-11-19 | 2019-03-19 | 国网河南省电力公司南阳供电公司 | Anti- illegal external connection device |
| CN104331676B (en) * | 2014-10-14 | 2017-04-05 | 山东超越数控电子有限公司 | A kind of method for realizing that by level match technology USB device authority is distinguished |
| CN104361277A (en) * | 2014-10-22 | 2015-02-18 | 成都卫士通信息产业股份有限公司 | Identity authentication module and method for USB interface equipment |
| CN105117912B (en) * | 2015-09-01 | 2019-04-02 | Oppo广东移动通信有限公司 | A kind of mobile terminal being stolen anti-brush machine and its it is stolen anti-brush machine method |
| CN105912958A (en) * | 2016-04-01 | 2016-08-31 | 浪潮电子信息产业股份有限公司 | Method and device for controlling access to external equipment |
| CN107545190A (en) * | 2016-06-27 | 2018-01-05 | 鸿富锦精密工业(武汉)有限公司 | Data protection system and data guard method |
| CN106844254A (en) * | 2016-12-29 | 2017-06-13 | 武汉烽火众智数字技术有限责任公司 | Mobile memory medium switching device, data ferry-boat system and method |
| CN108537072A (en) * | 2017-12-18 | 2018-09-14 | 北京航天控制仪器研究所 | A kind of USB interface-based security system |
| CN109921911B (en) * | 2019-04-19 | 2022-05-27 | 郑州大学第一附属医院 | Computer information security control device and method |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1294504C (en) * | 2004-03-18 | 2007-01-10 | 上海交通大学 | Data separation switching transmitting method based on USB bus |
| CN100465981C (en) * | 2007-04-29 | 2009-03-04 | 西南石油大学 | U-disc virus prevention interface |
| CN101414336A (en) * | 2007-10-16 | 2009-04-22 | 吴晓明 | Computer information safety control system |
| CN201203865Y (en) * | 2008-03-04 | 2009-03-04 | 范九伦 | Multifunctional hardware encryption box apparatus without relation with computer OS |
| CN101321065B (en) * | 2008-06-30 | 2012-03-28 | 中国船舶重工集团公司第七〇九研究所 | USB data safety transmission technique with double-factor identity validation function |
| JP4858511B2 (en) * | 2008-08-13 | 2012-01-18 | 日本電気株式会社 | USB connection storage device, USB connection storage method, USB connection storage program |
| CN201508549U (en) * | 2009-09-02 | 2010-06-16 | 中兴通讯股份有限公司 | Device and system for controlling on-off of USB (universal serial bus) interface |
-
2010
- 2010-07-30 CN CN 201010243069 patent/CN101901559B/en not_active Expired - Fee Related
Also Published As
| Publication number | Publication date |
|---|---|
| CN101901559A (en) | 2010-12-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101901559B (en) | Safety control method for USB (Universal Serial Bus) interface | |
| US5724426A (en) | Apparatus and method for controlling access to and interconnection of computer system resources | |
| CN109561071B (en) | Data flow control's external terminal protective equipment and protection system | |
| WO2020087781A1 (en) | External connection type terminal protection device and protection system | |
| CN101441601B (en) | Ciphering transmission method of hard disk ATA instruction and system | |
| CN101976320B (en) | Credible computer platform | |
| CN107563213B (en) | Safety secrecy control device for preventing data extraction of storage equipment | |
| CN109522760B (en) | Data forwarding control method and system based on hardware control logic | |
| CN103440462A (en) | Embedded control method for improving security and secrecy performance of security microprocessor | |
| CN103532980A (en) | Secure access terminal for intranet and extranet | |
| CN205584238U (en) | Network data encryption equipment | |
| CN101833620A (en) | Custom security JDBC driver-based database protective method | |
| CN105373724A (en) | Wireless Authentication System and Method for USB Storage Device | |
| CN104581008A (en) | Information security protection system and method for video monitoring system | |
| CN108572861A (en) | A kind of guard method, system, equipment and the storage medium of virtual credible root | |
| CN101593252A (en) | Control method and system that a kind of computing machine conducts interviews to USB device | |
| CN203618018U (en) | Internal and external network security access terminal | |
| CN203618020U (en) | Internal and external network security access mode | |
| CN1293483C (en) | Multistorage type physical buffer computer data safety protection method and device | |
| CN103824014A (en) | Isolation certificating and monitoring method of USB (universal serial bus) port within local area network | |
| CN101699456A (en) | Computer security system and method thereof | |
| WO2015127831A1 (en) | Anti-intrusion method and access device | |
| CN1208728C (en) | Safety computer with information safety management unit | |
| CN206470760U (en) | A kind of computer network security control device | |
| CN111885179B (en) | External terminal protection device and protection system based on file monitoring service |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20111228 Termination date: 20200730 |