WO2020087781A1 - 一种外接式终端防护设备及防护系统 - Google Patents

一种外接式终端防护设备及防护系统 Download PDF

Info

Publication number
WO2020087781A1
WO2020087781A1 PCT/CN2019/072029 CN2019072029W WO2020087781A1 WO 2020087781 A1 WO2020087781 A1 WO 2020087781A1 CN 2019072029 W CN2019072029 W CN 2019072029W WO 2020087781 A1 WO2020087781 A1 WO 2020087781A1
Authority
WO
WIPO (PCT)
Prior art keywords
external
interface
control module
terminal protection
external terminal
Prior art date
Application number
PCT/CN2019/072029
Other languages
English (en)
French (fr)
Inventor
杜华
艾伟
蔡镇河
张昊
Original Assignee
北京博衍思创信息科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京博衍思创信息科技有限公司 filed Critical 北京博衍思创信息科技有限公司
Priority to KR1020207036696A priority Critical patent/KR102313543B1/ko
Priority to JP2020571603A priority patent/JP7029000B2/ja
Priority to US16/978,772 priority patent/US10885230B1/en
Priority to RU2020139957A priority patent/RU2764292C1/ru
Priority to EP19878392.0A priority patent/EP3812948A4/en
Publication of WO2020087781A1 publication Critical patent/WO2020087781A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/82—Protecting input, output or interconnection devices
    • G06F21/85—Protecting input, output or interconnection devices interconnection devices, e.g. bus-connected or in-line devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/567—Computer malware detection or handling, e.g. anti-virus arrangements using dedicated hardware
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/22—Arrangements for preventing the taking of data from a data transmission channel without authorisation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2129—Authenticate client device independently of the user

Definitions

  • the invention belongs to the technical field of computer security, and particularly relates to an external terminal protection equipment and a protection system.
  • the present invention provides an external terminal protection device and a protection system that solve the above problems, so as to realize the takeover of each interface of the protected host, and ensure that the USB interface or serial port device of the protected host must be protected by the external terminal The equipment is completed, so that the purpose of protecting the USB interface or serial port of the protected host can be achieved without installing security protection software on the protected host.
  • this application provides an external terminal protection device, including:
  • the interface control module is used to provide one or more internal interfaces and one or more external interfaces, the internal interfaces are connected to corresponding interfaces of the protected host, and the external interfaces are used to access one or more external devices ;
  • the system control module is used to connect with the interface control module through the bus and control the security authentication of the external device accessed by one or more external interfaces on the interface control module to confirm whether the external device is a permitted access device.
  • the system control module when the external interface of the interface control module is connected to an external device, the system control module is notified through the bus, and the system control module first performs security authentication operations on the external device.
  • the external device fails the security authentication, the external device is set as an unauthorized access device, and the line between the external device and the protected host is physically disconnected; and // or
  • the external device passes the security authentication, it is confirmed that the external device is a permitted access device, and the physical connection of the line between the external device and the protected host is connected.
  • the interface control module monitors the connection status of the external interface connected to the external device in real time, and automatically confirms that the connected line is physically connected when the external device confirmed as the access device is allowed to be unplugged from the external interface Disconnect.
  • the system control module when the external device is unplugged from the external interface and accessed again, the system control module performs the security authentication operation on the external device again.
  • the interface control module monitors the connection status of the internal interface connected to the corresponding interface of the protected host in real time;
  • connection state When the connection state is abnormal, it automatically triggers to disconnect the line connection between the interface control module and the protected host.
  • automatically triggering to disconnect the line connection between the interface control module and the protected host further includes:
  • the monitoring circuit captures the current / voltage change of the internal interface, determines that the connection state is abnormal, and triggers an alarm indication signal.
  • connection state recovers from abnormal to normal, and the line between the interface control module and the protected host is still maintained The disconnected state of the connection.
  • system control module controls the security authentication of one or more external devices connected to the external interface on the interface control module based on the set security policy.
  • the external terminal protection equipment further includes:
  • Internal memory used to store data exchanged between interfaces.
  • the interface control module uses a current and voltage limiting circuit to prevent damage to the external terminal protection device by the strong discharge device connected to the external interface.
  • one or more of the internal interface and the external interface are USB interfaces.
  • one or more of the internal interface and the external interface are serial ports.
  • this application provides a protection system, including:
  • One or more external devices are One or more external devices.
  • the external terminal protection equipment As mentioned above, the external terminal protection equipment,
  • the external terminal protection device is externally connected to the protected host, so that the one or more external devices communicate with the protected host through the external terminal protection device.
  • the present invention has at least one or more of the following technical effects: it can realize the takeover of each data interface of the protected host, and ensure that the data communication using each interface of the protected host is completed through an external terminal, thereby achieving No need to install security protection software on the protected host to achieve the purpose of protecting the protected host, and greatly reduces the system security risk, and comprehensively solves the potential security risks caused by each interface.
  • FIG. 1 is a schematic diagram of an application scenario of a protection system based on an external terminal protection device according to a first embodiment of the present invention
  • FIG. 2 is a schematic diagram of the internal structure of the external terminal protection device according to the first embodiment of the present invention.
  • FIG. 3 is a schematic diagram of connection of an external terminal protection device according to a second embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a network deployment of a protection system based on an external terminal protection device according to a third embodiment of the present invention.
  • the external terminal protection equipment proposed by the present invention includes an interface control module and a system control module.
  • the interface control module provides an internal interface and an external interface.
  • the internal interface is connected to the corresponding interface of the protected host, and the external interface is used to access one or more external devices.
  • the system control module is used to be electrically connected with the interface control module, and controls the security authentication of the external device connected to one or more external interfaces on the interface control module. It can be seen that the present invention provides a terminal protection device in the form of hardware, which can achieve the purpose of protecting the protected host without installing security protection software on the protected host, and greatly reduces the system security risk, and comprehensively solves the problem Potential security risks caused by various interfaces.
  • the “module” referred to in the present invention is a hardware module, that is, a hardware module composed of tangible electronic components such as circuits, data processing devices, memories, and buffers.
  • the interface control module and the system control module in the present invention may be a combination of physically or functionally independent components, or may be a combination of physical or functionally integrated whole components.
  • the interface control module is composed of an interface control board
  • the system control module is composed of a system control board. Both the interface control board and the system control board are circuit boards with integrated electronic components, and the two are connected by a bus .
  • the interface control module and the system control module can also be integrated on a circuit board. Therefore, the key of the present invention lies in the control relationship between the interface control module and the system control module, but is not limited to the combination of the spatial or physical connection of the electronic components constituting the respective modules.
  • the interface control module when the external interface of the interface control module is connected to an external device, the interface control module notifies the system control module that the system control module performs a security authentication operation on the external device. If the external device fails the security authentication, the external device is set as an unauthorized access device, and the line between the external device and the protected host is physically disconnected; and / or if the After the external device passes the security authentication, the external device is confirmed as a permitted access device, and the physical connection of the line between the external device and the protected host is connected.
  • the present invention can achieve physically isolated security authentication of external devices, and improve the security performance of the protection system.
  • the interface control module monitors the connection status of the external interface connected to the external device in real time, and when the external device confirmed as the access device is unplugged from the external interface, the connection is automatically turned on The physical connection of the line is disconnected. In this way, it is possible to prevent the unauthorized access device from being accessed by the connection of the authorized access device.
  • the system control module when the external device is unplugged from the external interface and accessed again, the system control module performs the security authentication operation on the external device again. As a result, it is possible to prevent attacks by using the same external device.
  • FIG. 1 shows an application scenario of the protection system involved in the first embodiment of the present invention.
  • the external terminal protection equipment is connected to the protected host through each interface connection line, and each interface on the protected host that needs to be protected (UC1, UC2 of the USB port, CC0 of the COM port, and EC0 of the network port) Connect to its own internal interface through various types of cables, such as connecting the interfaces UC1 and UC2 of the protected host to the internal USB ports UA4 and UA3 of the external terminal protection device, and connecting the serial port CC0 to the internal On the serial port CA2, the network port EC0 is connected to the internal network port EA2.
  • All external devices (U disk, CD-ROM drive, serial port connection device, etc.) are all connected to the external terminal protection device, and only through the external terminal protection device can data communication with the protected host, such as the U disk through the external connection
  • the external interface UA1 of the terminal protection device is connected, the USB optical drive is accessed through the external interface UA2, and the serial port connection device is accessed through the external interface CA1.
  • the external devices such as U disk, USB optical drive and serial connection device need to communicate with the protected host, and they cannot be directly connected to the protected host, and the communication must be transferred through the corresponding external interface of the external terminal protection device.
  • FIG. 2 is a schematic diagram of the internal structure of the external terminal protection device of the foregoing embodiment of the present invention.
  • the external terminal protection device is mainly composed of an interface control board A and a system control board B.
  • the system control board B is connected to the interface control board A through a control connection line (such as a bus) for controlling the interface control board
  • a control connection line such as a bus
  • Various working modes of various interfaces on A such as USB interface, serial port and network port, and then realize the function of security control for the access of various external devices.
  • the system control board A can realize the control of the working mode of each interface.
  • the working modes include available, unavailable, protocol filtering, traffic mirroring, and traffic auditing, etc., but the present invention is not limited to specific working mode control types.
  • the system control board B can be connected to the interface control board A through an I2C or SPI interface, but the present invention is not limited to a specific control connection interface.
  • the external terminal protection device may further include a hardware memory D, that is, an internal memory as a terminal protection device, used to store data exchanged between interfaces; further, the internal memory may further store a set security policy; a system control board B reads the preset security policy stored in the internal memory to perform security authentication on different types of interfaces or interfaces with different numbers on the interface control board.
  • a hardware memory D that is, an internal memory as a terminal protection device, used to store data exchanged between interfaces
  • the internal memory may further store a set security policy
  • a system control board B reads the preset security policy stored in the internal memory to perform security authentication on different types of interfaces or interfaces with different numbers on the interface control board.
  • the security functions implemented by the external terminal protection device include but are not limited to: administrators pre-set permissions and security policy settings for the external terminal protection device; the security policy includes but is not limited to: enabling data Import (such as USB interface), enable data export (such as USB interface), USB access device restrictions (such as USB device-based Vendor ID, ie vendor identification code, and / or Product ID, ie product identification code), data Import antivirus strategy, data export black and white list control strategy, data export format control strategy, enable serial port access strategy, USB interface insertion protection, enable network communication audit, enable firewall function, set serial port command black and white list, etc.
  • data Import such as USB interface
  • enable data export such as USB interface
  • USB access device restrictions such as USB device-based Vendor ID, ie vendor identification code, and / or Product ID, ie product identification code
  • data Import antivirus strategy data export black and white list control strategy
  • data export format control strategy enable serial port access strategy
  • USB interface insertion protection enable network communication audit
  • enable firewall function set serial
  • the security policy includes: after the administrator sets each security policy, the related security policies will be executed one by one by the external terminal protection device.
  • the security policy includes: the administrator also controls whether the external terminal protection device enters the monitoring and protection mode. This mode will monitor the connection with the protected host, and an alarm will be generated under abnormal circumstances.
  • the security policy includes: when abnormal alarms or interface access conditions need to be recorded for subsequent administrator query, the internal memory D is further used to further record the alarm information or interface access log information.
  • the interface protection provided by the external terminal protection device may further include electrical safety protection of the device and protection against abnormal conditions during use, including but not limited to, attempting to forcibly skip the external terminal Protective equipment, use legal USB devices to pass the security verification and try to access illegal USB devices.
  • the electrical safety protection of the external terminal protection device refers to the ability to effectively prevent physical hardware damage to the protected host through an external interface such as USB, and to prevent such as a USB bomb Similar to the behavior of destroying the protected host through strong discharge.
  • electrical safety is divided into two levels for targeted design:
  • the electrical safety protection of the terminal protection equipment mentioned in the scheme refers to the function of the equipment to prevent the destruction of strong discharge equipment through the use of hardware design, and the introduction of current and voltage limiting circuits to prevent the current and voltage from being too large and build the first protection system;
  • the external terminal protection equipment further improves the electrical safety protection function.
  • an external USB device when a U-disk device or other USB device is inserted into the terminal protection device for operation, the necessary security authentication must be performed first. Only the authorized device is allowed to perform the next operation. Before authentication, the inserted USB device cannot communicate with the protected host. That is to say, before the inserted external device fails the security authentication, there is no communication line between it and the protected host, so even if the current-limiting and voltage-limiting design of the first layer of protection does not play its due role, the inserted The current and voltage shocks caused by the USB device will not affect the safety of the protected host.
  • the external terminal protection device has the function of protecting the interface from abnormal conditions during use, mainly for malicious users to unplug the connection between the external terminal protection device and the protected host, thereby trying to skip the external Terminal protection equipment, the situation of directly accessing the protected host, or after using a legal USB device to pass the security verification, and pulling out the legal device to replace the illegal USB device.
  • Interface connection lock such as USB connection lock
  • a preferred embodiment of the present invention provides the interface locking function of the external terminal protection device, which is realized by analog signal sampling and analog-to-digital conversion signal acquisition technology.
  • the interface control board in the external terminal protection device monitors the connection status of the specific internal interface connected to the protected host B in real time; when the connection status is abnormal, it automatically triggers the disconnection Open the line connection between the interface control board and the protected host. Further, the current / voltage change of the internal interface is captured by the monitoring circuit, it is determined that the connection state is abnormal, and an alarm indication signal is triggered.
  • the connection state recovers from abnormal to normal, and the line between the interface control board and the protected host is still maintained The disconnected state of the connection.
  • the external terminal protection device A will monitor the current and voltage of the interface connected to the protected host B in real time to obtain the connection line between device A and host B.
  • the monitoring circuit will capture the current and voltage changes in time, trigger the audible and visual alarm, and trigger the disconnection operation. Even if the user plugs in the connection line, the connection between A and B It cannot be restored automatically, and it needs to be restored after manual configuration by users with administrator rights.
  • the external device plug-in monitoring function provided by the external terminal protection device refers to the interface control board monitoring the connection status of the external interface connected to the external device in real time, when confirmed as When the external device of the access device is unplugged from the external interface, the physical connection of the connected line is automatically disconnected; further, when the external device is unplugged from the external interface and connected again, the The system control board 2 performs the security authentication operation on the external device again.
  • the external terminal protection device A will effectively monitor the inserted external device (such as a USB device) through the monitoring interface to prevent the user from using a compliant device. After the security check, unplug the compliant device and insert the illegal device. Once the user unplugs the device, the system automatically restores to the unauthorized disconnection state, thereby ensuring the device connection safety to the greatest extent.
  • the plugging and unplugging monitoring and abnormal connection disconnection functions of the terminal protection equipment described in this solution are realized by specific hardware control connection switching, and are not realized by software.
  • the schematic diagram of hardware design is shown in FIG. 3.
  • FIG. 3 shows another embodiment of the present invention.
  • the external terminal protection device of this embodiment has an interface control function, and adopts a hardware on / off solution based on FPGA / SCM control and implemented by a hardware isolation switch. Thereby controlling access switching of external devices.
  • the external terminal protection device of this embodiment includes the following components: an interface control board, an ARM / x86-based system control board, and an internal USB storage device.
  • the interface control board includes an AD acquisition module and a switching chip .
  • the interface connections of the interface control board are shown in Figure 3.
  • UA1 and UB1, UA2 and UB2, UA3 and UB3, UA2 and UA4, and UB1 and UB3 are switched by switches.
  • the AD acquisition module detects the status of each interface, and the exchange chip is responsible for the communication of network port data between the protected host, external terminal protection equipment, and the remote control center.
  • the hardware supports two control modes, corresponding to the two functions of USB device import and export and USB device direct connection:
  • the data import and export control logic of the external terminal protection device described in this embodiment, the hardware connection is as follows: the internal interfaces UA3 and UA4 are inserted into the USB cable of the protected host, and UB1 and UB2 are connected to the USB interface of the system control board to external
  • the interface UA1 is inserted into the U disk or removable storage medium to be connected
  • UA2 is inserted into the USB optical drive device
  • UB3 is connected to the internal USB storage. This allows the external terminal protection device to take over all data interfaces of the protected host, ensuring that data communication using each interface of the protected host is completed through the external terminal protection device.
  • the protection system further includes a control center that remotely controls the external terminal protection equipment, and the remote control center is connected to the network port EA2 of the external terminal protection equipment through a network to protect the external terminal The equipment is controlled remotely, so that the purpose of protecting the protected host can be achieved without installing security software on the protected host.
  • USB device direct connection control logic
  • the device direct connection control logic passes the system control board control interface control board hardware control logic to achieve data flow to the USB device Control
  • the hardware connection is as follows: the internal USB interface UA4 of the interface control board in the terminal protection device is connected to the USB interface UC1 of the protected host, the forwarding interface UB2 is connected to the USB interface of the system control board, and the external USB interface UA2 is inserted It is directly connected to the external device (such as USB optical drive) of the protected host B, and the interface control board is connected to the system control board through the control line.
  • the terminal protection device directly controls the USB device as follows:
  • the interface control board passes the control line Notify the system control board, the system control board control interface
  • the hardware control logic of the control board connects the physical line of the interface UA2 and the forwarding interface UB2, so that the USB optical drive inserted on the UA2 interface communicates with the USB interface of the system control board.
  • the logic keeps the interface UA2 disconnected from the physical line connecting the internal interface UA4 of the protected host.
  • the system control board performs security authentication on the USB optical drive on the UA2 interface to confirm whether the external device is a permitted access device. After confirming that the USB optical drive is a permitted access device, the hardware control logic will change the external interface UA2 and the internal interface UA4 The physical line is connected to realize the connection between the USB optical drive inserted on the UA2 interface and the protected host.
  • the hardware control logic automatically disconnects the physical line between the interface and other interfaces. For example, when an external device inserted on the UA2 interface is connected to the UA4 interface, the system control board will monitor the connection status of the external device inserted into the UA2 on the interface control board in real time, and will automatically disconnect the connection once the external device is pulled out of the interface.
  • the protection system includes one or more external devices, a protected host, and an external terminal protection device, wherein the external terminal protection device is externally connected to the protected host so that the one or more external devices pass
  • the external terminal protection equipment performs interface communication with the protected host.
  • the external terminal protection equipment is as described above, which will not be repeated here.
  • the protection system further includes a control center that remotely controls the external terminal protection equipment.
  • the control center is composed of a server, a management workstation, and other nodes, and is connected to the external terminal protection equipment through a network switching node. On the network port EA1.
  • modules in the device in the embodiment can be adaptively changed and set in one or more devices different from the embodiment.
  • the modules or units or components in the embodiments may be combined into one module or unit or component, and in addition, they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstract and drawings) and any method so disclosed or All processes or units of equipment are combined. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or implemented in software modules running on one or more processors, or implemented in a combination thereof.
  • a microprocessor or a digital signal processor may be used to implement some of the photo entry device, computing device, and computer-readable storage medium for text content according to embodiments of the present invention. Or some or all functions of all components.
  • the present invention may also be implemented as a device or device program (eg, computer program and computer program product) for performing part or all of the method described herein.
  • Such a program implementing the present invention may be stored on a computer-readable medium, or may have the form of one or more signals.
  • Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Storage Device Security (AREA)
  • Information Transfer Systems (AREA)
  • Small-Scale Networks (AREA)

Abstract

本发明提供一种外接式终端防护设备及相应的防护系统，其中所述外接式终端防护设备包括：接口控制模块，用于提供对内接口和对外接口，所述对内接口与被保护主机相应接口连接，所述对外接口用于接入一个或多个外部设备；系统控制模块，用于与接口控制模块相连，控制所述接口控制模块上一个或多个对外接口接入的外部设备的安全鉴权，以确认所述外部设备是否为许可接入设备。本发明能够实现无需在被保护主机上安装安全防护软件即可到达对被保护主机进行安全防护的目的，并且极大降低了系统安全风险，全面解决了由各个接口可能产生的安全隐患。

Description

一种外接式终端防护设备及防护系统 技术领域
本发明属于计算机安全技术领域，尤其涉及一种外接式终端防护设备及防护系统。
背景技术
近些年，计算机及信息技术获得高速发展，从而大大促进了网络的普及，当人们日益享受这计算机及信息技术带来的便利的同时，也为生产/生活中人们所使用的计算机中的数据安全带来了新的威胁，例如常见的有非授权访问、冒充合法用户、破坏数据完整性、干扰系统正常运行、利用网络传播病毒和中间人窃听等等。
解决内网安全问题的技术手段已有很多，例如在主机中安装和使用防火墙、防病毒、入侵检测系统等网络安全产品，但采取上述措施后各种网络安全事件仍频频发生。据统计，计算机犯罪的70％是由内部人员非法使用主机等关键资源造成的，真正来自外部的威胁只有30％，内部人员在使用主机时缺乏安全意识，又位于防火墙后端，接入各种外部设备不规范，以及系统的误操作或者蓄意的破坏，都会对机关、企事业单位等造成恶劣的影响甚至重大损失。
同时，对于某些特殊设备，如配备有特殊软件控制的主机，某些工业领域的工程师站/工作员站的设备，这些主机/设备往往由于系统特殊性，市面上没有此类系统适配的安全防护软件，或是由于安装安全类软件容易导致主机原有软件出现兼容性问题，甚至性能受到影响。另外这些工程师站/工作员站的主机上线后基本不会对操作系统进行升级，即使安装安全类软件后也往往不及时更新防恶意代码软件版本和恶意代码库，起不到全面的安全防护作用。
发明内容
基于此，本发明提供一种解决上述问题的外接式终端防护设备及防护系统，以实现对被保护主机的各个接口的接管，确保使用被保护主机的USB接口或串口设备必须通过外接式终端防护设备完成，从而无需在被保护主机上安装安全防护软件即可到达对被保护主机USB接口或串口进行防护的目的。
第一方面，本申请提供一种外接式终端防护设备，包括：
接口控制模块，用于提供一个或多个对内接口，以及一个或多个对外接口，所述对内接口与被保护主机相应接口连接，所述对外接口用于接入一个或多个外部设备；
系统控制模块，用于通过总线与接口控制模块相连，控制所述接口控制模块上一个或多个对外接口接入的外部设备的安全鉴权，以确认所述外部设备是否为许可接入设备。
可选地，当所述接口控制模块的对外接口接入外部设备时，通过所述总线通知所述系统控制模块，由所述系统控制模块先对所述外部设备进行安全鉴权操作。
可选地，如果所述外部设备未通过安全鉴权，则设定所述外部设备为非许可接入设备，保持所述外部设备与所述被保护主机之间线路物理断开状态；和/或
如果所述外部设备通过安全鉴权，则确认所述外部设备为许可接入设备，接通所述外部设备与所述被保护主机之间线路的物理连接。
可选地，所述接口控制模块实时监测接入所述外部设备的对外接口的连接状态，当确认为许可接入设备的外部设备从对外接口拔出时，自动将所述接通的线路物理连接进行断开。
可选地，所述外部设备从对外接口拔出后再次接入时，由所述系统控制模块重新对所述外部设备进行安全鉴权操作。
可选地，所述接口控制模块实时监测到所述与被保护主机相应接口连接的对内接口的连接状态；
当所述连接状态发生异常时，自动触发断开所述接口控制模块与被 保护主机之间的线路连接。
可选地，所述当所述连接状态发生异常时，自动触发断开所述接口控制模块与被保护主机之间的线路连接，还包括：
通过监测电路捕获所述对内接口的电流/电压变化，确定所述连接状态发生异常，触发告警指示信号。
可选地，当自动触发断开所述接口控制模块与被保护主机之间的线路连接后，所述连接状态从异常恢复到正常，依然保持所述接口控制模块与被保护主机之间的线路连接的断开状态。
可选地，所述系统控制模块，基于设定的安全策略，控制所述接口控制模块上一个或多个对外接口接入的外部设备的安全鉴权。
可选地，所述的外接式终端防护设备，还包括：
内部存储器，用于存储接口间交换的数据。
可选地，所述接口控制模块采用限流限压电路以防止所述对外接口接入强放电设备对所述外接式终端防护设备的破坏。
可选地，所述对内接口及对外接口中的一个或多个为USB接口。
可选地，所述对内接口及对外接口中的一个或多个为串口。
第二方面，本申请提供一种防护系统，包括：
一个或多个外部设备；
被保护主机；以及
如上所述的外接式终端防护设备，
其中，所述外接式终端防护设备外接于所述被保护主机上，使得所述一个或多个外部设备通过所述外接式终端防护设备与所述被保护主机进行接口通信。
通过本发明上述技术方案，至少具有如下一种或多种技术效果：可以实现对被保护主机各个数据接口的接管，确保使用被保护主机各个接口的数据通信都通过外接式的终端完成，从而实现无需在被保护主机上安装安全防护软件即可达到对被保护主机进行安全防护的目的，并且极大降低了系统安全风险，全面解决了由各个接口可能产生的安全隐患。
附图说明
图1为本发明第一实施例的基于外接式终端防护设备的防护系统的应用场景示意图；
图2为本发明第一实施例的外接式终端防护设备内部构造示意图；
图3为本发明第二实施例的外接式终端防护设备连接示意图；
图4为本发明第三实施例的基于外接式终端防护设备的防护系统的一种网络部署示意图。
具体实施方式
下面将参照附图更详细地描述本公开的示例性实施例。虽然附图中显示了本发明的示例性实施例，然而应当理解，可以以各种形式实现本发明而不应被这里阐述的实施例所限制。相反，提供这些实施例是为了能够更透彻地理解本发明，并且能够将本发明的范围完整的传达给本领域的技术人员。
本文中术语“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，“A和/或B”可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
本发明提出的外接式终端防护设备包括接口控制模块和系统控制模块。接口控制模块提供对内接口和对外接口，对内接口与被保护主机的相应接口连接，对外接口用于接入一个或多个外部设备。系统控制模块用于与接口控制模块电性相连，控制所述接口控制模块上一个或多个对外接口所接入的外部设备的安全鉴权。可见，本发明提供了一种硬件方式的终端防护设备，无需在被保护主机上安装安全防护软件即可到达对被保护主机进行安全防护的目的，并且极大降低了系统安全风险，全面解决了由各个接口可能产生的安全隐患。
需要注意的是，本发明中所称的“模块”为硬件模块，即由电路、数据处理装置、存储器、缓存器等有形电子元件构成的硬件模块。本发 明中的接口控制模块和系统控制模块可以是物理上或功能上独立的元件组合，也可以是物理上或功能上整合在一起的整体元件组合。例如，作为一种实施方式，接口控制模块由接口控制板构成，系统控制模块由系统控制板构成，接口控制板和系统控制板均为集成有电子元件的电路板，二者之间通过总线连接。而在其他的实施方式中，接口控制模块和系统控制模块亦可以集成在一个电路板上。因此，本发明的关键在于接口控制模块和系统控制模块之间的控制关系，但不限于组成各自模块的电子元件在空间上或物理连接上的组合方式。
根据本发明，当接口控制模块的对外接口接入外部设备时，接口控制模块通知所述系统控制模块，由所述系统控制模块对所述外部设备进行安全鉴权操作。如果所述外部设备未通过安全鉴权，则设定所述外部设备为非许可接入设备，保持所述外部设备与所述被保护主机之间线路物理断开状态；和/或如果所述外部设备通过安全鉴权，则确认所述外部设备为许可接入设备，接通所述外部设备与所述被保护主机之间线路的物理连接。由此，本发明能够实现对外部设备的物理隔离式安全鉴权，提高了防护系统的安全性能。
作为一种具体实施方式，所述接口控制模块实时监测接入所述外部设备的对外接口的连接状态，当确认为许可接入设备的外部设备从对外接口拔出时，自动将所述接通的线路物理连接进行断开。这样，可防止利用许可接入设备的连接接入非许可接入设备。
优选地，所述外部设备从对外接口拔出后再次接入时，由所述系统控制模块重新对所述外部设备进行安全鉴权操作。由此，可以防止利用同一外接设备的攻击行为。
实施例
参见图1，其显示了本发明第一实施例涉及的防护系统的应用场景。
如图1所示，外接式终端防护设备通过各个接口连接线外接于被保护主机上，将需要防护的被保护主机上各个接口(USB口的UC1、UC2，COM口的CC0、网口EC0)通过各种类型的连接线连接到自身对内接口上，比如将被保护主机的接口UC1与UC2分别连接到外接式终端防 护设备的对内USB口UA4和UA3上，将串口CC0连接到对内串口CA2上，网口EC0连接到对内网口EA2上。而各种外部设备(U盘、光驱、串口连接设备等)全部接到所述外接式终端防护设备上，通过外接式终端防护设备才能与被保护主机进行数据通信，比如U盘通过所述外接式终端防护设备的对外接口UA1接入，USB光驱通过对外接口UA2接入，串口连接设备通过对外接口CA1接入。U盘、USB光驱以及串口连接设备这些外部设备需要与被保护主机进行数据通信，都不能直接接入到被保护主机上，必须通过所述外接式终端防护设备相应的对外接口转接通信。
参见图2，其为本发明的上述实施例的外接式终端防护设备内部构造示意图。
该实施例中，所述外接式终端防护设备主要由接口控制板A和系统控制板B构成，系统控制板B通过控制连接线(例如总线)连接到接口控制板A，用于控制接口控制板A上各个接口，比如USB接口、串口及网口的不同工作模式，进而实现对各种外部设备的接入进行安全控制的功能。系统控制板A可实现对各个接口的工作模式控制，工作模式包括可用、不可用、协议过滤、流量镜像及流量审计等，但本发明不限于具体的工作模式控制类型。系统控制板B可通过I2C或SPI接口与接口控制板A相连，但本发明不限于具体的控制连接接口。
所述外接式终端防护设备还可包括硬件存储器D，即作为终端防护设备的内部存储器，用于存储接口间交换的数据；进一步地，内部存储器还可进一步存储设定的安全策略；系统控制板B通过读取内部存储器中存储的预先设定的安全策略，对接口控制板上不同类型的接口或不同编号的接口进行安全鉴权。
在此实施例中，外接式终端防护设备所实现的的安全功能包括但不限于：管理员预先对外接式终端防护设备进行权限设置和安全策略设定；安全策略包括但不限于：使能数据导入(如USB接口)、使能数据导出(如USB接口)、USB接入设备限制(如基于USB设备的Vendor ID，即供应商识别码，和/或Product ID，即产品识别码)、数据导入杀毒策略、 数据导出黑白名单控制策略、数据导出格式控制策略、使能串口接入策略、USB接口插入保护、使能网络通信审计、使能防火墙功能、设置串口命令黑白名单等。
在一种优选的实施方式中，安全策略包括：管理员在设定好各个安全策略后，相关的这些安全策略将被所述外接式终端防护设备逐一执行。在一种优选的实施方式中，安全策略包括：管理员还控制所述外接式终端防护设备是否进入监控保护模式，此模式将监控与被保护主机间的连接，异常情况下将进行告警。
在一种优选的实施方式中，安全策略包括：当需要记录异常告警或接口访问情况以备后续管理员查询时，内部存储器D还用于进一步记录所述告警信息或接口访问日志信息。
在一种优选的实施方式中，所述外接式终端防护设备所具备的接口防护进一步可包括设备电气安全防护，以及使用中的对异常情况防护，包括但不限于，试图强行跳过外接式终端防护设备，使用合法USB设备通过安全验证后试图接入非法USB设备等。
在一种优选的实施方式中，所述外接式终端防护设备具备的设备电气安全性防护，指的是能够有效防范通过USB等对外接口实现对被保护主机的物理硬件破坏，能够防范诸如USB炸弹等类似通过强放电破坏被保护主机的行为。
为实现此目标，本发明的一种优选实施方式中，在电气安全性上分为两个层次进行了针对性的设计：
1)接口采用限流限压设计
方案所述终端防护设备所具备设备电气安全性防护指设备功能通过采用硬件设计来防止强放电设备的破坏，通过引入限流限压电路，实现防止电流电压过大的情况，构建第一道防护体系；
2)基于物理开关切换的外部设备连接机制
所述外接式终端防护设备通过引入硬件切换逻辑，使得进一步提升电气安全性防护功能。以USB外部设备为例，当U盘设备或其他USB设备插入终端防护设备进行操作时，首先必须进行必要的安全鉴权认证， 只有许可的设备才允许进行下一步操作，在未获得安全鉴权认证前，插入的USB设备无法与被保护主机连通。也就是说，在插入的外部设备未通过安全鉴权认证前，其与被保护主机之间不存在连通线路，因此即使第一层防护的限流限压设计未发挥应有作用，由插入的USB设备所引发的电流电压冲击也不会影响到被保护主机的安全。
作为一种可选的实施方式，外接式终端防护设备具备使用中对接口异常情况防护功能，主要针对恶意用户拔掉外接式终端防护设备与被保护主机之间连线，从而试图跳过外接的终端防护设备，直接访问被保护主机的情况，或使用合法USB设备通过安全验证后，拔出合法设备替换为非法USB设备的情况。
本发明一种优选实施方式针对使用中对异常情况防护进行了针对性的设计：
1)接口连接锁定，例如USB连接锁定
传统接口锁定一般是通过机械方式，即通过特殊接口，例如涉密行业使用的特殊宽口U盘或特种网口，来实现防止误用或是防止他人插拔接口。这种方式的缺点是通用性差，需要对设备接口进行改造以满足机械连接要求，此方式往往只适用于特种行业强制管理的设备，实施性较差，且容易引起设备维护纠纷。
本发明一种优选实施方式提供了所述外接式终端防护设备具备的接口锁定功能，是通过模拟信号采样及模数转换信号采集技术实现，当外接式终端防护设备A特定接口与被保护主机B的特定接口连接时，所述外接式终端防护设备中的接口控制板实时监测到所述与被保护主机B连接的对内特定接口的连接状态；当所述连接状态发生异常时，自动触发断开所述接口控制板与被保护主机之间的线路连接。进一步地，通过监测电路捕获所述对内接口的电流/电压变化，确定所述连接状态发生异常，触发告警指示信号。再进一步地，当自动触发断开所述接口控制板与被保护主机之间的线路连接后，所述连接状态从异常恢复到正常，依然保持所述接口控制板与被保护主机之间的线路连接的断开状态。以二者的USB口连接为例，外接式终端防护设备A将实时监测与被保护主 机B连接接口的电流电压情况，从而获得设备A与主机B连接线情况。当有恶意用户拔出设备A与主机B的连接线时，监测电路将及时捕获电流电压变化，触发声光告警，并触发连接断开操作，用户即使插回连接线，A与B之间连接也无法自动恢复，需要管理员权限用户进行手工配置后恢复。
2)外部设备插拔监测
本发明的技术方案提供的所述外接式终端防护设备所具备的外部设备插拔监测功能，指的是所述接口控制板实时监测接入所述外部设备的对外接口的连接状态，当确认为许可接入设备的外部设备从对外接口拔出时，自动将所述接通的线路物理连接进行断开；进一步地，当所述外部设备从对外接口拔出后再次接入时，由所述系统控制板2重新对所述外部设备进行安全鉴权操作。作为一种实施例，用户在获得授权，进行数据导入导出操作时，外接式终端防护设备A将通过监测接口实现对插入的外部设备(例如USB设备)的有效监测，防止用户使用合规设备通过安全检查后，拔下合规设备插入非法设备这一行为。一旦用户拔出设备，系统自动恢复到未授权断开连接状态，从而最大程度确保设备连接安全。
本方案所述终端防护设备所具备的插拔监测及异常连接断开功能是通过特定硬件控制连接切换实现，非软件实现，硬件设计示意图如图3所示。
图3所示的是本发明的另一实施例，该实施例的外接式终端防护设备具备接口控制功能，采用的是基于FPGA/单片机控制，通过硬件隔离开关通断实现的硬件通断方案，从而控制外部设备的接入切换。
以USB控制功能为例，该实施例的外接式终端防护设备包括如下构成部分：接口控制板、基于ARM/x86的系统控制板，及内部USB存储设备，接口控制板包括AD采集模块和交换芯片。
接口控制板的各接口连接如图3所示，UA1与UB1、UA2与UB2、UA3与UB3、UA2与UA4、UB1与UB3通过开关切换。AD采集模块检测各个接口的状态，交换芯片负责被保护主机、外接式终端防护设备 以及远程控制中心之间网口数据的通信。
硬件支持两种控制模式，分别对应USB设备使用上的两种功能USB数据导入导出以及USB设备直连：
1)USB数据导入导出控制逻辑：
本实施例所述外接式终端防护设备的数据导入导出控制逻辑，硬件连线情况如下：对内接口UA3、UA4插入被保护主机USB连接线，UB1、UB2接入系统控制板的USB接口，对外接口UA1插入待接入U盘或移动存储介质，UA2插入USB光驱设备，UB3接上内部USB存储。这样使得外接式终端防护设备将被保护主机各个数据接口全部接管，确保使用被保护主机各个接口的数据通信都通过外接式的终端防护设备完成。
优选地，所述防护系统还包括其远程控制所述外接式终端防护设备的控制中心，位于远端的控制中心通过网络连接到外接式终端防护设备的网口EA2，对所述外接式终端防护设备进行远程控制，从而无需在被保护主机上安装安全护软件即可到达对被保护主机进行安全防护的目的。
2)USB设备直连控制逻辑：
本实施例针对一些需要直接接入且非存储类的USB设备，例如USB光驱，加密狗等，设备直连控制通逻辑过系统控制板控制接口控制板的硬件控制逻辑实现对USB设备的数据流量的控制，硬件连线情况如下：终端防护设备中的接口控制板的对内USB接口UA4连接被保护主机的USB接口UC1，转发接口UB2接入系统控制板的USB接口，对外USB接口UA2插入需直连被保护主机B的外部设备(比如USB光驱)，接口控制板通过控制线连接系统控制板。
优选地，所述终端防护设备对USB设备直连控制方法如下：当终端防护设备的对外USB接口UA2插入需直连被保护主机B的外部设备(比如USB光驱)时，接口控制板通过控制线通知系统控制板，系统控制板控制接口控制板的硬件控制逻辑接通接口UA2与转发接口UB2的物理线路，使得UA2接口上插入的USB光驱与系统控制板的USB接口连通，在此期间硬件控制逻辑保持接口UA2与连接被保护主机的对内接口 UA4的物理线路处于断开状态。
系统控制板对UA2接口上的USB光驱进行安全鉴权，确认此外部设备是否为许可接入设备，当确认此USB光驱是许可接入设备后，硬件控制逻辑将对外接口UA2与对内接口UA4的物理线路接通，实现UA2接口上插入的USB光驱与被保护主机的连接。
当所述系统控制板监测到存在一个或多个接口的连接状态发生变化时，硬件控制逻辑自动断开所述接口与其他接口的物理线路。例如UA2接口上插入的外部设备接入UA4接口期间，系统控制板将实时监测接口控制板的UA2插入的外部设备连接情况，一旦检测到外部设备拔出接口将自动断开连接。
图4为本发明的基于外接式终端防护设备的防护系统的一种网络部署实施例。所述防护系统包括一个或多个外部设备、被保护主机以及外接式终端防护设备，其中，所述外接式终端防护设备外接于所述被保护主机上，使得所述一个或多个外部设备通过所述外接式终端防护设备与所述被保护主机进行接口通信。在此，所述外接式终端防护设备如上所述，此不再赘述。
进一步地，所述防护系统还包括其远程控制所述外接式终端防护设备的控制中心，控制中心由服务器、管理工作站，以及其他节点所组成，通过网络交换节点连接到所述外接式终端防护设备的网口EA1上。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实施。在一些实施例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本发明并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要 求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的文字内容的拍照录入装置、计算设备和计算机可读存储介质中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。

Claims (13)

  1. 一种外接式终端防护设备，其包括：
    接口控制模块，用于提供一个或多个对内接口，以及一个或多个对外接口，所述对内接口与被保护主机的相应接口连接，所述对外接口用于接入一个或多个外部设备；
    系统控制模块，用于与接口控制模块电性相连，控制所述接口控制模块上一个或多个对外接口所接入的外部设备的安全鉴权。
  2. 如权利要求1所述的外接式终端防护设备，其中
    当所述接口控制模块的对外接口接入外部设备时，该接口控制模块通知所述系统控制模块，由所述系统控制模块对所述外部设备进行安全鉴权操作。
  3. 如权利要求2所述的外接式终端防护设备，其中，该防护设备进一步包括：
    如果所述外部设备未通过安全鉴权，则设定所述外部设备为非许可接入设备，保持所述外部设备与所述被保护主机之间线路物理断开状态；和/或
    如果所述外部设备通过安全鉴权，则确认所述外部设备为许可接入设备，接通所述外部设备与所述被保护主机之间线路的物理连接。
  4. 如权利要求3所述的外接式终端防护设备，其中，
    所述接口控制模块实时监测接入所述外部设备的对外接口的连接状态，当确认为许可接入设备的外部设备从对外接口拔出时，自动将所述接通的线路物理连接进行断开。
  5. 如权利要求4所述的外接式终端防护设备，其中，
    所述外部设备从对外接口拔出后再次接入时，由所述系统控制模块重新对所述外部设备进行安全鉴权操作。
  6. 如权利要求1所述的外接式终端防护设备，其中，
    所述接口控制模块实时监测到所述与被保护主机相应接口连接的对内接口的连接状态；
    当所述连接状态发生异常时，自动触发断开所述接口控制模块与被保护主机之间的线路连接。
  7. 如权利要求6所述的外接式终端防护设备，其中，
    所述当所述连接状态发生异常时，自动触发断开所述接口控制模块与被保护主机之间的线路连接，还包括：
    通过监测电路捕获所述对内接口的电流/电压变化，确定所述连接状态发生异常，触发告警指示信号。
  8. 如权利要求6所述的外接式终端防护设备，其中，
    当自动触发断开所述接口控制模块与被保护主机之间的线路连接后，所述连接状态从异常恢复到正常，依然保持所述接口控制模块与被保护主机之间的线路连接的断开状态。
  9. 如权利要求1所述的外接式终端防护设备，其中，
    所述系统控制模块，基于设定的安全策略，控制所述接口控制模块上一个或多个对外接口接入的外部设备的安全鉴权。
  10. 如权利要求1所述的外接式终端防护设备，其中，该防护设备还包括：
    内部存储器，用于存储接口间交换的数据。
  11. 如权利要求1所述的外接式终端防护设备，其中，
    所述接口控制模块包括限流限压电路，以防止所述对外接口接入强放电设备对所述外接式终端防护设备的破坏。
  12. 如权利要求1所述的外接式终端防护设备，其中，
    所述对内接口及对外接口中的一个或多个为USB接口。
  13. 一种防护系统，包括：
    一个或多个外部设备；
    被保护主机；以及
    如权利要求1-12任一项所述的外接式终端防护设备，
    其中，所述外接式终端防护设备外接于所述被保护主机上，使得所述一个或多个外部设备通过所述外接式终端防护设备与所述被保护主机进行接口通信。
PCT/CN2019/072029 2018-10-29 2019-01-16 一种外接式终端防护设备及防护系统 WO2020087781A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
KR1020207036696A KR102313543B1 (ko) 2018-10-29 2019-01-16 외접식 단말 보호 장치 및 보호 시스템
JP2020571603A JP7029000B2 (ja) 2018-10-29 2019-01-16 外付け端末保護デバイス及び保護システム
US16/978,772 US10885230B1 (en) 2018-10-29 2019-01-16 External terminal protection device and protection system
RU2020139957A RU2764292C1 (ru) 2018-10-29 2019-01-16 Защитное устройство внешнего терминала и система защиты
EP19878392.0A EP3812948A4 (en) 2018-10-29 2019-01-16 EXTERNAL CONNECTION TYPE TERMINAL PROTECTION DEVICE AND PROTECTION SYSTEM

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811264781.X 2018-10-29
CN201811264781.XA CN109543475B (zh) 2018-10-29 2018-10-29 一种外接式终端防护设备及防护系统

Publications (1)

Publication Number Publication Date
WO2020087781A1 true WO2020087781A1 (zh) 2020-05-07

Family

ID=65845128

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/072029 WO2020087781A1 (zh) 2018-10-29 2019-01-16 一种外接式终端防护设备及防护系统

Country Status (7)

Country Link
US (1) US10885230B1 (zh)
EP (1) EP3812948A4 (zh)
JP (1) JP7029000B2 (zh)
KR (1) KR102313543B1 (zh)
CN (1) CN109543475B (zh)
RU (1) RU2764292C1 (zh)
WO (1) WO2020087781A1 (zh)

Families Citing this family (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109561071B (zh) * 2018-10-29 2020-07-07 北京博衍思创信息科技有限公司 一种数据流量控制的外接式终端防护设备及防护系统
CN110188579A (zh) * 2019-05-29 2019-08-30 成都卫士通信息产业股份有限公司 一种端口安全防护设备及端口安全防护系统
US11100255B1 (en) * 2019-07-01 2021-08-24 Dialog Semiconductor (Uk) Limited Method and apparatus for high voltage protection
CN111007783A (zh) * 2019-12-28 2020-04-14 广东电科院能源技术有限责任公司 一种安全管控系统及方法
CN111901418B (zh) * 2020-07-28 2023-06-30 北京中科麒麟信息工程有限责任公司 基于单向文件传输协议的外接式终端防护设备及系统
CN111898167A (zh) * 2020-07-28 2020-11-06 北京中科麒麟信息工程有限责任公司 包括身份信息验证的外接式终端防护设备及防护系统
CN111898105A (zh) * 2020-07-28 2020-11-06 北京中科麒麟信息工程有限责任公司 具有用户追溯功能的外接式终端防护设备及防护系统
CN111859344A (zh) * 2020-07-28 2020-10-30 北京中科麒麟信息工程有限责任公司 包括人脸信息验证的外接式终端防护设备及防护系统
CN111885179B (zh) * 2020-07-28 2022-05-10 北京中科麒麟信息工程有限责任公司 一种基于文件监测服务的外接式终端防护设备及防护系统
CN111885178A (zh) * 2020-07-28 2020-11-03 北京中科麒麟信息工程有限责任公司 包括语音信息验证的外接式终端防护设备及防护系统
CN111859434A (zh) * 2020-07-28 2020-10-30 北京中科麒麟信息工程有限责任公司 一种提供保密文件传输的外接式终端防护设备及防护系统
BR102021010255A2 (pt) * 2021-05-27 2021-09-28 Strong Rock Ltda Dispositivo autônomo de backup e sistema autônomo de backup
CN114186293A (zh) * 2021-11-30 2022-03-15 北京博衍思创信息科技有限公司 Usb设备与被保护设备的通信控制方法、装置及电子设备
CN114153301A (zh) * 2021-12-02 2022-03-08 北京博衍思创信息科技有限公司 断电监控装置、方法及外接式防护设备
CN115203686A (zh) * 2022-07-11 2022-10-18 北京博衍思创信息科技有限公司 基于接口检测的外接式防护设备和方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060072241A1 (en) * 2004-09-30 2006-04-06 Feliss Norbert A System, method, and apparatus for a wireless hard disk drive
CN103532978A (zh) * 2013-10-30 2014-01-22 北京艾斯蒙科技有限公司 内外网安全接入模式
CN103532980A (zh) * 2013-10-30 2014-01-22 国家信息中心 内外网安全接入终端
CN203618020U (zh) * 2013-10-30 2014-05-28 北京艾斯蒙科技有限公司 内外网安全接入模式
CN203618018U (zh) * 2013-10-30 2014-05-28 国家信息中心 内外网安全接入终端
CN108537072A (zh) * 2017-12-18 2018-09-14 北京航天控制仪器研究所 一种基于usb接口的安全防控系统

Family Cites Families (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020013911A1 (en) * 1998-11-24 2002-01-31 Cordella Robert H. Compact hardware architecture for secure exchange of information and advanced computing
US8954624B2 (en) * 2005-10-06 2015-02-10 Safend Ltd. Method and system for securing input from an external device to a host
US7877788B1 (en) * 2006-02-27 2011-01-25 Teradici Corporation Method and apparatus for securing a peripheral data interface
US20090049307A1 (en) * 2007-08-13 2009-02-19 Authennex, Inc. System and Method for Providing a Multifunction Computer Security USB Token Device
FR2949888B1 (fr) * 2009-09-04 2014-12-26 Thales Sa Dispositif de protection contre les logiciels malveillants et ordinateur comprenant le dispositif.
US20110154023A1 (en) * 2009-12-21 2011-06-23 Smith Ned M Protected device management
JP5587050B2 (ja) 2010-06-22 2014-09-10 キヤノン株式会社 情報処理装置、情報処理装置の制御方法、及び、プログラム
JP2012068809A (ja) 2010-09-22 2012-04-05 Buffalo Inc 記憶装置
KR102195788B1 (ko) * 2011-08-10 2020-12-28 기타 스리바스타바 호스트 컴퓨팅 디바이스와 주변기기의 데이터의 보안을 강화하기 위한 장치 및 방법
RU2557476C2 (ru) * 2013-04-23 2015-07-20 Федеральное Государственное Автономное Образовательное Учреждение Высшего Профессионального Образования "Московский Физико-Технический Институт (Государственный Университет)" Аппаратно-вычислительный комплекс с повышенными надежностью и безопасностью в среде облачных вычислений
US20150365237A1 (en) * 2014-06-17 2015-12-17 High Sec Labs Ltd. Usb security gateway
JP6394296B2 (ja) 2014-11-07 2018-09-26 日本電気株式会社 コンピュータ装置、および、その管理方法
US9911011B1 (en) * 2014-11-19 2018-03-06 Western Digital Technologies, Inc. Communications device that logically connects an upstream signal line to a downstream signal line
JP6719894B2 (ja) 2015-12-04 2020-07-08 キヤノン株式会社 機能デバイス、制御装置
CN105871902A (zh) * 2016-05-25 2016-08-17 安徽问天量子科技股份有限公司 数据加密及隔离系统
CN206003099U (zh) * 2016-06-29 2017-03-08 国家电网公司 一种可集成于计算机的外网u盘隔离检测仪
CN206039532U (zh) * 2016-07-19 2017-03-22 国网新疆电力公司电力科学研究院 计算机usb外设安全识别过滤器
JPWO2018146747A1 (ja) 2017-02-08 2019-02-14 三菱電機株式会社 情報処理装置、情報処理方法及び情報処理プログラム
US20190294777A1 (en) * 2018-03-26 2019-09-26 Lenovo Enterprise Solutions (Singapore) Pte. Ltd. Systems and methods for managing access to host computing devices by external devices
CN108681677B (zh) * 2018-05-14 2022-08-19 深圳市永达电子信息股份有限公司 基于usb接口安全隔离双网计算机的方法、装置及系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060072241A1 (en) * 2004-09-30 2006-04-06 Feliss Norbert A System, method, and apparatus for a wireless hard disk drive
CN103532978A (zh) * 2013-10-30 2014-01-22 北京艾斯蒙科技有限公司 内外网安全接入模式
CN103532980A (zh) * 2013-10-30 2014-01-22 国家信息中心 内外网安全接入终端
CN203618020U (zh) * 2013-10-30 2014-05-28 北京艾斯蒙科技有限公司 内外网安全接入模式
CN203618018U (zh) * 2013-10-30 2014-05-28 国家信息中心 内外网安全接入终端
CN108537072A (zh) * 2017-12-18 2018-09-14 北京航天控制仪器研究所 一种基于usb接口的安全防控系统

Also Published As

Publication number Publication date
CN109543475A (zh) 2019-03-29
EP3812948A4 (en) 2022-03-02
JP7029000B2 (ja) 2022-03-02
EP3812948A1 (en) 2021-04-28
RU2764292C1 (ru) 2022-01-17
KR102313543B1 (ko) 2021-10-15
JP2021522616A (ja) 2021-08-30
CN109543475B (zh) 2020-07-07
US20200410139A1 (en) 2020-12-31
US10885230B1 (en) 2021-01-05
KR20210003933A (ko) 2021-01-12

Similar Documents

Publication Publication Date Title
WO2020087781A1 (zh) 一种外接式终端防护设备及防护系统
CN109561071B (zh) 一种数据流量控制的外接式终端防护设备及防护系统
CN109522760B (zh) 一种基于硬件控制逻辑的数据转发控制方法及系统
CN107493265B (zh) 一种面向工业控制系统的网络安全监控方法
CN103532980A (zh) 内外网安全接入终端
WO2024012135A1 (zh) 基于接口检测的外接式防护设备和方法
US7409563B2 (en) Method and apparatus for preventing un-authorized attachment of computer peripherals
US20230297678A1 (en) Ransomware mitigation system and method for mitigating a ransomware attack
US8954624B2 (en) Method and system for securing input from an external device to a host
CN203618018U (zh) 内外网安全接入终端
CN111898167A (zh) 包括身份信息验证的外接式终端防护设备及防护系统
CN111901418B (zh) 基于单向文件传输协议的外接式终端防护设备及系统
CN111885179B (zh) 一种基于文件监测服务的外接式终端防护设备及防护系统
WO2023098408A1 (zh) 断电监控装置、方法及外接式防护设备
CN111859434A (zh) 一种提供保密文件传输的外接式终端防护设备及防护系统
CN111859473A (zh) 基于空间检测的外接式终端防护设备及防护系统
CN111898105A (zh) 具有用户追溯功能的外接式终端防护设备及防护系统
CN209897087U (zh) 一种基于vpn技术的全网管理监控系统
CN104641378A (zh) 认证系统
CN111885178A (zh) 包括语音信息验证的外接式终端防护设备及防护系统
CN111859344A (zh) 包括人脸信息验证的外接式终端防护设备及防护系统
CN209659343U (zh) 一种网络层安全设备
Li et al. A Portable Network Isolation Apparatus for Substation Maintenance Based on Firewall

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19878392

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020571603

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 20207036696

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2019878392

Country of ref document: EP

Effective date: 20201210

NENP Non-entry into the national phase

Ref country code: DE