WO2023169148A1 - 一种用于hid键鼠设备防护的外接式防护设备和方法 - Google Patents

一种用于hid键鼠设备防护的外接式防护设备和方法 Download PDF

Info

Publication number
WO2023169148A1
WO2023169148A1 PCT/CN2023/075623 CN2023075623W WO2023169148A1 WO 2023169148 A1 WO2023169148 A1 WO 2023169148A1 CN 2023075623 W CN2023075623 W CN 2023075623W WO 2023169148 A1 WO2023169148 A1 WO 2023169148A1
Authority
WO
WIPO (PCT)
Prior art keywords
hid
external
interface
mouse
keyboard
Prior art date
Application number
PCT/CN2023/075623
Other languages
English (en)
French (fr)
Inventor
张昊
杜华
蔡镇河
Original Assignee
北京博衍思创信息科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京博衍思创信息科技有限公司 filed Critical 北京博衍思创信息科技有限公司
Publication of WO2023169148A1 publication Critical patent/WO2023169148A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G06F13/38—Information transfer, e.g. on bus
    • G06F13/382—Information transfer, e.g. on bus using universal interface adapter
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
    • G06F3/02—Input arrangements using manually operated switches, e.g. using keyboards or dials
    • G06F3/0202—Constructional details or processes of manufacture of the input device
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
    • G06F3/03—Arrangements for converting the position or the displacement of a member into a coded form
    • G06F3/033—Pointing devices displaced or positioned by the user, e.g. mice, trackballs, pens or joysticks; Accessories therefor
    • G06F3/0354—Pointing devices displaced or positioned by the user, e.g. mice, trackballs, pens or joysticks; Accessories therefor with detection of 2D relative movements between the device, or an operating part thereof, and a plane or surface, e.g. 2D mice, trackballs, pens or pucks

Definitions

  • the invention belongs to the technical field of equipment safety protection, and in particular relates to an external protection device and method for protecting HID keyboard and mouse equipment.
  • Chinese invention patent No. ZL 201410564213.7 proposes a PS/2 mouse and keyboard operation audit and control method.
  • the device provides a method for host PS/2 mouse, Keyboard operation audit and control methods.
  • the action information of the mouse and keyboard can be obtained without affecting the use of the host, and the PS/2 mouse and keyboard can be turned on and off by controlling them.
  • the existing technology cannot identify whether the mouse and keyboard connected to the system are illegal mice and keyboards, or illegal devices disguised as mice and keyboards; on the other hand, the existing technology does not install auditing inside the protected equipment. In the case of software, it is also impossible to audit or authenticate the legality and operating behavior of mice, keyboards and other devices connected to the corresponding interfaces in real time. Since illegal devices disguised as mice and keyboards will also generate normal keyboard and mouse operation data during illegal data interaction, the existing technology cannot actually protect the access and illegal operations of illegal devices, nor can it protect normal Record and audit operational behavior.
  • mice and keyboards basically no longer use the PS/2 interface, but use the more general USB interface that supports HID devices.
  • one aspect of the present invention aims to solve the problem that the existing technology cannot effectively prevent illegal devices from damaging the system by disguising themselves as keyboards and mice.
  • Another aspect of the present invention aims to solve the problem of being unable to record and audit keyboard and mouse communication protocols and operating behaviors when audit software cannot be installed in the protected equipment.
  • an external protective device for protecting HID keyboard and mouse equipment including: HID internal interface for connecting to the HID input interface of the protected equipment; HID The external interface is used to connect external devices; the forwarding control module is connected to the HID internal interface and the HID external interface respectively; and the protocol analysis module is used to perform protocol analysis on the external devices connected to the HID external interface to determine the Whether the external device is a legal HID keyboard and mouse device; wherein, the forwarding control module controls the connection or disconnection of the HID internal interface and the HID external interface according to the judgment results provided by the protocol analysis module to prevent illegal HID keys.
  • the mouse device is connected to the protected device.
  • controlling the connection or disconnection of the HID internal interface and the HID external interface according to the judgment result provided by the protocol analysis module includes: when the external device is judged to be an illegal HID after protocol analysis When the external device is a keyboard and mouse device or a non-HID keyboard and mouse device, the HID internal interface is controlled to be disconnected from the HID external interface; when the external device is determined to be a legal HID keyboard and mouse device after protocol analysis, the HID internal interface is controlled to The interface is connected to the HID external interface.
  • the protocol analysis module when the external device is a HID keyboard, the protocol analysis module is also used to monitor and record the input data of the HID keyboard; when the input data includes data in a predetermined blacklist When , the protocol analysis module instructs the forwarding control module to control the HID internal interface and the HID external interface to disconnect.
  • the external protection equipment further includes: a video internal interface for connecting to the video output interface of the protected equipment; a video external interface for connecting to video equipment; and a screen recording module for connecting to the video output interface of the protected equipment.
  • Video internal interface used to record the video data output by the protected device.
  • the screen recording module is connected to the protocol analysis module and receives control from the protocol analysis module; when the protocol analysis module determines that the external device has performed a specific operation, it controls all The screen recording module performs video data recording operations.
  • the external protective equipment further includes an image processing module, which is connected to the screen recording module and the protocol analysis module respectively, and is used to obtain real-time video data from the screen recording module and analyze the video The data is analyzed in real time, and when the analysis result indicates that there is an abnormality in the video data, the protocol analysis module is notified so that the protocol analysis module controls the disconnection of the HID internal interface and the HID external interface.
  • an image processing module which is connected to the screen recording module and the protocol analysis module respectively, and is used to obtain real-time video data from the screen recording module and analyze the video The data is analyzed in real time, and when the analysis result indicates that there is an abnormality in the video data, the protocol analysis module is notified so that the protocol analysis module controls the disconnection of the HID internal interface and the HID external interface.
  • the real-time analysis includes: extracting frame images from the video data, and identifying the obtained frame images.
  • the identification result includes a predetermined blacklist operation, generating a video representing the video data. There are abnormal analysis results in the data.
  • the real-time analysis includes: extracting frame images from the video data, calculating image features of the frame images and comparing them with image features of a predetermined image.
  • image features of the frame images When the similarity to the image feature of the predetermined image is higher than the threshold, an analysis result indicating that there is an abnormality in the video data is generated.
  • Another aspect of the present invention proposes an equipment protection method for HID keyboard and mouse equipment protection, including the following steps: providing an external protection device to take over the HID input interface of the protected device; and protecting the HID input interface connected to the external protection device.
  • the external device performs protocol analysis to determine whether the external device is a legal HID keyboard and mouse device; and controls the connection or disconnection of the external device and the protected device according to the result of the determination to prevent illegal HID keyboard and mouse devices from being connected.
  • Protected equipment is a legal HID keyboard and mouse device.
  • controlling the connection or disconnection of the external device and the protected device according to the judgment result includes: when the external device is determined to be an illegal HID keyboard and mouse device or a non-HID device after protocol analysis When the external device is a keyboard and mouse device, the external device is controlled to be disconnected from the protected device; when the external device is determined to be a legal HID keyboard and mouse device after protocol analysis, the external device is controlled to be connected to the protected device.
  • the method when the external device is a HID keyboard, the method further includes: monitoring and recording the input data of the HID keyboard; when the input data includes data in a predetermined blacklist, Control the external device to disconnect from the protected device.
  • the method further includes: monitoring data transmission between the external device and the protected device in real time, and when it is detected that there is a risk in the USB IN transaction, or when data in the USB OUT transaction exists, interrupting the protected device to Data transmission from external devices.
  • the present invention has at least the following beneficial effects:
  • the present invention has a forwarding control module controlled by the protocol analysis module, so illegal HID keyboard and mouse devices cannot be connected to the protected device, solving the problem of being unable to effectively prevent illegal devices from damaging the system by disguising themselves as keyboards and mice, and improving The system protects against illegal HID keyboard and mouse devices.
  • the present invention has a keyboard input monitoring and recording module controlled by a protocol analysis module, which can effectively block unauthorized keyboard input operations.
  • the present invention has a real-time screen recording module, which can realize real-time backup and monitoring of interface images, so as to monitor the operation of HID keyboard and mouse equipment in real time.
  • the present invention has an image analysis module, so that it can analyze illegal operations of legal HID keyboard and mouse equipment in real time, further improving the security of access to HID keyboard and mouse equipment.
  • Figure 1 is a schematic structural diagram of the first embodiment of the external protective equipment used to protect HID keyboard and mouse equipment according to the present invention
  • Figure 2 is a schematic structural diagram of a second embodiment of an external protective device used to protect HID keyboard and mouse equipment according to the present invention
  • Figure 3 is a schematic structural diagram of a third embodiment of an external protective device used to protect HID keyboard and mouse equipment according to the present invention
  • Figure 4 is a flow chart of an embodiment of the device protection method for HID keyboard and mouse device protection of the present invention.
  • an external protection device for protecting HID keyboard and mouse equipment (Human Interface Device of Keyboard or Mouse).
  • Protective Device EPD
  • the so-called external protective equipment is a physical device external to the protected device. By taking over the specific interface of the protected device (Protected Device, PD), it ensures that external devices that need to access the protected device must communicate with the external device. Access can only be achieved when the protective equipment is connected, so that the purpose of protecting the protected equipment can be achieved without installing security protection software on the protected equipment.
  • HID device also known as Human Interface Device
  • HIDs are computer add-on devices designed to be used directly by humans. Unlike other devices such as external hard drives or wireless cards, HIDs typically have buttons or controls that allow humans to interact with the computer.
  • Most modern human interface devices use the Universal Serial Bus (USB) communication protocol; before the name HID device was used, the number of protocols available for computer devices was limited. Manufacturers were restricted from making input devices that fell into narrow categories, and computer companies were forced to write drivers every time a new experimental input controller was made. HID devices were designed to address this limitation and encourage the construction of new types of input devices. HID devices contain preprogrammed data, called HID descriptors, that are reported to the host when the device is first connected.
  • HID descriptors preprogrammed data
  • the HID descriptor tells the computer the purpose of each packet sent from the interface device. Basically, this data provides "updates" to the host computer and informs the computer what input is required. While most HID hardware is designed for user control of the computer, the protocol is not limited to input. HID output can also be sent from the computer to the device. This communication capability is often used to provide information, such as status lights.
  • the HID keyboard and mouse device referred to in the present invention refers to a mouse or keyboard that meets the definition of HID. It is precisely because of the more general characteristics of HID devices that most of the current keyboards, mice and other devices are configured as HID keyboard and mouse devices, which provides more convenient conditions for the access of illegal HID keyboard and mouse devices. Therefore, this The invention proposes an external protective device for protecting HID keyboard and mouse equipment, which at least includes a HID internal interface, a HID external interface, a forwarding control module and a protocol analysis module.
  • the HID internal interface is used to connect to the HID input interface of the protected device, and the HID external interface is used to connect to external devices.
  • the HID input interface is generally a USB interface
  • the HID internal interface and the HID external interface of the present invention are usually interfaces that comply with the USB protocol.
  • the HID internal interface and the HID external interface of the present invention do not exclude interface types that comply with protocols of other standards.
  • the protected equipment in the present invention refers to a computer system with security requirements, such as an industrial control host, a server, etc., or it can also be other commercial or household computer equipment.
  • the host, server, etc. of the protected device the present invention is not limited to the operating system used, as long as it has the access function of the HID device and the corresponding hardware interface (HID input interface).
  • the present invention can directly connect the HID internal interface of the external protective device of the present invention to the protected device through a USB connection cable.
  • the external protective equipment has more than one internal interface so that it can be connected to all HID input interfaces of the protected equipment to form a comprehensive protection of the HID input interfaces.
  • the external protective equipment When the external protective equipment is connected to all HID input interfaces of the protected equipment, the external protective equipment is equivalent to taking over the HID input of the protected equipment.
  • external devices including HID keyboard and mouse devices or other devices that may be disguised as HID keyboard and mouse devices
  • the external device is connected to the HID external interface of the external protective device.
  • the HID external interface is also an interface that complies with the USB standard protocol.
  • the external protective equipment has some functional modules inside.
  • the module referred to here in the present invention is hardware or software with specific functions, or a combination of software and hardware.
  • a module can be a microcontroller written with a specific computer program, or a general-purpose processor that can read and execute the computer program, and a component with specific functions composed of related control circuits.
  • different modules are only functionally different here. When specifically implemented, they can be implemented by different hardware or software, or they can be implemented in the same hardware or the same software, or partially implemented by hardware and partially implemented by software. accomplish.
  • the external protection device of the present invention includes a forwarding control module and a protocol analysis module.
  • the forwarding control module is connected to the HID internal interface and the HID external interface respectively.
  • the protocol analysis module is connected to the forwarding control module, and performs protocol analysis on the external device connected to the HID external interface to determine whether the external device is a legal HID keyboard and mouse device.
  • the forwarding control module controls the connection or disconnection of the HID internal interface and the HID external interface according to the judgment results provided by the protocol analysis module to prevent illegal HID keyboard and mouse devices from connecting to the protected device.
  • the forwarding control module detects in real time whether the HID external interface is connected to an external device, and when it detects that an external device is connected, the protocol analysis module performs protocol analysis in real time to determine the legitimacy of the external device, and based on the The judgment result is used to determine whether to connect the HID internal interface and the HID external interface.
  • the protocol analysis module performs protocol analysis in real time to determine the legitimacy of the external device, and based on the The judgment result is used to determine whether to connect the HID internal interface and the HID external interface.
  • the judgment and control means when the external device has not been analyzed by the protocol, or is determined to be an illegal HID keyboard and mouse device after protocol analysis, controlling the HID internal interface and the HID external interface to disconnect ; When the external device is determined to be a legitimate HID keyboard and mouse device after protocol analysis, control the HID internal interface to connect with the HID external interface. In this way, after protocol analysis, only legal HID keyboard and mouse devices are allowed to access the protected device.
  • protocol analysis process in the present invention is:
  • USB device characteristics are described by USB descriptors in the internal firmware of the USB device.
  • the USB controller of the computer or other device will obtain the descriptor information of the USB device to confirm USB device access method and load the corresponding driver.
  • the USB descriptor includes device descriptor (vendor ID, product identification code (PID) and serial number information), configuration descriptor (number of configurations, currently used configuration identification, number of interfaces supported by the configuration), interface descriptor (interface subroutine) Class, interface protocol), endpoint descriptor, string descriptor.
  • HID class devices that comply with the USB protocol will also have three more descriptors: HID descriptor, report descriptor, and physical descriptor.
  • the protocol analysis module of the present invention obtains the data transmitted by the external device connected to the HID external interface according to the USB communication protocol by connecting to the forwarding control module, and monitors the communication process of the external device in real time, and analyzes the communication process of the external device connected to the HID external interface. device to control.
  • the forwarding control module When an external device is inserted into the HID external interface, the forwarding control module starts USB device enumeration. During the USB device enumeration process, the forwarding control module receives data sent by the external device for USB device enumeration and sends it to the protocol analysis module. The protocol analysis module analyzes the data received from the forwarding control module. When the data complies with the USB protocol, the protocol analysis module extracts according to the USB protocol specification: supplier ID, product identification code (PID) and serial number information, configuration number, currently used configuration identification, number of interfaces supported by the configuration, interface Number, interface class, interface subclass, interface protocol, etc.
  • PID product identification code
  • the type definition of the HID device is placed in the interface descriptor.
  • the protocol analysis module determines the type of the external device based on the information of the interface descriptor. When it is determined that the external device is not a HID device, nor is it a USB composite device (a device with HID and other USB characteristics, such as USB storage + HID class device), the protocol analysis module sends instructions to the forwarding control module to prevent the external device from accessing.
  • the HID device transmission type is interrupt transmission.
  • the token packets of all transmitted transactions are initiated by the USB Host, that is, all USB transactions (Setup transactions, IN transactions, OUT transactions) are controlled by the USB Host.
  • the protocol analysis module of the present invention monitors the data between the external equipment and the protected equipment in real time. Transmission, monitor interrupt transmission, run USB IN transactions, and strictly review USB OUT transactions (that is, allow data transmission from external devices as USB devices to protected devices, and strictly review data transmission from protected devices to external devices).
  • USB IN transactions that is, allow data transmission from external devices as USB devices to protected devices, and strictly review data transmission from protected devices to external devices.
  • the protocol analysis module of the present invention When it is determined that the external device is a HID keyboard, the protocol analysis module of the present invention also monitors and records the input data of the HID keyboard, and when the input data contains data in the predetermined blacklist, the protocol analysis module instructs the forwarding control module Control the HID internal interface and the HID external interface to be disconnected.
  • the data in the blacklist are, for example, operation instructions that are harmful to the computer, such as instructions for connecting to the network, transmitting data, or executing specific programs.
  • the external protection equipment also has a recording function. screen and video surveillance functions. This function is to prevent criminals from using legal HID keyboard and mouse equipment to conduct illegal operations. That is to say, when a legal external HID keyboard and mouse device is connected to the protected device through the external protection device of the present invention, the personnel's mouse, keyboard and other operations (deleting data, formatting memory, copying files, etc.) may also cause system serious damage. risk.
  • the external protective equipment of the present invention may also include a video interface, and the video interface includes a video internal interface and a video external interface.
  • the video inbound interface is connected to the video output interface of the protected device, and the video external interface is connected to the video device. Therefore, the present invention can obtain the video output data output by the protected device and display it through the video external device.
  • the video interface is, for example, a VGA connector, an HDMI interface, etc.
  • the video device can be an independent display, or it can also be a display screen integrated in an external protective device. Thus, the user can monitor the user's operation of the protected device through the video device.
  • the external protective equipment of the present invention may also include a screen recording module, which is connected to the video internal interface and used to record the video data output by the protected equipment.
  • the screen recording module is essentially a video storage module, which can store the image displayed on the screen as a video. It can be selectively compressed during storage and saved in a predetermined video format. The saved video data can be used as backup data for subsequent analysis when needed, or can be regularly sent to the corresponding control center for daily analysis.
  • the screen recording module is connected to the protocol analysis module and receives control from the protocol analysis module. Therefore, when the protocol analysis module determines that the external device has performed a specific operation, it controls the screen recording module to perform a recording operation of video data. Generally, the protocol analysis module can control the screen recording module to perform the recording operation only when the mouse, keyboard or other HID keyboard and mouse devices are active.
  • the external protective equipment of the present invention also has a real-time image analysis module to detect illegal operations performed by legal HID keyboard and mouse equipment in real time.
  • the external protective equipment of the present invention includes an image processing module, which is respectively connected to the screen recording module and the protocol analysis module, and is used to obtain real-time video data from the screen recording module and conduct real-time analysis of the video data. , and when the analysis result indicates that there is an abnormality in the video data, the protocol analysis module is notified, so that the protocol analysis module controls the disconnection of the HID internal interface and the HID external interface.
  • One method of real-time analysis is to extract frame images from the video data, and perform OCR recognition on the extracted frame images.
  • OCR recognition result contains predetermined blacklist text
  • a message indicating that the video data is abnormal is generated. Analyze the results. For example, if the text in the OCR recognition window contains "delete”, "copy” or the name of a certain software, it will be judged that there is an abnormality in the video data.
  • Another way of real-time analysis is to extract frame images from the video data, calculate the image features of the frame images and compare them with the image features of the predetermined image.
  • the predetermined image is, for example, a typical interface that appears when a computer is damaged, such as a shutdown interface, a restart interface, a command line interface, etc.
  • FIG 1 is a schematic structural diagram of the first embodiment of the external protective equipment used to protect HID keyboard and mouse equipment according to the present invention.
  • the external protective equipment 1 has a first HID internal interface 101 and a second HID internal interface 102, which are respectively connected to the first HID input interface 201 and the second HID input interface 202 of the protected equipment.
  • the external protective equipment 1 also has a first HID external interface 111 and a second HID external interface 112 .
  • the first HID external interface 111 and the second HID external interface 112 are respectively used to connect external devices.
  • they are respectively connected to a mouse 1 with a USB interface and a keyboard 4 with a USB interface.
  • the external protection device 1 has a protocol analysis module 12 and a forwarding control module 13, which in this embodiment are both implemented as hardware modules with information processing capabilities.
  • the protocol analysis module can be composed of programmable devices, and the forwarding control module includes controlled electronic switches.
  • protocol analysis module 12 and the forwarding control module 13 can be combined in one piece of hardware, or both can be implemented by software modules executed by a processor with general processing capabilities.
  • the forwarding control module 13 is respectively connected to the first HID internal interface, the second HID internal interface, and the first HID external interface and the second HID external interface to respectively control the first HID internal interface. Connect or disconnect with the first HID external interface, and control the connection or disconnection of the second HID internal interface with the second HID external interface; the protocol analysis module 12 is connected to the access end and control of the forwarding control module 13 end (only one line in the figure represents the connection relationship, which does not mean that there is only one connection line here), the protocol analysis module 12 reads the information of the first HID external interface and the second HID external interface from the access end, and passes Send instructions to the control end to control the operation of the corresponding electronic switch inside the forwarding control module 13 .
  • the protocol analysis module 12 performs protocol analysis on the external device (mouse 3 and keyboard 4 in the figure) connected to the two HID external interfaces according to the information provided by the first HID external interface 111 and the second HID external interface 112 to determine whether the external device It is a legal HID keyboard and mouse device.
  • the forwarding control module 13 controls the connection or disconnection of each HID internal interface and the HID external interface according to the instructions (representing the judgment results) input from the control terminal by the protocol analysis module 12 to prevent illegal HID keyboard and mouse devices from connecting to the Protected equipment.
  • the protocol analysis module since the protocol analysis module is connected to the input end of the forwarding control module, once the forwarding control module 13 detects that the HID external interface is connected to an external device, the protocol analysis module 12 can perform protocol analysis in real time to determine the legitimacy of the external device. And based on the judgment result, it is decided whether to connect the HID internal interface and the HID external interface. In this way, false or illegal HID keyboard and mouse devices cannot be connected to the internal interface, thus fundamentally preventing illegal persons from pretending or Illegal access to protected devices by forging HID keyboard and mouse devices.
  • protocol analysis module 12 determines whether the external device is a legal HID keyboard and mouse device. If the protocol analysis module 12 determines whether the external device is a legal HID keyboard and mouse device, the operations performed are as follows:
  • the forwarding control module 13 starts device enumeration.
  • the protocol analysis module 12 can extract from the protocol data: vendor ID, product identification code (PID) and serial number information, configuration number, and currently used configuration in the USB protocol specification. Identify and configure the number of supported interfaces, interface numbers, interface classes, interface subclasses, interface protocols, etc.
  • the type definition of the HID device is placed in the interface descriptor.
  • the protocol analysis module 12 first checks the device descriptor: bDeviceClass, bDeviceSubClass, and bDeviceProtocol values. Only when all three values are 0, the USB device meets the HID class device requirements.
  • the protocol analysis module 12 will also extract the relevant content in the interface descriptor and check it based on the following content:
  • the value of bInterfaceClass must be 0x03, and the value of bInterfaceSubClass is 0 or 1.
  • a value of 1 indicates that the HID device is a boot device (Boot Device, which is generally meaningful for PCs, meaning that the BIOS can recognize the device you use when starting up. HID device, and only a standard mouse or keyboard can be called a Boot Device), 0 means that the HID device is a device that can only be recognized and used after the operating system is started.
  • the value meaning of bInterfaceProtocol 1 is Keyboard, 2 is Mouse.
  • the protocol analysis module determines that the external device is a HID keyboard, it then monitors and records the input data of the HID keyboard, and when the input data contains data in the predetermined blacklist, the protocol analysis module instructs forwarding
  • the control module controls the HID internal interface to disconnect from the HID external interface.
  • the data in the blacklist are, for example, operation instructions that are harmful to the computer, such as instructions for connecting to the network, transmitting data, or executing specific programs.
  • FIG. 2 is a schematic structural diagram of a second embodiment of an external protective device used to protect HID keyboard and mouse equipment according to the present invention.
  • the external protective equipment 1 of the second embodiment also includes a video internal interface 103 , a video external interface 113 and a screen recording module 14 .
  • the video internal interface 103 is connected to the video output interface 203 of the protected device, and the video external interface 113 is connected to the display 5 .
  • the video interface in this embodiment is a VGA interface, but it can also be replaced by an HDMI interface or the like in this embodiment.
  • the display 5 may also be a display screen integrated in the external protective device 1 . The user can monitor the user's operation of the protected equipment through the display 5 .
  • the screen recording module 14 is connected to the video internal interface 103 for recording video data output by the protected device.
  • the screen recording module 14 may be composed of a storage controller with a large-capacity storage function, which can store images displayed on the screen as videos. And, preferably, it can be selectively compressed during storage and saved in a predetermined video format.
  • control end of the screen recording module 14 is connected to the protocol analysis module 12 to receive control from the protocol analysis module.
  • the recording operation is only performed when the protocol analysis module 12 determines that the external device has performed mouse, keyboard, etc. operations. In other embodiments, other conditions for starting or stopping recording may also be set.
  • FIG. 3 is a schematic structural diagram of an external protective device used to protect HID keyboard and mouse equipment according to the third embodiment of the present invention.
  • the external protective device of the third embodiment also includes an image analysis module 15 to detect illegal operations performed by legal HID keyboard and mouse devices in real time.
  • the image analysis module 15 is connected to the screen recording module 14 and the protocol analysis module 12 respectively, and is used to obtain real-time video data from the screen recording module and perform real-time analysis on the video data, and when the analysis result indicates that there is an abnormality in the video data When, the protocol analysis module is notified, so that the protocol analysis module controls the disconnection of the HID internal interface and the HID external interface.
  • the image analysis module 15 is implemented by an independent hardware module, but in other embodiments, it can also be integrated in the protocol analysis module 12, or the image analysis module 15 and the protocol analysis module 12 are integrated in one main unit. integrated in the control module.
  • the image analysis module 15 can also be implemented in software, that is, a software module, which can be executed by any hardware with information processing capabilities inside the external protective equipment.
  • the image analysis module 15 can perform image analysis in many different ways. Since it is connected to the screen recording module, it can obtain the interface image of the protected device obtained and recorded by the screen recording module in real time and perform real-time analyze.
  • the present invention is not limited to specific analysis methods, and preferably supports updating or upgrading image analysis methods.
  • a real-time analysis method is to extract frame images from the video data, and perform OCR recognition on the extracted frame images.
  • OCR recognition result contains predetermined blacklist text, generate video data representing There are abnormal analysis results. For example, if the text in the OCR recognition window contains "delete", "copy” or the name of a certain software, it will be judged that there is an abnormality in the video data.
  • Another way of real-time analysis is to extract frame images from the video data, calculate the image features of the frame images and compare them with the image features of the predetermined image.
  • the image features of the frame images are compared with the image features of the predetermined image, When the similarity of the features is higher than the threshold, analysis results indicating anomalies in the video data are generated.
  • the predetermined image is, for example, a typical interface that appears when a computer is damaged, such as a shutdown interface, a restart interface, a command line interface, etc.
  • the present invention since the present invention has a forwarding control module controlled by the protocol analysis module, illegal HID keyboard and mouse devices cannot be connected to the protected device, which solves the problem of being unable to effectively prevent illegal devices from damaging the system by disguising themselves as keyboards and mice.
  • the problem improves the system's protection against illegal HID keyboard and mouse devices.
  • the present invention also uses a real-time screen recording module to back up and monitor the operation of the HID keyboard and mouse device in real time. Furthermore, the present invention can also prevent illegal operations of legal HID keyboard and mouse equipment through real-time analysis of the image analysis module, and further improve the security of access to HID keyboard and mouse equipment.
  • the above method solves the problem that the keyboard and mouse communication protocols and operating behaviors cannot be recorded and audited when the audit software cannot be installed in the protected equipment.
  • FIG 4 is a flow chart of an embodiment of the device protection method for HID keyboard and mouse device protection of the present invention. As shown in Figure 4, the method of the present invention includes:
  • EPD External Protective Device
  • PD Protected Device
  • HID input interface of the protected device is generally a USB interface
  • the HID internal interface and the HID external interface of the present invention are usually interfaces that comply with the USB protocol.
  • the HID internal interface and the HID external interface of the present invention do not exclude interface types that comply with protocols of other standards.
  • the external protective device when an external device is plugged into the external protective device, the external protective device initiates device enumeration.
  • the external protection device can extract the following USB protocol specifications from the protocol data: vendor ID, product identification code (PID) and serial number information, configuration number, and currently used configuration Identify and configure the number of supported interfaces, interface numbers, interface classes, interface subclasses, interface protocols, etc.
  • the type definition of the HID device is placed in the interface descriptor.
  • the protocol analysis module 12 first checks the device descriptor: bDeviceClass, bDeviceSubClass, and bDeviceProtocol values. Only when all three values are 0, the USB device meets the HID class device requirements.
  • the external protective equipment will also extract the relevant content in the interface descriptor and check it based on the following content:
  • the value of bInterfaceClass must be 0x03, and the value of bInterfaceSubClass is 0 or 1.
  • a value of 1 indicates that the HID device is a boot device (Boot Device, which is generally meaningful for PCs, meaning that the BIOS can recognize the device you use when starting up. HID device, and only a standard mouse or keyboard can be called a Boot Device), 0 means that the HID device is a device that can only be recognized and used after the operating system is started.
  • the value meaning of bInterfaceProtocol 1 is Keyboard, 2 is Mouse.
  • the external device when the external device is determined to be an illegal HID keyboard and mouse device or a non-HID keyboard and mouse device after protocol analysis, the external device is controlled to be disconnected from the protected device; when the external device is determined to be legal after protocol analysis When using HID keyboard and mouse devices, control the connection between the external device and the protected device.
  • the type definition of the HID device is placed in the interface descriptor.
  • the external protection device determines the type of the external device based on the information of the interface descriptor. When it is determined that the external device is not a HID device, nor is it a USB composite device (a device with HID and other USB characteristics, such as USB storage + HID device), prevent the external device from accessing.
  • the method of the present invention may also include step S4: real-time monitoring of data transmission between the external device and the protected device, when it is detected that there is a risk in the USB IN transaction, or when the data of the USB OUT transaction exists , interrupting data transmission from the protected device to the external device.
  • the invention also aims to solve the problem of being unable to record and audit keyboard and mouse communication protocols and operating behaviors when audit software cannot be installed in the protected equipment. Through this step,

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Human Computer Interaction (AREA)
  • Input From Keyboards Or The Like (AREA)
  • User Interface Of Digital Computer (AREA)

Abstract

本发明提出一种用于HID键鼠设备防护的外接式防护设备和方法，所述设备包括：HID对内接口，用于连接被保护设备的HID输入接口；HID对外接口，用于连接外接设备；转发控制模块，分别连接所述HID对内接口与HID对外接口；以及协议分析模块，用于对连接至所述HID对外接口的外接设备进行协议分析以判断该外接设备是否是合法的HID键鼠设备；其中，所述转发控制模块根据协议分析模块提供的判断结果来控制所述HID对内接口与HID对外接口的连通或断开，以防止非法的HID键鼠设备连通所述被保护设备。本发明能够防止非法的HID键鼠设备的接入对被防护设备的破坏。

Description

一种用于HID键鼠设备防护的外接式防护设备和方法 技术领域
本发明属于设备安全防护技术领域，尤其涉及一种用于HID键鼠设备防护的外接式防护设备和方法。
 背景技术
对于工业控制系统、商业系统或办公系统等计算机系统，非法入侵的手段变得越来越隐敝和复杂，因此系统安全防护越来越受到人们的重视。一种入侵计算机系统的方式是利用伪装或改造过的键盘、鼠标等用户输入设备，插入系统的接口，通过向系统传输非法代码来对系统进行非法的读写或破坏。
为了防止用户利用鼠标、键盘来对系统进行破坏，ZL 201410564213 .7号中国发明专利提出了一种PS/2鼠标、键盘操作审计及控制方法，该装置提供是一种对主机PS/2鼠标、键盘操作审计与控制的方法。主要通过单片机解析PS/2鼠标、键盘协议解析，在不影响主机使用的情况下来获取鼠标、键盘的动作信息并可以通过控制PS/2鼠标、键盘开启与关闭。
然而，现有技术一方面无法识别接入系统的鼠标、键盘是否是非法的鼠标、键盘，或者是伪装成鼠标、键盘的非法设备；另一方面，现有技术在被防护设备内部不安装审计软件的情况下，也无法实时地对接入相应接口的鼠标、键盘等设备的合法性以及操作行为进行审计或鉴权。由于伪装成鼠标、键盘的非法设备在进行非法数据交互的过程中也会产生正常的键盘、鼠标操作数据，因此现有技术实际上无法真正防护非法设备的接入和非法操作，也无法对正常的操作行为进行记录和审计。
此外，目前的鼠标、键盘已基本上不再使用PS/2接口，而使用更通用的支持HID设备的USB接口。
 技术问题
有鉴于此，本发明的一个方面旨在解决现有技术无法有效防止非法设备伪装成键盘、鼠标对系统进行破坏的问题。
本发明的另一方面旨在解决在被防护设备内无法安装审计软件的情况下，无法对键盘、鼠标通信协议及操作行为进行记录和审计的问题。
 技术解决方案
为了实现上述目的，作为本发明的第一个方面，提出了一种用于HID键鼠设备防护的外接式防护设备，包括：HID对内接口，用于连接被保护设备的HID输入接口；HID对外接口，用于连接外接设备；转发控制模块，分别连接所述HID对内接口与HID对外接口；以及协议分析模块，用于对连接至所述HID对外接口的外接设备进行协议分析以判断该外接设备是否是合法的HID键鼠设备；其中，所述转发控制模块根据协议分析模块提供的判断结果来控制所述HID对内接口与HID对外接口的连通或断开，以防止非法的HID键鼠设备连通所述被保护设备。
根据本发明的优选实施例，所述根据协议分析模块提供的判断结果来控制所述HID对内接口与HID对外接口的连通或断开包括：当所述外接设备经协议分析后判断为非法HID键鼠设备或非HID键鼠设备时，控制所述HID对内接口与HID对外接口断开；当所述外接设备经协议分析后判断为合法的HID键鼠设备时，控制所述HID对内接口与HID对外接口连通。
根据本发明的优选实施例，当所述外部设备为HID键盘时，所述协议分析模块还用于对该HID键盘的输入数据进行监控和记录；当所述输入数据包含预定黑名单中的数据时，所述协议分析模块指示转发控制模块控制所述HID对内接口与HID对外接口断开。
根据本发明的优选实施例，所述外接式防护设备还包括：视频对内接口，用于连接被保护设备的视频输出接口；视频对外接口，用于连接视频设备；录屏模块，连接所述视频对内接口，用于记录所述被保护设备输出的视频数据。
根据本发明的优选实施例，所述录屏模块连接至所述协议分析模块，并接收所述协议分析模块的控制；当所述协议分析模块判断所述外接设备执行了特定操作时，控制所述录屏模块进行视频数据的记录操作。
根据本发明的优选实施例，所述外接式防护设备还包括图像处理模块，其分别连接所述录屏模块和协议分析模块，用于从所述录屏模块获取实时的视频数据并对该视频数据进行实时分析，并且，当分析结果表示视频数据存在异常时，通知所述协议分析模块，以便所述协议分析模块控制所述HID对内接口与HID对外接口断开。
根据本发明的优选实施例，所述实时分析包括：对所述视频数据进行帧图像的提取，并对的取得的帧图像进行识别，当所述识别结果包含预定黑名单操作时，产生表示视频数据存在异常的分析结果。
根据本发明的优选实施例，所述实时分析包括：对所述视频数据进行帧图像的提取，并计算帧图像的图像特征并与预定图像的图像特征进行比较，当所述帧图像的图像特征与预定图像的图像特征的相似度高于阈值时，产生表示视频数据存在异常的分析结果。
本发明的另一方面提出一种用于HID键鼠设备防护的设备防护方法，包括以下步骤：提供外接式防护设备以接管被保护设备的HID输入接口；对连接至所述外接式防护设备的外部设备进行协议分析以判断该外接设备是否是合法的HID键鼠设备；根据判断的结果来控制所述外部设备与被保护设备的连通或断开，以防止非法的HID键鼠设备连通所述被保护设备。
根据本发明的优选实施例，所述根据判断的结果来控制所述外部设备与被保护设备的连通或断开包括：当所述外接设备经协议分析后判断为非法HID键鼠设备或非HID键鼠设备时，控制外部设备与被保护设备断开；当所述外接设备经协议分析后判断为合法的HID键鼠设备时，控制外部设备与被保护设备连通。
根据本发明的优选实施例，当所述外部设备为HID键盘时，所述方法还包括：对该HID键盘的输入数据进行监控和记录；当所述输入数据包含预定黑名单中的数据时，控制所述外部设备与被保护设备断开。
根据本发明的优选实施例，方法还包括：实时监测外部设备与被保护设备之间的数据传输，当监测到USB IN事务存在风险时，或者USB OUT事务的数据存在时，中断被保护设备到外部设备的数据传输。
 有益效果
本发明相对于现有技术至少具有如下有益效果：
（1）本发明具有协议分析模块控制的转发控制模块，因此非法的HID键鼠设备无法连接到被保护设备，解决了无法有效防止非法设备伪装成键盘、鼠标对系统进行破坏的问题，提高了系统对于非法HID键鼠设备的防护。
（2）本发明具有协议分析模块控制的键盘输入监控记录模块，可以有效阻断非授权的键盘输入操作。
（3）本发明具有实时的录屏模块，能够实现对于界面图像的实时备份、监控，以便实时监控HID键鼠设备的操作。
（4）本发明具有图像分析模块，从而能够实时分析合法HID键鼠设备的非法操作，进一步提高了HID键鼠设备接入的安全性。
 附图说明
图1是本发明的用于HID键鼠设备防护的外接式防护设备的第一实施例的结构示意图；
图2是本发明的用于HID键鼠设备防护的外接式防护设备的第二实施例的结构示意图；
图3是本发明的用于HID键鼠设备防护的外接式防护设备的第三实施例的结构示意图；
图4是本发明的用于HID键鼠设备防护的设备防护方法的实施例的流程图。
 本发明的实施方式
为使本发明的目的、技术方案和优点更加清楚明白，以下结合具体实施例，并参照附图，对本发明作进一步的详细说明。
为解决现有技术无法有效防止非法设备伪装成键盘、鼠标对系统进行破坏的问题，本发明提出一种用于HID键鼠设备（Human Interface Device of Keyboard or Mouse）防护的外接式防护设备（External Protective Device, EPD）。所谓的外接式防护设备是外接于被保护设备的一种实体设备，通过对被保护设备（Protected Device, PD）的特定接口进行接管，确保需要访问被保护设备的外接设备必须通过与该外接式防护设备连接才能接入，从而无需在被保护设备上安装安全防护软件即可达到对被保护设备进行防护的目的。
HID设备也称人机界面设备，即Human Interface Device，其是一种旨在直接供人使用的计算机附加设备。与外部硬盘或无线卡等其他设备不同，HID通常具有按钮或控件，允许人类与计算机进行交互。大多数现代人机界面设备使用通用串行总线（USB）通信协议；HID设备这个名称被使用之前，计算机设备的协议数量是有限的。制造商被限制制造属于狭义类别的输入设备，每当一个新的实验性输入控制器被制造出来时，计算机公司就被迫编写驱动程序。HID设备则旨在解决此限制并鼓励构建新类型的输入设备。HID设备包含预编程数据，称为HID描述符，当设备第一次连接时向主机报告的信息。HID描述符告诉计算机将从接口设备发送的每个信息包的用途。基本上，这些数据向主机提供“更新”，并通知计算机需要哪些输入虽然大多数HID硬件是为用户控制计算机而设计的，但协议不仅限于输入。HID输出也可以从计算机发送到设备。这种通信能力通常用于提供信息，例如状态灯。
本发明中所称的HID键鼠设备是指符合HID定义的鼠标或键盘。正是出于HID设备的较为通用的特性，目前的键盘、鼠标等设备大多配置为HID键鼠设备，这为非法的HID键鼠设备接入也提供了更多的便利条件，由此，本发明提出用于HID键鼠设备防护的外接式防护设备，其至少包括HID对内接口、HID对外接口、转发控制模块和协议分析模块。HID对内接口用于连接被保护设备的HID输入接口，HID对外接口则用于连接外接设备。通常，所述的HID输入接口一般是USB接口，因此本发明的HID对内接口和HID对外接口通常也是符合USB协议的接口。但是本发明的HID对内接口和HID对外接口也不排除符合其他标准的协议的接口类型。
本发明中的被保护设备是指具有安全需求的计算机系统，例如工业控制的主机、服务器等，也可以是其他商有或家用的计算机设备。作为被保护设备的主机、服务器等，本发明不限于其使用的操作系统，只要其具有HID设备的接入功能和相应的硬件接口（HID输入接口）即可。例如，被保护设备具有用于连接键盘、鼠标等设备的USB接口，则本发明可以直接通过USB连接线将本发明的外接式防护设备的HID对内接口连接到被保护设备。优选的是，外接式防护设备的对内接口不止一个，以便其能够连接被保护设备的所有HID输入接口，以便形成对HID输入接口的全面防护。
当外接式防护设备连接到了被保护设备的所有HID输入接口时，外接式防护设备相当于接管了被保护设备的HID输入。当外部设备（包括HID键鼠设备或可能伪装成HID键鼠设备的其他设备）需要连接到被保护设备以进行用户输入操作时，其必须连接至该外接式防护设备。具体地，该外部设备连接至外接式防护设备的HID对外接口，通常，该HID对外接口也是符合USB标准协议的接口。
为了对连接到本发明的外接式防护设备的外部设备进行安全监测，外接式防护设备的内部具有一些功能模块。需要说明的是，本发明此处所称的模块是具有特定功能的硬件或软件，或者是软硬件的结合。例如，模块可以是被写入特定计算机程序的单片机，也可以是能够读入并执行计算机程序的通用处理器，及相关控制电路所构成的，具备特定功能的部件等。并且，不同的模块，在此仅作功能上的区别，具体实现时，其可以各自由不同的硬件或软件实现，也可以在同一硬件或同一软件中实现，或者部分由硬件实现，部分由软件实现。
如前所述，本发明的外接式防护设备包括有转发控制模块和协议分析模块。转发控制模块分别连接所述HID对内接口与HID对外接口。协议分析模块连接至转发控制模块，并且对连接至所述HID对外接口的外接设备进行协议分析以判断该外接设备是否是合法的HID键鼠设备。转发控制模块则根据协议分析模块提供的判断结果来控制所述HID对内接口与HID对外接口的连通或断开，以防止非法的HID键鼠设备连通所述被保护设备。需要说明的是，转发控制模块实时地检测HID对外接口是否连接了外部设备，并在监测到连接了外部设备时，协议分析模块实时地进行协议分析以判断该外部设备的合法性，并根据该判断结果来决定是否连通所述HID对内接口与HID对外接口，这样，虚假的或非法的HID键鼠设备就无法连接到对内接口，从而从根本上防止了不法人员通过伪装或伪造HID键鼠设备的方式非法访问被保护设备。
具体来说，所述的判断与控制是指：当所述外接设备未经协议分析，或者经协议分析后判断为非法HID键鼠设备时，控制所述HID对内接口与HID对外接口断开；当所述外接设备经协议分析后判断为合法HID键鼠设备时，控制所述HID对内接口与HID对外接口连通。这样，经协议分析后，只有合法的HID键鼠设备被允许接入到被保护设备中。
更进一步来说，本发明中的协议分析过程为：
（一）设备枚举阶段
USB设备特性是由USB设备内部固件中的USB描述符进行描述的，在USB设备插入计算机或其他设备的USB接口后，计算机或其他设备的USB控制器将获得USB设备的描述符信息，以确认USB设备的访问方式，并加载相应驱动程序。USB描述符包括设备描述符（供应商ID、产品标识码(PID)及序列号信息）、配置描述符（配置数、当前使用的配置标识、配置支持的接口数）、接口描述符（接口子类、接口协议）、端点描述符、字符串描述符，符合USB协议的HID类设备还会多出HID描述符、报告描述符、物理描述符这三种描述符。
据此，本发明的协议分析模块通过连接至转发控制模块来获取HID对外接口上连接的外部设备所传送的依照USB通信协议的数据实时监测该外部设备的通信过程，对HID对外接口上连接的设备进行控制。
在外部设备插入HID对外接口时，转发控制模块启动USB设备枚举。在USB设备枚举过程中，转发控制模块接收外部设备发送的用于USB设备枚举的数据并发送给协议分析模块，协议分析模块通过对从转发控制模块接收的数据进行分析。当所述的数据符合USB协议时，协议分析模块根据USB协议规范提取：供应商ID、产品标识码(PID)及序列号信息、配置数、当前使用的配置标识、配置支持的接口数、接口编号、接口类、接口子类、接口协议等。
根据USB协议规范，HID设备的类型定义放置在接口描述符中。根据本发明，协议分析模块根据接口描述符的信息对外部设备的类型进行判断，当判断所述外部设备不是HID设备，也不是USB复合设备（具有HID及其他USB特性设备，例如USB存储+HID类设备）时，协议分析模块向转发控制模块发送指令，以阻止该外部设备接入。
（二）设备使用阶段
根据USB规范，HID设备传输类型为中断传输。所有传输的事务的令牌包均由USB Host发起，即USB一切事务（Setup事务、IN事务、OUT事务）都是USB Host操纵的。
由于HID设备为输入设备，非控制数据的流向只可能是HID设备流向主机的方向。为了解决在被防护设备内无法安装审计软件的情况下，无法对键盘、鼠标通信协议及操作行为进行记录和审计的问题，本发明的协议分析模块实时监测外部设备与被保护设备之间的数据传输，监测中断传输运行USB IN事务，并严格审查USB OUT事务（即允许作为USB设备的外部设备到被保护设备的数据传输，严格审查被保护设备到外部设备的数据传输）。当根据预定的规则判断USB IN 事务的数据存在风险时，中断外部设备与被保护设备之间的数据传输。同时，当监测到USB OUT事务的数据时，也中断外部设备与被保护设备之间的数据传输。
当判断外部设备为HID键盘时，本发明的协议分析模块还对该HID键盘的输入数据进行监控和记录，并且当输入数据包含预定黑名单中的数据时，所述协议分析模块指示转发控制模块控制所述HID对内接口与HID对外接口断开。黑名单中的数据例如是对计算机有害的操作指令，例如连接网络、传送数据或执行特定程序等指令。
为了解决在被防护设备内无法安装审计软件的情况下，无法对键盘、鼠标通信协议及操作行为进行记录和审计的问题，根据本发明的一种优选的实施方式，外接式防护设备还具有录屏和视频监控的功能。此功能是为了防止不法人员利用合法的HID键鼠设备进行非法操作。也即，当合法的外部的HID键鼠设备通过本发明的外接式防护设备连接到被保护设备之后，人员的鼠标、键盘等操作（删除数据、格式化存储器复制文件等）也可能造成系统严重风险。
为此，一方面，本发明的外接式防护设备还可包括视频接口，视频接口包括视频对内接口和视频对外接口。视频对内接口连接被保护设备的视频输出接口，视频对外接口则连接视频设备。由此，本发明可以获取被保护设备输出的视频输出数据，并通过视频外接设备进行显示。视频接口例如是VGA接品、HDMI接口等，视频设备可以是独立的指显示器，但也可以是集成于外接式防护设备的显示屏。由此，用户可以通过视频设备来监控用户对被保护设备的操作。
另一方面，本发明的外接式防护设备还可包括录屏模块，其连接所述视频对内接口，用于记录所述被保护设备输出的视频数据。录屏模块实质上是一个视频存储模块，其可以将屏幕显示的图像作为视频进行存储，在存储时可以选择性地进行压缩，并以预定的视频格式保存。所保存的视频数据既可以作为备份数据以供后续分析需要时进行调取，也可以定时地发送到相应的控制中心进行日常的分析。
作为优选的实施方式，为了节约视频存储的空间，所述录屏模块连接至所述协议分析模块，并接收所述协议分析模块的控制。由此当所述协议分析模块判断所述外接设备执行了特定操作时，控制所述录屏模块进行视频数据的记录操作。通常，协议分析模块可以控制录屏模块只有当鼠标、键盘或其他HID键鼠设备处于活动时才进行所述记录操作。
作为更一步优选的实施方式，本发明的外接式防护设备还具有实时的图像分析模块，以便实时地检测到合法的HID键鼠设备进行的非法操作。具体来说，本发明的外接式防护设备包括图像处理模块，其分别连接所述录屏模块和协议分析模块，用于从所述录屏模块获取实时的视频数据并对该视频数据进行实时分析，并且，当分析结果表示视频数据存在异常时，通知所述协议分析模块，以便所述协议分析模块控制所述HID对内接口与HID对外接口断开。
一种实时分析的方式为：对所述视频数据进行帧图像的提取，并对的取的帧图像进行OCR识别，当所述OCR识别结果包含预定黑名单文字时，产生表示视频数据存在异常的分析结果。例如，OCR识别窗口的文字中包含“删除”、“复制”或某个软件的名称等，则判断有视频数据存在异常。另一种实时分析的方式为：对所述视频数据进行帧图像的提取，并计算帧图像的图像特征并与预定图像的图像特征进行比较，当所述帧图像的图像特征与预定图像的图像特征的相似度高于阈值时，产生表示视频数据存在异常的分析结果。预定图像例如是对电脑进地破坏时出现的典型界面，例如关机界面、重启界面、命令行界面等。
以下通过具体实施例来进行一步说明本发明。应当理解，具体实施例只是实施本发明的一些具体的实例，其作用主要在于示例性地解释本发明可能的实施方式，但其不表示本发明只能以具体实施例的方式进行实施，更不应以具体实施例的方案直接作为本发明所要求保护的范围。
图1是本发明的用于HID键鼠设备防护的外接式防护设备的第一实施例的结构示意图。如图1所示，外接式防护设备1具有第一HID对内接口101和第二HID对内接口102，其分别与被保护设备的第一HID输入接口201和第二HID输入接口202连接。，外接式防护设备1还具有第一HID对外接口111和第二HID对外接口112。第一HID对外接口111和第二HID对外接口112分别用于连接外部设备，在此，作为示例，其分别连接有USB接口的鼠标1和USB接口的键盘4。除此之外，外接式防护设备1具有一个协议分析模块12和一个转发控制模块13，在该实施例中均实现为具有信息处理能力的硬件模块。具体的，协议分析模块可以由可编程器件构成，转发控制模块则包含受控的电子开关。
但是，本领域技术人员可以理解，协议分析模块12和转发控制模块13可以合并在一个硬件中，或者，二者由具有通用处理能力的处理器执行的软件模块来实现。
如图1所示，转发控制模块13分别连接所述第一HID对内接口、第二HID对内接口，以及第一HID对外接口和第二HID对外接口，以分别控制第一HID对内接口与第一HID对外接口的连通或断开，以及控制第二HID对内接口与第二HID对外接口的连通或断开；协议分析模块12则连接至该转发控制模块13的接入端和控制端（图中仅以一条线表示连接关系，并不表示此处仅有一条连接线），协议分析模块12从接入端读取第一HID对外接口和第二HID对外接口的信息，并通过向控制端发送指领来控制转发控制模块13内部的相应电子开关的操作。协议分析模块12根据第一HID对外接口111和第二HID对外接口112提供的信息对连接至两个HID对外接口的外接设备（图中指鼠标3和键盘4）进行协议分析以判断该外接设备是否是合法的HID键鼠设备。
转发控制模块13根据协议分析模块12从控制端输入的指令（代表判断结果）来控制所述各HID对内接口与HID对外接口的连通或断开，以防止非法的HID键鼠设备连通所述被保护设备。这里，由于协议分析模块连接到转发控制模块的输入端，因此转发控制模块13一旦检测HID对外接口连接了外部设备，协议分析模块12就能实时地进行协议分析以判断该外部设备的合法性，并根据该判断结果来决定是否连通所述HID对内接口与HID对外接口，这样，虚假的或非法的HID键鼠设备就无法连接到对内接口，从而从根本上防止了不法人员通过伪装或伪造HID键鼠设备的方式非法访问被保护设备。
协议分析模块12判断外部设备是否是合法的HID键鼠设备时，执行的操作如下：
在外部设备插入HID对外接口时，转发控制模块13启动设备枚举。通过在设备枚举过程中的USB协议分析，协议分析模块12可从协议数据中提取USB协议规范中的：供应商ID、产品标识码(PID)及序列号信息、配置数、当前使用的配置标识、配置支持的接口数、接口编号、接口类、接口子类、接口协议等。
根据USB协议规范，HID设备的类型定义放置在接口描述符中。协议分析模块12首先检查设备描述符中：bDeviceClass, bDeviceSubClass, bDeviceProtocol值，只有三个值均为0，该USB设备才符合HID类设备要求。   
协议分析模块12还将提取接口描述符中相关内容，并依据以下内容进行检查：
接口描述符中：bInterfaceClass 的值必须是 0x03, bInterfaceSubClass 的值为 0 或 1， 为1表示HID设备是一个开机启动设备（Boot Device， 一般对PC机有意义，意思是BIOS启动时能识别您使用的HID设备，且只有标准鼠标或者键盘才能称为Boot Device），为0表示HID设备是操作系统启动后才能识别使用的设备。bInterfaceProtocol 的取值含义：1为 Keyboard（键盘），2为Mouse（鼠标）。
此外，当协议分析模块判断外部设备为HID键盘时，其接下来还对该HID键盘的输入数据进行监控和记录，并且当输入数据包含预定黑名单中的数据时，所述协议分析模块指示转发控制模块控制所述HID对内接口与HID对外接口断开。黑名单中的数据例如是对计算机有害的操作指令，例如连接网络、传送数据或执行特定程序等指令。
图2是本发明的用于HID键鼠设备防护的外接式防护设备的第二实施例的结构示意图。如图2所示，与第一实施例不同的是，该第二实施例的外接式防护设备1还包括视频对内接口103、视频对外接口113和录屏模块14。视频对内接口103连接被保护设备的视频输出接口203，视频对外接口113则连接显示器5。该实施例的视频接口是VGA接口，但本在其实施例中其也可以由HDMI接口等代替。此外，在其他实施例中，显示器5也可以是集成于外接式防护设备1的显示屏。用户可以通过显示器5来监控用户对被保护设备的操作。
如图2所示，录屏模块14连接所述视频对内接口103，用于记录所述被保护设备输出的视频数据。录屏模块14可以由一个具有大容量存储功能的存储控制器组成，其可以将屏幕显示的图像作为视频进行存储。并且，优选地，其在存储时可以选择性地进行压缩，并以预定的视频格式保存。
更进一步的，在该第二实施例中，为了节约视频存储的空间，所述录屏模块14的控制端连接至所述协议分析模块12，以接收所述协议分析模块的控制。当所述协议分析模块12判断所述外接设备执行了鼠标、键盘等操作时才进行所述记录操作。在其他实施例中，也可以设置其他的记录启动或停止的条件。
图3是本发明的第三实施例的用于HID键鼠设备防护的外接式防护设备的结构示意图。该实施例是在第二实施例的基础上的进一步改进。如图3所示，该第三实施例的外接式防护设备还包括有图像分析模块15，以便实时地检测到合法的HID键鼠设备进行的非法操作。图像分析模块15分别连接所述录屏模块14和协议分析模块12，用于从所述录屏模块获取实时的视频数据并对该视频数据进行实时分析，并且，当分析结果表示视频数据存在异常时，通知所述协议分析模块，以便所述协议分析模块控制所述HID对内接口与HID对外接口断开。在该实施例中，图像分析模块15由一个独立的硬件模块实现，但在其他实施例中，其也可以集成在协议分析模块12中，或者，图像分析模块15和协议分析模块12在一个主控模块中集成。此外，与其他模块一样，图像分析模块15也可以是软件实现，即软件模块，其可以由外接式防护设备内部任何具有信息处理能力的硬件进行执行。
如前所述，图像分析模块15可以执行多种不同方式的图像分析，由于其连接到录屏模块，因此其可以实时地获取录屏模块获取并记录的被保护设备的界面图像并执行实时的分析。本发明不限于具体的分析方法，并且优选为支持更新或升级图像分析方法。作为例子，一种实时分析的方式为：对所述视频数据进行帧图像的提取，并对的取的帧图像进行OCR识别，当所述OCR识别结果包含预定黑名单文字时，产生表示视频数据存在异常的分析结果。例如，OCR识别窗口的文字中包含“删除”、“复制”或某个软件的名称等，则判断有视频数据存在异常。另一种实时分析的方式为：对所述视频数据进行帧图像的提取，并计算帧图像的图像特征并与预定图像的图像特征进行比较，当所述帧图像的图像特征与预定图像的图像特征的相似度高于阈值时，产生表示视频数据存在异常的分析结果。预定图像例如是对电脑进地破坏时出现的典型界面，例如关机界面、重启界面、命令行界面等。
通过以上实施例可知，由于本发明具有协议分析模块控制的转发控制模块，因此非法的HID键鼠设备无法连接到被保护设备，解决了无法有效防止非法设备伪装成键盘、鼠标对系统进行破坏的问题，提高了系统对于非法HID键鼠设备的防护。本发明还通过实时的录屏模块来实时的备份和监控HID键鼠设备的操作。更进一步的来说，本发明还能通过图像分析模块的实时分析来防止合法HID键鼠设备的非法操作，进一步提高HID键鼠设备接入的安全性。以上的手段解决了在被防护设备内无法安装审计软件的情况下，无法对键盘、鼠标通信协议及操作行为进行记录和审计的问题。
图4是本发明的用于HID键鼠设备防护的设备防护方法的实施例的流程图。如图4所示，本发明的方法包括：
S1、提供外接式防护设备以接管被保护设备的HID输入接口。
本发明的方法的目的之一是旨在对被保护设备进行防护，以防止非法设备伪装成键盘、鼠标对系统进行破坏。如前所述，外接式防护设备（External Protective Device, EPD）是外接于被保护设备的一种实体设备，通过对被保护设备（Protected Device, PD）的特定接口进行接管，确保需要访问被保护设备的外接设备必须通过与该外接式防护设备连接才能接入，从而无需在被保护设备上安装安全防护软件即可达到对被保护设备进行防护的目的。通常，被保护设备的HID输入接口一般是USB接口，因此本发明的HID对内接口和HID对外接口通常也是符合USB协议的接口。但是本发明的HID对内接口和HID对外接口也不排除符合其他标准的协议的接口类型。
S2、对连接至所述外接式防护设备的外部设备进行协议分析以判断该外接设备是否是合法的HID键鼠设备。
具体来说，在外部设备插入外接式防护设备时，外接式防护设备启动设备枚举。通过在设备枚举过程中的USB协议分析，外接式防护设备可从协议数据中提取USB协议规范中的：供应商ID、产品标识码(PID)及序列号信息、配置数、当前使用的配置标识、配置支持的接口数、接口编号、接口类、接口子类、接口协议等。
根据USB协议规范，HID设备的类型定义放置在接口描述符中。协议分析模块12首先检查设备描述符中：bDeviceClass, bDeviceSubClass, bDeviceProtocol值，只有三个值均为0，该USB设备才符合HID类设备要求。   
外接式防护设备还将提取接口描述符中相关内容，并依据以下内容进行检查：
接口描述符中：bInterfaceClass 的值必须是 0x03, bInterfaceSubClass 的值为 0 或 1， 为1表示HID设备是一个开机启动设备（Boot Device， 一般对PC机有意义，意思是BIOS启动时能识别您使用的HID设备，且只有标准鼠标或者键盘才能称为Boot Device），为0表示HID设备是操作系统启动后才能识别使用的设备。bInterfaceProtocol 的取值含义：1为 Keyboard（键盘），2为Mouse（鼠标）。
S3、根据判断的结果来控制所述外部设备与被保护设备的连通或断开，以防止非法的HID键鼠设备连通所述被保护设备。
具体的，当所述外接设备经协议分析后判断为非法HID键鼠设备或非HID键鼠设备时，控制外部设备与被保护设备断开；当所述外接设备经协议分析后判断为合法的HID键鼠设备时，控制外部设备与被保护设备连通。
根据USB协议规范，HID设备的类型定义放置在接口描述符中。根据本发明，外接式防护设备根据接口描述符的信息对外部设备的类型进行判断，当判断所述外部设备不是HID设备，也不是USB复合设备（具有HID及其他USB特性设备，例如USB存储+HID类设备）时，阻止该外部设备接入。
根据本发明的优选实施例，本发明的方法还可以包括步骤S4：实时监测外部设备与被保护设备之间的数据传输，当监测到USB IN事务存在风险时，或者USB OUT事务的数据存在时，中断被保护设备到外部设备的数据传输。
本发明还旨在解决在被防护设备内无法安装审计软件的情况下，无法对键盘、鼠标通信协议及操作行为进行记录和审计的问题。通过该步骤，
以上所述的具体实施例，对本发明的目的、技术方案和有益效果进行了进一步详细说明，应理解的是，本发明不与任何特定计算机、虚拟装置或者电子设备固有相关，各种通用装置也可以实现本发明。以上所述仅为本发明的具体实施例而已，并不用于限制本发明，凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (12)

  1.  一种用于HID键鼠设备防护的外接式防护设备，包括：
    HID对内接口，用于连接被保护设备的HID输入接口；
    HID对外接口，用于连接外接设备；
    转发控制模块，分别连接所述HID对内接口与HID对外接口；以及
    协议分析模块，用于对连接至所述HID对外接口的外接设备进行协议分析以判断该外接设备是否是合法的HID键鼠设备；
    其中，所述转发控制模块根据协议分析模块提供的判断结果来控制所述HID对内接口与HID对外接口的连通或断开，以防止非法的HID键鼠设备连通所述被保护设备。
  2.  如权利要求1所述的用于HID键鼠设备防护的外接式防护设备，其中，所述根据协议分析模块提供的判断结果来控制所述HID对内接口与HID对外接口的连通或断开包括：
    当所述外接设备经协议分析后判断为非法HID键鼠设备或非HID键鼠设备时，控制所述HID对内接口与HID对外接口断开；
    当所述外接设备经协议分析后判断为合法的HID键鼠设备时，控制所述HID对内接口与HID对外接口连通。
  3.  如权利要求1所述的用于HID键鼠设备防护的外接式防护设备，其中，
    当所述外部设备为HID键盘时，所述协议分析模块还用于对该HID键盘的输入数据进行监控和记录；
    当所述输入数据包含预定黑名单中的数据时，所述协议分析模块指示转发控制模块控制所述HID对内接口与HID对外接口断开。
  4.  如权利要求1至3中任一项所述的用于HID键鼠设备防护的外接式防护设备，还包括：
    视频对内接口，用于连接被保护设备的视频输出接口；
    视频对外接口，用于连接视频设备；
    录屏模块，连接所述视频对内接口，用于记录所述被保护设备输出的视频数据。
  5.  如权利要求4所述的用于HID键鼠设备防护的外接式防护设备，其中，
    所述录屏模块连接至所述协议分析模块，并接收所述协议分析模块的控制；
    当所述协议分析模块判断所述外接设备执行了特定操作时，控制所述录屏模块进行视频数据的记录操作。
  6.  如权利要求4所述的用于HID键鼠设备防护的外接式防护设备，还包括：
    图像处理模模块，分别连接所述录屏模块和协议分析模块，用于从所述录屏模块获取实时的视频数据并对该视频数据进行实时分析，并且，当分析结果表示视频数据存在异常时，通知所述协议分析模块，以便所述协议分析模块控制所述HID对内接口与HID对外接口断开。
  7.  如权利要求6所述的用于HID键鼠设备防护的外接式防护设备，其中，所述实时分析包括：
    对所述视频数据进行帧图像的提取，并对的取得的帧图像进行识别，当所述识别结果包含预定黑名单操作时，产生表示视频数据存在异常的分析结果。
  8.  如权利要求6所述的用于HID键鼠设备防护的外接式防护设备，其中，所述实时分析包括：
    对所述视频数据进行帧图像的提取，并计算帧图像的图像特征并与预定图像的图像特征进行比较，当所述帧图像的图像特征与预定图像的图像特征的相似度高于阈值时，产生表示视频数据存在异常的分析结果。
  9.  一种用于HID键鼠设备防护的设备防护方法，包括以下步骤：
    提供外接式防护设备以接管被保护设备的HID输入接口；
    对连接至所述外接式防护设备的外部设备进行协议分析以判断该外接设备是否是合法的HID键鼠设备；
    根据判断的结果来控制所述外部设备与被保护设备的连通或断开，以防止非法的HID键鼠设备连通所述被保护设备。
  10.  如权利要求9所述的用于HID键鼠设备防护的设备防护方法，其中，所述根据判断的结果来控制所述外部设备与被保护设备的连通或断开包括：
    当所述外接设备经协议分析后判断为非法HID键鼠设备或非HID键鼠设备时，控制外部设备与被保护设备断开；
    当所述外接设备经协议分析后判断为合法的HID键鼠设备时，控制外部设备与被保护设备连通。
  11.  如权利要求9所述的用于HID键鼠设备防护的设备防护方法，其中，当所述外部设备为HID键盘时，所述方法还包括：
    对该HID键盘的输入数据进行监控和记录；
    当所述输入数据包含预定黑名单中的数据时，控制所述外部设备与被保护设备断开。
  12.  如权利要求9所述的用于HID键鼠设备防护的设备防护方法，还包括：
    实时监测外部设备与被保护设备之间的数据传输，当监测到USB IN事务存在风险时，或者USB OUT事务的数据存在时，中断被保护设备到外部设备的数据传输。
PCT/CN2023/075623 2022-03-11 2023-02-13 一种用于hid键鼠设备防护的外接式防护设备和方法 WO2023169148A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210244367.2A CN114595178A (zh) 2022-03-11 2022-03-11 一种用于hid键鼠设备防护的外接式防护设备和方法
CN202210244367.2 2022-03-11

Publications (1)

Publication Number Publication Date
WO2023169148A1 true WO2023169148A1 (zh) 2023-09-14

Family

ID=81808790

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/075623 WO2023169148A1 (zh) 2022-03-11 2023-02-13 一种用于hid键鼠设备防护的外接式防护设备和方法

Country Status (2)

Country Link
CN (1) CN114595178A (zh)
WO (1) WO2023169148A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114595178A (zh) * 2022-03-11 2022-06-07 北京博衍思创信息科技有限公司 一种用于hid键鼠设备防护的外接式防护设备和方法
CN115203686A (zh) * 2022-07-11 2022-10-18 北京博衍思创信息科技有限公司 基于接口检测的外接式防护设备和方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105528562A (zh) * 2014-10-22 2016-04-27 北京中电瑞铠科技有限公司 一种ps/2鼠标、键盘操作审计及控制方法与装置
US20180096150A1 (en) * 2015-12-02 2018-04-05 Institute for Development and Researchin Banking Technology System and method for detection and prevention of data breach and ransomware attacks
CN111783177A (zh) * 2020-07-15 2020-10-16 山东云天安全技术有限公司 一种对usb端口进行安全防护和管理的装置及方法
CN114139226A (zh) * 2021-11-30 2022-03-04 北京博衍思创信息科技有限公司 Usb设备接入控制方法、装置及电子设备
CN114595178A (zh) * 2022-03-11 2022-06-07 北京博衍思创信息科技有限公司 一种用于hid键鼠设备防护的外接式防护设备和方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105528562A (zh) * 2014-10-22 2016-04-27 北京中电瑞铠科技有限公司 一种ps/2鼠标、键盘操作审计及控制方法与装置
US20180096150A1 (en) * 2015-12-02 2018-04-05 Institute for Development and Researchin Banking Technology System and method for detection and prevention of data breach and ransomware attacks
CN111783177A (zh) * 2020-07-15 2020-10-16 山东云天安全技术有限公司 一种对usb端口进行安全防护和管理的装置及方法
CN114139226A (zh) * 2021-11-30 2022-03-04 北京博衍思创信息科技有限公司 Usb设备接入控制方法、装置及电子设备
CN114595178A (zh) * 2022-03-11 2022-06-07 北京博衍思创信息科技有限公司 一种用于hid键鼠设备防护的外接式防护设备和方法

Also Published As

Publication number Publication date
CN114595178A (zh) 2022-06-07

Similar Documents

Publication Publication Date Title
WO2023169148A1 (zh) 一种用于hid键鼠设备防护的外接式防护设备和方法
JP7029000B2 (ja) 外付け端末保護デバイス及び保護システム
US8255930B2 (en) Method and system for dynamically switching between different device configurations
CN101751524B (zh) 一种计算机外接设备管理装置、方法及计算机
CN108681677B (zh) 基于usb接口安全隔离双网计算机的方法、装置及系统
WO2020087783A1 (zh) 一种基于硬件控制逻辑的数据转发控制方法及系统
EP4443307A1 (en) Communication control method and apparatus for usb device and protected device, and electronic device
WO2024012135A1 (zh) 基于接口检测的外接式防护设备和方法
EP4443323A1 (en) Access control method and apparatus for usb device, and electronic device
CN111597520B (zh) 一种计算机usb接口信息安全防控方法及系统
CN106446654A (zh) 基于指纹识别的计算机输入输出设备隔离方法
JP2009517732A (ja) Ｕｓｂキーボードによる入力データの保安方法及び保安システム
US8250263B2 (en) Apparatus and method for securing data of USB devices
EP3719688A1 (en) Operation authentication relay device, method, and program
US20040230701A1 (en) Information processing device
CN106682512B (zh) 一种防止程序被修改的方法及其装置、系统
CN111898167A (zh) 包括身份信息验证的外接式终端防护设备及防护系统
CN107944268A (zh) 一种针对hid键盘攻击的主机安全防护方法
EP4443268A1 (en) Power failure monitoring apparatus and method, and external protection device
CN1243312C (zh) 嵌入式安全模块
CN111885179B (zh) 一种基于文件监测服务的外接式终端防护设备及防护系统
CN111859344A (zh) 包括人脸信息验证的外接式终端防护设备及防护系统
KR100537930B1 (ko) 유에스비 키보드를 통한 입력데이터의 보안방법과 이를구현하는 보안시스템
CN111859434A (zh) 一种提供保密文件传输的外接式终端防护设备及防护系统
CN112115524A (zh) 内嵌式控制器、电子设备及spi命令过滤方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23765726

Country of ref document: EP

Kind code of ref document: A1