CN112287415B - USB storage device access control method, system, medium, device and application - Google Patents

Abstract

The invention belongs to the technical field of removable storage devices, and discloses a USB storage device access control method, system, medium, device and application, including: a registration machine, used for negotiating modes with users, formulating encryption methods, key management, pairing A general-purpose computer that encrypts the boot area of a USB storage device and optionally encrypts the data area of a USB storage device; a confidential machine that can decrypt and read an encrypted USB storage device, but cannot read the data of an ordinary non-encrypted USB storage device A general-purpose computer; an analysis machine, a general-purpose computer that can not only decrypt and read encrypted USB storage devices, but also read ordinary USB storage devices. The invention can effectively ensure that the USB storage device can only be used within a limited range, enhances the security of the USB storage device and its data, is simple to deploy and maintain, supports multiple operating system platforms, and is suitable for use scenarios of individuals and organizations of different scales.

Description

USB storage device access control method, system, medium, device and application

technical field

The invention belongs to the technical field of removable storage devices, and in particular relates to a USB storage device access control method, system, medium, device and application.

Background technique

At present, as a removable storage device, the USB storage device includes a U disk, a mobile hard disk, an SD card, etc., and is widely used by the public because of its convenience and quickness. Because USB storage devices are easy to cause information loss, its access control strategy has attracted more and more attention. According to the characteristics and functions of the USB storage device, the data on it can be roughly divided into: boot area, file information area, and data area. The boot area stores the relevant information of the USB storage device itself and the boot program. The file information area records the size and location information of each partition of the USB storage device, and reflects the use of each area on the USB storage device. The data area stores the data that the user needs to store. After the USB storage device is inserted into the hardware interface, the hardware circuit of the USB storage device is triggered. Then, a certain process of the operating system will call the API of the file system, and then notify the I/O manager to generate an IRP (I/O Request Package). The IRP is first sent to the disk driver, and then sent to the USB device driver and bus driver.

Aiming at the potential safety hazards of existing USB storage devices, many units, enterprises, merchants, etc. have also implemented their own USB storage device access control schemes. In many party and government departments, the confidentiality control of USB storage devices is only limited to the policy formulation of one person, one responsibility, and there are great security risks. The current access control methods for USB storage devices on the market include authentication based on user name and password, digital certificate authentication based on PKI, encryption of the data area of USB storage devices, and establishment of USB storage devices by filtering system signals. The access control center of the equipment, etc., all have some problems such as insufficient security, high cost, and complicated maintenance.

It can be seen that the problems and defects in the existing USB storage device security technology are:

(1) The security level of the existing technology is low: the identity verification based on the user name and password is easy to be cracked; and the establishment of an access control center also provides the possibility for hackers to intercept data.

(2) The cost of the existing technology is high: the identity authentication based on PKI or smart card requires special equipment, resulting in high cost.

(3) Complex maintenance and deployment of existing technologies: The above methods and strategies require technicians to perform complex operations such as equipment distribution and maintenance of centralized management platforms.

(4) Poor compatibility of existing technologies: generally, existing technologies can only support fewer operating systems.

The difficulty of solving the above problems and defects is as follows: the above problems and defects have brought great inconvenience and potential safety hazards to organizations and individuals. In order to solve the security problems of the existing technology, it is necessary to use the principles of cryptography to design a security encryption algorithm for USB storage devices; it is necessary to combine the operating system to rewrite the USB driver; it needs to be compatible with all major platforms, and it is convenient, fast and safe at the driver level.

The significance of solving the above problems and defects is: the present invention designs and implements a USB storage device access control method, system, medium, device and application in order to improve the hidden dangers of traditional access control. The present invention modifies the driver of the USB storage device, designs the software of the formatted USB storage device capable of encryption and decryption, can guarantee data security, realizes the access control of the USB storage device, avoids the risk of network hacker attack, and guarantees other USB devices Under the premise of normal use, the security of the production environment is greatly improved. The present invention can be deployed on existing equipment, reducing costs for users. Moreover, the present invention is simple to deploy and maintain, and is compatible with multiple platforms.

Contents of the invention

Aiming at the problems existing in the prior art, the present invention provides a USB storage device access control method, system, medium, device and application.

The present invention is achieved in this way, a USB storage device access control system, the USB storage device access control system includes:

Keygen, a general-purpose computer for negotiating modes with users, formulating encryption methods, key management, encrypting the boot area of the USB storage device, and optionally encrypting the data area of the USB storage device;

Secret-related machine, a general-purpose computer that can decrypt and read encrypted USB storage devices, but cannot read ordinary USB storage devices;

The analysis machine is a general-purpose computer that can not only decrypt and read encrypted USB storage devices, but also read ordinary USB storage devices.

Further, the registration machine includes:

A variety of methods and algorithms for encrypting the data area of the USB storage device, a management unit for managing and recording the encryption algorithm and encrypting the information of the USB storage device;

An encryption algorithm negotiation unit for interacting with users and negotiating whether to encrypt data area information and adopt optional algorithms;

a key management unit for storing keys for managing user-selected algorithms;

The encryption unit is used for encrypting the boot area of the USB storage device and encrypting the data area of the USB storage device.

Further, the confidential machine includes:

A decryption unit for decrypting the file boot area inserted into the USB storage device and decrypting the encrypted data area file information through the modified computer USB driver;

An encryption unit for re-encrypting an encrypted USB storage device whose information has been changed.

Further, the analysis machine includes:

A modified computer USB driver, a decryption unit used for decrypting unrecognizable USB storage devices;

A reading unit that can read both encrypted USB storage devices and ordinary USB storage devices;

An encryption unit for re-encrypting an encrypted USB storage device whose information has been changed.

Another object of the present invention is to provide a USB storage device access control method running the USB storage device access control system, the USB storage device access control method comprising:

Step 1, the user chooses not to encrypt the data area of the USB storage device;

Step 2, the ordinary USB storage device becomes an encrypted USB storage device through the registration machine, and the registration machine encrypts the boot area of the USB storage device, and the encrypted USB storage device cannot be recognized by an ordinary computer because the boot area becomes ciphertext;

Step 3: The secret-involved machine can identify the encrypted USB storage device, but not the ordinary USB storage device; after the secret-involved machine detects the USB storage device, it decrypts the boot area of the file, and the decrypted file system boot area of the encrypted USB storage device is For normal information, the secret machine reads the USB storage device; while the file system boot area of the ordinary USB storage device is decrypted and becomes ciphertext, which cannot be recognized by the secret machine;

Step 4, the analysis machine can identify the encrypted USB storage device and the common USB storage device; the analysis machine decrypts the file system boot area of the encrypted USB storage device, so that the USB storage device can be read normally;

Step 5: After the analyzer finishes reading and writing the encrypted USB storage device, it encrypts its boot area. The process is shown in Step 2.

Further, the USB storage device access control method includes:

Step 1, the user chooses to encrypt the data area of the USB storage device, selects an appropriate method of encrypting the data area of the USB storage device according to the options provided by the registration machine, and obtains the key for encrypting the data area;

Step 2, the registration machine securely stores the key of the encryption method determined by the user in the boot area of the USB storage device, and then uses this key to encrypt the contents of the data area of the USB storage device;

Step 3, the registration machine encrypts the boot area containing the key in the USB storage device;

Step 4, after rewriting the driver program of the USB storage device of the confidential machine, when the insertion of the USB storage device is detected, the boot area of the USB storage device is decrypted;

Step 5: After decrypting the boot area of the USB storage device, the confidential machine extracts the written key, and decrypts the contents of the data area of the USB storage device; and when the inserted USB storage device is an ordinary USB storage device , the content of the decryption guide area is ciphertext, which cannot be recognized by the confidential machine;

Step 6: When the analysis machine is inserted into an ordinary USB storage device, it can be used normally; when an unrecognizable USB storage device is detected, the analysis machine will decrypt the boot area and data area of the encrypted USB storage device, so that the encrypted USB storage device becomes Ordinary USB storage device, realize reading and writing to encrypted USB storage device;

Step 7: After the analysis machine/confidential machine reads and writes the encrypted USB storage device, if the data of the USB device changes, it encrypts the data area according to the original key, and then encrypts the boot area. The process is shown in steps 2 and 3.

Another object of the present invention is to provide a computer device, the computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the following step:

Step 1, the user selects an encryption mode for the USB storage device;

Step 2: The ordinary USB storage device becomes an encrypted USB storage device through the registration machine, and the registration machine encrypts the boot area of the USB storage device, and encrypts or does not encrypt the data area of the USB storage device according to the encryption mode selected by the user. The USB storage device cannot be recognized by ordinary computers because the boot area becomes ciphertext;

Step 3: The secret-involved machine can identify the encrypted USB storage device, but not the ordinary USB storage device; when the secret-involved machine detects the USB storage device, it decrypts the boot area of the file, and encrypts the decrypted file system boot area of the USB storage device It is plaintext information, and the confidential machine reads the USB storage device, and if it is in full encryption mode, then decrypts the data area; while the file system boot area of the ordinary USB storage device is decrypted and becomes ciphertext, which cannot be classified. identified by the machine;

Step 4: The analysis machine can identify the encrypted USB storage device and the ordinary USB storage device; the analysis machine decrypts the file system boot area of the encrypted USB storage device, and if it is in full encryption mode, then decrypts the data area to make it an ordinary identifiable USB storage device, and then read normally;

Step 5: After the analysis machine/secret-related machine reads the encrypted USB storage device, if the data of the USB device changes, it encrypts its boot area again, and encrypts the data area again if it is in full encryption mode.

Another object of the present invention is to provide a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the processor performs the following steps:

Step 1, the user selects an encryption mode for the USB storage device;

Step 2: The ordinary USB storage device becomes an encrypted USB storage device through the registration machine, and the registration machine encrypts the boot area of the USB storage device, and encrypts or does not encrypt the data area of the USB storage device according to the encryption mode selected by the user. The USB storage device cannot be recognized by ordinary computers because the boot area becomes ciphertext;

Step 3: The secret-involved machine can identify the encrypted USB storage device, but not the ordinary USB storage device; when the secret-involved machine detects the USB storage device, it decrypts the boot area of the file, and encrypts the decrypted file system boot area of the USB storage device It is plaintext information, and the confidential machine reads the USB storage device, and if it is in full encryption mode, then decrypts the data area; while the file system boot area of the ordinary USB storage device is decrypted and becomes ciphertext, which cannot be classified. identified by the machine;

Step 4: The analysis machine can identify the encrypted USB storage device and the ordinary USB storage device; the analysis machine decrypts the file system boot area of the encrypted USB storage device, and if it is in full encryption mode, then decrypts the data area to make it an ordinary identifiable USB storage device, and then read normally;

Step 5: After the analysis machine/secret-related machine reads the encrypted USB storage device, if the data of the USB device changes, it encrypts its boot area again, and encrypts the data area again if it is in full encryption mode.

Another object of the present invention is to provide a USB flash drive installed with the USB storage device access control system.

Another object of the present invention is to provide a mobile hard disk installed with the USB storage device access control system.

In combination with all the above-mentioned technical solutions, the advantages and positive effects of the present invention are:

In order to improve the hidden dangers of traditional access control, the present invention designs and implements a set of USB storage device access control system and method. The present invention modifies the driver of the USB storage device, designs the software of the formatted USB storage device capable of encryption and decryption, can guarantee data security, realizes the access control of the USB storage device, avoids the risk of network hacker attack, and guarantees other USB devices Under the premise of normal use, the security of the production environment is greatly improved. The present invention can be deployed on existing equipment, reducing costs for users. Moreover, the present invention is simple to deploy and maintain, and is compatible with multiple platforms. The comparison between the present invention and other products is shown in Table 1.

Table 1 The present invention compares with other products

Note: t1: The time when the driver reads the USB storage device; t2: The time when the USB storage device is mounted; t3: The time when the software is loaded; t4: The time when the software is loaded into the storage device; t5: The time when the software is encrypted.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the accompanying drawings that need to be used in the embodiments of the present application. Obviously, the accompanying drawings described below are only some embodiments of the present application. Those of ordinary skill in the art can also obtain other drawings based on these drawings without any creative effort.

FIG. 1 is a flowchart of a method for controlling access to a USB storage device provided by an embodiment of the present invention.

2 is a schematic structural diagram of a USB storage device access control system provided by an embodiment of the present invention;

In Fig. 2: 1. Registration machine; 2. Confidentiality-related machine; 3. Analysis machine; the solid line indicates that it is accessible, and the dotted line indicates that it is not accessible.

Fig. 3 is an implementation diagram of a partial encryption mode registration machine provided by an embodiment of the present invention.

Fig. 4 is an implementation diagram of a partial encryption mode secret-related machine provided by an embodiment of the present invention.

Fig. 5 is an implementation diagram of a partial encryption mode analysis machine provided by an embodiment of the present invention.

Fig. 6 is an implementation diagram of the full encryption mode registration machine provided by the embodiment of the present invention.

Fig. 7 is an implementation diagram of a full-encryption mode secret-related machine provided by an embodiment of the present invention.

Fig. 8 is an implementation diagram of a fully encrypted mode analysis machine provided by an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention more clear, the present invention will be further described in detail below in conjunction with the examples. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

Aiming at the problems existing in the prior art, the present invention provides a USB storage device access control method, system, medium, equipment and application. The present invention will be described in detail below in conjunction with the accompanying drawings.

As shown in Figure 1, the USB storage device access control method provided by the present invention comprises the following steps:

S101: The user selects an encryption mode for the USB storage device.

S102: The ordinary USB storage device becomes an encrypted USB storage device through the registration machine. The registration machine encrypts the boot area of the USB storage device, encrypts or does not encrypt the data area of the USB storage device according to the encryption mode selected by the user, and encrypts the encrypted USB storage device. The USB storage device cannot be recognized by ordinary computers because the boot area becomes ciphertext.

S103: The secret-related machine can identify the encrypted USB storage device, but not the ordinary USB storage device; when the secret-related machine detects the USB storage device, it decrypts the boot area of the file, and the decrypted file system boot area of the encrypted USB storage device is For plaintext information, the confidential computer reads the USB storage device, and if it is in full encryption mode, then decrypts the data area; while the file system boot area of an ordinary USB storage device is decrypted and becomes ciphertext, which cannot be encrypted by the confidential computer. recognized.

S104: The analysis machine can identify encrypted USB storage devices and ordinary USB storage devices; the analysis machine decrypts the file system boot area of the encrypted USB storage device, and if it is in full encryption mode, then decrypts the data area to make it an ordinary identifiable USB storage device, followed by a normal read.

S105: After the analysis machine/secret-related machine finishes reading the encrypted USB storage device, if the data of the USB device is changed, then encrypt the boot area, and if it is in full encryption mode, then encrypt the data area.

Those of ordinary skill in the industry can implement the USB storage device access control method provided by the present invention by using other steps, and the USB storage device access control method provided by the present invention in FIG. 1 is only a specific embodiment.

As shown in Figure 2, the USB storage device access control system provided by the present invention includes:

The registration machine is a general-purpose computer used for negotiating modes with users, formulating encryption methods, key management, encrypting the boot area of the USB storage device, and optionally encrypting the data area of the USB storage device.

Secret-related machine, a general-purpose computer that can decrypt and read encrypted USB storage devices, but cannot read ordinary USB storage devices.

The analysis machine is a general-purpose computer that can not only decrypt and read encrypted USB storage devices, but also read ordinary USB storage devices.

The technical scheme of the present invention will be further described below in conjunction with the accompanying drawings.

As shown in Figure 2 (taking U disk as an example), the USB storage device access control system based on encryption provided by the implementation of the present invention includes:

Registration machine 1: a general-purpose computer device equipped with a USB interface. It can negotiate the mode with the user through software, formulate the encryption method, key management, encrypt the boot area of the USB storage device, and optionally encrypt the data area of the USB storage device;

Secret-related machine 2: a general-purpose computer device equipped with a USB interface. It can read encrypted USB storage devices after decryption, but not ordinary USB storage devices;

Analysis machine 3: a general-purpose computer device equipped with a USB interface. It can not only decrypt and read encrypted USB storage devices, but also read ordinary USB storage devices.

The registration machine 1 includes a variety of methods and algorithms for encrypting the data area of the USB storage device, a management unit for managing and recording the encryption algorithm and encrypting the information of the USB storage device, and for negotiating with the user whether to encrypt the data area information and adopt the available An encryption algorithm negotiating unit for selecting an algorithm, a key management unit for storing and managing a key of an algorithm selected by a user, and an encryption unit for encrypting the boot area of the USB storage device and encrypting the data area of the USB storage device.

The confidential machine 2 decrypts the boot area of the USB storage device by modifying the computer USB driver, and decrypts the encrypted data area file information. However, the file system boot area of an ordinary USB storage device is decrypted and becomes ciphertext, which cannot be recognized by a confidential machine.

Analyzer 3 decrypts unrecognized USB storage devices by modifying the computer’s USB driver, and can re-encrypt the read and written USB storage devices. It can read both encrypted USB storage devices and ordinary USB storage devices. .

The registration machine and the analysis machine can be the same computer.

The present invention has two modes for the encryption-based USB access control system, a partial encryption mode and a full encryption mode, and the two modes will be further described below in conjunction with the accompanying drawings.

The steps for partial encryption mode are as follows:

Step 1, the user chooses not to encrypt the data area of the USB storage device;

Step 2, as shown in Figure 3, the ordinary USB storage device becomes an encrypted USB storage device through the registration machine, and the registration machine encrypts the boot area of the USB storage device, and the encrypted USB storage device cannot be encrypted because the boot area becomes ciphertext. Recognized by ordinary computers;

Step 3, as shown in Figure 4, the classified machine can identify the encrypted USB storage device, but not the ordinary USB storage device; after the classified machine detects the USB storage device, it decrypts the boot area of the file, and the encrypted USB storage device is decrypted The boot area of the file system of the file system is normal information, and the confidential machine reads the USB storage device; while the file system boot area of the ordinary USB storage device is decrypted and becomes ciphertext, which cannot be recognized by the confidential machine;

Step 4, as shown in Figure 5, the analysis machine can identify the encrypted USB storage device and the common USB storage device; the analysis machine decrypts the file system boot area of the encrypted USB storage device, so that the USB storage device can be read normally;

Step 5: After the confidentiality-related machine/analysis machine finishes reading and writing the encrypted USB storage device, if the data of the USB device changes, then encrypt its boot area again, as in step 2.

The steps of full encryption mode are as follows:

Step 1, the user chooses to encrypt the data area of the USB storage device, selects an appropriate method of encrypting the data area of the USB storage device according to the options provided by the registration machine, and obtains the key for encrypting the data area;

Step 2, as shown in Figure 6, the registration machine safely stores the key of the encryption method decided by the user in the boot area of the USB storage device, and then uses this key to encrypt the contents of the data area of the USB storage device;

Step 3, as shown in Figure 7, the registration machine encrypts the boot area containing the key in the USB storage device;

Step 4, as shown in Figure 7, after rewriting the USB storage device driver of the classified machine, when the USB storage device is detected to be inserted, the boot area of the USB storage device is decrypted;

Step 5, as shown in Figure 7, after decrypting the boot area of the USB storage device, the confidential machine extracts the written key, and decrypts the contents of the data area of the USB storage device; and when the USB storage device is inserted When it is an ordinary USB storage device, the content of the decrypted boot area is ciphertext, which cannot be recognized by the confidential machine;

Step 6, as shown in Figure 8, when the analysis machine is inserted into a common USB storage device, it can be used normally; when an unrecognizable USB storage device is detected, the analysis machine decrypts the boot area and data area of the encrypted USB storage device, so that The encrypted USB storage device becomes an ordinary USB storage device, and the encrypted USB storage device can be read and written;

Step 7: After the analysis machine/confidential machine reads and writes the encrypted USB storage device, if the data of the USB device changes, it encrypts the data area according to the original key, and then encrypts the boot area. The process is shown in steps 2 and 3.

The present invention also includes computer equipment, including a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the following steps:

Step 1, the user selects an encryption mode for the USB storage device;

Step 2: The ordinary USB storage device becomes an encrypted USB storage device through the registration machine, and the registration machine encrypts the boot area of the USB storage device, and encrypts or does not encrypt the data area of the USB storage device according to the encryption mode selected by the user. The USB storage device cannot be recognized by ordinary computers because the boot area becomes ciphertext;

Step 3: The secret-involved machine can identify the encrypted USB storage device, but not the ordinary USB storage device; when the secret-involved machine detects the USB storage device, it decrypts the boot area of the file, and encrypts the decrypted file system boot area of the USB storage device It is plaintext information, and the confidential machine reads the USB storage device, and if it is in full encryption mode, then decrypts the data area; while the file system boot area of the ordinary USB storage device is decrypted and becomes ciphertext, which cannot be classified. identified by the machine;

Step 4, the analysis machine can identify the encrypted USB storage device and the ordinary USB storage device; the analysis machine decrypts the file system boot area of the encrypted USB storage device, and if it is in full encryption mode, then decrypts the data area to make it an ordinary usable storage device. Identify the USB storage device, and then read it normally;

Step 5: After the analysis machine/secret-related machine reads the encrypted USB storage device, if the data of the USB device changes, it encrypts its boot area again, and encrypts the data area again if it is in full encryption mode.

The present invention also includes a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the processor is made to perform the following steps:

Step 1, the user selects an encryption mode for the USB storage device;

Step 2: The ordinary USB storage device becomes an encrypted USB storage device through the registration machine, and the registration machine encrypts the boot area of the USB storage device, and encrypts or does not encrypt the data area of the USB storage device according to the encryption mode selected by the user. The USB storage device cannot be recognized by ordinary computers because the boot area becomes ciphertext;

Step 3: The secret-involved machine can identify the encrypted USB storage device, but not the ordinary USB storage device; when the secret-involved machine detects the USB storage device, it decrypts the boot area of the file, and encrypts the decrypted file system boot area of the USB storage device It is plaintext information, and the confidential machine reads the USB storage device, and if it is in full encryption mode, then decrypts the data area; while the file system boot area of the ordinary USB storage device is decrypted and becomes ciphertext, which cannot be classified. identified by the machine;

Step 4, the analysis machine can identify the encrypted USB storage device and the ordinary USB storage device; the analysis machine decrypts the file system boot area of the encrypted USB storage device, and if it is in full encryption mode, then decrypts the data area to make it an ordinary usable storage device. Identify the USB storage device, and then read it normally;

Step 5: After the analysis machine/secret-related machine reads the encrypted USB storage device, if the data of the USB device changes, it encrypts its boot area again, and encrypts the data area again if it is in full encryption mode.

The proof part, the comparison between the present invention and other products is shown in Table 2.

Table 2 The present invention compares with other products

Note: t1: The time when the driver reads the USB storage device; t2: The time when the USB storage device is mounted; t3: The time when the software is loaded; t4: The time when the software is loaded into the storage device; t5: The time when the software is encrypted.

It should be noted that the embodiments of the present invention can be realized by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in memory and executed by a suitable instruction execution system such as a microprocessor or specially designed hardware. Those of ordinary skill in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and/or contained in processor control code, for example, on a carrier medium such as a magnetic disk, CD or DVD-ROM, such as a read-only memory Such code is provided on a programmable memory (firmware) or on a data carrier such as an optical or electronic signal carrier. The device and its modules of the present invention may be implemented by hardware circuits such as VLSI or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., It can also be realized by software executed by various types of processors, or by a combination of the above hardware circuits and software such as firmware.

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone familiar with the technical field within the technical scope disclosed in the present invention, whoever is within the spirit and principles of the present invention Any modifications, equivalent replacements and improvements made within shall fall within the protection scope of the present invention.

Claims (10)

1. A USB storage device access control system, characterized in that, the USB storage device access control system comprises: Keygen, a general-purpose computer for negotiating modes with users, formulating encryption methods, key management, encrypting the boot area of the USB storage device, and optionally encrypting the data area of the USB storage device; Secret-related machine, which can decrypt and read encrypted USB storage devices, but not general-purpose computers that can read ordinary USB storage devices; secret-related machines can identify encrypted USB storage devices, but cannot recognize ordinary USB storage devices; after secret-related machines detect USB storage devices , to decrypt the boot area of the file, the file system boot area of the encrypted USB storage device after decryption is normal information, and the secret machine reads the USB storage device; while the file system boot area of the ordinary USB storage device is decrypted and becomes The ciphertext is not recognized by the confidential machine; Analytical machine, a general-purpose computer that can not only decrypt and read encrypted USB storage devices, but also read ordinary USB storage devices; the analytical machine can identify encrypted USB storage devices and ordinary USB storage devices, and the analytical machine can read the file system boot area of encrypted USB storage devices Decrypt and rewrite it to make it an ordinary recognizable USB storage device, and then read it normally. 2. USB storage device access control system as claimed in claim 1, is characterized in that, described registration machine comprises: A variety of methods and algorithms for encrypting the data area of the USB storage device, a management unit for managing and recording the encryption algorithm and encrypting the information of the USB storage device; An encryption algorithm negotiation unit for interacting with users and negotiating whether to encrypt data area information and adopt optional algorithms; a key management unit for storing keys for managing user-selected algorithms; The encryption unit is used for encrypting the boot area of the USB storage device and encrypting the data area of the USB storage device. 3. USB storage device access control system as claimed in claim 1, is characterized in that, described confidential machine comprises: A decryption unit for decrypting the file boot area inserted into the USB storage device and decrypting the encrypted data area file information through the modified computer USB driver; An encryption unit for re-encrypting an encrypted USB storage device whose information has been changed. 4. USB storage device access control system as claimed in claim 1, is characterized in that, described analyzer comprises: A decryption unit for decrypting an unrecognizable USB storage device through a modified computer USB driver; A reading unit capable of reading both an encrypted USB storage device and an ordinary USB storage device; an encryption unit used to re-encrypt an encrypted USB storage device whose information has been changed. 5. A USB storage device access control method for operating the USB storage device access control system described in any one of claims 1 to 4, wherein the USB storage device access control method comprises: Step 1, the user chooses not to encrypt the data area of the USB storage device; Step 2, the ordinary USB storage device becomes an encrypted USB storage device through the registration machine, and the registration machine encrypts the boot area of the USB storage device, and the encrypted USB storage device cannot be recognized by an ordinary computer because the boot area becomes ciphertext; Step 3: The secret-involved machine can identify the encrypted USB storage device, but not the ordinary USB storage device; after the secret-involved machine detects the USB storage device, it decrypts the boot area of the file, and the decrypted file system boot area of the encrypted USB storage device is For normal information, the secret machine reads the USB storage device; while the file system boot area of the ordinary USB storage device is decrypted and becomes ciphertext, which cannot be recognized by the secret machine; Step 4, the analysis machine can identify the encrypted USB storage device and the common USB storage device; the analysis machine decrypts the file system boot area of the encrypted USB storage device, so that the USB storage device can be read normally; Step 5: After the analysis machine/confidential machine reads and writes to the encrypted USB storage device, if the data of the USB device changes, it encrypts its boot area again. The process is shown in step 2. 6. the USB storage device access control method as claimed in claim 5, is characterized in that, described USB storage device access control method comprises: Step 1, the user chooses to encrypt the data area of the USB storage device, selects an appropriate method of encrypting the data area of the USB storage device according to the options provided by the registration machine, and obtains the key for encrypting the data area; Step 2, the registration machine securely stores the key of the encryption method determined by the user in the boot area of the USB storage device, and then uses this key to encrypt the contents of the data area of the USB storage device; Step 3, the registration machine encrypts the boot area containing the key in the USB storage device; Step 4, after rewriting the driver program of the USB storage device of the confidential machine, when the insertion of the USB storage device is detected, the boot area of the USB storage device is decrypted; Step 5: After decrypting the boot area of the USB storage device, the confidential machine extracts the written key, and decrypts the contents of the data area of the USB storage device; and when the inserted USB storage device is an ordinary USB storage device , the content of the decryption guide area is ciphertext, which cannot be recognized by the confidential machine; Step 6: When the analysis machine is inserted into an ordinary USB storage device, it can be used normally; when an unrecognizable USB storage device is detected, the analysis machine will decrypt the boot area and data area of the encrypted USB storage device, so that the encrypted USB storage device becomes Ordinary USB storage device, realize reading and writing to encrypted USB storage device; Step 7: After the analysis machine/confidential machine reads and writes the encrypted USB storage device, if the data of the USB device changes, it encrypts the data area according to the original key, and then encrypts the boot area. The process is shown in steps 2 and 3. 7. A computer device, characterized in that the computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor is made to perform the following steps: Step 1, the user selects an encryption mode for the USB storage device; Step 2: The ordinary USB storage device becomes an encrypted USB storage device through the registration machine, and the registration machine encrypts the boot area of the USB storage device, and encrypts or does not encrypt the data area of the USB storage device according to the encryption mode selected by the user. The USB storage device cannot be recognized by ordinary computers because the boot area becomes ciphertext; Step 3: The secret-involved machine can identify the encrypted USB storage device, but not the ordinary USB storage device; when the secret-involved machine detects the USB storage device, it decrypts the boot area of the file, and encrypts the decrypted file system boot area of the USB storage device It is plaintext information, and the confidential machine reads the USB storage device, and if it is in full encryption mode, then decrypts the data area; while the file system boot area of the ordinary USB storage device is decrypted and becomes ciphertext, which cannot be classified. identified by the machine; Step 4: The analysis machine can identify the encrypted USB storage device and the ordinary USB storage device; the analysis machine decrypts the file system boot area of the encrypted USB storage device, and if it is in full encryption mode, then decrypts the data area to make it an ordinary identifiable USB storage device, and then read normally; Step 5: After the analysis machine/secret-related machine reads the encrypted USB storage device, if the data of the USB device changes, it encrypts its boot area again, and encrypts the data area again if it is in full encryption mode. 8. A computer-readable storage medium, storing a computer program, when the computer program is executed by a processor, the processor is made to perform the following steps: Step 1, the user selects an encryption mode for the USB storage device; Step 2: The ordinary USB storage device becomes an encrypted USB storage device through the registration machine, and the registration machine encrypts the boot area of the USB storage device, and encrypts or does not encrypt the data area of the USB storage device according to the encryption mode selected by the user. The USB storage device cannot be recognized by ordinary computers because the boot area becomes ciphertext; Step 3: The secret-involved machine can identify the encrypted USB storage device, but not the ordinary USB storage device; when the secret-involved machine detects the USB storage device, it decrypts the boot area of the file, and encrypts the decrypted file system boot area of the USB storage device It is plaintext information, and the confidential machine reads the USB storage device, and if it is in full encryption mode, then decrypts the data area; while the file system boot area of the ordinary USB storage device is decrypted and becomes ciphertext, which cannot be classified. identified by the machine; Step 4: The analysis machine can identify the encrypted USB storage device and the ordinary USB storage device; the analysis machine decrypts the file system boot area of the encrypted USB storage device, and if it is in full encryption mode, then decrypts the data area to make it an ordinary identifiable USB storage device, and then read normally; Step 5: After the analysis machine/secret-related machine reads the encrypted USB storage device, if the data of the USB device changes, it encrypts its boot area again, and encrypts the data area again if it is in full encryption mode. 9. A USB flash drive, characterized in that the USB storage device access control system according to any one of claims 1 to 4 is installed on the USB flash drive. 10. A mobile hard disk, characterized in that, the mobile hard disk is equipped with the USB storage device access control system according to any one of claims 1 to 4.

Images