CN112363968A - Improved communication method of USB interface - Google Patents
Improved communication method of USB interface Download PDFInfo
- Publication number
- CN112363968A CN112363968A CN202011178880.3A CN202011178880A CN112363968A CN 112363968 A CN112363968 A CN 112363968A CN 202011178880 A CN202011178880 A CN 202011178880A CN 112363968 A CN112363968 A CN 112363968A
- Authority
- CN
- China
- Prior art keywords
- upper computer
- computer
- usb
- lower computer
- data line
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
- G06F13/38—Information transfer, e.g. on bus
- G06F13/42—Bus transfer protocol, e.g. handshake; Synchronisation
- G06F13/4282—Bus transfer protocol, e.g. handshake; Synchronisation on a serial bus, e.g. I2C bus, SPI bus
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Small-Scale Networks (AREA)
Abstract
An improved USB interface communication method is characterized by comprising the following steps of manufacturing an improved USB data line, specifically using a 9-pin data line for USB signal transmission to form a special interface line, namely setting 4 pins in the 9-pin data line as 4 pins of a standard USB interface, and keeping the other 5 pins in the data line to be only grounded and not used for signal and power transmission; the method is simple and convenient to use, meets the requirement of comprehensively guaranteeing the communication safety of the integrated equipment management machine (the upper computer) and the intelligent terminal (the lower computer), and achieves the communication guarantee. The requirement of confidentiality of communication is met.
Description
Technical Field
The invention relates to an improved communication method of a USB interface, which is used for equipping a virtual network for comprehensively ensuring the communication between an integrated management machine and an intelligent terminal and ensuring the confidentiality of the communication.
Background
According to the field maintenance support of certain equipment, an equipment comprehensive support management intelligent mobile terminal (intelligent terminal for short) is used as a data carrier, outfield operation data are collected through the intelligent terminal, and the data are transmitted to an equipment support integrated machine (integrated machine for short) through a USB cable. The common USB cable is convenient to transmit data, but the safety does not meet the requirements of special occasions, and the intelligent terminal and the equipment guarantee all-in-one machine (the upper computer) lack identity detection and authentication processes, so that the potential safety hazard of a server caused by the fact that an illegal terminal is connected into the upper computer cannot be avoided.
Based on the idea of realizing a TCP/IP protocol by a USB, according to RNIDS (Remote Network Driver Interface Specification) and under the specific application scene that a Network cannot be used, the invention forms a safe USB-based intelligent terminal and upper computer communication method by comprehensively modifying a Linux kernel Driver, an Android Driver and an SSL (Secure Sockets Layer) authentication program.
Disclosure of Invention
The invention aims to provide an improved communication method of a USB interface so as to ensure the communication safety of an equipment comprehensive guarantee management all-in-one machine server and an intelligent terminal.
An improved communication method of USB interface is characterized by that it includes the following steps,
step one, manufacturing an improved USB data line, specifically, using a 9-pin data line for USB signal transmission to form a special interface line, namely setting 4 pins in the 9-pin data line as 4 pins of a standard USB interface, and reserving the rest 5 pins in the data line for only grounding and not transmitting signals and power;
step two, making an upper computer PC and an external interface of the information to be transmitted and an interface of the lower computer intelligent terminal into an interface corresponding to the improved USB data line, and corresponding to 4 pins set in 9 pins of the improved USB data line one by one;
step three, physically connecting the PC of the upper computer with an external interface and an interface of the intelligent terminal of the lower computer by using an improved USB data line;
step four, after the upper computer PC and the lower computer are connected through the improved USB data line, the USB drive of the upper computer automatically executes judgment and operation on the lower computer, the upper computer PC verifies the identity information of the lower computer through an SSL certificate verification program on a Linux operating system and a customized USB-RNDIS drive terminal identity verification daemon, and meanwhile, the lower computer customizes a USB-RNDIS drive on an AOSP operating system and verifies the upper computer with the SSL certificate; the upper computer and the lower computer pass the verification, and bidirectional data transmission can be carried out.
The specific identity verification method process is as follows:
the identity verification adopts a bidirectional asymmetric encryption algorithm, the lower computer stores the public key of the upper computer and the CPUID, and the upper computer stores the public key of the lower computer and the CPUID; a checking step:
the first step is as follows: the lower computer sends an identity verification request to the server, and the upper computer responds to the CPUID random string encrypted by the private key of the upper computer;
the second step is that: the lower computer decrypts the received random string by the public key of the upper computer, checks the random string with a CPUID list of the upper computer stored locally, encrypts the CPUID information of the lower computer by the private key of the lower computer and sends the information to the upper computer; if the verification fails, the communication is terminated;
the third step: the upper computer decrypts the received random string by using the public key of the lower computer and verifies the random string with the CPUID list of the lower computer stored locally, and the two conditions are generally adopted, namely, a communication link is established after the verification is passed; if the verification fails, the communication is terminated;
step five, if the verification fails, the communication is terminated; if the verification is passed, the next step is carried out;
and step six, checking and communicating the USB cable to a lower computer of the upper computer, and specifically comprising the following steps:
the first step is as follows: the upper computer automatically negotiates RNDIS virtual networking with the lower computer through a USB;
the third step: monitoring the establishment of a virtual network by an upper computer automatic script;
the third step: the upper computer sets a local virtual network address parameter;
the fourth step: the upper computer service starts virtual network monitoring;
the fifth step: the lower computer starts a client APP;
and a sixth step: and data transmission is carried out between the lower computers of the upper computer.
The method is simple and convenient to use, meets the requirement of comprehensively guaranteeing the communication safety of the integrated equipment management machine (the upper computer) and the intelligent terminal (the lower computer), and achieves the communication guarantee. The requirement of confidentiality of communication is met.
Drawings
FIG. 1, a comparison of an improved USB interface on the left with an existing USB interface on the right;
fig. 2 is a schematic diagram of a link relationship between a single upper computer and a single lower computer;
FIG. 3 is a schematic diagram of a plurality of lower computers connected with an upper computer;
FIG. 4 is a schematic diagram of improved USB connection device communication.
Detailed Description
An improved communication method of USB interface is characterized by that it includes the following steps,
step one, manufacturing an improved USB data line, specifically, using a 9-pin data line for USB signal transmission to form a special interface line, namely setting 4 pins in the 9-pin data line as 4 pins of a standard USB interface, and reserving the rest 5 pins in the data line for only grounding and not transmitting signals and power;
step two, making an upper computer PC and an external interface of the information to be transmitted and an interface of the lower computer intelligent terminal into an interface corresponding to the improved USB data line, and corresponding to 4 pins set in 9 pins of the improved USB data line one by one;
step three, physically connecting the PC of the upper computer with an external interface and an interface of the intelligent terminal of the lower computer by using an improved USB data line;
step four, after the upper computer PC and the lower computer are connected through the improved USB data line, the USB drive of the upper computer automatically executes judgment and operation on the lower computer, the upper computer PC verifies the identity information of the lower computer through an SSL certificate verification program on a Linux operating system and a customized USB-RNDIS drive terminal identity verification daemon, and meanwhile, the lower computer customizes a USB-RNDIS drive on an AOSP operating system and verifies the upper computer with the SSL certificate; the upper computer and the lower computer pass the verification, and bidirectional data transmission can be carried out.
The specific identity verification method process is as follows:
the identity verification adopts a bidirectional asymmetric encryption algorithm, the lower computer stores the public key of the upper computer and the CPUID, and the upper computer stores the public key of the lower computer and the CPUID; a checking step:
the first step is as follows: the lower computer sends an identity verification request to the server, and the upper computer responds to the CPUID random string encrypted by the private key of the upper computer;
the second step is that: the lower computer decrypts the received random string by the public key of the upper computer, checks the random string with a CPUID list of the upper computer stored locally, encrypts the CPUID information of the lower computer by the private key of the lower computer and sends the information to the upper computer; if the verification fails, the communication is terminated;
the third step: the upper computer decrypts the received random string by using the public key of the lower computer and verifies the random string with the CPUID list of the lower computer stored locally, and the two conditions are generally adopted, namely, a communication link is established after the verification is passed; if the verification fails, the communication is terminated;
step five, if the verification fails, the communication is terminated; if the verification is passed, the next step is carried out;
and step six, checking and communicating the USB cable to a lower computer of the upper computer, and specifically comprising the following steps:
the first step is as follows: the upper computer automatically negotiates RNDIS virtual networking with the lower computer through a USB;
the third step: monitoring the establishment of a virtual network by an upper computer automatic script;
the third step: the upper computer sets a local virtual network address parameter;
the fourth step: the upper computer service starts virtual network monitoring;
the fifth step: the lower computer starts a client APP;
and a sixth step: and data transmission is carried out between the lower computers of the upper computer.
The integrated equipment comprehensive guarantee management all-in-one machine has the capability of expanding managed equipment models and other guarantee task data, and equipment guarantee data management software has the characteristic of three-person management and meets the requirements of confidentiality and safety.
The intelligent terminal is a reinforced mobile terminal which removes Wi-Fi and Bluetooth and is additionally provided with NFC hardware, and product data, task data, NFC label data and the like can be synchronized between the intelligent terminal and the all-in-one machine through a USB cable.
The equipment comprehensive guarantee management system software provides an equipment guarantee data comprehensive retrieval function, can inquire according to the model, the number, the delivery time, the user unit, the state and the position, and can check and record task information.
The equipment comprehensive guarantee management APP runs on the intelligent terminal and is used for collecting field operation task data.
The special USB cable initiates a communication request to the upper computer through the USB by the intelligent terminal, the two parties carry out identity authentication, the upper computer identifies the connected terminal codes through the USB link, the authentication is passed, and the two-way data communication mode is entered.
The customized USB drive is installed on the all-in-one machine, the intelligent terminal is connected with an upper computer (the all-in-one machine) through a USB cable, the USB drive of the upper computer judges whether the terminal equipment is legal or not, if the terminal equipment is legal, a communication agent program is started, interactive data communication between the mobile terminal and the server is completed, and downloading and uploading of data are achieved. The protocol is SSL certificate check communication protocol based on USB RNDIS. SSL enhanced USB RNDIS software packages are respectively developed at two ends of a server and a mobile terminal, a basic communication link is established by means of the USB RNDIS, and the SSL client certificate ensures that only a specific mobile terminal certificate is received for access, and the mobile terminal without a legal certificate is configured, so that even if a corresponding USB RNDIS driver is owned, data communication cannot be established with a host, and illegal terminals are effectively prevented from accessing an upper computer.
The RNDIS protocol takes an intelligent terminal as an initiating terminal, sends hardware ID and certificate information of the RNDIS protocol to an upper computer, the upper computer is in an initialization process of establishing connection with a mobile terminal, a terminal identity verification daemon records the hardware ID and the certificate of the initiating terminal, the validity of the certificate is verified, the identity of the mobile terminal is confirmed when the certificate is legal (signed and issued by an upper computer self-establishing CA) and the hardware ID is matched with the certificate, a link can be established, normal communication can be carried out between the APP and an application program of the upper computer, otherwise, the link is not established, the communication cannot be normally carried out, and an alarm prompt is given.
In order to ensure that the multi-path communication is not interfered mutually when a plurality of intelligent terminals are connected with an upper computer, a virtual port for requesting the application software of the upper computer is established for each intelligent terminal on the RNDIS drive of the upper computer, and the mutual isolation of the requests is ensured.
The customized plug is adopted in the scheme to replace a standard USB plug, and the plug and the cable position of the USB cable are adjusted to ensure that the non-customized cable cannot form a physical link for communication of an upper computer and a lower computer.
The protocol involves the following list of procedures:
ASOPRNDIS driver
LINUXRNDIS kernel module
3. Terminal identity verification daemon program
The present invention is described in detail below with reference to the attached drawings so that the advantages and features of the present invention can be more easily understood by those skilled in the art.
Fig. 1 shows that the modified USB interface is different from the standard USB interface. The conventional 9-pin serial port is used for providing USB four-core cable butt joint, and four pins 1, 2, 3 and 4 of the serial port are respectively corresponding to GND, DATA-, DATA + and VCC of the USB.
Fig. 2 shows a relationship between the upper PC and the lower intelligent PC from a physical link to software; after the USB physical link is connected with the upper computer and the lower computer, the SSL certificate verification program on the Linux operating system and the customized USB-RNDIS drive terminal identity verification daemon verify the identity information of the lower computer, meanwhile, the customized USB-RNDIS drive and the SSL certificate on the AOSP operating system verify the identity information of the upper computer, and the upper computer and the lower computer pass verification and can perform bidirectional data transmission.
The specific identity verification method process is as follows:
the identity verification adopts a bidirectional asymmetric encryption algorithm, the lower computer stores the public key of the upper computer and the CPUID, and the upper computer stores the public key of the lower computer and the CPUID. A checking step:
the first step is as follows: the lower computer sends an identity verification request to the server, and the upper computer responds to the CPUID random string encrypted by the private key of the upper computer;
the second step is that: the lower computer decrypts the received random string by the public key of the upper computer, checks the random string with a CPUID list of the upper computer stored locally, encrypts the CPUID information of the lower computer by the private key of the lower computer and sends the information to the upper computer; if the verification fails, the communication is terminated;
the third step: the upper computer decrypts the received random string by using the public key of the lower computer, checks the random string with a CPUID (compact peripheral device identifier) list of the lower computer stored locally, and establishes a communication link after the check is passed; if the verification fails, the communication is terminated.
The upper computer shown in fig. 3 is connected with the plurality of lower computers through USB cables, and the number of the upper computers connected with the lower computers depends on the number of USB interfaces of the upper computers.
The communication schematic diagram of the USB cable connected with the lower computer of the upper computer shown in FIG. 4 comprises the following steps:
the first step is as follows: the USB line is connected with the upper computer and the lower computer;
the second step is that: the upper computer automatically negotiates RNDIS virtual networking with the lower computer through a USB;
the third step: monitoring the establishment of a virtual network by an upper computer automatic script;
the fourth step: the upper computer sets a local virtual network address parameter;
the fifth step: the upper computer service starts virtual network monitoring;
and a sixth step: the lower computer starts a client APP;
the seventh step: data transmission is carried out between lower computers of the upper computer;
after the USB line is connected, the special USB driver of the upper computer automatically executes judgment and operation of the lower computer.
Claims (1)
1. An improved communication method of USB interface is characterized by that it includes the following steps,
step one, manufacturing an improved USB data line, specifically, using a 9-pin data line for USB signal transmission to form a special interface line, namely setting 4 pins in the 9-pin data line as 4 pins of a standard USB interface, and reserving the rest 5 pins in the data line for only grounding and not transmitting signals and power;
step two, making an upper computer PC and an external interface of the information to be transmitted and an interface of the lower computer intelligent terminal into an interface corresponding to the improved USB data line, and corresponding to 4 pins set in 9 pins of the improved USB data line one by one;
step three, physically connecting the PC of the upper computer with an external interface and an interface of the intelligent terminal of the lower computer by using an improved USB data line;
step four, after the upper computer PC and the lower computer are connected through the improved USB data line, the USB drive of the upper computer automatically executes judgment and operation on the lower computer, the upper computer PC verifies the identity information of the lower computer through an SSL certificate verification program on a Linux operating system and a customized USB-RNDIS drive terminal identity verification daemon, and meanwhile, the lower computer customizes a USB-RNDIS drive on an AOSP operating system and verifies the upper computer with the SSL certificate; the upper computer and the lower computer pass the verification, and bidirectional data transmission can be carried out.
The specific identity verification method process is as follows:
the identity verification adopts a bidirectional asymmetric encryption algorithm, the lower computer stores the public key of the upper computer and the CPUID, and the upper computer stores the public key of the lower computer and the CPUID; a checking step:
the first step is as follows: the lower computer sends an identity verification request to the server, and the upper computer responds to the CPUID random string encrypted by the private key of the upper computer;
the second step is that: the lower computer decrypts the received random string by the public key of the upper computer, checks the random string with a CPUID list of the upper computer stored locally, encrypts the CPUID information of the lower computer by the private key of the lower computer and sends the information to the upper computer; if the verification fails, the communication is terminated;
the third step: the upper computer decrypts the received random string by using the public key of the lower computer and verifies the random string with the CPUID list of the lower computer stored locally, and the two conditions are generally adopted, namely, a communication link is established after the verification is passed; if the verification fails, the communication is terminated;
step five, if the verification fails, the communication is terminated; if the verification is passed, the next step is carried out;
and step six, checking and communicating the USB cable to a lower computer of the upper computer, and specifically comprising the following steps:
the first step is as follows: the upper computer automatically negotiates RNDIS virtual networking with the lower computer through a USB;
the third step: monitoring the establishment of a virtual network by an upper computer automatic script;
the third step: the upper computer sets a local virtual network address parameter;
the fourth step: the upper computer service starts virtual network monitoring;
the fifth step: the lower computer starts a client APP;
and a sixth step: and data transmission is carried out between the lower computers of the upper computer.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011178880.3A CN112363968B (en) | 2020-10-29 | 2020-10-29 | Improved communication method of USB interface |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011178880.3A CN112363968B (en) | 2020-10-29 | 2020-10-29 | Improved communication method of USB interface |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112363968A true CN112363968A (en) | 2021-02-12 |
| CN112363968B CN112363968B (en) | 2022-01-28 |
Family
ID=74512370
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011178880.3A Active CN112363968B (en) | 2020-10-29 | 2020-10-29 | Improved communication method of USB interface |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112363968B (en) |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2011082073A2 (en) * | 2010-01-04 | 2011-07-07 | Pillar Ventures, Llc | Identification and authorization of communication devices |
| CN103238305A (en) * | 2010-05-28 | 2013-08-07 | 安全第一公司 | Accelerator system for use with secure data storage |
| CN103444153A (en) * | 2011-03-22 | 2013-12-11 | 萨热姆防务安全公司 | Method and device for connecting to high security network |
| CN103608794A (en) * | 2011-06-17 | 2014-02-26 | 阿尔卡特朗讯 | Method and apparatus for remote delivery of managed usb services via a mobile computing device |
| CN105337977A (en) * | 2015-11-16 | 2016-02-17 | 苏州通付盾信息技术有限公司 | Secure mobile communication architecture with dynamic two-way authentication and implementation method thereof |
-
2020
- 2020-10-29 CN CN202011178880.3A patent/CN112363968B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2011082073A2 (en) * | 2010-01-04 | 2011-07-07 | Pillar Ventures, Llc | Identification and authorization of communication devices |
| CN103238305A (en) * | 2010-05-28 | 2013-08-07 | 安全第一公司 | Accelerator system for use with secure data storage |
| CN103444153A (en) * | 2011-03-22 | 2013-12-11 | 萨热姆防务安全公司 | Method and device for connecting to high security network |
| CN103608794A (en) * | 2011-06-17 | 2014-02-26 | 阿尔卡特朗讯 | Method and apparatus for remote delivery of managed usb services via a mobile computing device |
| CN105337977A (en) * | 2015-11-16 | 2016-02-17 | 苏州通付盾信息技术有限公司 | Secure mobile communication architecture with dynamic two-way authentication and implementation method thereof |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112363968B (en) | 2022-01-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102663300B (en) | Media player and annex | |
| KR100906119B1 (en) | Distributed filesystem network security extension | |
| JP6656157B2 (en) | Network connection automation | |
| CN106708489B (en) | Debugging method and system of equipment | |
| US20030131257A1 (en) | Method and apparatus for initiating strong encryption using existing SSL connection for secure key exchange | |
| CN103136463A (en) | System and method for temporary secure boot process of an electronic device | |
| CN104202185A (en) | Backup method and backup device for communication data | |
| CN110716831A (en) | Terminal, debugging system of USB (universal serial bus) equipment and debugging method of USB equipment | |
| CN111586021B (en) | Remote office business authorization method, terminal and system | |
| CN111669351B (en) | Authentication method, service server, client and computer readable storage medium | |
| KR101430861B1 (en) | Security information sharing system and execution method thereof | |
| EP3217695A1 (en) | Device pairing method | |
| CN104023043B (en) | A kind of Remote configuration management method and device | |
| CN111901301A (en) | Safety protection system and method based on network multimedia equipment data transmission | |
| CN103824014A (en) | Isolation certificating and monitoring method of USB (universal serial bus) port within local area network | |
| CN112363968B (en) | Improved communication method of USB interface | |
| CN115250203A (en) | Method and device for controlling equipment access and related products | |
| CN110602693B (en) | Networking method and equipment of wireless network | |
| CN102255902A (en) | Network equipment function sharing method and device | |
| CN109842600B (en) | Method for realizing mobile office, terminal equipment and MDM equipment | |
| CN110278127B (en) | Agent deployment method and system based on secure transmission protocol | |
| JP5705699B2 (en) | Connection control system and connection control method | |
| CN111723042B (en) | Remote high-speed USB transparent transmission method, device and equipment | |
| US7849166B1 (en) | Creation of secure communication connections through computer networks | |
| CN112926093A (en) | Singlechip firmware encryption downloading management system based on cloud service |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |