Media Encryption & Port Protection Deep Dive: USB Control, Encryption & Device Authorization
Media Encryption & Port Protection Deep Dive: USB Control, Encryption & Device Authorization
媒体加密与端口保护深度解析：USB 控制、加密及设备授权
This article is part of my Harmony Endpoint Deep Dives series, originally published on Check Point CheckMates. It is written for a cloud-managed deployment (Infinity Portal / Web Management); where an on-premises Management Server behaves differently, that is called out. 本文是我“Harmony Endpoint 深度解析”系列文章的一部分，最初发布于 Check Point CheckMates。本文针对云管理部署（Infinity Portal / Web 管理）编写；若本地管理服务器（On-premises Management Server）的行为有所不同，文中会特别说明。
Purpose
目的
The USB port is one of the easiest ways data walks out of a company, and one of the easiest ways malware walks in. This article dissects Media Encryption & Port Protection (ME&PP): the write-action encryption modes, storage vs peripheral device control, device exceptions with wildcards, offline access, device scanning and authorization, media lockout, and the UUID “Site” trust model that decides who can open an encrypted stick. USB 端口是数据泄露最容易的途径之一，也是恶意软件入侵最便捷的通道之一。本文将深入剖析媒体加密与端口保护（ME&PP）：包括写入操作加密模式、存储设备与外设控制、带通配符的设备例外规则、离线访问、设备扫描与授权、媒体锁定，以及决定谁能打开加密存储设备的 UUID “站点（Site）”信任模型。
Two Kinds of Devices
两类设备
ME&PP protects sensitive information by encrypting data and requiring authorization to access devices. Everything starts with a distinction: ME&PP 通过加密数据并要求授权来访问设备，从而保护敏感信息。一切都始于以下区分：
| Type | Definition | Can encrypt? |
|---|---|---|
| Storage Device | Removable media users can save data files to: USB storage, SD cards, CD/DVD, external drives | Yes |
| Peripheral Device | Devices users cannot save data to (keyboard, mouse, modem, Bluetooth, Wi-Fi, etc.) | No |
| 类型 | 定义 | 可加密吗？ |
|---|---|---|
| 存储设备 | 用户可保存数据文件的可移动媒体：USB 存储、SD 卡、CD/DVD、外部驱动器 | 是 |
| 外围设备 | 用户无法保存数据的设备（键盘、鼠标、调制解调器、蓝牙、Wi-Fi 等） | 否 |
Rules are built in the Web Management console (Policy > Data Protection > General > Capabilities and Exclusion > Media Encryption) and cover: read/write defaults, storage access, device access, which file types to encrypt, offline access, and user overrides. Device-level exceptions can be imported and exported as JSON. 规则在 Web 管理控制台中构建（策略 > 数据保护 > 常规 > 功能与排除 > 媒体加密），涵盖：读/写默认设置、存储访问、设备访问、需加密的文件类型、离线访问以及用户覆盖。设备级例外规则可以 JSON 格式导入和导出。
Write Actions: the Core of Data Protection
写入操作：数据保护的核心
The write action decides what happens when a user copies a file to a USB stick. Five predefined options: 写入操作决定了当用户将文件复制到 USB 存储设备时会发生什么。共有五个预定义选项：
| Write Action | Behavior |
|---|---|
| Allow writing any data | All file types written freely |
| Encrypt business related data | Business-related file types must go to encrypted storage; non-business files can be unencrypted |
| Encrypt all data | Every file (business + non-business) must be encrypted |
| Do not allow writing any data | No writes at all |
| …allow user override | Blocked by default, but UserCheck lets the user override with a justification |
| 写入操作 | 行为 |
|---|---|
| 允许写入任何数据 | 所有文件类型均可自由写入 |
| 加密业务相关数据 | 业务相关文件类型必须存入加密存储区；非业务文件可不加密 |
| 加密所有数据 | 每个文件（业务+非业务）都必须加密 |
| 不允许写入任何数据 | 完全禁止写入 |
| …允许用户覆盖 | 默认阻止，但 UserCheck 允许用户通过提供理由进行覆盖 |
What counts as “business-related” (encrypted by default): Word, Spreadsheet, Presentation, Database, Drawing, Graphic, Viewer, Archive, Markup, Email, Text. Not business-related by default: Multimedia, Image, Executable. You cannot edit the predefined groups, but you can create custom ones. 哪些属于“业务相关”（默认加密）：Word、电子表格、演示文稿、数据库、绘图、图形、查看器、存档、标记、电子邮件、文本。默认非业务相关：多媒体、图像、可执行文件。您无法编辑预定义组，但可以创建自定义组。
“Encrypt business related data” is the sweet spot for most organizations. Confidential documents are forced into encryption while personal photos and music stay usable, so users do not fight the policy. “加密业务相关数据”是大多数组织的最佳平衡点。机密文档被强制加密，而个人照片和音乐仍可使用，因此用户不会抵触该策略。
The UUID “Site” Trust Model: Who Can Open the Stick
UUID “站点”信任模型：谁能打开存储设备
Each management instance is a Site with a UUID. When a device is encrypted, that Site’s UUID is written to it. When someone plugs the encrypted device in elsewhere, ME&PP compares the device’s UUID against the connected Site (and any trusted Sites): 每个管理实例都是一个带有 UUID 的“站点”。当设备被加密时，该站点的 UUID 会被写入其中。当有人将加密设备插入其他地方时，ME&PP 会将设备的 UUID 与所连接的站点（以及任何受信任的站点）进行比对：
(Flowchart logic: Encrypted device attached -> Check UUID vs Site -> Same Site/Trusted Site = Access with password; Non-trusted = No access) （流程图逻辑：插入加密设备 -> 比对设备 UUID 与站点 -> 同一站点/受信任站点 = 密码访问；非受信任 = 禁止访问）
The controlling setting is the Site action (enabled by default): “Allow access to storage devices encrypted at current site only” means clients open only media encrypted by the same Site. This is what stops an encrypted USB from being opened on a random unmanaged machine, and what lets you deliberately share media across trusted Sites. For machines with no ME&PP (or offline), the Explorer Utility can be copied onto the device so encrypted data is still readable with a password. 控制设置是站点操作（默认启用）：“仅允许访问在当前站点加密的存储设备”，这意味着客户端只能打开由同一站点加密的媒体。这阻止了加密 USB 在随机的非托管机器上被打开，同时也允许您在受信任的站点之间有目的地共享媒体。对于没有 ME&PP（或离线）的机器，可以将 Explorer Utility 复制到设备上，以便加密数据仍可通过密码读取。
Peripheral Device Access (Port Protection)
外围设备访问（端口保护）
For devices that cannot store data, you control the ports directly: 对于无法存储数据的设备，您可以直接控制端口：
-
Allow essential devices only (keyboard, mouse, network adapters): Everything else blocked.
-
Block all transmitting devices (Modem, Bluetooth, IrDA, Wi-Fi): Everything else allowed.
-
Allow all peripheral devices: No port restriction.
-
Custom actions: Set per-device Access Type (Allow/Block) and Log.
-
仅允许基本设备（键盘、鼠标、网络适配器）：其他所有设备均被阻止。
-
阻止所有传输设备（调制解调器、蓝牙、IrDA、Wi-Fi）：其他所有设备均被允许。
-
允许所有外围设备：无端口限制。
-
自定义操作：按设备设置访问类型（允许/阻止）和日志。
Device Exceptions & Wildcards
设备例外与通配符
You rarely apply one rule to every USB stick. Exceptions target a device by serial number, a model (device ID), a device type, or a user-defined group. Serial numbers accept wildcards: * matches one or more characters, ? matches exactly one character.
您很少会对所有 USB 存储设备应用同一条规则。例外规则通过序列号、型号（设备 ID）、设备类型或用户定义的组来针对特定设备。序列号支持通配符：* 匹配一个或多个字符，? 匹配且仅匹配一个字符。
Precedence (enforced in this order): Serials containing * first, Serials containing ? next, Exact serials (no wildcard) last.
优先级（按此顺序执行）：包含 * 的序列号优先，其次是包含 ? 的序列号，最后是精确序列号（无通配符）。
Device Scanning & Authorization
设备扫描与授权
Beyond encryption, ME&PP can scan inserted media for malware and unauthorized file types before allowing access. 除了加密之外，ME&PP 还能在允许访问之前扫描插入的媒体，以查找恶意软件和未经授权的文件类型。
Unauthorized file types work in two modes: Unauthorized (you list what is blocked and everything else is allowed) or Authorized (you list what is allowed and everything else is blocked). On E80.64+ clients, optical media (CD/DVD) can also be scanned. 未经授权的文件类型有两种工作模式：未经授权（您列出被阻止的内容，其他均允许；这是默认设置，默认允许所有类型）或 授权（您列出允许的内容，其他均被阻止）。在 E80.64 及更高版本的客户端上，光盘媒体（CD/DVD）也可以进行扫描。
Offline Access, Container Sizing & Lockout
离线访问、容器大小与锁定
Offline Access lets users open encrypted media on protected computers not connected to a server, or on non-protected computers, via a password, with an optional read-only password and Remote Help password recovery. 离线访问允许用户通过密码在未连接服务器的受保护计算机上，或在非受保护的计算机上打开加密媒体，并可选择设置只读密码和远程协助密码恢复。