Protected peripheral ports
By introducing hardware security controllers and protection services into computer systems, generating shared confidential values and encryption values, monitoring the connection of peripheral devices, providing sandbox environments and user permissions, it solves the problem of being difficult to distinguish and block malicious peripheral devices in the prior art. The problem has achieved effective security protection for computer systems.
Patent Information
- Application Number
- CN201980077943.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Priority Date
- 2018-12-06
- Filing Date
- 2019-11-26
- Publication Date
- 2024-12-24
- Estimated Expiration
- 2039-11-26
AI Technical Summary
The existing technology is difficult to effectively protect computer systems from potential attacks and malware caused by peripheral devices such as USB storage devices, especially difficult to distinguish and block connections of malicious devices, and existing protection measures may limit system functionality or fail to Block the attack completely.
By introducing hardware security controllers and protection services into computer systems, disable unverified peripheral ports, generate shared secret values and generate encryption values based on them, ensure the correct operation of protection services, enable ports and monitor peripheral connections, Provides a sandbox environment to isolate the file system, asks users for permission and monitors device types, and ensures safe enumeration and loading of devices.
It effectively prevents the harm of malicious peripheral devices, ensures system security, avoids functional limitations, and allows the normal use of legal devices. It provides a powerful protection mechanism through the coordinated work of hardware and software.
Smart Images
Figure CN113168467B_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to protection of devices. Background Art
[0002] Users often connect peripheral devices to the input / output (I / O) ports of computer systems and devices. Common ports include Thunderbolt, eSATA, USB, etc., which can be used, for example, to connect mass storage devices such as hard drives and USB memory sticks or similar devices such as keyboards, printers, etc. Summary of the invention
[0003] According to one aspect of the present disclosure, a computer system for interfacing with a peripheral device is provided, the computer system comprising: a port configured to couple to the peripheral device, wherein the port is initialized in a disabled state; a processor; a memory, the memory comprising instructions, which when executed cause the processor to: determine that the peripheral device is connected to the port; receive information from the peripheral device, the information indicating a device type, wherein the peripheral device is blocked from connecting to the computer system except for providing the device type; send a prompt including the device type to a user, wherein the prompt requests user permission for the peripheral device; a hardware security controller coupled to the port, accessing a shared secret value generated by the hardware security controller; generating an encrypted value based on the shared secret value; and the hardware security controller is configured to: generate the shared secret value; receive the encrypted value; and enable the port in response to determining that a protection service is running, wherein determining that the protection service is running includes the hardware security controller determining that the encrypted value has been correctly generated based on the shared secret, resetting a timer.
[0004] According to another aspect of the present disclosure, a method for protecting a computer system from a peripheral device is provided, the method comprising: disabling a port by a hardware security controller of the computer system coupled to the port; determining that the peripheral device is connected to the port; receiving information from the peripheral device, the information indicating a device type, and wherein the peripheral device is blocked from connecting to the device except for providing the device type; sending a prompt including the device type to a user, wherein the prompt requests user permission for the peripheral device; generating a shared secret value by the hardware security controller of the computer system; generating an encrypted value by a protection service based on accessing the shared secret value; and enabling the port by the hardware security controller in response to determining that the protection service is executing, wherein determining that the protection service is running includes the hardware security controller determining that the encrypted value has been correctly generated based on the shared secret, and resetting a timer. BRIEF DESCRIPTION OF THE DRAWINGS
[0005] The various features of the present disclosure are shown in the following Figure 1 It will become apparent from the detailed description which illustrates the features of the present disclosure, in which:
[0006] Figure 1 A computer system according to an example of the present disclosure is shown;
[0007] Figure 2 A method according to an example of the present disclosure is shown;
[0008] Figure 3 Another method according to an example of the present disclosure is shown; and
[0009] Figure 4 is a schematic block diagram of a computer system according to an example of the present disclosure. DETAILED DESCRIPTION
[0010] In the following description, for the purpose of explanation, many specific details of some examples are set forth. References to "example" or similar language in the specification mean that a particular feature, structure or characteristic described in conjunction with the example is included in at least one example, but not necessarily in other examples.
[0011] Users often connect peripheral devices to the I / O ports of personal computers to share files (e.g., using eSATA, USB, and Thunderbolt ports). However, such ports can be abused. In particular, an attacker can create a peripheral device loaded with malicious code or other functionality that, when connected to a port of a computer system, can cause the computer system to be compromised. As a result, users have become wary of using devices (e.g., USB drives) from unknown sources. Furthermore, in corporate environments, system administrators may respond by locking down ports or otherwise enforcing strict policies regarding port usage.
[0012] Protecting PCs from malicious peripherals such as USB memory sticks (mass storage) is difficult because it is difficult for users to know whether these devices are harmful before connecting them to the computer system. An attacker can install malware on a USB drive that automatically executes upon insertion. More insidiously, seemingly benign USB devices can be reprogrammed to present themselves as multiple devices such as keyboards, which can unexpectedly execute commands without the user's knowledge. As a result, IT administrators are constantly warning users not to plug in unreliable devices or use restrictive policies to limit their use. These policies are often too strict or impractical, but the other options can be very dangerous.
[0013] Some antivirus software can provide some protection for computer devices from malware loaded onto peripheral devices. For example, antivirus tools can be used to automatically scan mass storage devices to detect and block the execution of malicious code. However, these tools may incur significant performance overhead and may not guarantee the prevention of more potential attacks through peripheral ports. In addition, these tools may not prevent the enumeration of malicious virtual devices.
[0014] In response to the possibility of a computer system being compromised through a peripheral port, some users and administrators may simply disable all ports. This may be accomplished in software through a BIOS setting, or by using hardware measures such as lockable port covers. While this approach eliminates the possibility of an attack through the port, it severely limits the functionality of the computer system. Furthermore, in practice, users may attempt to circumvent the protection measures to re-enable the port when they find themselves wishing to connect a peripheral device in the course of their work.
[0015] Some computer systems may have protection mechanisms for isolating malicious input within a virtualized environment. However, in practice, these isolation mechanisms can sometimes be disabled by malware that defeats the protection provided. Furthermore, these protection mechanisms may disrupt the normal workflow of attaching and using peripherals.
[0016] Certain examples described herein provide methods and devices for protecting users from malicious mass storage devices and other peripheral devices by containing the device's contents and input within a hardware-enforced protection environment.
[0017] For the purpose of this disclosure, examples will be described in the context of USB devices, which are probably the most common port devices. However, it will be appreciated by those skilled in the art that the described technology can be easily extended to other port types used to connect mass storage devices to computers, such as eSATA, PCIE, Thunderbolt, etc.
[0018] USB devices have at least four wires, one each for power, ground, data positive (Data+), and data negative (Data-). When a device is plugged into a USB port, the bus master (USB host) detects changes on the data lines. This triggers the device interrogation process. The host first determines the device speed (USB version) and then resets the device. After reset, the host uses the Get_Device_Descriptor command to query the different USB device descriptors to determine what type of device it is. The device is expected to return a value programmed by the manufacturer that informs the host which device driver should be loaded to handle the device. The hardware, USB host controller, and drivers can perform much of this process automatically to improve performance. As a result, visibility into this process can often be limited without custom drivers or modifications.
[0019] USB mass storage devices are often mounted immediately after enumeration and, depending on the operating system's settings, can mount file systems and automatically start any auto-executable files. This provides a prime attack vector for maliciously implanted USB drivers.
[0020] Another potential attack is to reprogram the USB device firmware to present itself as some other device, such as a keyboard, rather than a mass storage device. The values returned by the device to identify the device type during enumeration can be easily forged because they are not authenticated. As a result, a USB memory stick may appear to the host as a keyboard or mouse. Once loaded, the USB memory stick's firmware may be able to input keystrokes to initiate commands. Alternatively, a USB keyboard may enumerate as a USB mass storage device containing malware.
[0021] Finally, the device can display the correct device and then enumerate a second device without the user noticing. There are two possible approaches to this, including: 1) resetting the device after a delay to enumerate the new device; 2) enumerating a USB hub that can provide any number of devices in the future.
[0022] According to some examples of the present disclosure, methods and apparatus are provided for mitigating these and similar potential attacks via peripheral ports. Examples provide a software operating system protection agent to protect the host operating system environment from connected peripheral devices, and a hardware / firmware agent that monitors the software protection agent to ensure that the protection agent is operating properly. After the peripheral device is plugged in, the operating system protection agent and the driver can properly protect the host operating system environment from the peripheral device. The agent is monitored by a hardware / firmware component that ensures that the protection agent is operating properly before enumerating the device to the operating system.
[0023] In some examples, if the peripheral device is a storage device, the user may be presented with the files stored therein, and such operations are blocked from being performed on the system. If the peripheral device is some other device type, the agent may ask the user whether he or she wishes to use the peripheral device normally.
[0024] Figure 1 A computer system 100 according to an example of the present disclosure is shown. The computer system 100 includes an operating system (OS) portion 110 and a low-level hardware or BIOS portion 180. Peripheral devices 170 are coupled to the computer system 100 via protected ports 160. A software protection module including a protection service 130 and plug-in drivers 140 executes in the OS portion 110 of the device 100. A hardware security controller 150 resident in the BIOS portion 180 monitors the plug-in drivers 140 and the protection service 130.
[0025] In an example, the hardware security controller 150 may be implemented as a separate hardware-based microcontroller, such as a watchdog microcontroller (MCU), or may be a firmware routine that forms part of the system BIOS software.
[0026] In use, a port may be designated as a protected port 160 by default, or may be explicitly designated by a user or administrator to be protected, for example based on BIOS or operating system settings.
[0027] Before any device-specific drivers are loaded, in response to any USB device enumerating onto a protected port 160, a plug-in driver 140 is loaded. The plug-in driver 140 communicates with the protection service 130 and indicates that a new device has been detected. The protection service 130 is responsible for mediating devices 170 connected to the port.
[0028] For a mass storage device, it can load a file system into a sandbox (e.g., virtualized) environment 120, which can then be presented to the user. For example, a sandbox file system can present files in a web browser executing in a virtualized environment to allow the user to read any files stored on the device while isolating the files from the operating system 110 of the device 100.
[0029] If the connected peripheral device 170 (e.g., a keyboard) is not a mass storage device, the protection service 130 can prompt the user that a device claiming to belong to a specific device class is attempting to enumerate on the protected port 160. If the user accepts the peripheral device 170, the protection service 130 can load the corresponding device driver to allow the device to operate on the computer system 100.
[0030] According to an example, a predefined policy may be provided, for example, by an administrator, so that the protection service 130 may allow certain device types to be automatically loaded. Similarly, the protection service 130 and / or the plug-in driver 140 may provide the detected authentication value (e.g., a one-time encryption) to the peripheral device 170 and facilitate automatic enumeration of the device and loading of the corresponding device driver, bypassing the protection service.
[0031] For example, a user may have a specific USB storage device that they own and wish to use regularly to transfer files to and from the computer system 100. Since the device is owned by the user, the user can trust that the device does not contain any malicious code. By storing appropriate authentication values on known devices, the protection service 130 can be bypassed, thereby avoiding delays when connecting the device to the computer system 100. In this way, the use of well-known and trusted devices is not affected by the presence of the protection service 130.
[0032] The protection service 130 and plug-in driver 140 are further monitored by a hardware-based security controller 150 or a watchdog microcontroller at runtime. The watchdog checks whether the protection service is running properly and has not been disabled by malware or a malicious user. If the security controller 150 determines that the protection service 130 or plug-in driver 140 is not loaded and executed, the security controller 150 disables the protected port 160 to prevent misuse.
[0033] According to an example, the hardware-based security controller 150 may receive periodic messages including an encrypted value from the protection service 130 to allow the hardware-based security controller 150 to verify that the protection service 130 is executing correctly. The hardware-based security controller 150 may set / reset a timer based on receiving a verified message from the protection service 130. If the timer fails to be reset within a certain period of time, the hardware-based security controller 150 may determine that the protection service 130 is not executing.
[0034] According to one example, when the computer system 100 is first booted, a new shared secret value, such as a random number of a certain number of bytes (e.g., 32 bytes), can be generated and shared between the hardware security controller and the protection service. The secret value can be generated by the hardware security controller 150. The shared secret value can be stored in a secure storage accessible to the protection service 130 but not accessible to other processes, such as a trusted platform module (TPM); using a value stored in the TPM that is disabled after booting, the shared secret value can be provided to the protection service 130 in an encrypted form and decrypted based on the value stored in the TPM; before executing any user process, early in the boot process, using an API call to obtain the shared secret value from the firmware, etc. Once the protection service has obtained the shared secret, the shared secret value can be protected using a data protection application programming interface, virtualization, etc.
[0035] The protection service 130 uses the shared secret value with a nonce (number used once) (e.g., an incrementing counter) at fixed intervals to generate an encrypted value to be included in a periodic message to be sent to the hardware security controller 150. For example, the protection service 130 can use the shared secret and the nonce to generate a hash-based message authentication code (HMAC) value. The message is then provided to the hardware security controller 150.
[0036] After receiving the message, the hardware security controller 150 determines that the encrypted value (e.g., HMAC) has been correctly generated based on the shared secret and has not been received previously, that is, the number used once is not repeated to avoid replay attacks. If the encrypted value is successfully verified, the timer is reset and the hardware security controller 150 considers that the protection service 130 is executing correctly.
[0037] This provides hardware failsafe protection that prevents the use of protected port 160 when protection service 130 and plug-in driver 140 have not yet loaded, or if protection service 130 and plug-in driver 140 are unable to execute for any reason.
[0038] In an example, the computer system 100 may have multiple ports for connecting peripheral devices, where one or more ports are designated as protected ports 160. For example, certain ports may be designated as protected ports at design time and may be marked as preferred ports to indicate to the user when connecting untrusted or potentially malicious devices. Ports may also be designated via BIOS settings, or using a hardware switch, to activate a protection mechanism for the port when an untrusted device is connected.
[0039] The protection provided by protection service 130 to protected port 160 may also extend to any hubs connected to that port and devices connected via those hubs.
[0040] The default policy may be to enumerate non-storage devices in response to the user accepting the device. However, further protection mechanisms may be applied, such as emulating specified device types from the sandbox environment 120. This may limit the types of operations that the device can perform and allow monitoring of the behavior of the device even if the local device driver does not allow such actions.
[0041] Frequently used or well-known devices can be identified as trusted devices (e.g., based on some captured unique data identifying the device or some stored confidential value) and can bypass the protection service. Appropriate confidential values can be pre-set for devices manufactured by certain trusted providers to allow those devices to bypass the protection service.
[0042] Figure 2 200 is a flow chart illustrating a method 200 according to an example of the present disclosure. According to the method 200, a protected port 160 is initialized 202 in a disabled state. The hardware security controller 150 monitors the software protection service 130 and the plug-in driver 140. If it is determined 204 that the software protection service 130 is executing, the port is enabled 206. The peripheral devices 170 connected to the protected port 160 can then be enumerated 208. The plug-in driver 140 collects information about the enumerated devices and reports 210 the details, including the device type, to the protection service 130. The protection service 130 then determines 212 whether the device includes a mass storage device. If so, the file system of the device 170 is mounted 214 into the sandbox file system 120. Otherwise, the user is prompted 216 to accept the device before the driver for the device 170 can be loaded.
[0043] Figure 3 A method 300 performed by the hardware security controller 150 according to an example of the present disclosure is shown. Figure 3 In the method 300, the security controller 150 disables 302 a protected port and then monitors 304 the execution of a port protection software module, such as the protection service 130 and the plug-in driver 140. Once the security controller 150 determines 306 that the port protection software module is executing properly, the security controller 150 enables the protected port to allow peripheral devices to connect and enumerate onto the computer system under control of the port protection software module.
[0044] Certain methods and systems described herein may be implemented by a processor that processes program code retrieved from a non-transitory storage medium, such as BIOS firmware. Figure 4An example 400 of a device including a computer-readable storage medium 430 coupled to at least one processor 420 is shown. The computer-readable medium 430 may be a medium that may contain, store, or maintain programs and data used by or related to the instruction execution system. The computer-readable medium may include any of a number of physical media, such as electronic, magnetic, optical, electromagnetic, or semiconductor media. More specific examples of suitable machine-readable media include, but are not limited to, a hard drive, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory, or a portable optical disk.
[0045] exist Figure 4 In the computer readable storage medium, a computer readable storage medium includes a computer readable storage medium for executing Figure 3 The example shown corresponds to program code for a method of: disabling 402 protected port 160; monitoring 404 execution of a port protection software module; determining 406 whether the port protection software module is executing properly; and in response to determining that the port protection module is executing, enabling 408 the protected port.
[0046] All features disclosed in this specification (including any attached claims, abstracts and drawings) can be combined in any combination, except for combinations containing mutually exclusive features. Unless otherwise expressly stated, each feature disclosed in this specification (including any attached claims, abstracts and drawings) can be replaced by an alternative feature having the same, equivalent or similar purpose. Therefore, unless otherwise expressly stated, each feature disclosed is an example in a general series of equivalent or similar features.
[0047] The present teaching is not limited to the details of any of the foregoing examples. Any novel combination of features disclosed in this specification (including any accompanying claims, abstracts and drawings) can be envisioned. The claims should not be interpreted as covering only the foregoing examples, but also any variations that fall within the scope of the claims.
Claims
1. A computer system for interfacing with a peripheral device, the computer system comprising: a port configured to be coupled to the peripheral device, wherein the port is initialized in a disabled state; processor; a memory comprising instructions that, when executed, cause the processor to: determining that the peripheral device is connected to the port; receiving information from the peripheral device, the information indicating a device type, wherein the peripheral device is blocked from connecting to the computer system except by providing the device type; sending a prompt including the device type to a user, wherein the prompt requests user permission for the peripheral device; a hardware security controller coupled to the port, accessing a shared secret value generated by the hardware security controller; generating an encrypted value based on the shared secret value; as well as The hardware security controller is configured to: generating the shared secret value; receiving the encrypted value; as well as In response to determining that the protection service is running, enabling the port, Wherein determining that the protection service is running includes the hardware security controller determining that the cryptographic value has been correctly generated based on the shared secret, and resetting the timer.
2. The computer system of claim 1 , further comprising a protection service and a plug-in driver associated with the port, the plug-in driver being configured to: In response to a peripheral device being connected to the port, determining capabilities of the peripheral device; and The determined performance is reported to the protection service.
3. The computer system of claim 1, wherein: The peripheral device includes a mass storage device, and wherein the instructions, when executed, further cause the processor to prevent files stored on the mass storage device from being executed on the processor.
4. The computer system of claim 3, wherein: The instructions, when executed, further cause the processor to enumerate the mass storage device into a sandbox file system.
5. The computer system of claim 1, wherein: The peripheral device is a human interface device, and wherein the instructions, when executed, further cause the processor to isolate input from the human interface device in a virtualized environment.
6. The computer system of claim 1, wherein the port is a USB port configured to couple to a USB peripheral device.
7. The computer system of claim 1, wherein the port is one of the following: an eSATA port, a PCIE port, or a Thunderbolt port.
8. The computer system of claim 1, wherein: The instructions, when executed, further cause the processor to: In response to a peripheral device being coupled to the port, determining whether the peripheral device comprises a known trusted device; and In response to determining that the peripheral device comprises a known trusted device, the protection service is bypassed.
9. A method for protecting a computer system from a peripheral device, the method comprising: disabling the port by a hardware security controller of the computer system coupled to the port; determining that the peripheral device is connected to the port; receiving information from the peripheral device, the information indicating a device type, and wherein the peripheral device is blocked from connecting to the computer system except by providing the device type; sending a prompt including the device type to a user, wherein the prompt requests user permission for the peripheral device; generating, by the hardware security controller of the computer system, a shared secret value; generating, by the protection service, an encrypted value based on accessing the shared secret value; as well as In response to determining that the protection service is being executed, enabling, by the hardware security controller, the port, Wherein determining that the protection service is running includes the hardware security controller determining that the cryptographic value has been correctly generated based on the shared secret, and resetting the timer.
10. The method of claim 9, further comprising: monitoring execution of protection services and plug-in drivers associated with the port; In response to the peripheral device being connected to the port, determining, by the plug-in driver, capabilities of the peripheral device; as well as The determined performance is reported to the protection service.
11. The method of claim 10, further comprising: In response to the reported performance indicating that the peripheral device includes a mass storage device, a sandbox file system is instantiated by the protection service and a file system of the mass storage device is loaded into the sandbox file system.
12. The method of claim 10, further comprising: In response to the reported capabilities indicating that the peripheral device does not include a mass storage device, indicating the reported capabilities of the peripheral device to a user, and prompting the user to accept connection of the peripheral device.
13. The method of claim 10, further comprising: In response to the reported performance indicating that the peripheral device includes a human interface device; as well as The human interface device is isolated in a virtualized environment.
14. The method of claim 9, further comprising: Determining, by the hardware security controller, that the protection service has ceased execution; as well as In response to determining that the protection service has ceased execution, the port is disabled.
15. The method of claim 9, further comprising: determining that the peripheral device comprises a known trusted device; as well as Protection provided by the protection service for the known trusted device is bypassed.
16. A computer readable medium having instructions stored thereon, which when executed, cause a computing device to perform the method according to any one of claims 9 to 15.