External HID Protection Device for Protocol Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies cannot effectively prevent illegal devices from disguising themselves as keyboards or mice to damage computer systems, and they fail to authenticate and audit the legitimacy of HID devices in real time without installing audit software within the protected device.
Innovation Solution
An external protective device with HID internal and external interfaces, a protocol analysis module, and a forwarding control module that determines the legitimacy of connected HID devices and controls their access, along with a screen recording and image analysis module for real-time monitoring and recording of device operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If prior art uses PS/2 protocol auditing methods, then keyboard and mouse operations can be controlled, but it cannot identify illegal devices disguised as keyboards or mice
Solution Approach 1:
The patent segments the auditing function into a separate external protective device that interfaces between the USB connection and the protected device. This external auditing device contains the protocol analysis module, separating the security auditing function from the main protected system, allowing it to handle multiple device types without affecting the core system's adaptability.
Solution Approach 2:
The patent introduces an external protective device as an intermediary component between the external HID device and the protected device. This intermediary performs protocol analysis and authentication, acting as a mediator that can identify illegal devices while maintaining compatibility with legitimate devices across different interfaces.
2Loss of information
If audit software is installed inside the protected device, then operational behavior can be audited, but it cannot prevent illegal devices from accessing the system in the first place
Solution Approach 1:
The patent implements preliminary action by performing device authentication and protocol analysis before the device gains access to the protected system. The external protective device analyzes the HID protocol during the connection establishment phase, preventing illegal devices from accessing the system before they can cause harm, while still enabling audit of legitimate operations.
3Adaptability or versatility
If the system allows all USB HID devices to connect, then device versatility is maintained, but illegal devices can disguise themselves and damage the system
Solution Approach 1:
The patent implements feedback mechanisms where the external protective device continuously monitors HID protocol communications and provides feedback control. When illegal devices are detected through protocol analysis, the system provides feedback by blocking further communication. This maintains versatility for legitimate devices while preventing system damage from illegal ones.
Solution Approach 2:
The patent changes the parameter of device authentication from simple connection recognition to detailed protocol parameter analysis. By examining specific HID protocol parameters and communication patterns, the system can distinguish between legitimate and illegal devices while maintaining compatibility with standard HID devices, preventing system damage without reducing versatility.
Data Source
AI summary
A device and method used for protection against attacks using a HID keyboard or mouse, the device comprising: one or more HID internal interfaces for connecting the HID input interface of the protected device; one or more HID external interfaces for connecting to the external device; a forwarding control module for connecting to the HID internal interface and HID external interface respectively; and protocol analysis module, for performing protocol analysis on the external device connected to the HID external interface to determine whether the external device is a legitimate HID keyboard or mouse device; wherein, the forwarding control module is used to switch the HID internal interface and the HID external on or off to prevent illegal HID keyboard or mouse devices from accessing to the protected device. The present invention can prevent the unauthorized access of HID keyboard or mouse devices from damaging the protected devices.