PnP Driver Security for Enumerated Bus Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for detecting and preventing security exploits delivered through enumerated bus devices, such as USB devices, are limited, especially when device serial numbers are unknown or unavailable, posing significant threats like cyber terrorism and industrial espionage.
Innovation Solution
A Plug-and-Play (PnP) driver is developed to attach to device stacks of enumerated bus devices as upper or lower filters, allowing for the alteration, limitation, or blocking of device functionality, and creating unique descriptors for identification, while also inventorying and fingerprinting devices to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If device serial numbers are used to detect and block malicious USB devices, then security detection capability is improved, but the system becomes ineffective when serial numbers are unknown or unavailable
Solution Approach 1:
The patent creates a virtual copy of the USB device through a virtual device driver that mimics the physical device's behavior and interface. This virtual representation allows the security system to interact with and control the device without relying on physical serial numbers, enabling detection and blocking capabilities even when serial numbers are unavailable.
Solution Approach 2:
The virtual device driver acts as an intermediary layer between the operating system and the physical USB device. It intercepts and filters device communications, allowing the system to detect malicious devices through their operational characteristics rather than relying solely on serial number matching.
2Reliability
If a PnP driver attaches to device stacks as filter to block malicious devices, then security protection is improved, but device complexity and potential false positives increase
Solution Approach 1:
The virtual device driver serves as a controlled intermediary that attaches to device stacks only when needed for security detection. It provides a standardized interface for security operations without requiring complex modifications to the existing device stack architecture, thereby limiting the increase in system complexity.
3Reliability
If comprehensive device fingerprinting and inventorying is performed, then security monitoring capability is improved, but processing time and system resources increase
Solution Approach 1:
The system performs device fingerprinting and inventorying activities in advance, during device enumeration and initialization phases. By completing these resource-intensive operations before normal device operation begins, the system minimizes the impact on processing time during active security monitoring.
Solution Approach 2:
Once devices are fingerprinted and inventoried initially, the system maintains continuous security monitoring using the collected information. This allows the system to leverage preliminary analysis results for ongoing security decisions, reducing the need for repeated comprehensive scanning and minimizing continuous processing overhead.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A plug-and-play (PnP) driver associated with a security agent is described herein. The PnP driver attaches to device stacks of enumerated bus devices of a computing device as upper-device or lower-device filters based on the device classes of the enumerated bus devices. For example, the PnP driver may attach to the device stack of a hub or controller device as an upper-device filter and to device stacks of other devices as lower-device filters. Either while attaching or after attachment, the PnP driver may take action to alter, limit, or otherwise block functionality of an enumerated bus device. The PnP driver may also perform a system inventory of enumerated bus devices connected to the computing device and create fingerprints for one or more of the computing devices. Additionally, the PnP driver may create and remove control device objects (CDOs) to enable communication with user-mode processes or threads.