USB Peripheral Authentication Using Certificates for Embedded Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current embedded systems lack effective mechanisms to authenticate USB peripherals, allowing malicious devices to enumerate themselves and steal data, which existing security measures like anti-virus software cannot detect.
Innovation Solution
A USB peripheral authentication method involving a security unit, storage unit, and processor to verify user identity, generate a self-signed certificate using USB device and embedded system IDs, and a salt value, ensuring only authorized devices can communicate by matching authentication credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If USB protocol is used to provide universal connectivity, then ease of operation and adaptability are improved, but security and reliability deteriorate due to inability to authenticate device legitimacy
Solution Approach 1:
The system performs preliminary authentication actions before allowing USB device connectivity. A certificate authority (CA) pre-issues digital certificates to legitimate USB devices, and the embedded system stores these certificates in advance. When a USB device connects, the system automatically verifies the device's certificate against the stored trusted certificates before enabling communication, thus preventing unauthorized devices from accessing the system.
2Device complexity
If no authentication mechanism is implemented, then device complexity is reduced, but security deteriorates allowing malicious devices to enumerate as legitimate
Solution Approach 1:
The patent introduces a certificate authority (CA) as an intermediary entity that issues digital certificates to USB devices. The CA acts as a trusted mediator between the embedded system and USB devices, verifying device identity and issuing cryptographic certificates. The embedded system stores these certificates and uses them to authenticate devices, creating a layered security architecture that prevents direct trust between the system and external devices.
Solution Approach 2:
The patent replaces mechanical/physical USB connectivity with a cryptographic authentication mechanism. Instead of relying on physical connection alone, the system uses digital certificates, public-key infrastructure, and cryptographic verification to authenticate device identity. The authentication process involves cryptographic operations such as certificate verification, key pair generation, and digital signature validation, substituting physical connection trust with mathematical security.
3Reliability
If authentication credentials are stored in USB device, then reliability is improved, but device complexity increases due to storage requirements
Solution Approach 1:
The patent applies local quality by differentiating storage requirements based on device capabilities. USB devices with storage functions (mass storage devices) have their authentication certificates stored locally in a dedicated memory area within the device. USB devices without storage functions (such as keyboards, mice, chargers) rely on the embedded system to store and verify their certificates. This differentiated approach ensures reliable authentication while avoiding unnecessary storage complexity in devices that don't require it.
Data Source
AI summary
USB device authentication, and in particular to a USB peripheral authentication method, an embedded system, and a storage medium. The method includes: verifying a user identity, and accessing a USB device authentication credential generation program of a legitimate user; acquiring USB device ID information, embedded system ID information, and a salt value generated by a random number generator; associating the information by means of a secure unit, using the information as an input, generating a key pair, and issuing a self-signed certificate; placing the information into a storage area of the secure unit, and returning the self-signed certificate and the salt value to the USB device or the user; and when the USB device is accessed, verifying whether the information matches, if yes, activating a USB communication function, or otherwise, disabling the communication function of the USB device.