USB Device Provisioning for Secure Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions are ineffective in preventing unauthorized access and impersonation attacks through USB devices, as they either block all USB ports or can be easily spoofed by whitelisting software, making it difficult to allow only authorized peripherals to connect to a system while preventing malicious devices.
Innovation Solution
A provisioning process is implemented where a hash value of the device descriptor is encrypted with a private key and inserted into the device descriptor, and upon connection, the encrypted hash is decrypted and compared to a new hash value produced by the client device, allowing only authorized peripherals to access the system by ensuring equivalence between the two values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all USB ports are blocked to prevent unauthorized access, then system security is improved, but usability and access to legitimate peripherals deteriorate
Solution Approach 1:
The system performs preliminary actions by provisioning USB devices with encrypted hash values of their device descriptors before they connect to the client device. This pre-authentication mechanism allows the system to verify device legitimacy upon connection without blocking legitimate peripherals, resolving the contradiction between security and usability.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism using encrypted hash values embedded in device descriptors. This intermediary layer acts as a mediator between the USB device and the client device, enabling secure verification without completely blocking USB ports, thus maintaining both security and accessibility.
2Adaptability or versatility
If whitelisting software is used to allow specific devices, then device selection is improved, but security deteriorates because it can be easily spoofed
Solution Approach 1:
The patent replaces the mechanical/software-based whitelisting approach with a cryptographic authentication mechanism. Instead of relying on software-based device identification that can be spoofed, the system uses encrypted hash values of device descriptors that are computationally infeasible to replicate, thereby maintaining device selection capability while eliminating spoofing vulnerabilities.
Solution Approach 2:
The system changes the authentication parameter from simple device ID whitelisting to cryptographic hash verification. By transforming the authentication mechanism from a software-based list to a cryptographic proof system, the patent maintains adaptability for device selection while dramatically improving security against spoofing attacks.
3Reliability
If USB device authentication is implemented, then security against impersonation is improved, but device complexity increases
Solution Approach 1:
The patent extracts the authentication logic from the client device and places it within the USB device itself through the provisioning process. The encrypted hash value is embedded in the device descriptor, allowing verification to occur with minimal client-side complexity. This extraction reduces the computational burden on the client device while maintaining strong impersonation prevention.
Data Source
AI summary
One embodiment provides a method, including: connecting a USB device to a secure device; provisioning, at the secure device, the USB device, wherein the provisioning comprises encrypting, using a private key, a hash value associated with a device descriptor associated with the USB device into a product field of the device descriptor: introducing the provisioned peripheral device into a client device; determining, using a processor of the client device, that the USB device is an authorized USB device, wherein the determining comprises: decrypting, using a public key that corresponds to the private key, the hash value; producing, by running a hash function on the device descriptor minus the hash value, a new hash value; and identifying that the hash value is equivalent to the new hash value; and enabling the USB device to gain access to a system of the client device. Other aspects are described and claimed.