USB Driver Layer Packet Protection for Keyboard Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current USB keyboard security methods, particularly those using filtering and hooking techniques at the HID USB driver or USB hub driver layers, have reached their limits in effectively protecting user input data from malicious keyloggers and spyware, leading to inadequate safety for important information.
Innovation Solution
A method that involves monitoring and filtering input/output packets at the USB driver layer by registering a data protection routine, using identifier filter drivers, and creating clone driver objects to hook and protect packets, ensuring that input/output packets from specific devices like HID USB keyboards are safely processed and protected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If filtering and hooking methods are applied at the HID USB driver or USB hub driver layers, then keyboard security is improved, but interference and collision between security products occur frequently
Solution Approach 1:
The patent segments the USB driver stack into multiple layers (USB driver layer, hub driver layer, HID driver layer, class driver layer) and assigns different security functions to each layer. The USB driver layer handles packet monitoring and classification for all USB devices, while lower layers handle device-specific processing, reducing conflicts between security products.
Solution Approach 2:
The patent introduces a USB driver layer as an intermediary between the USB hub driver and higher-level drivers. This intermediate layer monitors and classifies packets before they reach the HID driver layer, preventing direct conflicts between security products operating at different layers while maintaining systematic security control.
2Reliability
If filtering and hooking are applied at the HID USB driver layer, then keyboard data protection is achieved, but protection reaches the limits and important information cannot be further safely protected
Solution Approach 1:
The patent performs packet monitoring and classification at the USB driver layer before packets are processed by the HID driver layer. By establishing security control early in the data flow path, the system prevents malicious interception at higher layers and enables additional protection mechanisms to operate effectively on already-classified packets.
Solution Approach 2:
The patent adds a new dimension to USB security by operating at the USB driver layer rather than only at the HID driver layer. This dimensional shift in the driver stack allows simultaneous operation of multiple security products at different layers without conflict, expanding the overall protection capability beyond what single-layer solutions can achieve.
3Reliability
If packet monitoring is performed at the USB driver layer for all USB devices, then comprehensive data protection is achieved, but system complexity increases
Solution Approach 1:
The patent implements a universal packet monitoring mechanism at the USB driver layer that handles all USB devices through a common classification framework. The system uses device identifiers and packet type classification to route different device types (keyboards, mice, storage devices) to appropriate processing paths, achieving comprehensive protection without requiring device-specific monitoring code for each device type.
Data Source
AI summary
Disclosed is a method of protecting an input/output packet of a USB device. The method includes: a) registering a filter driver to a USB host controller within a system, and loading the filter driver; b) generating a first filter driver object (filter device object; FiDO), monitoring input/output packets of all USB devices by attaching the first filter driver object (FiDO) to a device object (functional device object; FDO) for the USB host controller; c) determining if there is an identifier in the input/output packet; d) when it is determined that there is the identifier in the input/output packet, registering a data protection routine in the input/output packet; e) copying the input/output packet from the data protection routine to a predetermined region, and exchanging the input/output packet with a predetermined value.