USB Device Emulation for Malicious Payload Detection

Solution Overview

Problem

Existing systems lack effective methods to detect and prevent malicious actions from USB devices, particularly during the plug-and-play detection and enumeration process, which can lead to vulnerabilities in computing devices and enterprise networks.

Innovation Solution

A security system that intercepts data exchanges between USB devices and computing devices, redirects them to a sandboxed environment for analysis, and uses emulation logic to determine if the USB device is infected before allowing enumeration or configuration.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If plug-and-play functionality is enabled for automatic detection and enumeration of USB devices, then ease of operation is improved, but security vulnerability increases due to potential malicious exploits during the detection process

Engineering Contradiction:

Improveease of operationVSAvoidsecurity vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary actions by creating a virtual machine snapshot before USB device enumeration occurs. This snapshot captures the system state prior to potential malicious attacks, enabling rollback if exploitation is detected. The virtual machine is configured with USB device access capabilities in advance, and security analysis software is pre-installed to monitor the enumeration process for malicious activities before they can compromise the host system.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

A virtual machine serves as an intermediary layer between the USB device and the host computing device. The virtual machine handles all USB device detection, enumeration, and communication, preventing direct access to the host system. Security analysis software running in the virtual machine monitors and analyzes USB device behavior, blocking malicious exploits while allowing legitimate devices to function normally through the virtualized environment.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If USB device enumeration and driver installation are performed automatically, then productivity is improved, but reliability deteriorates due to potential installation of malicious payloads

Engineering Contradiction:

ImproveproductivityVSAvoidreliability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system performs preliminary actions by creating a virtual machine snapshot before USB device enumeration occurs. This snapshot captures the system state prior to potential malicious attacks, enabling rollback if exploitation is detected. The virtual machine is configured with USB device access capabilities in advance, and security analysis software is pre-installed to monitor the enumeration process for malicious activities before they can compromise the host system.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system creates a virtual copy of the computing device environment through virtualization. This virtual machine copy replicates the host system's USB device handling capabilities, allowing malicious USB devices to be enumerated and analyzed in the virtual environment without affecting the real host system. The virtual machine snapshot can be reverted to its original state after analysis, ensuring no permanent changes or malicious installations persist.

Inventive Principle:

Principle #26Copying

3Reliability

If security analysis is performed on USB devices before enumeration, then security is improved, but device complexity increases due to additional interception and redirection mechanisms

Engineering Contradiction:

ImprovesecurityVSAvoiddevice complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

A virtual machine serves as an intermediary layer between the USB device and the host computing device. The virtual machine handles all USB device detection, enumeration, and communication, preventing direct access to the host system. Security analysis software running in the virtual machine monitors and analyzes USB device behavior, blocking malicious exploits while allowing legitimate devices to function normally through the virtualized environment.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces complex hardware-based security inspection mechanisms with software-based virtualization and emulation. Instead of using physical hardware to intercept and analyze USB devices, the system uses virtual machine software to create a virtualized USB environment, simplifying the overall system architecture while maintaining security analysis capabilities through software-based monitoring and control.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS12242397B1System and method for replay of peripheral device attacks

Publication Date: 2025.03.04 MUSARUBRA US LLC

AI summary

Disclosed herein is a computerized method for emulating processing of a peripheral device including operations of providing an insertion emulation signal to a computing device emulating insertion of the peripheral device to a port of the computing device, intercepting a request for a device descriptor of the peripheral device from a PnP manager operating on the computing device, providing a device descriptor of the peripheral device to the PnP manager, wherein the PnP manager is configured to enumerate the emulated peripheral device, intercepting one or more universal serial bus (USB) request blocks (URBs) from the PnP manager, and responsive to each of the one or more URBs, providing a response to the PnP manager. The insertion emulation signal may emulate a voltage transition on a data line of the port of the computing device. The peripheral device may adhere to a USB standard.