USB Endpoint Type Detection for Selective Device Enumeration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
USB mass storage devices pose a security threat by potentially spreading damaging software and copying sensitive data, and existing solutions either disable all USB access or rely on insecure software measures that can be easily bypassed.
Innovation Solution
Implementing a control hub with endpoint type detection during enumeration, which selectively disables enumeration of USB devices based on their endpoint types and uses a USB lock policy to whitelist trusted devices, while allowing enumeration of safer devices like keyboards and mice, and remotely managing this policy through a secure channel.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If USB ports are physically locked or USB subsystem is disabled, then security against damaging software and data theft is improved, but USB access including friendly access is completely prevented
Solution Approach 1:
The patent segments USB device functionality by endpoint type, creating separate enumeration paths for different device categories. Control endpoints are evaluated against a policy database that identifies safe device types (HID, audio, video, networking) versus potentially harmful types (mass storage, smart card). This segmentation allows selective blocking of harmful devices while permitting friendly devices to enumerate normally.
Solution Approach 2:
The patent introduces an intermediary control hub between the USB host controller and USB devices. This control hub intercepts enumeration requests, queries the policy database to determine if the device type is permitted, and either allows or blocks enumeration based on the policy result. This intermediary layer provides security filtering without completely disabling USB functionality.
2Ease of operation
If software-based USB security solutions are implemented, then USB access is maintained, but security is only as strong as the underlying operating system security and can be easily bypassed
Solution Approach 1:
The patent replaces software-based USB security with a hardware-based solution implemented in the control hub. The security policy enforcement is moved from the operating system software layer to the hardware control hub, which makes security decisions during the physical enumeration process. This hardware-based approach is more resistant to software-based attacks and bypass attempts.
Solution Approach 2:
The patent performs security evaluation during the USB enumeration process, before the device is fully initialized and before any data transfer can occur. The control hub queries the policy database during enumeration to determine permit or block status, preventing potentially harmful devices from establishing communication with the host system in the first place.
3Reliability
If all USB devices are blocked during enumeration, then security against harmful devices is improved, but access to safe devices like keyboards and mice is prevented
Solution Approach 1:
The patent applies different security policies to different USB device types based on their endpoint characteristics. The policy database contains specific rules for different device categories: HID devices (keyboards, mice) are permitted, mass storage devices are blocked, and other device types are evaluated according to their specific security risk profile. This local quality approach ensures that security measures are applied selectively rather than universally.
Solution Approach 2:
The patent changes the enumeration parameter from a blanket block/unblock decision to a nuanced evaluation based on endpoint type, device class, and policy rules. The control hub examines specific parameters of the USB device (endpoint types, device descriptors) and compares them against the policy database to determine the appropriate action, enabling fine-grained control over device access.
Data Source
AI summary
Described herein are embodiments of USB device control using endpoint type detection during enumeration. An apparatus configured for USB device control using endpoint type detection during enumeration may include a host controller configured to selectively disable enumeration of a USB device based at least in part on an endpoint type of the USB device. The apparatus may include a management engine configured to store in the host controller a USB lock policy defining endpoint types disallowed to be enumerated by the apparatus. Other embodiments may be described and/or claimed.