USB Firewall File Access Control Using Hash Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing USB devices lack granular control over file access permissions, leading to potential security vulnerabilities and data exfiltration risks, particularly from infected devices.
Innovation Solution
Implementing a USB firewall and communication subsystem to intercept file access requests, transmit them to an authorization server for permission determination based on file hashes and hardware-generated tokens, and manage cryptographically signed messages for secure file sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If USB devices allow unrestricted file access, then ease of operation is improved, but security and data protection deteriorate
Solution Approach 1:
The patent introduces a USB firewall as an intermediary component between the USB device and the host system. This firewall intercepts file access requests and communicates with an authorization server to determine whether access should be permitted. The intermediary approach allows the system to maintain ease of operation for authorized files while blocking harmful access, thus resolving the contradiction between operational ease and security.
Solution Approach 2:
The patent implements a feedback mechanism where the USB firewall sends file access requests to an authorization server, receives authorization decisions based on file hashes and hardware tokens, and uses this feedback to control file access. This continuous feedback loop ensures that only authorized files can be accessed while maintaining user convenience, addressing both ease of operation and security concerns.
2Reliability
If USB devices implement comprehensive security checks, then security is improved, but device complexity increases
Solution Approach 1:
The patent extracts the complex security verification logic from the USB device itself and places it in a separate authorization server. The USB device only contains a simple firewall that intercepts requests and communicates with the authorization server. This extraction reduces the complexity of the USB device while maintaining comprehensive security checks, as the authorization server handles file hash verification and hardware token validation.
Solution Approach 2:
The authorization server acts as an intermediary that handles the complex security verification tasks. Instead of embedding complex security logic in the USB device, the system uses the authorization server as a mediator that performs hash verification, token validation, and access decision-making. This approach improves security while keeping the USB device structure simple.
3Reliability
If USB devices perform thorough file verification, then security against malware is improved, but processing time increases
Solution Approach 1:
The patent implements preliminary action by pre-computing and storing file hashes before access is requested. When a file access request occurs, the system only needs to verify the pre-computed hash against authorized values rather than performing comprehensive analysis in real-time. This preliminary preparation significantly reduces processing time while maintaining thorough verification, thus resolving the contradiction between malware protection and access speed.
Solution Approach 2:
The patent uses file hashes as copies or representations of the actual file content for verification purposes. Instead of analyzing the entire file content during access, the system verifies a condensed hash representation that captures the essential security characteristics. This copying approach maintains malware protection effectiveness while dramatically reducing processing time compared to full file analysis.
4Reliability
If USB devices use cryptographic verification, then security is improved, but resource consumption increases
Solution Approach 1:
The patent uses cryptographic hashes as efficient copies of file content for verification. Hashing creates a condensed representation that can be quickly compared without processing the entire file. This approach provides strong authentication security while consuming minimal processing resources compared to full file cryptographic analysis, thus resolving the contradiction between authentication reliability and resource consumption.
Data Source
AI summary
Described are techniques for Universal Serial Bus (USB) security. The techniques include intercepting, by a Universal Serial Bus (USB) firewall of a USB device connected to a host, a file access request for a file. The techniques further include transmitting the file access request for the file to an authorization server, where the authorization server determines whether the file access request for the file is permitted based on a hash of the file. The techniques further include receiving a cryptographically signed message from the authorization server based on the hash of the file, where the cryptographically signed message indicates whether the file access request for the file is permitted.