USB Firewall Intercepts Malicious Device Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
USB devices pose a significant security threat as they can be subverted to facilitate attacks on computer systems, making it difficult to prevent or mitigate malicious behavior from misbehaving USB devices.
Innovation Solution
A software or hardware-based USB firewall intercepts and inspects USB traffic, reroutes it to a sandbox for verification, and allows or blocks it based on user-defined policies, providing an additional layer of protection by quarantining unauthorized devices and their firmware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If USB devices are allowed to connect freely to the host machine, then USB connectivity and device compatibility are improved, but security vulnerabilities and malicious attacks increase
Solution Approach 1:
The patent implements a USB firewall as an intermediary device that sits between the USB device and the host machine. This firewall intercepts USB traffic, inspects it for malicious content, and selectively blocks or allows communication based on security policies. The firewall acts as a mediator that maintains USB connectivity while filtering out harmful attacks, thus resolving the contradiction between device compatibility and security protection.
2Reliability
If USB traffic is intercepted and inspected for security, then security protection is improved, but system performance and USB communication speed deteriorate
Solution Approach 1:
The USB firewall implements partial inspection by selectively monitoring only certain types of USB traffic or applying different inspection levels based on device type and risk assessment. Rather than inspecting every byte of USB communication, the system applies security measures to the most critical traffic streams, thereby maintaining security protection while minimizing the performance overhead associated with comprehensive traffic analysis.
3Reliability
If USB devices are blocked without verification, then security protection is improved, but legitimate device functionality and user convenience deteriorate
Solution Approach 1:
The USB firewall incorporates feedback mechanisms where the system monitors USB device behavior, learns from inspection results, and dynamically adjusts security policies. When a new USB device is detected, the firewall can prompt the user for verification or automatically allow devices that exhibit legitimate behavior patterns. This feedback loop enables the system to protect against malicious devices while maintaining ease of operation for legitimate USB peripherals.
Data Source
AI summary
USB traffic is intercepted between a USB device and a computer system. It is determined whether the USB device has previously had a policy associated with it as to whether USB traffic from the device should be blocked, allowed, or sanitized. In response to not having a previous policy for the USB device, a request is made for a user to be prompted to provide a policy of one of block, allow, or sanitize for the USB device. In response to a user-provided-policy, one of the following are performed: blocking the traffic, allowing the traffic, or sanitizing the traffic between the USB device and the computer system. Apparatus, methods, and computer program products are disclosed.