Virtual Bus Driver Blocks Malicious USB Firmware Reprogramming
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions fail to prevent malicious reprogramming of USB devices' firmware, allowing malware to alter firmware for malicious purposes, such as emulating keyboard input or network card functions, which can spread malware and compromise host systems.
Innovation Solution
A virtual bus driver in a VDI environment monitors USB request blocks (URBs) to identify attempts to modify firmware and blocks unauthorized changes, ensuring only authorized users or applications can modify the firmware of redirected USB devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If USB device redirection is implemented in VDI environment, then USB device functionality is accessible remotely, but firmware can be maliciously reprogrammed
Solution Approach 1:
The patent introduces a virtual bus driver as an intermediary component between the host system and the redirected USB device. This virtual bus driver intercepts and monitors USB Request Blocks (URBs) destined for the device, examining their contents to identify firmware modification attempts. By positioning this intermediary in the communication path, the system maintains USB device functionality while adding a security layer that prevents malicious firmware reprogramming without blocking legitimate operations
Solution Approach 2:
The system performs preliminary analysis of USB Request Blocks before they reach the USB device. The virtual bus driver examines URB contents in advance to detect vendor-specific commands that could modify firmware, and blocks these commands before they can execute on the device. This preliminary action prevents malicious reprogramming attempts from reaching the device while allowing legitimate firmware operations to proceed
2Adaptability or versatility
If firmware modification is allowed, then device functionality can be updated, but malware can exploit this for malicious purposes
Solution Approach 1:
The virtual bus driver implements a feedback mechanism by monitoring USB Request Blocks and analyzing their contents for firmware modification commands. When a vendor-specific command is detected, the driver provides feedback by blocking the URB and preventing it from reaching the USB device. This feedback loop enables the system to distinguish between legitimate firmware updates and malicious reprogramming attempts, maintaining security while preserving necessary device functionality
Solution Approach 2:
The patent extracts and isolates the security monitoring function into a separate virtual bus driver component. This extracted security layer specifically targets and removes malicious firmware modification commands from the stream of USB communications without affecting legitimate device operations. By separating the security function from the main USB communication path, the system can selectively block harmful commands while maintaining overall system reliability
Data Source
AI summary
Reprogramming of a redirected USB device can be restricted to prevent the redirected USB device's firmware from being modified maliciously. A virtual bus driver can be configured to monitor USB request blocks (URBs) to identify whether an URB pertains to an attempt to alter the firmware of a redirected USB device. When an URB is identified as pertaining to an attempt to alter the firmware, the virtual bus driver can block the URB unless the URB is associated with an authorized user or application. In this way, only an authorized user or application will be allowed to modify the firmware of a redirected USB device thereby ensuring that a malicious user or application cannot modify the firmware in an improper manner.