USB HID Firewall Timing Analysis Against Automation Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information handling systems face challenges in mitigating the security risks associated with USB ports, which can be exploited for data exfiltration and malware, and current technologies fail to provide secure USB ports, which can be used to solve the problem of unauthorized data access and keystroke injection attacks.
Innovation Solution
Implementing a hardware firewall between the USB port and the processor to analyze the timing and patterns of USB data transmissions to distinguish between human and automated inputs, and block malicious communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If USB ports are disabled to prevent security attacks, then security is improved, but usability and functionality are worsened
Solution Approach 1:
A hardware firewall is introduced as an intermediary component between the USB port and the system processor. This firewall monitors and filters USB communications, allowing legitimate human input while blocking automated attack patterns. The firewall acts as a mediator that enables USB functionality while preventing security breaches through pattern recognition and timing analysis of USB packets.
2Reliability
If PS2 ports are used instead of USB ports for security, then security is improved, but adaptability and cost are worsened
Solution Approach 1:
The system changes the operational parameters of USB ports by implementing timing analysis and pattern recognition on USB communications. Instead of disabling USB ports or using outdated PS2 interfaces, the system modifies how USB communications are processed by analyzing packet timing intervals and patterns to distinguish human input from automated attacks, thereby maintaining USB adaptability while achieving security.
3Reliability
If USB ports are completely blocked to prevent attacks, then security is improved, but productivity and functionality are worsened
Solution Approach 1:
Instead of completely blocking all USB communications, the system applies partial action by selectively filtering only malicious patterns while allowing legitimate communications to pass through. The firewall analyzes USB packet timing and patterns, permitting normal human input that falls within expected timing ranges while blocking automated attack sequences, thereby maintaining productivity while providing security.
Data Source
AI summary
An information handling system may include at least one processor, a memory, an external peripheral port configured to couple to external peripheral devices, and a firewall physically coupled between the at least one processor and the external peripheral port. The firewall may be configured to: receive a plurality of communications associated with the external peripheral port, wherein each communication has a time of transmission associated therewith; compare the times of transmission to a human input model to determine a likelihood that the communications were generated by a human; and in response to the likelihood being below the threshold, block the communication from proceeding.