USB Intermediary Protection Against BadUSB Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern communication devices are vulnerable to BadUSB attacks, where malicious USB devices can be reprogrammed to attack hosts, and existing solutions like USB descriptor firewalls do not effectively prevent such attacks at the hardware level, posing risks to both devices and hosts.
Innovation Solution
A protection device is inserted between the communication device and accessory device via a USB link, generating a random identifier to create a registration rule, modifying responses to requests for serial numbers, and enforcing security policies to sanitize the USB connection, preventing unauthorized access and attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If USB devices are made highly portable and universally compatible, then ease of operation and adaptability improve, but vulnerability to malicious attacks increases
Solution Approach 1:
The patent introduces a protection device as an intermediary component inserted between the USB host and USB accessory. This protection device intercepts and validates USB communication packets, preventing malicious devices from directly attacking the host while maintaining USB compatibility. The protection device acts as a security gatekeeper that allows legitimate devices to communicate while blocking malicious ones.
2Reliability
If USB descriptor firewall uses transfer snooping methods for device identification, then device authorization improves, but device complexity and processing overhead increase
Solution Approach 1:
The protection device performs preliminary validation of USB devices during the initial connection and descriptor exchange phase. By validating device identifiers, serial numbers, and descriptors early in the USB communication sequence, the system prevents unauthorized devices from establishing full communication, reducing the need for complex ongoing monitoring and validation mechanisms.
3Adaptability or versatility
If malicious USB devices can be reprogrammed at controller level, then adaptability of USB devices improves, but security vulnerability worsens
Solution Approach 1:
The protection device applies preliminary anti-action by validating USB device identifiers and descriptors before the device can execute any reprogramming or malicious operations. The system checks device serial numbers, manufacturer identifiers, and descriptor integrity during the initial connection phase, preventing reprogrammable devices from establishing malicious control before their harmful functionality can be activated.
Data Source
Figure 1
Figure 2
AI summary
For a universal serial bus, USB, attack protection between a communication device (CD) and an accessory device (AD), a protection device (PD) inserted between the communication device (CD) and the accessory device (AD) through a USB link is able to: receive (S6) a message (Mes) from the accessory device (AD), the message (Mes) including fields of characteristics of the accessory device, generate (S7) a random identifier (Rid), send (S8) the generated random identifier (Rid) to the communication device (CD) that creates a registration rule based on the generated random identifier, modify (S11) an intercepted response from the accessory device (AD) to a request from the communication device (CD), the request being dedicated to get a value associated with a serial number of the accessory device, by including the generated random identifier (Rid), send (S12) the modified response to the communication device (CD), the modified response triggering a query for registration of the accessory device (AD) by means of the content of the modified response and the created registration rule.