USB Intermediary Protection Against BadUSB Attacks

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Modern communication devices are vulnerable to BadUSB attacks, where malicious USB devices can be reprogrammed to attack hosts, and existing solutions like USB descriptor firewalls do not effectively prevent such attacks at the hardware level, posing risks to both devices and hosts.

Innovation Solution

A protection device is inserted between the communication device and accessory device via a USB link, generating a random identifier to create a registration rule, modifying responses to requests for serial numbers, and enforcing security policies to sanitize the USB connection, preventing unauthorized access and attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If USB devices are made highly portable and universally compatible, then ease of operation and adaptability improve, but vulnerability to malicious attacks increases

Engineering Contradiction:
ImproveUSB device compatibilityVSAvoidmalicious attacks
Core Design Contradiction:
Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a protection device as an intermediary component inserted between the USB host and USB accessory. This protection device intercepts and validates USB communication packets, preventing malicious devices from directly attacking the host while maintaining USB compatibility. The protection device acts as a security gatekeeper that allows legitimate devices to communicate while blocking malicious ones.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If USB descriptor firewall uses transfer snooping methods for device identification, then device authorization improves, but device complexity and processing overhead increase

Engineering Contradiction:
Improvedevice authorizationVSAvoidfirewall complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The protection device performs preliminary validation of USB devices during the initial connection and descriptor exchange phase. By validating device identifiers, serial numbers, and descriptors early in the USB communication sequence, the system prevents unauthorized devices from establishing full communication, reducing the need for complex ongoing monitoring and validation mechanisms.

Inventive Principle:
Principle #10Preliminary action

3Adaptability or versatility

If malicious USB devices can be reprogrammed at controller level, then adaptability of USB devices improves, but security vulnerability worsens

Engineering Contradiction:
ImproveUSB device reprogrammabilityVSAvoidcontroller-level attacks
Core Design Contradiction:
Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The protection device applies preliminary anti-action by validating USB device identifiers and descriptors before the device can execute any reprogramming or malicious operations. The system checks device serial numbers, manufacturer identifiers, and descriptor integrity during the initial connection phase, preventing reprogrammable devices from establishing malicious control before their harmful functionality can be activated.

Inventive Principle:
Principle #9Preliminary anti-action

Data Source

PatentEP3104296B1USB attack protection
Publication Date: 2019.12.18 ALCATEL LUCENT SA
  • EP3104296B1 patent drawingFigure 1
  • EP3104296B1 patent drawingFigure 2

AI summary

For a universal serial bus, USB, attack protection between a communication device (CD) and an accessory device (AD), a protection device (PD) inserted between the communication device (CD) and the accessory device (AD) through a USB link is able to: receive (S6) a message (Mes) from the accessory device (AD), the message (Mes) including fields of characteristics of the accessory device, generate (S7) a random identifier (Rid), send (S8) the generated random identifier (Rid) to the communication device (CD) that creates a registration rule based on the generated random identifier, modify (S11) an intercepted response from the accessory device (AD) to a request from the communication device (CD), the request being dedicated to get a value associated with a serial number of the accessory device, by including the generated random identifier (Rid), send (S12) the modified response to the communication device (CD), the modified response triggering a query for registration of the accessory device (AD) by means of the content of the modified response and the created registration rule.