USB Peripheral Authentication Before Embedded-System Enumeration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current embedded systems lack mechanisms to detect the legitimacy of USB devices, allowing malicious peripherals to enumerate as USB transmission devices and steal system data, which cannot be identified by security protection measures like anti-virus software.
Innovation Solution
A USB peripheral authentication method involving a security unit, storage unit, and processor to verify user identity, generate a self-signed certificate using USB device and embedded system IDs and a salt value, and activate communication only if matching credentials are verified.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If USB device enumeration is allowed without authentication, then USB communication functionality is achieved, but system security is compromised allowing data theft
Solution Approach 1:
The patent implements preliminary authentication actions before USB device enumeration is allowed. The embedded system performs certificate verification and identity authentication on the USB device before establishing communication, preventing unauthorized devices from enumerating. This preliminary security check ensures that only authenticated devices can access the system, resolving the contradiction between ease of operation and system security.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism involving certificates and security units. Instead of direct enumeration, the USB device must present valid certificates that are verified by the embedded system's security unit. This intermediary verification layer acts as a mediator between the USB device and the system, ensuring security while maintaining communication functionality.
2Reliability
If USB device authentication is implemented, then system security is improved, but device complexity increases
Solution Approach 1:
The patent extracts the complex authentication logic into a separate security unit within the embedded system. The USB device itself remains relatively simple, while the authentication complexity is moved to the embedded system's security unit that handles certificate verification and key management. This extraction reduces the complexity burden on the USB device while maintaining strong security.
Solution Approach 2:
The patent implements self-service authentication where the USB device carries its own certificates and identification information, and the embedded system performs self-verification using its security unit. The authentication process is automated without requiring external intervention or complex manual configuration, reducing operational complexity while maintaining security.
3Reliability
If certificate verification is performed for all USB devices, then data theft is prevented, but processing time increases
Solution Approach 1:
The patent performs certificate verification as a preliminary action during the USB device connection initialization phase. By checking authentication credentials before establishing full communication, the system prevents data theft from occurring in the first place. This preliminary verification ensures that time is not lost during data transfer operations, as unauthorized devices are blocked before they can access system data.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to the technical field of USB device authentication, and in particular to a USB peripheral authentication method, an embedded system, and a storage medium. The method comprises: verifying a user identity, and accessing a USB device authentication credential generation program of a legitimate user; acquiring USB device ID information, embedded system ID information, and a salt value generated by a random number generator; associating the information by means of a secure unit, using the information as an input, generating a key pair, and issuing a self-signed certificate; placing the information into a storage area of the secure unit, and returning the self-signed certificate and the salt value to the USB device or the user; and when the USB device is accessed, verifying whether the information matches, if yes, activating a USB communication function, or otherwise, disabling the communication function of the USB device. The present invention is reliable and effective, and can be used for a USB peripheral lacking storage capability and can solve the problem that existing embedded systems lack a mechanism for performing legitimacy detection on USB devices accessing the systems.