USB Device Security Screening via Descriptor and ROM Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer security measures are inadequate in detecting and preventing keystroke injection tools, such as the USB rubber ducky, which can mimic a keyboard and inject malicious keystrokes into computing devices, exploiting the USB HID class's universal acceptance.
Innovation Solution
A method that identifies and analyzes USB device descriptors and ROM information to assign a security score, comparing them against historic data to determine if the device is malicious, and takes appropriate security actions based on the score, including blocking access or triggering alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If USB devices are accepted based on standard HID class protocols, then device compatibility and ease of operation are improved, but security vulnerability increases allowing keystroke injection tools to function undetected
Solution Approach 1:
The system performs preliminary security screening of USB devices before they are fully recognized and activated. By analyzing device descriptors, ROM information, and configuration files in advance, the system can identify malicious devices like USB rubber ducks before they inject keystrokes, thereby maintaining compatibility while preventing attacks
Solution Approach 2:
The patent introduces an intermediary security screening layer between the USB device and the host computer. This intermediary component analyzes device characteristics and assigns security scores, acting as a mediator that can block malicious devices while allowing legitimate ones to function normally
2Measurement precision
If security screening of USB devices is implemented, then detection accuracy of malicious devices is improved, but system complexity increases
Solution Approach 1:
The security screening process is segmented into multiple independent analysis stages: descriptor analysis, ROM information analysis, and configuration file analysis. Each stage assigns security scores independently, and the results are aggregated, making the complex security function modular and manageable while improving detection accuracy through comprehensive multi-point verification
3Reliability
If USB devices undergo comprehensive security analysis, then security reliability is improved, but device connection time increases
Solution Approach 1:
Security analysis is performed as a preliminary action during the device enumeration phase, before the device is fully initialized. By completing security screening early in the connection process, the system minimizes the time impact while ensuring reliable security verification
Solution Approach 2:
The security screening operates continuously during the device connection process without blocking the overall enumeration flow. Multiple security checks run in parallel and continuously monitor device characteristics, ensuring reliable security verification while maintaining smooth connection timing
Data Source
AI summary
Universal serial bus (USB) devices are evaluated for access according to characteristics including descriptors and ROM information. Descriptors are cross-references to historic descriptors known to be associated with malicious or approved USB devices. ROM information is analyzed to determine congruity of data. Device drivers and configuration files on the USB device are reviewed for indicators of compromise or threat and assigned a corresponding security score. Security actions are taken according to a security score assigned according to matching descriptors and analyzed ROM information.