USB Threat Intelligence via Virtual Environment Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
USB ports provide an easy access point for unauthorized attacks on computer systems, even when locked, as malicious devices can inject code without user interaction, posing a threat to security and convenience.
Innovation Solution
A computing device detects USB connections to a locked computer and creates a temporary virtual environment to monitor and record input, processing keystrokes to determine threats and record information, thereby reducing exposure to USB-based threats while allowing 'plug-n-play' functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If USB ports are enabled for plug-n-play functionality, then ease of operation is improved, but security reliability deteriorates due to unauthorized code injection
Solution Approach 1:
A virtual machine environment acts as an intermediary layer between the USB device and the host operating system. When a USB device is connected, the system creates a virtual machine that intercepts and processes all inputs from the USB device, preventing direct access to the host system until the device is verified as safe through analysis of its behavior in the isolated environment.
2Reliability
If security monitoring is implemented for USB connections, then computer security is improved, but device complexity increases due to additional detection and virtualization components
Solution Approach 1:
The security analysis functionality is extracted from the main operating system into a separate virtual machine environment. This allows the host system to maintain normal USB functionality while the virtual machine handles all security monitoring, input interception, and threat analysis operations, effectively isolating complexity into a dedicated component.
3Reliability
If a virtual environment is created to monitor USB input, then computer security is improved, but loss of time occurs during threat detection and analysis
Solution Approach 1:
The system performs preliminary actions by automatically creating the virtual machine environment and beginning monitoring of USB device behavior immediately upon connection, before any potentially harmful actions can occur. The virtual machine pre-configures input interception and begins analyzing the device's behavior patterns in real-time, reducing the time needed for threat detection.
Data Source
AI summary
A method includes: detecting, by a computing device, connection of a universal serial bus device to a computer; determining, by the computing device, that the computer is in a locked mode; detecting, by the computer device, input to the computer within a predetermined time of detecting the connection; determining, by the computing device as a result of the computer being locked and detecting the input, that the input is a threat to the computer; creating, by the computing device, a temporary virtual environment; receiving, by the computing device, the input into the temporary virtual environment; processing, by the computing device, the input in the temporary virtual environment; and recording, by the computing device, information related to the input.