Differentiating and managing identical USB devices

Patent metadata

Field	Value
Publication number	US-11068613-B2
Application number	US-201816057684-A
Country	US
Kind code	B2
Filing date	Aug 7, 2018
Priority date	Aug 7, 2018
Publication date	Jul 20, 2021
Grant date	Jul 20, 2021

Abstract

Identical USB devices can be differentiated and managed. During enumeration, a filter driver can be loaded on the device stack of any USB device to enable it to selectively allow or block the particular USB device based on a unique identifier of the USB device. The filter driver can obtain this unique identifier of the particular USB device and compare it to an applicable policy to determine whether the particular USB device is allowed. If the policy indicates that a USB device having the unique identifier should be blocked, the filter driver can stop the enumeration process so that the USB device cannot be accessed.

First claim

What is claimed:

1. A method, performed by a filter driver, for managing a particular USB device, comprising:
during enumeration of a first USB device on a computing device, retrieving a unique identifier of the first USB device;
comparing the unique identifier to a policy that includes unique identifiers of USB devices that are to be allowed or blocked;
based on the comparison of the unique identifier to the policy, determining that the first USB device is not allowed; and
stopping the enumeration of the first USB device to prevent the first USB device from being accessible on the computing device.

2. The method of claim 1 , wherein retrieving the unique identifier of the first USB device comprises sending an I/O control request to retrieve a USB container ID or a serial number of the first USB device.

3. The method of claim 2 , wherein the I/O control request is an IOCTL_USB_GET_DESCRIPTOR_FROM_NODE_CONNECTION request.

4. The method of claim 1 , wherein the unique identifier is a USB container ID of the first USB device.

5. The method of claim 1 , wherein the unique identifier is a serial number of the first USB device.

6. The method of claim 1 , wherein the unique identifier comprises both a USB container ID and a serial number of the first USB device.

7. The method of claim 1 , wherein the policy lists unique identifiers of USB devices that are allowed.

8. The method of claim 1 , wherein the policy lists unique identifiers of USB devices that are blocked.

9. The method of claim 1 , wherein stopping enumeration of the first USB device comprises modifying an identifier of the first USB device that is reported to the operating system to prevent a client driver from being loaded for the first USB device.

10. The method of claim 1 , wherein stopping enumeration of the first USB device comprises modifying an IRP_MN_QUERY_ID request.

11. The method of claim 1 , further comprising:
during enumeration of a second USB device on the computing device, retrieving a unique identifier of the second USB device;
comparing the unique identifier of the second USB device to the policy;
based on the comparison of the unique identifier of the second USB to the policy, determining that the second USB device is allowed; and
allowing the enumeration of the second USB device to proceed thereby causing the second USB device to be accessible on the computing device.

12. The method of claim 1 , wherein the first device is a composite device and stopping the enumeration of the first USB device prevents each interface of the first USB device from being accessible on the computing device.

13. The method of claim 1 , further comprising:
causing the unique identifier to be sent to a management server as part of a request to allow the first USB device to be accessed.

14. One or more computer storage media storing computer-executable instructions which when executed by one or more processors implement a method for managing a particular USB device, the method comprising:
during enumeration of a first USB device on a computing device, retrieving a unique identifier of the first USB device;
comparing the unique identifier to a policy that includes unique identifiers of USB devices that are to be allowed or blocked;
based on the comparison of the unique identifier to the policy, determining that the first USB device is not allowed; and
stopping the enumeration of the first USB device to prevent the first USB device from being accessible on the computing device.

15. The computer storage media of claim 14 , wherein the method further comprises:
sending the unique identifier to a management server as part of a request to allow the first USB device to be accessible;
receiving an updated policy;
during a subsequent enumeration of the first USB device on a computing device, retrieving the unique identifier of the first USB device;
comparing the unique identifier to the updated policy;
based on the comparison of the unique identifier to the updated policy, determining that the first USB device is allowed; and
allowing the subsequent enumeration of the first USB device to proceed to cause the first USB device to be accessible on the computing device.

16. The computer storage media of claim 15 , wherein the method further comprises:
wherein an agent service receives the unique identifier from a filter driver and then sends the unique identifier to the management server.

17. The computer storage media of claim 14 , wherein the unique identifier is one or more of a USB container ID or a serial number.

18. The computer storage media of claim 15 , wherein the method further comprises:
receiving, at the management server, input from an administrator that approves the request; and
in response to the input, generating the updated policy by adding or removing the unique identifier of the first USB device.

19. A method for allowing a particular USB device based on a unique identifier of the particular USB device, comprising:
during enumeration of a first USB device on a computing device, retrieving a unique identifier of the first USB device, the unique identifier comprising one or both of a USB container ID or a serial number;
using the unique identifier to query a policy that governs connection of USB devices;
determining that the policy indicates that the unique identifier represents a USB device that is not allowed; and
preventing the first USB device from being accessible on the computing device.

20. The method of claim 19 , further comprising:
sending a request to a management server for approval to connect the first USB device, the request including the unique identifier.

Assignees

• Dell Products Lp

Inventors

• Vajravel Gokul Thiruchengode
• Johnsimon Jenin

Classifications

• G06F13/102 Primary

  where the program performs an interfacing function, e.g. device driver (G06F13/105 takes precedence; contention policies within device drivers G06F9/4881; scheduling within device drivers G06F9/52) · CPC title

• G06F2213/0042

  Universal serial bus [USB] · CPC title

• G06F13/4282

  on a serial bus, e.g. I2C bus, SPI bus (on daisy chain buses G06F13/4247) · CPC title

• G06F21/73

  by creating or determining hardware identification, e.g. serial numbers · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title