Protecting a system from attack via a device attached to a usb port

Patent metadata

Field	Value
Publication number	US-2022019549-A1
Application number	US-202016930738-A
Country	US
Kind code	A1
Filing date	Jul 16, 2020
Priority date	Jul 16, 2020
Publication date	Jan 20, 2022
Grant date	—

Abstract

A method for protecting a system from a malicious USB device. The method includes one or more computer processors interrupting a universal serial bus (USB) enumeration process corresponding to a first USB device operatively couple to a system. The method further includes determining whether the first USB device is a human interface device (HID) based on a set of descriptor values corresponding to the first USB device. The method further includes responding to determining that that first USB device is a HID by generating a validation challenge. The method further includes presenting the validation challenge to a user of the system. The method further includes responding to determining that the user fulfils one or more actions of the validation challenge by resuming the USB enumeration process corresponding to the first USB device.

First claim

1 . A method comprising:
interrupting, by one or more computer processors, a universal serial bus (USB) enumeration process corresponding to a first USB device operatively couple to a system; determining, by one or more computer processors, whether the first USB device is a human interface device (HID) based on a set of descriptor values corresponding to the first USB device; responsive to determining that that first USB device is a HID, generating, by one or more computer processors, a validation challenge, wherein the validation challenge includes at least one of highlighted graphical elements, a text-to-speech program, a speech-to text program, dictionary program, a thesaurus, a question and answer program, a key or function mapping program that can determine the elements included within a USB HID, an image recognition program, a stopwatch or timer program, a graphics program, a sound/music generation program and an audio recognition program; presenting, by one or more computer processors, the validation challenge to a user of the system; and responsive to determining that the user fulfils one or more actions of the validation challenge, resuming, by one or more computer processors, the USB enumeration process corresponding to the first USB device, wherein the interrupting the USB enumeration process comprises blocking instructions to assign an address to the first USB device.

2 . The method of claim 1 , further comprising:
determining, by one or more computer processors, information related to the system, wherein information related to the system includes a list of one or more trusted HIDs operatively coupled to respective USB ports of the system, and wherein a first descriptor is respectively associated with a trusted HID indicates a HID class corresponding to the trusted HID.

3 . The method of claim 1 , wherein determining whether the first USB device is a HID based on the set of descriptor values corresponding to the first USB device further comprises:
determining, by one or more computer processors, whether a value of a second descriptor of set of descriptor values corresponding to the first USB device is equal to a value of 0x03; and responsive to determining that the value of the second descriptor value of the set of descriptor values corresponding the first USB device is equal to the value of 0x03, flagging, by one or more computer processors, the first USB device as the HID.

4 . The method of claim 3 , further comprising:
responsive to determining that the value of the second descriptor is different from the value of 0x03, resuming, by one or more computer processors, the USB enumeration process corresponding to the first USB device.

5 . The method of claim 1 , wherein generating the validation challenge further comprises:
determining, by one or more computer processors, whether the system includes a trusted HID; responsive to determining that the system includes the trusted HID, generating, by one or more computer processors, the validation challenge based on one or more random actions related to the trusted HID and random temporal windows during which a respective random action of the one or more random actions is performed by a user of the system; and responsive to determining that each of the one or more random actions is performed by the user within the respective random temporal window, determining, by one or more computer processors, that the validation challenge is passed.

6 . The method of claim 1 , further comprising:
determining, by one or more computer processors, initial sets of USB descriptor values respectively associated with one or more USB devices operatively couple to the system that are further identified as HIDs.

7 . The method of claim 6 , further comprising:
monitoring, by one or more computer processors, a USB device operatively coupled to the system while the system operates, wherein monitoring includes determining a subsequent set of USB descriptor values respectively associated with the monitored USB device; determining, by one or more computer processors, that one or more descriptor values corresponding to the subsequent set of USB descriptor values for the monitored USB device differs from the initial set of USB descriptor values respectively associated with the monitored USB device; and blocking, by one or more computer processors, a USB port corresponding to the monitored USB device associated with the subsequent set of USB descriptors that differ.

8 . A computer program product comprising:
one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions readable/executable by one or more computer processors:
program instructions to interrupt a universal serial bus (USB) enumeration process corresponding to a first USB device operatively couple to a system;
program instructions to determine whether the first USB device is a human interface device (HID) based on a set of descriptor values corresponding to the first USB device;
responsive to determining that that first USB device is a HID, program instructions to generate a validation challenge, wherein the validation challenge includes at least one of highlighted graphical elements, a text-to-speech program, a speech-to text program, dictionary program, a thesaurus, a question and answer program, a key or function mapping program that can determine the elements included within a USB HID, an image recognition program, a stopwatch or timer program, a graphics program, a sound/music generation program and an audio recognition program;
program instructions to present the validation challenge to a user of the system;
program instructions to block an active USB port that includes the first USB device that failed the validation challenge; and
responsive to determining that the user fulfils one or more actions of the validation challenge, program instructions to resume the USB enumeration process corresponding to the first USB device,
wherein the program instructions to interrupt the USB enumeration process comprise program instructions to block instructions to assign an address to the first USB device.

9 . The computer program product of claim 8 , further comprising:
program instruction to determine information related to the system, wherein information related to the system includes a list of one or more trusted HIDs operatively coupled to respective USB ports of the system, and wherein a first descriptor is respectively associated with a trusted HID indicates a HID class corresponding to the trusted HID.

10 . The computer program product of claim 8 , wherein program instructions to
determine whether the first USB device is a HID further comprise: program instructions to determine whether a value of a second descriptor of set of descriptor values corresponding to the first USB device is equal to a value of 0x03; and responsive to determining that the value of the second descriptor value of the set of descriptor values corresponding the first USB device is equal to the value of 0x03, program instructions to flag the first USB device as the HID.

11 . The computer program product of claim 10 , further comprising:
responsive to determining that the value of the second descriptor is different from the value of 0x03, program instructions to resume the USB enumeration process corresponding to the first USB device.

12 . The computer program product of claim 8 , wherein program instructions to generate the validation challenge further comprise:
program instructions to determine whether the system includes a trusted HID; responsive to determining that the system inc

Assignees

• IBM

Inventors

• Liebinger Portela Franz Friedrich
• Rodriguez Bravo Cesar Augusto
• Jimenez Mendez Kevin

Classifications

• G06F21/554

  involving event detection and direct action · CPC title

• G06F13/385 Primary

  for adaptation of a particular data processing system to different peripheral devices · CPC title

• G06F2221/2103

  Challenge-response · CPC title

• G06F21/85

  interconnection devices, e.g. bus-connected or in-line devices · CPC title

• G06F11/3051

  Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs (verification or detection of system hardware configuration G06F11/2247) · CPC title