Universal serial bus (USB) filter hub malicious code prevention system

Patent metadata

Field	Value
Publication number	US-9990325-B2
Application number	US-201514683469-A
Country	US
Kind code	B2
Filing date	Apr 10, 2015
Priority date	Apr 10, 2015
Publication date	Jun 5, 2018
Grant date	Jun 5, 2018

Abstract

Embodiments relate a universal serial bus (USB) filter hub. An aspect includes receiving, by the USB filter hub that is in communication with a host computer system, a connection from a USB device at a USB port of the USB filter hub. Another aspect includes determining, by the USB filter hub, a type of the USB device. Another aspect includes determining whether the type of the USB device is valid. Yet another aspect includes, based on determining that the type of the USB device is valid, filtering commands that are communicated between the USB device and the host computer system via the USB filter hub based on a predetermined command set corresponding to the determined type of the USB device.

First claim

What is claimed is:

1. A computer implemented method comprising:
receiving, by a universal serial bus (USB) filter hub that is in communication with a host computer system, a connection from a USB device at a USB port of the USB filter hub;
determining, by the USB filter hub, a type of the USB device;
determining that the type of the USB device is valid;
based on determining that the type of the USB device is valid, filtering commands that are communicated between the USB device and the host computer system via the USB filter hub based on a predetermined command set corresponding to the determined type of the USB device;
intercepting, by the USB filter hub, a command from the USB storage device that is not part of the predetermined command set, such that the intercepted command is not transmitted to the host computer system;
detecting a deregistration attempt by the USB device wherein the deregistration attempt comprises spoofing of a physical unplugging and plugging back in of the USB device, and wherein the detections comprises one of physical detection of the presence of the USB device in the USB port by an optical detector or a switch, and electrical detection of the presence of the USB device in the USB port based on continuity of a ground connection of the USB filter hub; and
disabling the USB device based on at least one of the intercepted command and the deregistration attempt.

2. The method of claim 1 , wherein determining that the type of the USB device is valid comprises checking a whitelist of permitted devices, wherein the whitelist comprises a list of permitted device types, and a respective permitted number of each permitted device type.

3. The method of claim 1 , wherein determining that the type of the USB device is valid comprises receiving confirmation from a user of the host computer system that the type of the USB device is valid.

4. The method of claim 1 , wherein the USB filter hub comprises a lock switch, and the method further comprises allowing booting of the host computer system from the USB device that is attached to the USB filter hub based on the lock switch.

5. The method of claim 1 , wherein the USB filter hub is located internally to the host computer system.

6. The method of claim 1 , wherein the USB filter hub is located externally to the host computer system and is connected to a USB port of the host computer system, and the method further comprises comprising disabling an additional USB port of the host computer system based on the USB filter hub being connected to the USB port.

7. A computer program product comprising:
a computer readable storage medium having program instructions embodied therewith, the program instructions readable by a processing circuit to cause the processing circuit to perform a method comprising:
receiving, by a universal serial bus (USB) filter hub that is in communication with a host computer system, a connection from a USB device at a USB port of the USB filter hub;
determining, by the USB filter hub, a type of the USB device;
determining that the type of the USB device is valid;
based on determining that the type of the USB device is valid, filtering commands that are communicated between the USB device and the host computer system via the USB filter hub based on a predetermined command set corresponding to the determined type of the USB device;
intercepting, by the USB filter hub, a command from the USB storage device that is not part of the predetermined command set, such that the intercepted command is not transmitted to the host computer system; and
detecting a deregistration attempt by the USB device wherein the deregistration attempt comprises spoofing of a physical unplugging and plugging back in of the USB device, and wherein the detections comprises one of physical detection of the presence of the USB device in the USB port by an optical detector or a switch, and electrical detection of the presence of the USB device in the USB port based on continuity of a ground connection of the USB filter hub; and
disabling the USB device based on at least one of the intercepted command and the deregistration attempt.

8. The computer program product of claim 7 , wherein determining that the type of the USB device is valid comprises checking a whitelist of permitted devices, wherein the whitelist comprises a list of permitted device types, and a respective permitted number of each permitted device type.

9. The computer program product of claim 7 , wherein determining that the type of the USB device is valid comprises receiving confirmation from a user of the host computer system that the type of the USB device is valid.

10. The computer program product of claim 7 , wherein the USB filter hub comprises a lock switch, and further comprising allowing booting of the host computer system from the USB device that is attached to the USB filter hub based on the lock switch.

11. A universal serial bus (USB) filter hub comprising:
a memory; and
a processor, communicatively coupled to said memory, the computer system configured to perform a method comprising:
receiving, by the USB filter hub that is in communication with a host computer system, a connection from a USB device at a USB port of the USB filter hub;
determining, by the USB filter hub, a type of the USB device;
determining whether the type of the USB device is valid;
based on determining that the type of the USB device is valid, filtering commands that are communicated between the USB device and the host computer system via the USB filter hub based on a predetermined command set corresponding to the determined type of the USB device;
intercepting, by the USB filter hub, a command from the USB storage device that is not part of the predetermined command set, such that the intercepted command is not transmitted to the host computer system; and
detecting a deregistration attempt by the USB device wherein the deregistration attempt comprises spoofing of a physical unplugging and plugging back in of the USB device, and wherein the detections comprises one of physical detection of the presence of the USB device in the USB port by an optical detector or a switch, and electrical detection of the presence of the USB device in the USB port based on continuity of a ground connection of the USB filter hub; and
disabling the USB device based on at least one of the intercepted command and the deregistration attempt.

12. The system of claim 11 , wherein determining that the type of the USB device is valid comprises checking a whitelist of permitted devices, wherein the whitelist comprises a list of permitted device types, and a respective permitted number of each permitted device type.

13. The system of claim 11 , wherein determining that the type of the USB device is valid comprises receiving confirmation from a user of the host computer system that the type of the USB device is valid.

Assignees

• IBM

Inventors

• Hetzler Steven R
• Smith Daniel F

Classifications

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F13/4282

  on a serial bus, e.g. I2C bus, SPI bus (on daisy chain buses G06F13/4247) · CPC title

• G06F12/14

  Protection against unauthorised use of memory {or access to memory} · CPC title

• G06F13/4068 Primary

  Electrical coupling · CPC title

• G06F3/0227

  Cooperation and interconnection of the input arrangement with other functional units of a computer (G06F3/023 - G06F3/037 take precedence) · CPC title