Systems and methods for securing ports

• US 20050229249A1
• Filed: 04/09/2004
• Published: 10/13/2005
• Est. Priority Date: 04/09/2004
• Status: Active Grant

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Piwonka, Mark A., Reynolds, Edward M.
• Granted Patent: US 7,552,475 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices

Abstract

Systems, methodologies, media, and other embodiments associated with securing ports are described. One exemplary system embodiment includes a configuration logic configured to provide a security option for securing one or more selected ports. The example system may also include a security logic configured to, in response to the security option being selected, cause a data store to be modified by changing a port count to specify a fewer number of physical ports to cause an operating system to not detect the one or more selected ports.

Claims

1. A system for securing one or more ports of a computing device that includes an actual number of physical ports and a data store that contains a port count specifying the actual number of physical ports, the system comprising:

a configuration logic configured to provide a security option for securing one or more selected ports; and

a security logic configured to, in response to the security option being selected, cause the data store to be modified by changing the port count to specify a fewer number of physical ports to cause an operating system to not detect the one or more selected ports.

2. The system of claim 1 where the security logic is configured to access the data store that includes a register configured to store host controller structural parameters based on an enhanced host controller interface specification.

3. The system of claim 2 where the port count is an N_PORTS field included within the host controller structural parameters that specifies a number of physical ports present in the computing device, the security logic being configured to cause the N_PORTS field to be modified in order to hide the one or more selected ports from the operating system.

4. The system of claim 2 where the host controller structural parameters include a companion controller field that indicates a number of companion controllers associated with the ports, the security logic being configured to cause the companion controller field to be reduced by a number to cause the operating system to be unaware of one or more of the companion controllers.

5. The system of claim 1 where the data store includes a register configured to be read by the operating system during an enumeration process to determine the number of physical ports to enumerate, where the one or more selected ports are not enumerated by the operating system.

6. The system of claim 5 where the number of physical ports indicated in the data store cause the operating system to enumerate a fewer number of ports than the actual number of physical ports.

7. The system of claim 1 where the system configuration logic includes a graphical user interface.

8. The system of claim 1 where the system is embodied as a computer-readable medium configured to provide the system configuration logic and the security logic as processor executable instructions.

9. The system of claim 1 where the one or more selected ports are front ports of the computing device.

10. A computing system, comprising:

a housing;

one or more processors;

a set of physical ports including;

one or more front ports positioned on the housing and being accessible by a user to connect an external device to the computing system; and

one or more back ports, positioned on the housing, being configured to connect an external device to the computing system;

a structural parameter configured to indicate a total number of physical ports that are present in the computing system including the one or more front ports and the one or more back ports, the structural parameter being configured to indicate a fewer number of ports than the total number of physical ports in order to prohibit operation of the one or more front ports; and

an operating system configured to enumerate ports that are present in the computing system based on the structural parameter, the structural parameter causing the one or more front ports to be undetectable by the operating system causing the one or more front ports to be inoperable.

11. The computing system of claim 10 where the fewer number of ports indicated in the structural parameter causes the operating system to not enumerate the one or more front ports so that no operable connection is established between the one or more front ports and the operating system.

12. The computing system of claim 10 where the one or more front ports are logically numbered with greater port numbers than the one or more back ports, and where the operating system is configured to enumerate ports from a lowest to highest port number.

13. The computing system of claim 10 where the structural parameter is a data stored configured to contain a plurality of configuration parameters.

14. The computing system of claim 10 where the set of physical ports are universal serial bus (USB) ports and where the computing system further includes:

a high speed host controller configured to control selected ports of the set of physical ports at a first communication speed;

one or more companion controllers configured to control selected ports of the set of physical ports at one or more communication speeds that are different than the first communication speed; and

a companion controller field configured to specify a number of actual companion controllers where the companion controller field being modified to specify a fewer number of companion controllers than the number of actual companion controllers to account for the one or more front ports being undetected by the operating system.

15. The computing system of claim 10 further including:

a graphical user interface configured to allow a user to select the one or more front ports to be inoperable or operable; and

a port security logic configured to reconfigure the structural parameter to modify the total number of physical ports stored therein in response to the one or more front ports being selected to be inoperable or operable.

16. A method for securing a port in a device having a total number of physical ports, the method comprising:

receiving a signal that indicates a number of ports to be secured from user access;

accessing a data store that contains a value for the total number of physical ports; and

reducing the value in the data store by the number of ports to be secured to cause an operating system to be aware of a number of physical ports that is less than the total number of physical ports.

17. The method of claim 16 further including:

providing an option to a user to secure a port; and

in response to the option being selected, generating the signal that indicates the number of ports to be secured.

18. The method of claim 16 where the total number of physical ports include one or more front ports positioned on the device and being accessible by a user, and one or more back ports positioned on the housing, and where the signal indicates to secure the one or more front ports;

and

where the reducing step includes reducing the value by the number of the one more front ports to cause the operating system to not enumerate the one or more front ports.

19. The method of claim 18 further including:

storing a controller value that specifies a number of controllers present in the device that are configured to control the physical ports; and

reducing the controller value by a number of controllers that are associated with the one or more front ports to cause the operating system to not enumerate the controllers that are associated with the one or more front ports.

20. The method of claim 18 where the reducing step includes:

enabling the data store to be writeable;

modifying the value in the data store to specify the number of physical ports that is less than the total number of physical ports; and

enabling the data store to be read-only.

21. A computer-readable medium for providing processor executable instructions operable to perform a method, the method comprising:

providing a security option to secure one or more ports of a device;

in response to the security option being selected for a port, specifying a reduced number of physical ports that is less than an actual number of physical ports present in the device; and

changing a configuration parameter that indicates, to an operating system, the actual number physical ports, where the configuration parameter is changed to indicate the reduced number of physical ports causing the operating system not to enumerate the one or more ports.

22. The computer-readable medium of claim 21 where changing the configuration parameter to the reduced number of physical ports causes no operable connection to be established between the one or more ports and the operating system.

23. The computer-readable medium of claim 21 further including processor executable instructions to cause a processor to:

enable the configuration parameter to be writeable;

change the configuration parameter to indicate the reduced number of physical ports; and

enabling the configuration parameter to be read-only.

24. The computer-readable medium of claim 21 where the configuration parameter includes a host controller structural parameter associated with a universal serial bus controller.

25. A system, comprising:

port configuration means for selecting a port to be secured from a set of physical ports configured within a computing device; and

security means for causing an operating system to not enumerate the selected port to cause the selected port to be inoperable, including modifying a port count to specify one less port than a total number of the set of physical ports where the operating system enumerates ports based on the port count.

26. The system of claim 25 where the security means is further configured to modify the port count by one or more values.

27. In a computer system having a graphical user interface comprising a display and a selection device, a method of providing and selecting from a set of data entries on the display, the method comprising:

retrieving a one or more data entries, where a data entry represents a security status of a port;

displaying the one or more data entries on the display to show the security status and allow the security status to be modified;

receiving a data entry selection signal indicative of the selection device selecting one or more of the data entries that modifies the security status of a port; and

in response to the data entry selection signal, initiating an operation that causes a configuration parameter to be modified in accordance with the security status where the configuration parameter stores a value that specifies a total number of physical ports that are present in the computer system, the operation causing the value to be reduced in response to the security status for a selected port being set to indicate a secured status to cause an operating system not to enumerate the selected port.

28. The graphical user interface of claim 27 where the security status includes an available status and a hidden status.

29. The graphical user interface of claim 27 where the configuration parameter is configured as part of a host controller structural parameter associated with a host controller that provides an interface to one or more ports in the computer system.

30. The graphical user interface of claim 29 where the one or more ports are universal serial ports.