Universal serial bus selective encryption

• US 20090094672A1
• Filed: 08/01/2008
• Published: 04/09/2009
• Est. Priority Date: 10/05/2007
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Pano Logic, Inc.
• Inventors: Garg, Pankaj, Khubchandani, Teju, Choudhury, Himadri, Orady, Aly E., Debski, Matthew B., Kilani, Dali, Bunger, Nils
• Granted Patent: US 8,984,580 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 13/102 where the programme performs an interfacing function, e.g. device driver G06F13/105 takes precedence; scheduling within device drivers G06F9/52; contention policies within device drivers G06F9/4881
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 3/038 Control and interface arrangements therefor, e.g. drivers or device-embedded control circuitry
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: Y02D 10/00 Energy efficient computing, e.g. low power processors, power management or thermal management

Abstract

A method to interact with a remote USB device is disclosed. An identifying message is received from a remote client associated with the remote USB device. The remote USB device is identified based at least in part on the identifying message from the remote client. A security policy is determined for the remote USB device. A policy message is transmitted to the remote client for selectively implementing the security policy of the remote USB device. A method to interact with a local USB device is disclosed. An identifying message is determined by performing a host controller service for the local USB device. The identifying message is transmitted to a server. A policy message is received from the server for selectively implementing a security policy on the local USB device. The security policy is regarded and configuring the host controller service.

Claims

1. A server configured to interact with a remote USB device comprising:

a interface to receive an identifying message from a remote client associated with the remote USB device to a security policy engine;

the security policy engine, configured to;

identify the remote USB device based at least in part on the identifying message from the remote client; and

determine a security policy for the remote USB device; and

the interface, further configured to transmit a policy message from the security policy engine to the remote client for selectively implementing the security policy on the remote USB device.

2. A server as recited in claim 1, wherein the security policy is refined on a transaction by transaction basis.

3. A server as recited in claim 1, wherein the security policy includes a policy to determine which messages to encrypt.

4. A server as recited in claim 1, wherein the security policy includes a policy to determine which unencrypted messages to reject.

5. A server as recited in claim 1, wherein the security policy includes an encryption scheme.

6. A server as recited in claim 1, wherein the security policy includes a public key encryption scheme.

7. A server as recited in claim 1, wherein the security policy includes a symmetric key encryption scheme.

8. A server as recited in claim 1, wherein the policy message selectively implements the security policy for a remote USB device with a specified transfer descriptor index.

9. A server as recited in claim 1, wherein the interface is further configured to selectively not implement the security policy on the remote USB device.

10. A server as recited in claim 1, wherein the security policy is selectively not implemented for a USB configuration of the remote USB device.

11. A server as recited in claim 1, wherein the remote USB device includes a keyboard.

12. A server as recited in claim 1, wherein the remote USB device includes a keyboard and wherein the security policy is selectively not implemented for a keyboard configuration for predetermination of extracted information of a keyboard transfer descriptor.

13. A server as recited in claim 1, wherein the remote USB device includes a mass storage device.

14. A server as recited in claim 1, wherein the remote USB device includes a mass storage device, and wherein the security policy is selectively implemented for a subset of files on the mass storage device.

15. A server as recited in claim 1, wherein the remote USB device includes a mass storage device, and wherein the security policy is selectively not implemented for a subset of directories on the mass storage device.

16. A server as recited in claim 1, wherein the remote USB device includes a mass storage device, and wherein the security policy is selectively not implemented for a subset of operations on the mass storage device.

17. A client configured to interact with a local USB device comprising:

a host controller coupled to the local USB device;

a security policy engine, coupled to the host controller;

an interface, configured to receive a policy message from the server to the security policy engine for selectively implementing a security policy on the local USB device; and

the security policy engine, configured to regard the policy message and configure the host controller.

18. A client as recited in claim 17, wherein the host controller includes a memory protected by a security policy.

19. A client as recited in claim 17, wherein the host controller includes a memory protected by a security policy based on the memory address.

20. A client as recited in claim 17, wherein the security policy is refined on a transaction by transaction basis.

21. A client as recited in claim 17, wherein the security policy includes a policy to determine which messages to encrypt.

22. A client as recited in claim 17, wherein the security policy includes a policy to determine which unencrypted messages to reject.

23. A client as recited in claim 17, wherein the security policy includes an encryption scheme.

24. A client as recited in claim 17, wherein the security policy includes a public key encryption scheme.

25. A client as recited in claim 17, wherein the security policy includes a symmetric key encryption scheme.

26. A client as recited in claim 17, wherein the policy message selectively implements the security policy for the local USB device with a specified transfer descriptor index.

27. A client as recited in claim 17, wherein the security policy is selectively not implemented for a USB configuration of the local USB device.

28. A client as recited in claim 17, wherein the local USB device includes a keyboard.

29. A client as recited in claim 17, wherein the local USB device includes a keyboard and wherein the security policy is selectively not implemented for a keyboard configuration for predetermination of extracted information of a keyboard transfer descriptor.

30. A client as recited in claim 17, wherein the local USB device includes a mass storage device.

31. A client as recited in claim 17, wherein the local USB device includes a mass storage device, and wherein the security policy is selectively implemented for a subset of files on the mass storage device.

32. A client as recited in claim 17, wherein the local USB device includes a mass storage device, and wherein the security policy is selectively not implemented for a subset of directories on the mass storage device.

33. A client as recited in claim 17, wherein the local USB device includes a mass storage device, and wherein the security policy is selectively not implemented for a subset of operations on the mass storage device.

34. A client as recited in claim 17, wherein the security policy engine configures the host controller to interact with the local USB device if and only if the local USB device regards the security policy and otherwise reject interaction.

35. A method to interact with a remote USB device comprising:

receiving an identifying message from a remote client associated with the remote USB device;

identifying the remote USB device based at least in part on the identifying message from the remote client;

determining a security policy for the remote USB device; and

transmitting a policy message to the remote client for selectively implementing the security policy of the remote USB device.

36. A method to interact with a local USB device comprising:

determining an identifying message by performing a host controller service for the local USB device;

transmitting the identifying message to a server;

receiving a policy message from the server for selectively implementing a security policy on the local USB device; and

regarding the security policy and configuring the host controller service.