Method and apparatus for managing a peripheral port of a computer system

• US 8,230,149 B1
• Filed: 09/25/2008
• Issued: 07/24/2012
• Est. Priority Date: 09/26/2007
• Status: Active Grant

• Current Assignee: Teradici Corporation (HP Inc.)
• Original Assignee: Teradici Corporation (HP Inc.)
• Inventors: Long, Ngo Bach, Citterelle, Kevin Bradley, Yiu, Edlic
• Primary Examiner(s): Rinehart, Mark
• Assistant Examiner(s): Vu, Trisha
• Application Number:
  US12/284,765
• Time in Patent Office: 1,398 Days
• Field of Search: 710300-306, 710/8, 710/10, 710/62, 710/63, 710/72, 726 4- 5, 726/7, 726/11, 726/13, 726/21, 726/17, 726 26- 30, 726/34
• US Class Current: 710/305
• CPC Class Codes: G06F 13/12 using hardware independent of the central processor, e.g. channel or peripheral processor
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices

Abstract

A method and apparatus for managing a peripheral port of a computer system by identifying, within the computer system, a descriptor list for a peripheral device and manipulating the descriptor list to manage communications between a peripheral device and resources of the computer system via the peripheral port.

Claims

1. A method of managing a peripheral port of a computer system comprising:

identifying, within the computer system, a descriptor list for communicating data with a peripheral device, wherein the descriptor list comprises transfer commands generated by a bus controller driver of a Central Processing Unit (CPU) of the computer system and executable by a bus controller for the peripheral port; and

manipulating the descriptor list to manage communications via the peripheral port between the peripheral device and resources of the CPU of the computer system, wherein manipulating the descriptor list comprises altering information in the descriptor list to selectively prevent the communication of the data, wherein the peripheral device is located at a remote computer and the resources of the CPU of the computer system are located at a host computer, wherein the remote computer and the host computer are coupled to one another through a network, and wherein the remote computer comprises the peripheral port, wherein manipulating comprises managing a shadow list in the remote computer, the shadow list associated with the descriptor list.

2. The method of claim 1 wherein manipulating comprises:

determining whether the peripheral device is authorized to communicate with resources of the CPU of the computer system; and

manipulating the descriptor list to restrict communications between the peripheral device and the resources of the CPU of the computer system.

3. The method of claim 1 further comprising, upon manipulating the descriptor list, selectively enabling communications between the peripheral device and the resources of the CPU of the computer system.

4. The method of claim 1 wherein the peripheral device is a USB device.

5. The method of claim 1 wherein manipulating comprises:

determining whether the peripheral device is authorized to communicate with the resources of the CPU of the computer system; and

manipulating the shadow list to restrict communications between the peripheral device and the resources of the CPU of the computer system.

6. The method of claim 1 wherein manipulating the descriptor list comprises:

determining whether the peripheral device is authorized to communicate with the resources of the computer system; and

manipulating the association between the shadow list and the descriptor list to restrict communications between the peripheral device and the resources of the CPU of the computer system.

7. A method of managing a peripheral port of a computer system comprising:

intercepting, between a bus controller for the peripheral port and a bus driver, the bus driver for the bus controller and executed on a Central Processing Unit (CPU) of the computer system, peripheral identification information communicated from a peripheral device, through the peripheral port, to the bus controller;

associating the peripheral identification information with at least one authorization criterion to establish a device authorization; and

managing communications between the peripheral port and resources of the computer system, the managing communications comprising altering, based on the device authorization, information in a descriptor list generated by the bus driver, wherein the descriptor list comprises commands executable by the bus controller for transferring data with the peripheral device through the peripheral port, wherein the intercepting comprises, responsive to a hub status change, performing a hub emulation to at least partially enumerate the peripheral device, and the managing step further comprises emulating a peripheral device attachment by presenting the hub status change to the bus controller only if the device authorization is granted, and wherein performing the hub emulation further comprises managing at least one shadow descriptor list, the at least one shadow descriptor list for filtering communications with the peripheral port.

8. The method of claim 7 wherein the peripheral device is an unauthorized USB peripheral device, and wherein the altering information in the descriptor list prevents data transfers related to the unauthorized USB peripheral device.

9. The method of claim 8 wherein the peripheral identification information comprises at least one of a USB Product identification, a USB Vendor identification, a USB class description, a USB sub-class description or a USB protocol description.

10. The method of claim 7 wherein managing comprises controlling communications between the resources of the computer system and the peripheral device.

11. The method of claim 7 wherein the descriptor list comprises the peripheral identification information and the method further comprises manipulating the descriptor list to control communication between the peripheral device and the resources of the computer system.

12. The method of claim 11 wherein managing communications comprises:

passing content of the descriptor list to the bus controller if the peripheral device is authorized.

13. The method of claim 11 wherein managing communications comprises:

presenting an authorized descriptor to the bus controller if the peripheral device is authorized, the authorized descriptor comprising content of the descriptor list, the authorized descriptor enabled to allow communications with the peripheral device.

14. The method of claim 11 wherein managing communications comprises:

passing content of the descriptor list in a modified form to the bus controller if the peripheral device is unauthorized.

15. The method of claim 11 wherein the descriptor list comprises an unauthorized descriptor if the peripheral device is unauthorized, wherein managing communications comprises preventing the bus controller from communicating content associated with the unauthorized descriptor with the peripheral device.

16. The method of claim 15 wherein preventing comprises:

marking the unauthorized descriptor, the marking indicating to the bus controller to disallow communications with the peripheral device;

or

maintaining a shadow descriptor list comprising content of the descriptor list and absent of content of the unauthorized descriptor.

17. The method of claim 16 wherein the bus controller comprises an ability to selectively process descriptors.

18. The method of claim 7 further comprising:

masking, from the resources of the computer system, a connection between the peripheral device and the bus controller until the peripheral device is authorized.

19. The method of claim 18 wherein masking comprises delaying a queuing of a peripheral port status change transfer descriptor.

20. The method of claim 7 further comprising:

responsive to a connection event, enabling an interface module; and

performing device enumeration, wherein the device enumeration is performed by presenting control transfer operations to the bus controller.

21. The method of claim 20 wherein the computer system comprises a remote computer coupled to a host computer via a network, the peripheral port is a port in the remote computer.

22. The method of claim 21 wherein the host computer comprises the resources of the computer system.

23. The method of claim 7 wherein the at least one authorization criterion is provided by an independent authorization server.

24. The method of claim 7 wherein the intercepting comprises:

performing at least partial enumeration of the peripheral device if the authorization is not yet established.

25. The method of claim 7 wherein performing the hub emulation comprises:

performing a translation between function addresses assigned by the hub emulation and function addresses assigned by the resources of the computer system.

26. The method of claim 7 wherein intercepting peripheral identification information comprises monitoring a descriptor list associated with the bus controller.

27. Apparatus for managing a peripheral port of a computer system comprising:

a descriptor firewall coupled to memory, the memory comprising (i) secure descriptor lists generated by bus controller driver software and comprising data transfer commands for the peripheral port, and (ii) unsecure descriptor lists, executable by a bus controller to transfer data via the peripheral port;

wherein the descriptor firewall is enabled to generate at least part of the unsecure descriptor lists, the at least part of the unsecure descriptor lists defined by (iii) devices coupled to the peripheral port, (iv) management criteria, and (v) at least part of the data transfer commands of the secure descriptor lists altered to prevent data transfers related to an unauthorized peripheral device; and

wherein the descriptor firewall is further enabled to process at least part of the secure descriptor lists based on the unsecure descriptor lists executed by the bus controller.

28. The apparatus claim of 27 wherein the memory comprises a first memory comprising the secure descriptor lists, where in the memory further comprises a second memory comprising the unsecure descriptor lists, wherein the descriptor firewall is coupled between the first memory and the second memory.

29. The apparatus of claim 28 wherein the computer system comprises a remote computer coupled to a host computer through a network, the first memory is a portion of the host computer and the second memory is a portion of the remote computer.

30. Apparatus for managing a peripheral port of a computer system comprising:

a bus controller coupled between the peripheral port and a memory, wherein the memory stores at least one descriptor list comprising altered data transfer commands and the bus controller is enabled to execute the altered data transfer commands of the at least one descriptor list to transfer data via the peripheral port; and

a descriptor firewall coupled between the memory and a CPU sub-system of the computer system, the descriptor firewall enabled to manage the at least one descriptor list according to authorization criteria to prevent data transfers related to an unauthorized peripheral device by generating the altered data transfer commands from original data transfer commands generated by the CPU sub-system.

31. The apparatus of claim 30 wherein the computer system comprises a computer containing the bus controller, peripheral port, memory, descriptor firewall and CPU sub-system.

32. The apparatus of claim 30 wherein the computer system comprises a remote computer and a host computer, the descriptor firewall, bus controller and memory are located in the remote computer.

33. The apparatus of claim 30 wherein the computer system comprises a remote computer and a host computer, the bus controller and memory are located in the remote computer and the descriptor firewall is located in the host computer.

34. A computer readable storage medium for storing computer instructions that, when executed by a processor within a computer system, cause the processor to perform a method comprising:

generating at least part of unsecure descriptor lists, the unsecure descriptor lists defined by (i) devices coupled to a peripheral port, (ii) management criteria, and (iii) data transfer commands of secure descriptor lists altered to prevent data transfers related to an unauthorized peripheral device; and

processing at least part of the secure descriptor lists in relation to the at least part of the unsecure descriptor lists executed to transfer data via the peripheral port and the management criteria.

35. The computer readable storage medium of claim 34 wherein the method further comprises storing the unsecure descriptor lists in a first memory and storing the secured descriptor lists in a second memory.

36. The computer readable storage medium of claim 35 wherein the computer system comprises a host computer coupled to a remote computer through a network, the first memory is a portion of the host computer and the second memory is a portion of the second memory.

37. The computer readable storage medium of claim 35 wherein processing comprises transferring a modified version of a USB descriptor between the unsecure descriptor lists and the secure descriptor lists, the transferring the modified version associated with at least one authorization criterion, the at least one authorization criterion defining communication restrictions between at least one peripheral device and resources of the computer system.