Systems and methods for using USB device descriptors to identify computing environments

• US 8,281,058 B1
• Filed: 10/19/2009
• Issued: 10/02/2012
• Est. Priority Date: 10/19/2009
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: McCorkendale, Bruce, Cooley, Shaun
• Primary Examiner(s): Misiura, Brian
• Assistant Examiner(s): Huynh, Kim
• Application Number:
  US12/581,302
• Time in Patent Office: 1,079 Days
• Field of Search: 710/104, 710300-306, 710/313
• US Class Current: 710/104
• CPC Class Codes: G06F 13/102 where the programme performs an interfacing function, e.g. device driver G06F13/105 takes precedence; scheduling within device drivers G06F9/52; contention policies within device drivers G06F9/4881
• CPC Class Codes: G06F 2213/0042 Universal serial bus [USB]

Abstract

An exemplary method for using USB device descriptors to uniquely identify computing environments may include: 1) detecting a set of USB devices connected to a computing device within a computing environment, 2) obtaining a USB device descriptor for each USB device within the set of USB devices, and then 3) creating an environmental signature for the computing environment that identifies the computing environment based at least in part on the USB device descriptors. Exemplary methods for using such environmental signatures to uniquely identify computing environments are also disclosed.

Claims

1. A computer-implemented method for using USB device descriptors to identify computing environments, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

detecting a set of USB devices connected to the computing device in a computing environment;

obtaining a USB device descriptor for each USB device within the set of USB devices connected to the computing device;

creating an environmental signature for the computing environment that identifies the computing environment based at least in part on the USB device descriptors;

wherein creating the environmental signature for the computing environment comprises;

creating a hash of each USB device descriptor;

storing the hashes of the USB device descriptors in the environmental signature for the computing environment.

2. The method of claim 1, wherein detecting the set of USB devices connected to the computing device comprises identifying when each USB device within the set of USB devices connects to and disconnects from the computing device.

3. The method of claim 2, further comprising identifying, by analyzing when each USB device within the set of USB devices connects to and disconnects from the computing device, a recurring temporal pattern followed by the computing device when connecting to the computing environment.

4. The method of claim 3, further comprising including information that identifies the recurring temporal pattern within the environmental signature for the computing environment.

5. The method of claim 1, wherein creating a hash of each USB device descriptor comprises creating, for each USB device descriptor:

a hash of the entire USB device descriptor;

or

a hash of a portion of the USB device descriptor.

6. The method of claim 1, wherein storing the hashes of the USB device descriptors in the environmental signature for the computing environment comprises:

combining the hashes of the USB device descriptors into a single hash;

storing the single hash in the environmental signature for the computing environment.

7. The method of claim 1, wherein each USB device descriptor identifies, for its respective USB device, at least one of:

a USB specification supported by the USB device;

a USB device class assigned to the USB device;

a USB device subclass assigned to the USB device;

a USB protocol used by the USB device;

a maximum packet size supported by the USB device;

a vendor ID assigned to the USB device;

a product ID assigned to the USB device;

a device release number assigned to the USB device;

a device serial number assigned to the USB device.

8. The method of claim 1, wherein creating the environmental signature for the computing environment further comprises including, within the environmental signature, information that identifies at least one characteristic of a network associated with the computing environment.

9. The method of claim 1, further comprising at least one of:

performing the computer-implemented method in response to a request from a user of the computing device;

automatically performing the computer-implemented method.

10. A computer-implemented method for using USB device descriptors to identify computing environments, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

detecting a set of USB devices connected to the computing device;

obtaining a USB device descriptor for each USB device within the set of USB devices connected to the computing device;

creating a hash of each USB device descriptor obtained from the set of USB devices connected to the computing device;

identifying a computing environment within which the computing device is operating by determining that at least a predetermined portion of the hashes of the USB device descriptors obtained from the set of USB devices connected to the computing device are identical to hashes of USB device descriptors known to be associated with the computing environment;

identifying a computing action that is applicable to the identified computing environment;

performing the computing action.

11. The method of claim 10, wherein identifying the computing environment further comprises determining at least one of:

that the number of USB devices within the set of USB devices connected to the computing device is greater than a predetermined minimum;

that the number of USB devices within the set of USB devices connected to the computing device is less than a predetermined maximum.

12. The method of claim 10, wherein identifying the computing environment further comprises:

identifying a network to which the computing device is connected;

determining that at least one characteristic of the network is identical to at least one characteristic of a network associated with the computing environment.

13. The method of claim 10, wherein performing the computing action comprises:

enabling a software feature;

disabling a software feature;

modifying a software option;

enabling a hardware feature;

disabling a hardware feature.

14. The method of claim 10, further comprising:

detecting a change in the computing environment;

determining that the change in the computing environment represents a potential security risk;

performing a security action.

15. The method of claim 14, wherein determining that the change in the computing environment represents a potential security risk comprises determining that the computing device has connected to an unrecognized computing environment.

16. The method of claim 14, wherein performing the security action comprises at least one of:

identifying the current location of the computing device;

logging keystrokes on the computing device;

capturing screenshots of activity on the computing device;

monitoring processes executing on the computing device;

altering a security server regarding the potential security risk;

providing information to the security server that identifies at least one of;

the current location of the computing device;

keystrokes logged on the computing device;

screenshots captured on the computing device;

a list of processes executing on the computing device;

enabling an owner of the computing device to remotely control the computing device;

encrypting sensitive data on the computing device;

preventing access to sensitive data on the computing device;

disabling at least one software feature on the computing device;

disabling at least one hardware feature of the computing device;

requiring input of a password for continued operation of the computing device.

17. A system for using USB device descriptors to identify computing environments, the system comprising:

a device-detection module programmed to;

detect a set of USB devices connected to a computing device;

obtain a USB device descriptor for each USB device within the set of USB devices connected to the computing device;

create a hash of each USB device descriptor obtained from the set of USB devices connected to the computing device;

an environment-identification module programmed to identify a computing environment within which the computing device is operating by determining that at least a predetermined portion of the hashes of the USB device descriptors obtained from the set of USB devices connected to the computing device are identical to hashes of USB device descriptors known to be associated with the computing environment;

an action-identification module programmed to;

identify a computing action that is applicable to the identified computing environment;

perform the computing action;

at least one processor configured to execute the device-detection module, the environment-identification module, and the action-identification module.