Detection of a malicious peripheral

• US 9,712,545 B2
• Filed: 12/23/2014
• Issued: 07/18/2017
• Est. Priority Date: 12/23/2014
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Edwards, Jonathan L., Cochin, Cedric, Kapoor, Aditya
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Sanders, Stephen
• Application Number:
  US14/582,009
• Publication Number:
  US 20160182539A1
• Time in Patent Office: 938 Days
• Field of Search: 726 23
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/82 Protecting input, output or interconnection devices
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Particular embodiments described herein provide for an electronic device that can be configured to determine when a peripheral is connected to the electronic device, determine a peripheral identification for the peripheral, and monitor the data going to and from the peripheral. Based on the monitored data, a type for the peripheral can be determine. The peripheral identification can be compared with the determined type for the peripheral and if they do not match, then communication to and from the peripheral can be blocked.

Claims

1. At least one non-transitory computer-readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to:

determine that a peripheral is connected to an electronic device;

determine a peripheral identification for the peripheral;

determine whether the peripheral identification matches an entry in a blacklist;

monitor data from the peripheral;

determine a type for the peripheral based on the monitored data;

determine whether the peripheral identification matches the determined type for the peripheral; and

block communication to and from the peripheral based on a determination that the peripheral identification does not match the determined type for the peripheral.

2. The at least one computer-readable medium of claim 1, further comprising one or more instructions that when executed by the at least one processor, further cause the processor to:

block communication to and from the peripheral based on a determination that the peripheral identification matches an entry in the blacklist.

3. The at least one computer-readable medium of claim 1, further comprising one or more instructions that when executed by the at least one processor, further cause the processor to:

determine that a second peripheral is connected to the electronic device;

determine a second type for the second peripheral; and

block communication to and from the peripheral based on a determination that the determined type for the peripheral matches the determined second type for the second peripheral.

4. The at least one computer-readable medium of claim 3, further comprising one or more instructions that when executed by the at least one processor, further cause the processor to:

allow the communication based on a determination that the determined type for the peripheral is data storage and the determined second type for the second peripheral is also data storage.

5. The at least one computer-readable medium of claim 1, further comprising one or more instructions that when executed by the at least one processor, further cause the processor to:

determine whether the peripheral performs two or more functions;

determine the type of the two or more functions; and

block communication to and from the peripheral based on a determination that the two or more functions are not related.

6. The at least one computer-readable medium of claim 1, wherein the peripheral is connected to the electronic device using a hardwire connection.

7. The at least one computer-readable medium of claim 1, wherein the peripheral is connected to the electronic device using a wireless connection.

8. An apparatus comprising:

a hardware processor

configured to;

determine that a peripheral is connected to an electronic device;

determine a peripheral identification for the peripheral;

determine whether the peripheral identification matches an entry in a blacklist;

monitor data from the peripheral;

determine a type for the peripheral based on the monitored data;

determine whether the peripheral identification matches the determined type for the peripheral; and

block communication to and from the peripheral based on a determination that the peripheral identification does not match the determined type for the peripheral.

9. The apparatus of claim 8, wherein the hardware processor is further configured to:

block communication to and from the peripheral based on a determination that the peripheral identification matches an entry in the blacklist.

10. The apparatus of claim 8, wherein the hardware processor is further configured to:

determine that a second peripheral is connected to the electronic device;

determine a second type for the second peripheral; and

block communication to and from the peripheral based on a determination that the determined type for the peripheral matches the determined second type for the second peripheral.

11. The apparatus of claim 10, wherein the hardware processor is further configured to:

allow the communication based on a determination that the determined type for the peripheral is data storage and the determined second type for the second peripheral is also data storage.

12. The apparatus of claim 8, wherein the hardware processor is further configured to:

determine whether the peripheral performs two or more functions;

determine the type of the two or more functions; and

block communication to and from the peripheral based on a determination that the two or more functions are not related.

13. The apparatus of claim 8, wherein the peripheral is connected to the electronic device using a hardwire connection.

14. The apparatus of claim 8, wherein the peripheral is connected to the electronic device using a wireless connection.

15. A method comprising:

determining that a peripheral is connected to an electronic device;

determining a peripheral identification for the peripheral;

determining whether the peripheral identification matches an entry in a blacklist;

monitoring data from the peripheral;

determining a type for the peripheral based on the monitored data;

determining whether the peripheral identification matches the determined type for the peripheral; and

blocking communication to and from the peripheral based on a determination that the peripheral identification does not match the determined type for the peripheral.

16. The method of claim 15, further comprising:

blocking communication to and from the peripheral based on a determination that the peripheral identification matches an entry in the blacklist.

17. The method of claim 15, further comprising:

determining that a second peripheral is connected to the electronic device;

determining a second type for the second peripheral; and

blocking communication to and from the peripheral based on a determination that the determined type for the peripheral matches the determined second type for the second peripheral.

18. The method of claim 17, further comprising:

allowing the communication based on a determination that the determined type for the peripheral is data storage and the determined second type for the second peripheral is also data storage.

19. The method of claim 15, further comprising:

determining whether the peripheral performs two or more functions;

determining the type of the two or more functions; and

blocking communication to and from the peripheral based on a determination that the two or more functions are not related.

20. A system for detection of a malicious peripheral, the system comprising:

a memory; and

a hardware processor

configured for;

determining that a peripheral is connected to an electronic device;

determining a peripheral identification for the peripheral;

determining whether the peripheral identification matches an entry in a blacklist;

monitoring data from the peripheral;

determining a type for the peripheral based on the monitored data;

determining whether the peripheral identification matches the determined type for the peripheral; and

blocking communication to and from the peripheral based on a determination that the peripheral identification does not match the determined type for the peripheral.

21. The system of claim 20, wherein the hardware processor is further configured for:

determining whether the peripheral performs two or more functions;

determining the type of the two or more functions; and

blocking communication to and from the peripheral based on a determination that the two or more functions are not related.

22. The system of claim 20, wherein the hardware processor is further configured for:

blocking communication to and from the peripheral based on a determination that the peripheral identification matches an entry in the blacklist.

23. The system of claim 20, wherein the hardware processor is further configured for:

determining that a second peripheral is connected to the electronic device;

determining a second type for the second peripheral; and

blocking communication to and from the peripheral based on a determination that the determined type for the peripheral matches the determined second type for the second peripheral.

24. The system of claim 23, wherein the hardware processor is further configured for:

allowing the communication based on a determination that the determined type for the peripheral is data storage and the determined second type for the second peripheral is also data storage.