Method for securing and controlling USB ports

• US 8,011,013 B2
• Filed: 07/16/2007
• Issued: 08/30/2011
• Est. Priority Date: 07/19/2006
• Status: Active Grant

• Current Assignee: OL Security LLC (Intellectual Ventures LLC)
• Original Assignee: Quick Vault, Inc. (d/b/a CloudVault)
• Inventors: Bacastow, Steven V.
• Primary Examiner(s): Dinh; Minh
• Assistant Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US11/879,162
• Publication Number:
  US 20080022360A1
• Time in Patent Office: 1,506 Days
• Field of Search: 726/9, 726/4, 726/28, 726 34- 35, 726/20, 726/17, 713193-194, 713/185, 713/165
• US Class Current: 726/27
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices

Abstract

A method for limiting devices and controlling the applications executed from USB ports on personal computers (PCs). More specifically, the present invention relates to a method for ensuring that only authorized devices and applications are accessed from USB ports using software and configuration files on the PC. Using the software application stored on the PC storage device in conjunction with functionality performed by a designed security file server, the use of USB applications and devices is limited to authorized applications and devices.

Claims

1. A method for controlling a USB device, accessed from a USB port on a personal computer comprising the steps of:

the personal computer monitoring the USB port;

the personal computer detecting the USB device connected to the USB port;

a software module identifying a type of the USB device, the software module stored in a memory on the personal computer and comprising a configuration rule in accordance with a security policy;

the software module determining that the USB device is authorized by comparing the type of the USB device to a list of USB device types stored in a parameter file in the memory of the personal computer;

the software module determining that a file stored on the USB device is authorized by comparing the file to a list of files stored in the parameter file in the memory of the personal computer; and

the software module, in accordance with the configuration rule and determining the USB device is authorized and the file is authorized, either allowing the personal computer to access the USB device or preventing the personal computer from accessing the USB device.

2. The method as defined in claim 1, whereby the software module on the personal computer periodically receives updates from a remote file server.

5. The method of claim 1, wherein the list of USB device types stored in the parameter file comprises authorized USB device types.

6. The method of claim 1, wherein the list of USB device types stored in the parameter file comprises unauthorized USB device types.

7. The method of claim 1, wherein the list of files stored in the parameter file comprises authorized files.

8. The method of claim 1, wherein the list of files stored in the parameter file comprises unauthorized files.

3. A method for controlling a device, accessed from a USB port on a personal computer comprising the steps of:

the personal computer detecting the device connected to the USB port;

a software module stored in a memory on the personal computer and comprising a configuration rule in accordance with a security policy, the software module receiving a security update from a remote computer via a network;

the software module updating the configuration rule and a parameter file in accordance with the security update;

the software module identifying a type of the device;

the software module determining that the device is authorized by comparing the type of the device to a list of device types stored in the parameter file;

the software module determining that a program stored on the device is authorized by comparing the program to a list of programs stored in the parameter file; and

the software module, in accordance with the updated configuration rule and determining the USB device is authorized and the file is authorized, either allowing the personal computer to access the program or preventing the personal computer from accessing the program.

9. The method of claim 3, wherein the list of device types stored in the parameter file comprises authorized device types.

10. The method of claim 3, wherein the list of device types stored in the parameter file comprises unauthorized device types.

11. The method of claim 3, wherein the list of programs stored in the parameter file comprises authorized programs.

12. The method of claim 3, wherein the list of programs stored in the parameter file comprises unauthorized programs.

4. A method for controlling a device accessed from a port on a personal computer wherein the personal computer is in communication with a remote computer, comprising the steps of:

detecting that the device is coupled to the personal computer;

a software module stored in a memory of the personal computer and comprising a configuration rule in accordance with a security policy, the software module comparing the detected device to a list of devices stored in a parameter file on the personal computer;

the software module sending a request for an update from the personal computer to the remote computer;

the software module receiving the update from the remote computer and updating the parameter file;

and

the software module granting or denying access to the device based on the updated parameter file.

13. The method of claim 4, wherein the list of devices stored in the parameter file comprises authorized devices.

14. The method of claim 4, wherein the list of devices stored in the parameter file comprises unauthorized devices.