Firewell system for human interface devices
View Patent ↗A system for providing a human interface device firewall (HID-F) is disclosed, including a device detector to detect the presence of a human interface device and to turn on a human interface device firewall if a human interface device is detected. An interceptor intercepts one or more inputs and transmit the one or more inputs to a malicious input engine configured to analyze the one or more inputs for malicious input. If the input is deemed safe the one or more inputs are sent to a host operating system for processing. An encrypted data store receives and stores the one or more inputs from the malicious input engine. An enforcer receives the one or more inputs if they are deemed malicious and shuts down the one or more malicious inputs such that they are not sent to the host operating system. The HID-F also has advanced optional features such as: support multiple payload analyses, optional enforcement options, historical payload analysis, and complex meta rules bases on analyses results.
1 . A system for providing a human interface device firewall (HID-F), comprising:
a device detector module configured to register with an operating system for raw input notifications and, responsive to detection of a human interface device (HID), transition the HID-F to an active state;
an interceptor module configured to intercept individual HID inputs via operating system raw input registration before the inputs are delivered to an application program and to provide the intercepted inputs to a malicious input engine;
a data store configured to maintain the inputs in memory as an aged input history and a dynamic input buffer, the dynamic input buffer accumulating inputs until a predetermined block size or threshold is reached and the accumulated inputs being appended to the aged input history;
the malicious input engine configured to analyze the inputs for malicious patterns using the aged input history and a per-window normalized input context that accounts for deleted text and active window focus, and configured to complete analysis within a predetermined latency threshold selected to prevent perceptible input lag, for example about 13 milliseconds, and, when the inputs are deemed safe, to permit the inputs to be processed by the host operating system; and
an enforcer module configured, when the malicious input engine determines that the inputs are malicious, to receive the inputs and to shut down the malicious inputs before they are executed by the host operating system.
2 . The system of claim 1 , wherein the HID-F is auditable for its functioning and its presence, wherein a payload is normalized into a canonical, a raw form, or both, for analysis.
3 . The system of claim 1 , wherein the HID-F categorizes the one or more outputs from the malicious input engine.
4 . The system of claim 3 , wherein the HID-F processes one or more rules into a configured action or a hardcoded action, wherein the configured action or the hardcoded action included at least one of the following: disconnecting the human interface device, seeking additional authorization, transmitting an alert, ignoring the configured action or the hardcoded action, or blocking the configured action or the hardcoded action.
5 . The system of claim 4 , wherein the HID-F is further comprised of one or more
Meta Rules, wherein the HID-F ranks the Meta Rules in order of precedence or order of severity.
6 . The system of claim 5 , wherein the HID-F is configured to decide an action when the action is derived from rules using the Meta Rules.
7 . The system of claim 6 , wherein an analysis is generated, via the HID-F, to alert the appearance of a specified payload on a keyboard.
8 . The system of claim 7 , wherein an analysis is generated, via the HID-F, to detect encoded or cryptographically transformed data.
9 . The system of claim 8 , wherein the HID-F transforms cryptographically encoded data into an intermediate decoded form or multiple transformation rounds into final decoded form.
10 . The system of claim 9 , wherein the HID-F utilizes pattern matching on payloads.
11 . The system of claim 10 , wherein the HID-F runs an analysis on the source the context, or both, of the payload to further analyze the meta-information on the payload.
12 . The system of claim 11 , wherein the HID-F runs an analysis on embedded data of the payload.
13 . The system of claim 12 , wherein the HID-F controls the data retention and the encryption of a plurality of stored data to prevent access to the plurality of stored data to only the human interface device.
14 . The system of claim 13 , wherein the HID-F is configured to selectively override the encryption of the plurality of stored data to provide a replay of the payload.
15 . The system of claim 14 , wherein the HID-F is configured to limit the replay of the payload via the restriction of queries of the replay to meet one or more predefined criteria or non-predefined criteria.
16 . The system of claim 1 , wherein the HID-F stores one or more plaintext credentials or one or more representations of the credentials and is configured to erase the one or more plaintext credentials or the one or more representations of credentials from the data store.
17 . The system of claim 5 , wherein the HID-F back tests one or more new rules to the data store up to a limit of retained data.
18 . The system of claim 5 , wherein the HID-F causes the user to authenticate when the HID-F enforcer takes action.
19 . The system of claim 5 , wherein the HID-F simulates an oracle with an intelligent modeled mode of thought, an artificially intelligent modeled mode of thought, or a mathematically modeled mode of thought as an analysis engine.
20 . The system of claim 1 , wherein the HID-F transmits one or more rules for remote analysis, wherein one or more results are returned to the HID-F.