Universal serial bus device with security check
Described are techniques for Universal Serial Bus (USB) security. The techniques include intercepting, by a Universal Serial Bus (USB) firewall of a USB device connected to a host, a file access request for a file. The techniques further include transmitting the file access request for the file to an authorization server, where the authorization server determines whether the file access request for the file is permitted based on a hash of the file. The techniques further include receiving a cryptographically signed message from the authorization server based on the hash of the file, where the cryptographically signed message indicates whether the file access request for the file is permitted.
1 . A computer-implemented method comprising:
intercepting, by a Universal Serial Bus (USB) firewall of a USB device connected to a host, a file access request for a file;
transmitting the file access request for the file to an authorization server, wherein the authorization server determines whether the file access request for the file is permitted based on a hash of the file; and
receiving a cryptographically signed message from the authorization server based on the hash of the file, wherein the cryptographically signed message is generated using an Elliptic Curve Digital Signature Algorithm (ECDSA) with a private key, a name of the file, and an indication of whether the file access request for the file is permitted, wherein the cryptographically signed message selectively enables permissions for a portion of the file, wherein the portion of the file is identified based on a starting offset and an ending offset in the file that is covered by the permissions, and wherein the permissions are selected from a group consisting of: read, write, and delete.
2 . The computer-implemented method of claim 1 , wherein the cryptographically signed message indicates that the file access request for the file is permitted, and wherein the method further comprises:
copying the file to the host in response to receiving the cryptographically signed message.
3 . The computer-implemented method of claim 2 , further comprising:
authenticating the USB device using a hardware-generated token of a hardware authentication device; and
wherein the copying the file to the host occurs in further response to authenticating the USB device using the hardware-generated token of the hardware authentication device.
4 . The computer-implemented method of claim 3 , wherein transmitting the file access request for the file to the authorization server further comprises transmitting the hardware-generated token to the authorization server.
5 . The computer-implemented method of claim 4 , wherein the authorization server determining whether the file access request for the file is permitted is further based on the hardware-generated token and permission information associated with the file.
6 . The computer-implemented method of claim 1 , further comprising:
storing the cryptographically signed message in the USB device;
intercepting, by the USB firewall of the USB device connected to the host, a subsequent file access request for the file; and
utilizing the cryptographically signed message associated with the file and the host to authorize the subsequent file access request.
7 . The computer-implemented method of claim 6 , further comprising:
automatically deleting the cryptographically signed message after a predetermined period of time.
8 . The computer-implemented method of claim 6 , further comprising:
automatically deleting the cryptographically signed message in response to disconnecting the USB device from the host.
9 . The computer-implemented method of claim 1 , wherein the USB firewall is implemented by USB adapter hardware.
10 . The computer-implemented method of claim 1 , wherein the USB firewall is implemented by USB driver software.
11 . A computer-implemented method comprising:
receiving, at an authorization server communicatively coupled to a Universal Serial Bus (USB) device, a file access request for a file between the USB device and a host;
determining that the file access request for the file is permitted based on a hash of the file;
generating a cryptographically signed message that allows the file to be shared with the host, wherein the cryptographically signed message is generated using an Elliptic Curve Digital Signature Algorithm (ECDSA) with a private key, a name of the file, and an indication that the file is allowed to be shared with the host, wherein the cryptographically signed message selectively enables permissions for a portion of the file, wherein the portion of the file is identified based on a starting offset and an ending offset in the file that is covered by the permissions, and wherein the permissions are selected from a group consisting of: read, write, and delete; and
transmitting the cryptographically signed message to the USB device.
12 . The computer-implemented method of claim 11 , further comprising:
determining that a first authorization level associated with information stored in the file is compatible with a second authorization level associated with the host; and
wherein the cryptographically signed message is further based on determining that the first authorization level is compatible with the second authorization level.
13 . The computer-implemented method of claim 12 , wherein the first authorization level is based on a hardware-generated token from a hardware authentication device and wherein the second authorization level is based on a second hardware-generated token from a second hardware authentication device.
14 . The computer-implemented method of claim 11 , further comprising:
determining that the hash of the file matches at least one hash in a database of allowed file hashes.
15 . The computer-implemented method of claim 11 , further comprising:
determining that the hash of the file does not match any hash in a database of blocked file hashes.
16 . A system comprising:
a Universal Serial Bus (USB) device comprising:
a USB firewall configured to intercept a file access request for a file between the USB device and a host;
a USB communication subsystem configured to transmit the file access request for the file to an authorization server and receive a cryptographically signed message from the authorization server that allows the file to be shared with the host; and
a cache for storing the cryptographically signed message for a predetermined period of time; and
the authorization server communicatively coupled to the USB device, wherein the authorization server is configured to determine that the file access request for the file is permitted based on a hash of the file, and wherein the authorization server is configured to generate the cryptographically signed message based on the hash of the file, wherein the cryptographically signed message is generated using an Elliptic Curve Digital Signature Algorithm (ECDSA) with a private key, a name of the file, and an indication that the file access request is permitted, wherein the cryptographically signed message selectively enables permissions for a portion of the file, wherein the portion of the file is identified based on a starting offset and an ending offset in the file that is covered by the permissions, and wherein the permissions are selected from a group consisting of: read, write, and delete.
17 . The system of claim 16 , further comprising:
a hardware authentication device communicatively coupled to the USB device and configured to generate a hardware-generated token associated with the file access request;
wherein the USB communication subsystem is further configured to transmit the hardware-generated token to the authorization server; and
wherein the authorization server is further configured determine that the file access request for the file is permitted based on the hardware-generated token.
18 . The system of claim 16 , wherein the USB firewall is further configured to copy the file to the host in response to receiving the cryptographically signed message.
19 . The computer-implemented method of claim 1 , wherein the file access request includes an ID, a workstation name, a user name, a second factor token, a start time, an end time, a filename, an MD5 hash of the file, an SHA-256 hash of the file, and a file operation, and wherein the file operation is selected from a group consisting of: read, write, and delete.