Security arrangements for extended USB protocol stack of a USB host system

1. A method for protecting a host system from a first device connected to the host system, the method comprising:

executing an extended protocol stack having security arrangements at a processor of the host system,

compiling a first list of devices that are not authorized to communicate with the host system, the first list of devices maintained by the security arrangements of the extended protocol stack;

compiling a second list of suspicious descriptors maintained by the security arrangements of the extended protocol stack, wherein devices with those descriptors are not authorized to communicate with the host system;

identifying the first device and its descriptors, wherein the first device is a first USB device;

comparing the first list and the second list to the identified device and its descriptors and, if there is a match,

preventing communications between the first device and the host system; and

detecting suspicious activities between a second USB device and the system through static analysis and heuristic analysis, wherein the heuristic analysis includes monitoring a rate of keystrokes originating from a third USB device identified as a keyboard and, if the keystroke rate exceeds a predetermined limit representing a maximum typing speed, flagging the third USB device as suspicious.

2. The method of claim 1 further comprising:

detecting suspicious activities of the first USB device connected with the host system; and

in response to detecting the suspicious activities, preventing communication between the first USB device and the host system.

3. The method of claim 2 further comprising:

compiling a whitelist of USB devices that are authorized to communicate with the host system; and

if the first USB device is on the white list, allowing communications between the first USB device and the host system.

4. The method of claim 2 further comprising notifying a user that an unauthorized or suspicious USB device is connected to the host system.

5. The method of claim 2 wherein detecting suspicious activities comprises:

examining run time activities of the first USB device; and

in response to determining the activities are inconsistent with the first USB device, preventing communication between the first USB device and the host system.

6. The method of claim 5 wherein examining run time activities comprises:

examining data within packets originating from and destined to the first USB device; and

in response to determining that the data is inconsistent with the first USB device, preventing communication between the first USB device and the host system.

7. A system comprising:

a host controller;

a processor coupled to the host controller and adapted to execute an extended USB protocol stack having a security control module interfaced with a device identification database; and

a memory adapted to store the device identification database and the security control module to:

maintain a first list of USB devices that are not authorized to communicate with the host controller;

maintain a second list of USB devices having suspicious combinations of descriptors that are not authorized to communicate with the host controller;

maintain a third list of USB devices connected to the host controller that exhibit suspicious activities while communicating with the host controller;

block communication between a first USB device connected to the host controller and the system if there is a match between the first USB device and the first list, the second list or the third list; and

clear a second USB device to communicate with the system using a device identification module stored in the memory and adapted to detect suspicious activities between the second USB device and the system through static analysis and heuristic analysis, wherein the heuristic analysis includes monitoring a rate of keystroke originating from a third USB device identified as a keyboard and, if the keystroke rate exceeds a predetermined limit representing a maximum typing speed, flagging the third USB device as suspicious.

8. The system of claim 7 further comprising:

a security control application interface module stored in the memory and adapted to compare the first, the second and the third lists maintained by the device identification database with the first USB device and descriptors of the first USB device and, in response to a match, cooperating with the security control module to prevent communication between the first USB device and the system.

9. The system of claim 8 wherein the descriptors provide information to select a driver for the first USB device and wherein the descriptors include device descriptors, configuration descriptors, and string descriptors.

10. The system of claim 9 wherein the device descriptors include a device class and a USB specification version number.

11. The system of claim 9 wherein the configuration descriptors include an interface descriptor of alternative settings and classes, and a total number of bytes in the configuration descriptors.

12. The system of claim 9 wherein the string descriptors include a manufacturer identification (ID), a product ID, and a serial number.

13. The system of claim 7 wherein the static analysis includes deep packet inspection that examines data contained in packets originating from the second USB device and destined to the second USB device to determine if the data is appropriate for the second USB device.

14. The system of claim 7 further comprising:

a USB mass storage device connected to the host controller; and

wherein the device identification module is further adapted to store a hash of predetermined storage locations on the USB mass storage device.

15. The system of claim 14 wherein the static analysis includes monitoring the USB mass storage device for suspicious changes in the hash.

16. The system of claim 7 wherein the static analysis includes identifying suspicious activity of USB human interface devices (HIDs), and rejecting the suspicious activity to defeat an attempt to gain administrative access to the system.

17. The system of claim 16 wherein USB HIDs include a keyboard and a mouse, and wherein the suspicious activity includes pressing of a start key of the keyboard to run programs to gain administrative access to the system and detecting left- and/or right-clicks of the mouse to access menus that run programs or allow unprotected access to system.

18. A non-transitory computer-readable medium containing instructions, the instructions when executed by a processor operable to:

provide a universal serial bus (USB) protocol stack;

extend the USB protocol stack to include security modules adapted to protect a host system from unauthorized activity initiated by a USB device connected to the host system, the security modules including a security control module operating to enable communication between the host system and a USB device connected to the host system when the USB device is identified as authorized to communicate with the host system, the security control module further operating to disable communication between the host system and the USB device when the USB device is identified as not authorized to communicate with the host system, the security control module further operating to disable further communication between the host system and the USB device when the USB device is identified as initiating unauthorized activity with respect to the host system; and

clear a second USB device to communicate with the system using a device identification module stored in the memory and adapted to detect suspicious activities between the second USB device and the system through static analysis and heuristic analysis, wherein the heuristic analysis includes monitoring a rate of keystrokes originating from a third USB device identified as a keyboard and, if the keystroke rate exceeds a predetermined limit representing a maximum typing speed, flagging the third USB device as suspicious.