Systems and methods for dynamic external input/output port screening
In accordance with embodiments of the present disclosure, an information handling system may include a host system comprising a processor, one or more external input/output (I/O) ports, a chipset communicatively coupled to the processor and including an I/O port controller, the I/O port controller interfacing between the processor and the one or more external I/O ports, and a management controller communicatively coupled to the processor configured to provide out-of-band management of the information handling system, and further configured to communicate a port security policy to a component of the chipset such that the I/O port controller dynamically enables and disables, independent of an operating state of the host system, individual ones of the one or more external I/O ports in accordance with the port security policy.
1. An information handling system comprising:
a host system comprising a processor;
one or more external input/output (I/O) ports;
a chipset communicatively coupled to the processor and including an I/O port controller, the I/O port controller being configured to interface between the processor and the one or more external I/O ports; and
a management controller communicatively coupled to the processor configured to provide out-of-band management of the information handling system, and further configured to communicate a port security policy to a component of the chipset such that the I/O port controller is configured to dynamically enable or disable, independent of an operating state of the host system, individual ones of the one or more external I/O ports in accordance with the port security policy, wherein the I/O port controller is further configured to enable no more than a maximum number of the one or more external I/O ports, wherein the maximum number is specified by the port security policy.
2. The information handling system of claim 1 , wherein the chipset comprises the management controller.
3. The information handling system of claim 1 , wherein the component of the chipset includes a port security policy engine interfaced between the I/O port controller and the management controller and configured to control the I/O port controller to dynamically enable or disable the individual ones of the one or more external I/O ports in accordance with the port security policy.
4. The information handling system of claim 1 , wherein the one or more external I/O ports comprise Universal Serial Bus (USB) ports and the I/O port controller comprises a USB controller.
5. The information handling system of claim 1 , wherein the I/O port controller is configured to conditionally enable at least one external I/O port of the one or more external I/O ports such that an external I/O device coupled to the at least one external I/O port is permitted to communicate with the processor only if the external I/O device is within one or more permitted classes of devices set forth in the port security policy.
6. The information handling system of claim 1 , wherein the I/O port controller is configured to conditionally enable at least one external I/O port of the one or more external I/O ports such that an external I/O device coupled to the at least one external I/O port is permitted to communicate with the processor only if the external I/O device has one or more particular identifying characteristics as set forth in the port security policy.
7. The information handling system of claim 6 , wherein the particular identifying characteristics comprise at least one of an identifier of the external I/O device or a certificate associated with the external I/O device.
8. The information handling system of claim 1 , wherein the I/O port controller is configured to disable an enablement or a conditional enablement of at least one external I/O port of the one or more external I/O ports in accordance with a temporal limitation of the enablement or conditional enablement as set forth in the port security policy.
9. The information handling system of claim 1 , wherein the I/O port controller is configured to disable an enablement or a conditional enablement of at least one external I/O port of the one or more external I/O ports in response to disconnection of an external I/O device from the at least one external I/O port as set forth in the port security policy.
10. The information handling system of claim 1 , wherein the I/O port controller is further configured to disable individual ones of the one or more external I/O ports in accordance with a maximum hub depth of the one or more external I/O ports as set forth in the port security policy.
11. A method comprising:
dynamically enabling or disabling, independent of an operating state of a host system of an information handling system, individual ones of one or more external input/output (I/O) ports of the host system in accordance with a port security policy, wherein the dynamically enabling or disabling includes enabling no more than a maximum number of the one or more external I/O ports, wherein the maximum number is specified by the port security policy;
wherein the host system includes:
a processor; and
a chipset communicatively coupled to the processor and including an I/O port controller, the I/O port controller being configured to interface between the processor and the one or more external I/O ports.
12. The method of claim 11 , wherein the one or more external I/O ports comprise Universal Serial Bus (USB) ports and the I/O port controller comprises a USB controller.
13. The method of claim 11 , further comprising conditionally enabling at least one external I/O port of the one or more external I/O ports such that an external I/O device coupled to the at least one external I/O port is permitted to communicate with the processor only if the external I/O device is within one or more permitted classes of devices set forth in the port security policy.
14. The method of claim 11 , further comprising conditionally enabling at least one external I/O port of the one or more external I/O ports such that an external I/O device coupled to the at least one external I/O port is permitted to communicate with the processor only if the external I/O device has one or more particular identifying characteristics as set forth in the port security policy.
15. The method of claim 14 , wherein the particular identifying characteristics comprise at least one of an identifier of the external I/O device or a certificate associated with the external I/O device.
16. The method of claim 11 , further comprising disabling an enablement or a conditional enablement of at least one external I/O port of the one or more external I/O ports in accordance with a temporal limitation of the enablement or conditional enablement as set forth in the port security policy.
17. The method of claim 11 , further comprising disabling an enablement or a conditional enablement of at least one external I/O port of the one or more external I/O ports in response to disconnection of an external I/O device from the at least one external I/O port as set forth in the port security policy.
18. The method of claim 11 , further comprising disabling individual ones of the one or more external I/O ports in accordance with a maximum hub depth of the one or more external I/O ports as set forth in the port security policy.
19. An information handling system comprising:
a host system comprising a processor;
one or more external input/output (I/O) ports;
a chipset communicatively coupled to the processor and including an I/O port controller, the I/O port controller being configured to interface between the processor and the one or more external I/O ports; and
a management controller communicatively coupled to the processor configured to provide out-of-band management of the information handling system, and further configured to communicate a port security policy to a component of the chipset such that the I/O port controller is configured to dynamically enable or disable, independent of an operating state of the host system, individual ones of the one or more external I/O ports in accordance with the port security policy, wherein the I/O port controller is further configured to enable only those ones of the one or more external I/O ports having hub depths that are in accordance with a maximum hub depth specified by the port security policy.