Security component for devices on an enumerated bus
A plug-and-play (PnP) driver associated with a security agent is described herein. The PnP driver attaches to device stacks of enumerated bus devices of a computing device as upper-device or lower-device filters based on the device classes of the enumerated bus devices. For example, the PnP driver may attach to the device stack of a hub or controller device as an upper-device filter and to device stacks of other devices as lower-device filters. Either while attaching or after attachment, the PnP driver may take action to alter, limit, or otherwise block functionality of an enumerated bus device. The PnP driver may also perform a system inventory of enumerated bus devices connected to the computing device and create fingerprints for one or more of the computing devices. Additionally, the PnP driver may create and remove control device objects (CDOs) to enable communication with user-mode processes or threads.
1. A system comprising:
a processor; and
a PnP driver attached as a filter in a device stack of an enumerated bus device of one or more enumerated bus devices plugged in to the system, the PnP driver being operated by the processor to:
receive a message directed through the device stack, the message specifying indicative features of at least one of the one or more enumerated bus devices or commanding the at least one of the one or more enumerated bus devices to take an action; and
based on the message, take an action to alter, limit, or otherwise block functionality of the at least one of the one or more enumerated bus devices, wherein the action includes:
sending a request to a hub device requesting that an individual port of the hub device associated with the at least one of the one or more enumerated bus devices be powered off, disabled, or power cycled, or
suspending the at least one of the one or more enumerated bus devices by updating a state machine of a hub device.
2. The system of claim 1 , wherein the action additionally or alternatively includes failing, by the PnP driver, a start routine initiated by a start device message received from a PnP manager.
3. The system of claim 1 , wherein the action additionally or alternatively includes returning a failure status for an add device routing to a PnP manager to cause a device stack for the at least one of the one or more enumerated bus devices to be torn down.
4. The system of claim 1 , wherein taking the action is based at least on part on configurable policies of the PnP driver.
5. The system of claim 1 , wherein the action additionally or alternatively includes altering installation strings for the at least one of the one or more enumerated bus devices.
6. The system of claim 1 , wherein the action additionally or alternatively includes altering capability flags for the at least one of the one or more enumerated bus devices.
7. A method implemented in a PnP driver attached as a filter in a device stack of an enumerated bus device of one or more enumerated bus devices, the method comprising:
receiving, by the PnP driver, a message directed through the device stack, the message commanding at least one of the one or more enumerated bus devices to take an action; and
based on the message, taking, by the PnP driver, an action to alter, limit, or otherwise block functionality of the at least one of the one or more enumerated bus devices, wherein the action includes:
sending a request to a hub device requesting that an individual port of the hub device associated with the at least one of the one or more enumerated bus devices be powered off, disabled, or power cycled, or
suspending the at least one of the one or more enumerated bus devices by updating a state machine of a hub device.
8. The method of claim 7 , wherein the action additionally or alternatively includes altering installation strings or capability flags for the at least one of the one or more enumerated bus devices.
9. The method of claim 7 , wherein taking the action is based at least on part on configurable policies of the PnP driver.
10. The method of claim 7 , wherein the action additionally or alternatively includes failing, by the PnP driver, a start routine initiated by a start device message received from a PnP manager.
11. The method of claim 7 , wherein the action additionally or alternatively includes returning a failure status for an add device routing to a PnP manager to cause a device stack for the at least one of the one or more enumerated bus devices to be torn down.
12. A non-transitory computer-readable medium having programming instructions stored thereon that, when executed by a PnP driver perform operations comprising:
receiving, by the PnP driver, a message directed through a device stack, the message specifying indicative features of at least one of one or more enumerated bus devices or commanding the at least one of the one or more enumerated bus devices to take an action, wherein the PnP driver is attached as a filter in the device stack of an enumerated bus device of the one or more enumerated bus devices; and
based on the message, taking, by the PnP driver, an action to alter, limit, or otherwise block functionality of the at least one of the one or more enumerated bus devices, wherein the action includes:
sending a request to a hub device requesting that an individual port of the hub associated with the at least one of the one or more enumerated bus devices be powered off, disabled, or power cycled, or
suspending the at least one of the one or more enumerated bus devices by updating a state machine of a hub device.
13. The non-transitory computer-readable medium of claim 12 , wherein the action additionally or alternatively includes altering installation strings or capability flags for the at least one of the one or more enumerated bus devices.
14. The non-transitory computer-readable medium of claim 12 , wherein the action additionally or alternatively includes failing, by the PnP driver, a start routine initiated by a start device message received from a PnP manager.
15. The non-transitory computer-readable medium of claim 12 , wherein the action additionally or alternatively includes returning a failure status for an add device routing to a PnP manager to cause a device stack for the at least one of the one or more enumerated bus devices to be torn down.
16. The non-transitory computer-readable medium of claim 12 , wherein taking the action is based at least on part on configurable policies of the PnP driver.