Selective device connection
One embodiment provides a method, including: connecting a USB device to a secure device; provisioning, at the secure device, the USB device, wherein the provisioning comprises encrypting, using a private key, a hash value associated with a device descriptor associated with the USB device into a product field of the device descriptor: introducing the provisioned peripheral device into a client device; determining, using a processor of the client device, that the USB device is an authorized USB device, wherein the determining comprises: decrypting, using a public key that corresponds to the private key, the hash value; producing, by running a hash function on the device descriptor minus the hash value, a new hash value; and identifying that the hash value is equivalent to the new hash value; and enabling the USB device to gain access to a system of the client device. Other aspects are described and claimed.
1. A method, comprising:
provisioning, at an information handling device, a peripheral USB device, wherein the provisioning comprises:
downloading a device descriptor from the USB peripheral device;
creating, using a hash function, a hash of the device descriptor;
encrypting, using a private key, the hash of the device descriptor; and
inserting the encrypted hash into a product field of the device descriptor.
2. The method of claim 1 , wherein the information handling device is a secure device.
3. The method of claim 2 , wherein the secure device corresponds to a non-network connected device.
4. The method of claim 1 , wherein the private key is associated with a corporation.
5. The method of claim 1 , wherein the private key is associated with a division of a corporation.
6. A method, comprising:
detecting, at an information handling device, a connection request from a peripheral USB device, wherein the peripheral USB device is a provisioned peripheral USB device having an encrypted hash value within a device descriptor packet resident on the peripheral USB device generated by a system associated with the information handling device;
analyzing, responsive to the detecting, the device descriptor packet resident on the peripheral USB device, wherein the analyzing comprises:
identifying content that is encrypted in the device descriptor packet;
decrypting, using a public key corresponding to a private key used to encrypt the content, the content;
identifying a decrypted version of the encrypted hash value in the decrypted content; and
producing, by running a hash function on the device descriptor packet minus the hash value, a new hash value;
determining the decrypted version of the hash value and the new hash value are equivalent; and
forwarding the connection request to a system of the information handling device responsive to determining that the decrypted version of the hash value and the new hash value are equivalent.
7. The method of claim 6 , wherein the analyzing comprises analyzing the device descriptor using a USB filter driver.
8. The method of claim 7 , wherein the USB filter driver is installed at the bus level of the information handling device.
9. The method of claim 6 , wherein the analyzing further comprises analyzing utilizing BIOS firmware resident on the information handling device.
10. A method, comprising:
connecting, in a physically secure location, a peripheral USB device to a secure information handling device;
provisioning, at the secure information handling device, the peripheral USB device, wherein the provisioning comprises encrypting, using a private key, a hash value associated with a device descriptor associated with the USB peripheral device into a product field of the device descriptor;
introducing the provisioned peripheral device into a client device located outside of the secure location;
determining, using a processor of the client device, that the peripheral USB device is an authorized peripheral USB device, wherein the determining comprises:
decrypting, using a public key that corresponds to the private key, the hash value;
producing, by running a hash function on the device descriptor minus the hash value, a new hash value; and
identifying that the hash value is equivalent to the new hash value; and
enabling the peripheral USB device to gain access to a system of the client device.