System and method to secure ports on a computer
A system, method, and computer-readable medium are disclosed for securing hot-pluggable ports, such as USB ports, of an information handling system, by isolating a dedicated controller from the operating system of the information handling system. Devices that are to be allowed to be enabled at the ports are determined. A hash signature is created and saved to verify the devices. The controller and ports are held in reset until the devices are authenticated.
1. A computer-implementable method of securing hot-pluggable ports of an information handling system comprising:
isolating from an operating system of the information handling system a controller configured to the hot-pluggable ports;
determining devices to be enabled at the hot-pluggable ports;
creating a hash signature for the hot-pluggable ports;
saving the hash signature for device verification;
holding the controller and the hot-pluggable ports in reset if no devices are plugged at the hot-pluggable ports; and
taking the controller and the hot-pluggable ports out of reset by a system management interrupt (SMI) handler when devices are authenticated.
2. The method of claim 1 , wherein the controller is a universal serial bus (USB) controller, and the hot-pluggable ports are USB ports.
3. The method of claim 1 , wherein the determining is based on one or more of the following: device type, class code, descriptors returned by devices.
4. The method of claim 1 , wherein the creating the hash signature comprises concatenated descriptors returned by a device, and signed by a private key.
5. The method of claim 1 , wherein the creating the hash signature is performed when a device is plugged into a hot-pluggable port to create the hash signature based on descriptors.
6. The method of claim 1 , wherein the hash signature is used by other information handling systems.
7. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:
isolating from an operating system of the information handling system a controller configured to the hot-pluggable ports;
determining devices to be enabled at the hot-pluggable ports;
creating a hash signature for the hot-pluggable ports;
saving the hash signature for device verification;
holding the controller and the hot-pluggable ports in reset if no devices are plugged at the hot-pluggable ports; and
taking the controller and the hot-pluggable ports out of reset by a system management interrupt (SMI) handler when devices are authenticated.
8. The system of claim 7 , wherein the controller is a universal serial bus (USB) controller, and the hot-pluggable ports are USB ports.
9. The system of claim 7 , wherein the determining is based on one or more of the following: device type, class code, descriptors returned by devices.
10. The system of claim 7 , wherein the creating the hash signature comprises concatenated descriptors returned by a device, and signed by a private key.
11. The system of claim 7 , wherein the creating the hash signature is performed when a device is plugged into a hot-pluggable port to create the hash signature based on descriptors.
12. The system of claim 7 , wherein the hash signature is used by other information handling systems.
13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:
isolating from an operating system of the information handling system a controller configured to the hot-pluggable ports;
determining devices to be enabled at the hot-pluggable ports;
creating a hash signature for the hot-pluggable ports;
saving the hash signature for device verification;
holding the controller and the hot-pluggable ports in reset if no devices are plugged at the hot-pluggable ports; and
taking the controller and the hot-pluggable ports out of reset by a system management interrupt (SMI) handler when devices are authenticated.
14. The non-transitory, computer-readable storage medium of claim 13 , wherein the controller is a universal serial bus (USB) controller, and the hot-pluggable ports are USB ports.
15. The non-transitory, computer-readable storage medium of claim 13 , wherein the determining is based on one or more of the following: device type, class code, descriptors returned by devices.
16. The non-transitory, computer-readable storage medium of claim 13 , wherein the creating the hash signature comprises concatenated descriptors returned by a device, and signed by a private key.
17. The non-transitory, computer-readable storage medium of claim 13 , wherein the hash signature is used by other information handling systems.