Input/output interface security
Methods, computer program products, and systems are presented. The Methods, computer program products, and systems can include, for example: examining hardware device transmitted data received through an I/O interface port of a computer system; determining in dependence on the examining whether the hardware device transmitted data received through the I/O interface port of the computer system satisfies a criterion; and in response to determining that the hardware device transmitted data received through the I/O interface port of the computer system satisfies the criterion, initiating a security process for protecting the computer system.
1 . A computer implemented method comprising:
determining whether a hardware device transmitted data received through an I/O interface port of a computer system satisfies a criterion;
in response to determining that the hardware device transmitted data received through the I/O interface port of the computer system satisfies the criterion, initiating a security process for protecting the computer system,
wherein the initiating the security process comprises loading, by the computer system, a custom security driver which is operational for (i) sending an amount of electrical energy to an external device that is sufficient to overload the external device, (ii) transmitting to the external device a request for return data, and (iii) monitoring for receipt of the requested return data; and
in response to determining that a current security risk level is acceptable, disabling the I/O interface port and sending a notification that the data received through the I/O interface port satisfied the criterion.
2 . The computer implemented method of claim 1 , wherein the determining whether the hardware device transmitted data received through the I/O interface port of the computer system satisfies the criterion comprises determining whether the hardware device transmitted data specifies a human interface device classification.
3 . The computer implemented method of claim 1 , wherein the determining whether the hardware device transmitted data received through the I/O interface port of the computer system satisfies the criterion comprises determining whether the hardware device transmitted data matches a signature string.
4 . The computer implemented method of claim 1 , wherein the determining whether the hardware device transmitted data received through the I/O interface port of the computer system satisfies the criterion is performed in response to determining that the computer system is in a locked state.
5 . The computer implemented method of claim 1 , wherein the security process comprises one or more actions selected from the group consisting of (a) the disabling the I/O interface port, (b) outputting at least one notification, (c) producing an audit trail of a detected attack, and (d) destroying an external device that has transmitted the hardware device transmitted data.
6 . The computer implemented method of claim 1 , further comprising installing an installation package on the computer system during runtime of the computer system, wherein the installation package includes user application layer software code that modifies behavior of an operating system of the computer system so that the operating system performs the determining whether the hardware device transmitted data received through the I/O interface port of the computer system satisfies the criterion, and the initiating the security process for protecting the computer system.
7 . The computer implemented method of claim 1 , wherein the initiating the security process comprises initiating a security process wherein the computer system loads a custom security driver that supports communications with an external device that has transmitted the hardware device transmitted data, wherein the custom security driver sends data request communications to the external device that emulate operation of a device driver loaded for support of an authorized hardware device, receives in response to the data request communications subsequent data from the external device, and initiates creation of an audit file record recording the subsequent data.
8 . The computer implemented method of claim 1 , wherein the custom security driver is further operational for (iv) iteratively performing the sending, the transmitting, and the monitoring until the return data is determined to be not received by the monitoring.
9 . The computer implemented method of claim 1 , wherein the disabling the I/O interface port comprises one or more actions selected from the group consisting of: configuring the computer system to ignore transmitted data of an external device that has transmitted the hardware device transmitted data, even where the transmitted data is compliant with a format required of an I/O interface associated to the I/O interface port, restricting the computer system from presenting a descriptive data request to an attached hardware device, restricting launch of a device driver for facilitating communication with the attached hardware device, and restricting delivery of electrical power for powering the attached hardware device.
10 . The computer implemented method of claim 1 , wherein the determining whether the hardware device transmitted data received through the I/O interface port of the computer system satisfies the criterion is selectively performed while the computer system is in a locked operating state.
11 . A computer program product comprising:
a computer readable storage medium readable by one or more processing circuit and storing instructions for execution by one or more processor for performing a method comprising:
determining whether hardware device transmitted data received through an I/O interface port of a computer system satisfies a criterion;
in response to determining that the hardware device transmitted data received through the I/O interface port of the computer system satisfies a criterion, initiating a security process for protecting the computer system,
wherein the initiating the security process comprises loading, by the computer system, a custom security driver, and
wherein the custom security driver is operational for (i), sending an amount of electrical energy to an external device that is sufficient to overload the external device; (ii) transmitting to the external device a request for return data; and (iii) monitoring for receipt of the requested return data; and
in response to determining that a current security risk level is acceptable, disabling the I/O interface port and sending a notification that the data received through the I/O interface port satisfied the criterion.
12 . The computer program product of claim 11 , wherein the whether the hardware device transmitted data received through the I/O interface port of the computer system satisfies the criterion comprises determining whether the hardware device transmitted data matches a signature string.
13 . The computer program product of claim 11 , wherein the security process comprises one or more actions selected from the group consisting of the disabling the I/O interface port, outputting at least one notification, producing an audit trail of a detected attack, and destroying an external device that has transmitted the hardware device transmitted data.
14 . The computer program product of claim 11 , wherein the method comprises installing an installation package on the computer system during runtime of the computer system, wherein the installation package comprises user application layer software code that modifies behavior of an operating system of the computer system so that the operating system performs the determining whether the hardware device transmitted data received through the I/O interface port of the computer system satisfies the criterion, and the initiating the security process for protecting the computer system.
15 . The computer program product of claim 11 , is further operational iteratively performing the sending, the transmitting, and the monitoring until the return data is determined to be not received by the monitoring.
16 . The computer program product of claim 11 , wherein the disabling the I/O interface port comprises one or more actions selected from the group consisting of configuring the computer system to ignore transmitted data of an external device that has transmitted the hardware device transmitted data, even where the transmitted data is compliant with a format required of an I/O interface associated to the I/O interface port, restricting the computer system from presenting a descriptive data request to an attached hardware device, restricting launch of a device driver for facilitating communication with the attached hardware device, and restricting delivery of electrical power for powering the attached hardware device.
17 . A system comprising:
a memory;
at least one processor in communication with the memory; and
program instructions executable by one or more processor via the memory to perform a method comprising:
determining whether a hardware device transmitted data received through an I/O interface port of a computer system satisfies a criterion;
in response to determining that the hardware device transmitted data received through the I/O interface port of the computer system satisfies the criterion, initiating a security process for protecting the computer system,
wherein the initiating the security process comprises loading, by the computer system, a custom security driver, and
wherein the custom security driver is operational for (i), sending an amount of electrical energy to an external device that is sufficient to overload the external device; (ii) transmitting to the external device a request for return data; and (iii) monitoring for receipt of the requested return data; and
in response to determining that a current security risk level is acceptable, disabling the I/O interface port and sending a notification that the data received through the I/O interface port satisfied the criterion.
18 . The system of claim 17 , wherein the determining whether the hardware device transmitted data received through the I/O interface port of the computer system satisfies the criterion comprises determining whether the hardware device transmitted data matches a signature string.
19 . The system of claim 17 , wherein the security process comprises one or more actions selected from the group consisting of disabling the I/O interface port, outputting at least one notification, producing an audit trail of a detected attack, and destroying an external device that has transmitted the hardware device transmitted data.
20 . The system of claim 17 , wherein the custom security driver is further operational for iteratively performing the sending, the transmitting, and the monitoring until the return data is determined to be not received by the monitoring.