# US 11,113,425 B2 · Security component for devices on an enumerated bus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,113,425 B2 - Document ID: US11113425B2 - Status: Granted - Kind: B2 - Application number: 15/873,670 - Filed: 2018-01-17 - Published: 2019-07-18 - Granted: 2021-09-07 - Earliest claimed: 2018-01-17 - Assignees: Crowd Strike, Inc. - Applicants: Crowdstrike, Inc. - Inventors: Aaron LeMasters; Ion-Alexandru Ionescu - Web page: https://patentgrep.com/patent/US11113425B2 ## CPC - G06F 21/82: Protecting input, output or interconnection devices - G06F 9/4415: {Self describing peripheral devices} - G06F 13/385: {for adaptation of a particular data processing system to different peripheral devices} - G06F 13/387: {for adaptation of different data processing systems to different peripheral devices, e.g. protocol converters for incompatible systems, open system} - G06F 13/4063: {Device-to-bus coupling} - G06F 21/554: {involving event detection and direct action} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/572: {Secure firmware programming, e.g. of basic input output system [BIOS]} - G06F 21/71: to assure secure computing or processing of information - G06F 21/85: interconnection devices, e.g. bus-connected or in-line devices - G06F 13/20: for access to input/output bus - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A plug-and-play (PnP) driver associated with a security agent is described herein. The PnP driver attaches to device stacks of enumerated bus devices of a computing device as upper-device or lower-device filters based on the device classes of the enumerated bus devices. For example, the PnP driver may attach to the device stack of a hub or controller device as an upper-device filter and to device stacks of other devices as lower-device filters. Either while attaching or after attachment, the PnP driver may take action to alter, limit, or otherwise block functionality of an enumerated bus device. The PnP driver may also perform a system inventory of enumerated bus devices connected to the computing device and create fingerprints for one or more of the computing devices. Additionally, the PnP driver may create and remove control device objects (CDOs) to enable communication with user-mode processes or threads. ## Claims ### Claim 1 A system comprising: a processor; and a PnP driver attached as a filter in a device stack of an enumerated bus device of one or more enumerated bus devices plugged in to the system, the PnP driver being operated by the processor to: receive a message directed through the device stack, the message specifying indicative features of at least one of the one or more enumerated bus devices or commanding the at least one of the one or more enumerated bus devices to take an action; and based on the message, take an action to alter, limit, or otherwise block functionality of the at least one of the one or more enumerated bus devices, wherein the action includes: sending a request to a hub device requesting that an individual port of the hub device associated with the at least one of the one or more enumerated bus devices be powered off, disabled, or power cycled, or suspending the at least one of the one or more enumerated bus devices by updating a state machine of a hub device. ### Claim 2 (depends on 1) The system of claim 1, wherein the action additionally or alternatively includes failing, by the PnP driver, a start routine initiated by a start device message received from a PnP manager. ### Claim 3 (depends on 1) The system of claim 1, wherein the action additionally or alternatively includes returning a failure status for an add device routing to a PnP manager to cause a device stack for the at least one of the one or more enumerated bus devices to be torn down. ### Claim 4 (depends on 1) The system of claim 1, wherein taking the action is based at least on part on configurable policies of the PnP driver. ### Claim 5 (depends on 1) The system of claim 1, wherein the action additionally or alternatively includes altering installation strings for the at least one of the one or more enumerated bus devices. ### Claim 6 (depends on 1) The system of claim 1, wherein the action additionally or alternatively includes altering capability flags for the at least one of the one or more enumerated bus devices. ### Claim 7 A method implemented in a PnP driver attached as a filter in a device stack of an enumerated bus device of one or more enumerated bus devices, the method comprising: receiving, by the PnP driver, a message directed through the device stack, the message commanding at least one of the one or more enumerated bus devices to take an action; and based on the message, taking, by the PnP driver, an action to alter, limit, or otherwise block functionality of the at least one of the one or more enumerated bus devices, wherein the action includes: sending a request to a hub device requesting that an individual port of the hub device associated with the at least one of the one or more enumerated bus devices be powered off, disabled, or power cycled, or suspending the at least one of the one or more enumerated bus devices by updating a state machine of a hub device. ### Claim 8 (depends on 7) The method of claim 7, wherein the action additionally or alternatively includes altering installation strings or capability flags for the at least one of the one or more enumerated bus devices. ### Claim 9 (depends on 7) The method of claim 7, wherein taking the action is based at least on part on configurable policies of the PnP driver. ### Claim 10 (depends on 7) The method of claim 7, wherein the action additionally or alternatively includes failing, by the PnP driver, a start routine initiated by a start device message received from a PnP manager. ### Claim 11 (depends on 7) The method of claim 7, wherein the action additionally or alternatively includes returning a failure status for an add device routing to a PnP manager to cause a device stack for the at least one of the one or more enumerated bus devices to be torn down. ### Claim 12 A non-transitory computer-readable medium having programming instructions stored thereon that, when executed by a PnP driver perform operations comprising: receiving, by the PnP driver, a message directed through a device stack, the message specifying indicative features of at least one of one or more enumerated bus devices or commanding the at least one of the one or more enumerated bus devices to take an action, wherein the PnP driver is attached as a filter in the device stack of an enumerated bus device of the one or more enumerated bus devices; and based on the message, taking, by the PnP driver, an action to alter, limit, or otherwise block functionality of the at least one of the one or more enumerated bus devices, wherein the action includes: sending a request to a hub device requesting that an individual port of the hub associated with the at least one of the one or more enumerated bus devices be powered off, disabled, or power cycled, or suspending the at least one of the one or more enumerated bus devices by updating a state machine of a hub device. ### Claim 13 (depends on 12) The non-transitory computer-readable medium of claim 12, wherein the action additionally or alternatively includes altering installation strings or capability flags for the at least one of the one or more enumerated bus devices. ### Claim 14 (depends on 12) The non-transitory computer-readable medium of claim 12, wherein the action additionally or alternatively includes failing, by the PnP driver, a start routine initiated by a start device message received from a PnP manager. ### Claim 15 (depends on 12) The non-transitory computer-readable medium of claim 12, wherein the action additionally or alternatively includes returning a failure status for an add device routing to a PnP manager to cause a device stack for the at least one of the one or more enumerated bus devices to be torn down. ### Claim 16 (depends on 12) The non-transitory computer-readable medium of claim 12, wherein taking the action is based at least on part on configurable policies of the PnP driver.