Security arrangements for extended USB protocol stack of a USB host system

A system comprising:

• a host controller;
• a processor coupled to the host controller and adapted to execute an extended USB protocol stack having a security control module interfaced with a device identification database;
• and
• a memory adapted to store the device identification database and the security control module to:
• maintain a first list of USB devices that are not authorized to communicate with the host controller;
• maintain a second list of USB devices having suspicious combinations of descriptors that are not authorized to communicate with the host controller;
• maintain a third list of USB devices connected to the host controller that exhibit suspicious activities while communicating with the host controller;
• block communication between a first USB device connected to the host controller and the system if there is a match between the first USB device and the first list, the second list or the third list;
• and
• clear a second USB device to communicate with the system using a device identification module stored in the memory and adapted to detect suspicious activities between the second USB device and the system through static analysis and heuristic analysis, wherein the heuristic analysis includes monitoring a rate of keystroke originating from a third USB device identified as a keyboard and, if the keystroke rate exceeds a predetermined limit representing a maximum typing speed, flagging the third USB device as suspicious.

A non-transitory computer-readable medium containing instructions, the instructions when executed by a processor operable to:

• provide a universal serial bus (USB) protocol stack;
• extend the USB protocol stack to include security modules adapted to protect a host system from unauthorized activity initiated by a USB device connected to the host system, the security modules including a security control module operating to enable communication between the host system and a USB device connected to the host system when the USB device is identified as authorized to communicate with the host system, the security control module further operating to disable communication between the host system and the USB device when the USB device is identified as not authorized to communicate with the host system, the security control module further operating to disable further communication between the host system and the USB device when the USB device is identified as initiating unauthorized activity with respect to the host system;
• and
• clear a second USB device to communicate with the system using a device identification module stored in the memory and adapted to detect suspicious activities between the second USB device and the system through static analysis and heuristic analysis, wherein the heuristic analysis includes monitoring a rate of keystrokes originating from a third USB device identified as a keyboard and, if the keystroke rate exceeds a predetermined limit representing a maximum typing speed, flagging the third USB device as suspicious.