Patent Application
20080250165
Security, and particularly data security, remains an important issue in the computer industry. In some environments it may be useful to block universal serial bus (USB) mass storage devices from functioning on computer systems or other electronic apparatus, e.g., to prevent users from downloading data to the USB storage device.
In the embodiment depicted in
A file store 180 is communicatively connected to computer 108. File store 180 may be internal such as, e.g., one or more hard drives, or external such as, e.g., one or more external hard drives, network attached storage, or a separate storage network. File store 180 comprises may comprise one or more partitions 182, 184, 186.
Memory 130 includes an operating system 140 for managing operations of computer 108. In one embodiment, operating system 140 includes a hardware abstraction layer 154 that provides an interface to system hardware 120. In addition, operating system 140 includes a kernel 144, one or more file systems 146 that manage files used in the operation of computer 108 and a process control subsystem 148 that manages processes executing on computer 108. Operating system 140 further includes one or more device drivers 150 and a system call interface module 142 that provides an interface between the operating system 140 and one or more application modules 162 and/or libraries 164. The various device drivers 150 interface with and generally control the hardware installed in the electronic apparatus 100.
In operation, one or more application modules 162 and/or libraries 164 executing on computer 108 make calls to the system call interface module 142 to execute one or more commands on the computer's processor. The system call interface module 142 invokes the services of the file system(s) 146 to manage the files required by the command(s) and the process control subsystem 148 to manage the process required by the command(s). The file system(s) 146 and the process control subsystem 148, in turn, invoke the services of the hardware interface module 154 to interface with the system hardware 120. The operating system kernel 144 can be generally considered as one or more software modules that are responsible for performing many operating system functions.
The particular embodiment of operating system 140 is not critical to the subject matter described herein. Operating system 140 may be embodied as a UNIX operating system or any derivative thereof (e.g., Linux, Solaris, etc.), a Windows® brand operating system, or any other operating system.
Electronic apparatus 100 further includes a basic input/output system (BIOS) 160. In one embodiment, BIOS 126 may be implemented in flash memory and may comprise a power-on self-test (POST) module for performing system initialization and tests. In operation, when activation of electronic apparatus 100 begins processing unit 126 accesses BIOS 122 and shadows the instructions of BIOS 122, such as power-on self-test module, into operating memory. Processor 126 then executes power-on self-test operations to implement POST processing.
In some embodiments, electronic apparatus 100 includes an access management module 128 to implement a USB port access management. In the embodiment depicted in
Referring to
If, at operation 225, the BIOS controls the USB bus, then control passes to operation 260. If, at operation 260, it is determined whether the device connected to the USB port comprises mass storage. As used herein, the term “mass storage” when applied to USB devices refers to a USB device that is compatible with the USB mass storage device class as defined by the USB Implementers Forum. Such devices may include, for example, external magnetic hard drives external optical drives, including CD and DVD reader and writer drives, portable flash memory devices, adapters bridging between standard flash memory cards and a USB connection, digital cameras, digital audio players, high-end hardware media players, personal data assistants and handheld computers, and mobile phones. If, at operation 260, the device connected to the USB port does not comprise mass storage, then control passes to operation 280 and normal operations are continued. By contrast, if at operation 260 the device connected to the USB port comprises mass storage, then control passes to operation 265.
At operation 265 it is determined whether the computer 108 is configured to permit mass storage devices to be connected to USB port 118. The computer 108 may be configured using a configuration utility to configure system to deny access to USB devices which comprise mass storage. In one embodiment, USB access may be configured using an F10 setup utility which resides on most computer systems, and which may be invoked by the BIOS during POST operations. The F10 setup utility permits computer system operators to configure various aspects of their computer system including, but not limited to, USB port access. The F10 setup utility is accessed by pressing the F10 key on a standard keyboard during the boot process. The BIOS detects the F10 key and, in response, invokes the F10 setup utility. Thus, at operation 265 the BIOS may consult an F10 configuration file for the computer 108 to determine whether mass storage devices are permitted.
If, at operation 265, the configuration parameter indicates that mass storage devices may be used with the USB port, then control passes to operation 270 and the device is reported to the operating system and normal operations may continue (operation 280). By contrast, if the configuration parameter indicates that mass storage devices may not be used with the USB port, then control passes to operation 275 and the device is not reported to the operating system. Thus, the operating remains unaware of the mass storage device and the device cannot be used with the computer 108. The system may invoke an error routine, wherein the error routine comprises presenting an error message on a user interface associated with the electronic apparatus. Normal operations can then continue at operation 280.
Referring back to operation 225, if the BIOS does not control the USB bus, then control passes to operation 230 and the BIOS assumes control of the USB bus. If, at operation 235, the device does not comprise mass storage, then control passes to operation 255 and the BIOS releases control of the USB bus and normal operations continue (operation 280). By contrast, if at operation 235 the device comprises mass storage, then control passes to operation 245.
If, at operation 240 the configuration parameter indicates that mass storage devices may be used with the USB port, then control passes to operation 255 and the BIOS releases control of the USB bus and normal operations continue (operation 280).
By contrast, if the configuration parameter indicates that mass storage devices may not be used with the USB port, then control passes to operation 245 and the BIOS clears the status and status change bits in the USB port, and disables the USB port (operation 250). Control then passes to operation 255 and the BIOS releases control of the USB bus and normal operations continue (operation 280).
Thus, the operations of
Reference in the specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least an implementation. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment.
