Abstract:
In one embodiment an electronic apparatus comprises a processor, an operating system, a basic input/output system, and logic to detect a connection of a device to a USB port, in response to the connection, generate a system management interrupt that causes the basic input/output system to assume control of the electronic apparatus, determine, in the basic input/output system, whether the device comprises storage, determine whether the USB port is configured to accept a storage device, and initiate a routine to block access to the USB port in the event that the device comprises storage.

Description:
BACKGROUND 
       [0001]    Security, and particularly data security, remains an important issue in the computer industry. In some environments it may be useful to block universal serial bus (USB) mass storage devices from functioning on computer systems or other electronic apparatus, e.g., to prevent users from downloading data to the USB storage device. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0002]      FIG. 1  is a schematic illustration of one embodiment of an electronic apparatus adapted to implement USB port access management. 
           [0003]      FIG. 2  is a flowchart illustrating operations in one embodiment of implementing USB port access management. 
       
    
    
     DETAILED DESCRIPTION 
       [0004]      FIG. 1  is a schematic illustration of one embodiment of an electronic apparatus adapted to implement USB port access management, according to an embodiment. In the illustrated embodiment, device  100  may be embodied as a hand-held or stationary device for accessing the Internet, a desktop PC, notebook computer, personal digital assistant, or any other processing devices that have a basic input/output system (BIOS) or equivalent. 
         [0005]    In the embodiment depicted in  FIG. 1 , the electronic apparatus  100  includes a computer  108  and one or more accompanying input/output devices  106 , which may include a display  102  having a screen  104 , a keyboard  110 , other I/O device(s)  112 , and a mouse  114 . The other device(s)  112  may include, for example, a touch screen, a voice-activated input device, a track ball, and any other device that allows the system  100  to receive input from a developer and/or a user. The computer  108  includes system hardware  120  including a processing unit  126 , a disk controller  128 , and random access memory and/or read-only memory  130 . Input/output devices  106  may be coupled to computer  108  by a suitable input/output interface such as, e.g., a universal serial bus (USB) port  118 . 
         [0006]    A file store  180  is communicatively connected to computer  108 . File store  180  may be internal such as, e.g., one or more hard drives, or external such as, e.g., one or more external hard drives, network attached storage, or a separate storage network. File store  180  comprises may comprise one or more partitions  182 ,  184 ,  186 . 
         [0007]    Memory  130  includes an operating system  140  for managing operations of computer  108 . In one embodiment, operating system  140  includes a hardware abstraction layer  154  that provides an interface to system hardware  120 . In addition, operating system  140  includes a kernel  144 , one or more file systems  146  that manage files used in the operation of computer  108  and a process control subsystem  148  that manages processes executing on computer  108 . Operating system  140  further includes one or more device drivers  150  and a system call interface module  142  that provides an interface between the operating system  140  and one or more application modules  162  and/or libraries  164 . The various device drivers  150  interface with and generally control the hardware installed in the electronic apparatus  100 . 
         [0008]    In operation, one or more application modules  162  and/or libraries  164  executing on computer  108  make calls to the system call interface module  142  to execute one or more commands on the computer&#39;s processor. The system call interface module  142  invokes the services of the file system(s)  146  to manage the files required by the command(s) and the process control subsystem  148  to manage the process required by the command(s). The file system(s)  146  and the process control subsystem  148 , in turn, invoke the services of the hardware interface module  154  to interface with the system hardware  120 . The operating system kernel  144  can be generally considered as one or more software modules that are responsible for performing many operating system functions. 
         [0009]    The particular embodiment of operating system  140  is not critical to the subject matter described herein. Operating system  140  may be embodied as a UNIX operating system or any derivative thereof (e.g., Linux, Solaris, etc.), a Windows® brand operating system, or any other operating system. 
         [0010]    Electronic apparatus  100  further includes a basic input/output system (BIOS)  160 . In one embodiment, BIOS  126  may be implemented in flash memory and may comprise a power-on self-test (POST) module for performing system initialization and tests. In operation, when activation of electronic apparatus  100  begins processing unit  126  accesses BIOS  122  and shadows the instructions of BIOS  122 , such as power-on self-test module, into operating memory. Processor  126  then executes power-on self-test operations to implement POST processing. 
         [0011]    In some embodiments, electronic apparatus  100  includes an access management module  128  to implement a USB port access management. In the embodiment depicted in  FIG. 1 , portions of access management module  128  are stored in association with BIOS  126 . In alternate embodiments, access management module  128  may be stored in other memory modules associated with computer system  108 . 
         [0012]      FIG. 2  is a flowchart illustrating operations implemented by access management module  128  in one embodiment of implementing USB access management. The operations depicted in  FIG. 2  may be embodied as logic instructions on a computer-readable medium which may be loaded into the operating memory of the computer system and, when executed by the processing unit  122 , configure the computer to implement USB port access management. 
         [0013]    Referring to  FIG. 2 , at operation  210 , a device connection to a USB port is detected. For example, in the embodiment depicted in  FIG. 1  a device may connect to USB port  118 . When the device connection is detected, e.g., by the USB host port controller, the USB port  118  generates a system management interrupt (operation  215 ), which suspends normal processing by processing unit  122  and places the computer  108  in system management mode. At operation  220  the system begins device enumeration for device connected to USB port  118 . Device enumeration may be performed by a USB subsystem of computer  108 . Device enumeration may include, for example, assigning a unique device number to the device, and reading elements of a device descriptor associated with the device. 
         [0014]    If, at operation  225 , the BIOS controls the USB bus, then control passes to operation  260 . If, at operation  260 , it is determined whether the device connected to the USB port comprises mass storage. As used herein, the term “mass storage” when applied to USB devices refers to a USB device that is compatible with the USB mass storage device class as defined by the USB Implementers Forum. Such devices may include, for example, external magnetic hard drives external optical drives, including CD and DVD reader and writer drives, portable flash memory devices, adapters bridging between standard flash memory cards and a USB connection, digital cameras, digital audio players, high-end hardware media players, personal data assistants and handheld computers, and mobile phones. If, at operation  260 , the device connected to the USB port does not comprise mass storage, then control passes to operation  280  and normal operations are continued. By contrast, if at operation  260  the device connected to the USB port comprises mass storage, then control passes to operation  265 . 
         [0015]    At operation  265  it is determined whether the computer  108  is configured to permit mass storage devices to be connected to USB port  118 . The computer  108  may be configured using a configuration utility to configure system to deny access to USB devices which comprise mass storage. In one embodiment, USB access may be configured using an F10 setup utility which resides on most computer systems, and which may be invoked by the BIOS during POST operations. The F10 setup utility permits computer system operators to configure various aspects of their computer system including, but not limited to, USB port access. The F10 setup utility is accessed by pressing the F10 key on a standard keyboard during the boot process. The BIOS detects the F10 key and, in response, invokes the F10 setup utility. Thus, at operation  265  the BIOS may consult an F10 configuration file for the computer  108  to determine whether mass storage devices are permitted. 
         [0016]    If, at operation  265 , the configuration parameter indicates that mass storage devices may be used with the USB port, then control passes to operation  270  and the device is reported to the operating system and normal operations may continue (operation  280 ). By contrast, if the configuration parameter indicates that mass storage devices may not be used with the USB port, then control passes to operation  275  and the device is not reported to the operating system. Thus, the operating remains unaware of the mass storage device and the device cannot be used with the computer  108 . The system may invoke an error routine, wherein the error routine comprises presenting an error message on a user interface associated with the electronic apparatus. Normal operations can then continue at operation  280 . 
         [0017]    Referring back to operation  225 , if the BIOS does not control the USB bus, then control passes to operation  230  and the BIOS assumes control of the USB bus. If, at operation  235 , the device does not comprise mass storage, then control passes to operation  255  and the BIOS releases control of the USB bus and normal operations continue (operation  280 ). By contrast, if at operation  235  the device comprises mass storage, then control passes to operation  245 . 
         [0018]    If, at operation  240  the configuration parameter indicates that mass storage devices may be used with the USB port, then control passes to operation  255  and the BIOS releases control of the USB bus and normal operations continue (operation  280 ). 
         [0019]    By contrast, if the configuration parameter indicates that mass storage devices may not be used with the USB port, then control passes to operation  245  and the BIOS clears the status and status change bits in the USB port, and disables the USB port (operation  250 ). Control then passes to operation  255  and the BIOS releases control of the USB bus and normal operations continue (operation  280 ). 
         [0020]    Thus, the operations of  FIG. 2  permit the electronic apparatus  100  to manage access to a USB port. As noted above, the methods described herein may be embodied as logic instructions on a computer-readable medium. When executed on a processor, the logic instructions cause a general purpose computing device to be programmed as a special-purpose machine that implements the described methods. The processor, when configured by the logic instructions to execute the methods recited herein, constitutes structure for performing the described methods. 
         [0021]    Reference in the specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least an implementation. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment.