GB2448354A

GB2448354A - Security device for blocking a USB port

Info

Publication number: GB2448354A
Application number: GB0707080A
Authority: GB
Inventors: David Land; Andrew Forrester; Sophia Lawrence
Original assignee: Individual
Current assignee: Individual
Priority date: 2007-04-12
Filing date: 2007-04-12
Publication date: 2008-10-15
Anticipated expiration: 2027-04-12
Also published as: GB0707080D0; WO2008125837A1; GB2448354B

Abstract

A security device for blocking a computer port such as a Universal Serial Bus (USB) port comprises a connector member 110 for fitting inside a USB port, wedge shaped projections 130 for securing the connector member to the USB port and a frangible (breakable) fascia 120. An attempt by a user to gain unauthorised access to the USB port by tampering with the device results in the fascia breaking off. The loss of the fascia provides clear evidence of tampering during a subsequent security audit. The fascia may be colour contrasted with the connector member to make unauthorised access readily visible during the audit. The device may be fitted with an identifier (600, fig. 6) and may include an RFID tag. A restrainer (1020, 1021, 1022, fig. 10) may be fitted to the device in order to prevent unauthorised disconnection of a peripheral such as a keyboard from a neighbouring port. The restrainer may be a steel wire in conjunction with a lead crimp to form a noose around the keyboard USB plug, or alternatively a cable tie may be used.

Description

Application No. GB0707080.8 RT.IvI Datc:9 August 2007 The following

terms are registered trademarks and should be read as such wherever they occur in this document: Bakeljte

SECURITY DEVICE

The present invention is concerned with the security of computers and other devices.

Many electronic devices, such as computers and portable storage devices, have ports for enabling data to be transferred to/from the device. Examples of ports are the USB (Universal Serial Bus) and Firewire (RTM) (IEEE 1394) ports Some institutions, such as banks, require security in order to prevent the unauthorised transfer of information. For example, a dishonest bank employee could transfer financial data Onto a USB memory device. Another potential security problem is that of users connecting USB memory devices to a PC (personal computer) in order to listen to music stored as data on a USB memory device. This could unwittingly introduce a computer virus onto the PC.

IS There is therefore a need for an apparatus for improving the security of PCs. PCs are typically replaced on a 2-3 year cycles and in order to maximise the resale value of the PCs, the ports (such as USB ports) must still be functional. Although ports such as USB ports could be disabled by physically damaging the USS ports in order to prevent users from using the USB ports, this (somewhat drastic) method has the disadvantage that the resale value of the PCs (PCs are typically replaced every 2 to3 years) will be decreased due to the damaged USB ports.

A prior art device is the PC Guardian (RIM) available from PC Guardian Anti-Theft Products, Inc. These security devices have the disadvantage that mechanical keys are required in order to mechanically secure and release the security devices to/from a USB port; thus the user must store and manage the various mechanical keys.

Another prior art device is the USB Blocker available from All-In-One (RIM). These devices block USB ports but have the disadvantage that they can be removed without providing any indication that they have been removed.

According to the present invention, there is provided a security device comprising: a plug; one or more features on the plug for engagement with a port; and a fascia.

A benefit of some embodiments of the present invention is that ports are reversibly disabled. That is, ports can be restored to use, thereby enhancing the re-sale value of the PC.

Another benefit of some embodiments of the present invention is that ports are rendered tamper-proof. That is, if a port is restored to use by removing the security device then the fact that the security device has been removed is made readily apparent. In contrast. with some prior art devices, if a user managed to pick the lock then there would be no record that the port has been used without authorisation.

Yet another benefit of some embodiments of the present invention is that a user can, if necessary, over-ride the security device by removing the security device from the PC.

For example, if a company executive needs to transfer data (for example in order to perform an urgent Powerpoint (RTM) presentation to other executives) using a secured port then the security can be over-ridden and the port can be used. However.

the fact that the Security device has been used is readily apparent and thus an audit trail is established. In some institutions, all the ports of all that institution's PCs may be protected with a security device and then audited on, say, an annual basis to check that the security devices have not been removed. In the event that a company executive did need to remove a security device then this can be recorded as part of an audit trait.

DESCRIPTION OF FIGURES

Figure 1 shows an isometric view of a plug end of a first embodiment of a security device.

Figure 2 shows a cross-sectional view of the security device of Figure I, installed inside a USB receptacle.

Figure 3 shows an isometric view of a fascia end of the security device of Figure I. Figure 4 shows an exploded isometric view of the security device of Figure I. Figure 5 shows a cross-sectional view of a second embodiment of a security device, installed inside a USB receptacle.

Figure 6 shows an isometric view of a fascia component of Figure 5.

Figure 7 shows an isometric view of a plug component of Figure 5.

Figure 8 shows a cross-sectional view, in a plane perpendicular to the plane of Figure 5, of the plug component of Figure 5.

Figure 9 shows a tool that may be used to remove the security device of Figure 5 from a tJSB receptacle.

Figure 10 shows a third embodiment that prevent the unauthorised disconnection of peripherals.

Elements with the same numbers in the various Figures are the same.

DESCRIPTION OF PREFERRED EMBODIMENTS

First embodiment Figure 1 shows a security device 100 comprising a plug I 10, a fascia 120 and two wedge shaped projections 130 provided on the plug 110. The plug 110 and the projections 130 are preferably formed of a frangible plastic such as Bakelite.

Figure 2 shows a cross-sectional view of the security device 100, installed in a type A USB receptacle 250. The plug 110 is a cuboid that is dimensioned to fit inside the USB receptacle 250. Figure 2 shows a recess 201 which, for clarity, is not shown by Figure 1. The recess 201 is formed in the plug 110. The recess 201 allows the plug to accommodate a tongue 251 (which tongue 251 carries the electrical contacts of the USB receptacle 250) the USB receptacle 250 during insertion of the plug 110 into the USB receptacle 250.

As those skilled in the art will appreciate, type A USB receptacles typically have a pair of metal prongs formed in the metal shielding cage of the receptacle. The metal prongs cooperate with a pair of corresponding recesses formed in the shielding cage of type A USB plugs (not shown). The recesses in a IJSB plug receive the metal prongs of a USB receptacle as a detent mechanism in order to prevent accidental removal of the USB plug from the USB receptacle.

Figure 2 does not show the metal prongs of the USB receptacle 250 but Figure 2 does show that the projections 130 protrude through the metal shielding cage of the USB receptacle 250 at a prong region 260. The wedge shaped projections 130 of the plug I 10, when the plug 110 is inserted into a type A USB receptacle, displace the metal prongs with the result that the projections 130 (and hence the plug 110) are captively retained by the shielding cage of the USB receptacle.

The projections 130 each comprise a ramp portion 231 and an abutment surface 232.

The abutment surface 232 is shown protruding at substantially 90 relative to the plug I 10 although in alternative embodiments the abutment surface 232 may be a! a different angle, for example to form a barb.

Other than the recess 201, the plug 110 is a generally solid cuboid; the plug 110 has dimensions similar to the metal shielding cage of a USB plug but the plug 110 does not have a metal shielding cage.

Figure 3 shows an isometric view of a fascia end of the security device 100. The fascia 120 comprises a planar inner panel 301 which is connected to, but spaced apart from, a planar outer panel 303 by a total of eight support pins 302 (in other embodiments, one or more support pins 302 may be used). The projections 130 are not visible in Figure 3 as the projections are hidden by the plug 110.

The outer panel 303 is provided with four intersecting fault lines 310 which are regions where the thickness of the outer panel 303 is reduced. Thus if the fascia 120 is tampered with (e.g. by an unauthorised user who attempts to use a USB port) then the outer panel 303 will become damaged.

In alternative embodiments the fascia 120 may comprise a single panel instead of the inner panel 301, support pins 302 and outer panel 303. Such a single panel would still provide a tamper evident means of preventing access to the electrical connections of the USB receptacle. More generally, the force required to remove (by shearing off the projections 130 from the plug 110) the security device 100 from a USB receptacle is greater than the force required to damage the fascia 120. Thus the security device 100 cannot be removed without causing tamper evident damage to the fascia 120.

Figure 4 shows an exploded view exploded isometric view of the security device 100.

The projections 130 are not visible in Figure 4 as the projections are hidden by the plug I 10.

Although shown as separate pieces in the exploded view, a preferred method of manufacture of the security device 100 is to simultaneously mould all the parts simultaneously. As those skilled in the art will appreciate, one plastic may be used to form the plug 110 and the projections 130 and another plastic may be used to form the inner panel 301, support pins 302 and the outer panel 303.

In this embodiment, it is preferred that the outer panel 303 is formed from a black plastic and the inner panel 301, the plug 110 and the projections 130 are formed from a high visibility plastic, e.g. yellow.

If a user attempts to use a USB port which has been secured by the security device then when the user attempts to remove the security device 100, the device 100 will be damaged. For example, the outer panel 303 will become at least partially broken and thus the underlying yellow plastic of the inner panel 301 will be revealed.

IS It is therefore possible, at a glance, to determine that an attempt has been made to obtain unauthorised access to the USB port.

It is envisaged that the security device 100 will not be readily available to the public; only designated authorised company personnel will be able to buy replacement security devices 100. Thus even if a user does manage to remove the security device from a USB port (the removal is difficult due to the projections 130 being engaged with the metal shielding cage of the USB receptacle 250), the user will not be able to obtain an undamaged (i.e. with an intact black Outer panel 303) replacement security device.

It is also envisaged that security devices 100 are customised for each site of a customer. For example, if a bank has twenty different offices then a unique identifier may be assigned to the bank, and a sub-identifier may be used to differentiate the twenty offices. Figure 6 shows an example of an alphanumeric identifier comprising a sub-identifier.

Security devices 100 may also, or additionally, be CustomisecJ by including a unique, machine readable, identifier in each security device. For example, an RFID tag having a unique, machine-readable, serial number may be included in the plug 110 of each security device 110. During installation of security devices 100 into USS ports of a bank, a record is maintained of the serial number of each of the security devices.

Thus even if a user (that is, a user who had removed without authorisation a security device 100 from a USB port and was then attempting to hide the fact that the security device 100 had been removed) was able to obtain a replacement security device 100 having a similar appearance, the alphanumeric identifier and/or the serial number of the replacement security device 100 would not match the alphanumeric identifier and/or the serial number of the security device 100 that had been removed by the user.

Security devices tOO may also be customised by the colour combination, e.g. orange on blue instead of yellow on black.

It is envisaged that a company may provide security services to organisations such as banks. First, the company installs security devices 100 into all the USB ports of all computers owned by the bank. Then, on either a random or periodic basis, the company audits the computers owned by the bank to confirm that the security devices previously installed are still intact and have not been tampered. The company receives a fee from the bank in return for providing the security services which facilitate the compliance of the bank with legislation, e.g. the Sarbanes-Oxley Act in the USA. In some circumstances it may be necessary for, say, a company executive to remove a security device 100 in order say, to show a presentation to other executives.

In such circumstance a record may be made, in advance of a randomfperiodjc audit, of the circumstances surrounding the removal of the security device 100.

Second embodiment Figure 5 shows a cross-sectional view of a second embodiment 500 of a security device, installed inside a USB receptacle 250. The security device 500 comprises a fascia component 520 and a separate plug component 510. The fascia component 520 and the plug component 510 cooperate together inside the IJSB receptacle 250.

Figure 6 shows an isometric view of the fascia component 520 of Figure 5. As shown, the fascia component 520 comprises two wedge shaped projections 130. In this embodiment the fascia component 520 is provided with an identifier 600, here the alphanumeric characters "A9OBXR".

Figure 7 shows an isometric view of the plug component 510 of Figure 5. As shown, the plug component 110 has a recess 701 which accommodates the tongue 250 of the USB receptacle 250. The plug component 510 also has a recess 710 which allows a tool 900 to remove the plug component 510 from the USB receptacle 250.

Figure 8 shows a cross-sectional view, in a plane perpendicular to the plane of Figure 5, of the plug component 510. As shown, the recess 710 forms the entrance to a generally "L" shaped cavity 800. In alternative embodiments, the cavity may instead be T' shaped in order to facilitate injection moulding of the plug component 510.

Figure 9 shows a tool 900 that may be used to remove the security device 500 from the USB receptacle 250. The tool 900 has a generally "L" shaped end 901. To remove the security device 500, a portion of the fascia component 520 is deliberately damaged in order to allow access to the recess 710 (the recess 710 is otherwise obscured by the fascia component 520). The end 901 of the tool 900 is then inserted into the recess 710 and the end 901 is then moved sideways so that the L shaped end 901 engages the L shaped cavity 800. The tool 900 is then used to pull the plug component 510, together with the damaged fascia component 520, Out of the USB receptacle 250.

In an alternative embodiment, the cavity 800 may be arranged to communicate with the recess 701 instead of the recess 710.

Third embodiment Figure 10 shows a third embodiment 1000 that prevent the unauthorised disconnection of peripherals. Some computer peripherals, such as keyboards and mice, are connected to a PC via a USB receptacle. There is therefore the risk that an unauthorised employee could disconnect the keyboard the USB receptacle, plug in a USB memory stick into the now available USB port, transfer sensitive data, and then reconnect the keyboard to the USB port.

USB ports are typically provided in pairs. The security device 1000 uses one port of an adjacent pair of ports to prevent the unauthorised disconnection of a device connected to the other port of the adjacent pair of ports.

Figure 1000 shows a keyboard USB plug 1010 that is plugged into a first USB receptacle 1001. Adjacent the first USB receptacle 1001 is a second LJSB receptacle 1002.

The security device 100 has been inserted into the second USB receptacle 1002. A steel wire 1020 in conjunction with a lead crimp 1021 form a noose 130 around the keyboard USB plug 1010. The diameter of the noose 1030 is no less than the diameter of a cable 101 I that emanates from keyboard USB plug 1010. The diameter of the noose 1030 is less than the effective diameter (USB plugs are typically rectangular in cross section) of the keyboard USB plug 1010 with the result that the noose 1030 holds the keyboard USB plug 1010 captive inside the first USB receptacle 1001.

The other end of the wire 1020 passes between the inner panel 301 and the outer panel 303 of the fascia 120. Another lead crimp 1022 holds the wire 1020 captive within the fascia 120. Thus the keyboard USB plug 1010 cannot be removed without damaging the fascia 120 in a tamper evident manner.

The lead crimps may be patterned as is sometimes done with utility meters, for example electricity meters. Thus even if an unauthorised person were to cut the wire 1020 and then attempt to replace the wire 1020 and make replacement crimps 1021, 1022, the replacement crimps would not match the original crimps.

In alternative embodiments, the wire 1020 may be moulded into the security device 100, obviating the second crimp 1022. In yet other embodiments, a cable tie (a type of ratchet locking securing device) may be integrally moulded with the security device and the cable tie may be used instead of the wire 1020 and crimps 1021, 1022.

Other embodiments Features of the security device 100, security device 500 and wire 1020, and the various alternative embodiments, may be combined.

In alternative embodiments, spring mounted shear pins (not shown) may be used instead of the projections 130. Such shear pins are arranged to emerge from the plug normal to the plug 110. The shear pins engage with the recesses in the metal shielding cage of a connector. Of course, some embodiments of the security device may be designed to operate fl Conjunction with connectors that do not have a metal shielding cage. lfsufficient force is used to remove the security device, then an extremity of the shear pin shears off.

Embodiments described above related to a security device 100, 500 that was inserted into a receptacle. In other embodiments, the security device may instead be a receptacle or may imitate a male or a female connector. In other embodiments, the security device may be provided with a cavity that receives a USB plug; the cavity is provided with one or more projections for engaging with one or more of the pair of recesses formed in the shielding cage of type A USB plugs.

According to some embodiments, there is a security device (100; 500; 1020) comprising: a connector member (110) for fitting inside a computer port, e.g. a USB port (250); wedge shaped projections (130) for securing the connector member to the USB port; and a fascia (120). If a user attempts to obtain unauthorised access to the USB port then the fascia breaks off, this will become apparent during a subsequent security audit. The fascia may be colour contrasted with the connector member to make unautharised access readily visible. The security device may be provided with an identifier (600). A restrainer (1020, 1021, 1022) may be fitted to the security device in order to prevent the unauthorised disconnection of peripherals such as USB keyboards. Is

Claims

CLAIMS: 1. A security device comprising: a connector member for

engaging with an electrical connector; and a securing means for securing the security device to an electrical connector.
2. A security device according to claim I, wherein the securing means comprises one or more projections.
3. A security device according to claim I or 2, wherein the one or more projections are frangible from the connector portion.
4. A security device according to any preceding claim, comprising a fascia.
5. A security device according to claim 4, wherein the fascia is frangible.
6. A security device according to claim 4 or 5, wherein the fascia comprises one or more fault lines.
7. A security device according to claim 4, 5 or 6, wherein the fascia comprises: an inner panel, an outer panel and one or more support pins connecting the inner panel to the outer panel.
8. A security device according to any one of claims 4 to 7, wherein the connector portion, the fascia and the securing means are integrally formed.
9. A security device according to any one of claims 4 to 7, wherein the connector member and the securing means are integrally formed, and the fascia is a separate component.
10. A security device according to any one of claims 4 to 9, wherein the connector member and the fascia are of different colours.
I I. A security device according to any preceding claim, wherein the connector member comprises a recess for accommodating one or more electrical contacts of an electrical connector.
12. A security device according to any preceding claim, wherein the connector member comprises a cavity for extracting the connector member from an electrical connector.
13. A security device according to any preceding claim, wherein the connector member is dimensioned to cooperate with a type A USB receptacle.
14. A security device according to any preceding claim, comprising information for distinguishing the security device from other security devices.
15. A security device according to claim 14, wherein the information comprises an alphanumeric identifier.
16. A security device according to claim 14 or I 5, wherein the information comprises a unique identifier.
17. A security device according to any one of claims 14 to 16, comprising an RFID tag.
18. A security device according to any preceding claim, comprising a restrainer for preventing the disconnection of an electrical connector.
19. A security device according to claim 18, wherein the restrainer comprises a wire.
20. A security device according to claim 19, wherein the restrainer comprises a noose formed at one end of the wire.
21. A security device according to any one of claims 18 to 20, wherein the restrainer is integrally moulded with at least one of a connector member and a fascia.
22. A computer fitted with a security device according to any one of claims Ito 21.
23. A peripheral fitted with a security device according to any one of claims I to 21.
24. A method of controlling transfer of data with a computer, comprising the steps of: fitting a security device according to any one of claims I to 21 to the computer.
25. A method according to claim 24, further comprising the step of restraining an electrical connector to prevent disconnection of the electrical connector from the corn puter.
26. A method according to claim 24 or 25, comprising the step of inspecting one or security devices to check whether or not the one or more security devices have been tampered with.
27. A method according to any one of claims 24 to 26, comprising the step of receiving money from an institution such as bank in order to verit' compliance of the institution with security legislation.