Zero-Trust Peripheral Gatekeeper

Motivation

BadUSB attacks and malicious peripherals (like compromised Thunderbolt devices) can execute DMA attacks or masquerade as keyboards. Current OS trust models allow any peripheral to load drivers and interact with the system immediately upon connection. There is no kernel-level enforcement layer that validates device identity and behavior before granting access.

Proposal

An eBPF program that hooks into the Linux kernel’s USB/PCIe driver subsystems to enforce strict, policy-based verification before any peripheral can interact with the OS.

Core Mechanisms

1. Initialization Interception — intercept the initialization sequence of every newly plugged peripheral at the kernel level, before any driver is loaded
2. Policy-Based Verification — check device firmware signatures, behavioral profiles, and declared vs actual capabilities against a configurable policy engine
3. Real-Time Blocking — block suspicious behavior in real-time (e.g., a “mouse” trying to mount a filesystem) and log all anomalies for forensic review

Architecture

• eBPF hooks attached to usb_probe_device and PCIe hotplug paths
• Userspace policy daemon that manages allow/deny rules and firmware signature databases
• Audit log with structured events for every device connection attempt, policy decision, and anomaly

Threat Model

• USB devices claiming to be HID (keyboard/mouse) but injecting commands
• Thunderbolt/PCIe devices performing DMA attacks
• Firmware-modified devices that pass basic USB descriptor checks but exhibit malicious runtime behavior

Alternatives Considered

• USBGuard — userspace-only, no kernel-level interception, limited to USB (no PCIe), and relies on device descriptors which can be spoofed
• IOMMU-only — protects against DMA but doesn’t validate device identity or behavior
• Physical port blockers — impractical for dynamic environments

Decision

Pending — draft stage.