PSD v5.0: Permit USB peripherals with integrated hubs and composite functions

Issue
PSD v4.0’s security model requires the PSD to control the user-peripheral path and prevent a peripheral from creating a cross-domain communication path. It should not require every permitted USB peripheral to be a simple, single-function USB device.

Many current peripherals are complex USB structures. A CAC reader, camera, video bar, sound bar, headset, or keyboard may include an internal USB hub, several USB interfaces, multiple endpoints, or composite-device functionality. The PSD may need to expose only approved functions to a protected computer while disabling, suppressing, or not exposing others.

The presence of a hub or multiple endpoints is not itself a cross-domain risk. The risk arises if an internal hub, interface, endpoint, or downstream port can bypass PSD mediation or create an uncontrolled connection between protected computers.

Proposed clarification

PSD v5.0 should permit a USB peripheral that contains an integrated hub or composite-device functionality where:

• The hub, supported downstream ports, and peripheral functions are within the PSD-controlled peripheral path.
• The PSD independently mediates each host-facing interface.
• The PSD exposes only approved functions, USB interfaces, endpoints, and downstream ports to the applicable protected computer.
• An internal hub, USB interface, endpoint, or downstream port cannot create an uncontrolled connection to another protected computer or PSD domain.
• Unsupported device classes, interfaces, endpoints, or hub functions cannot be used to bypass the required PSD mediation.

Filtering selected USB enumeration fields alone should not be treated as sufficient isolation. The relevant requirement is independently mediated host-facing behavior for each protected computer channel.

Requested change

Add a narrow clarification to the relevant peripheral requirements and Evaluation Activities permitting hub-containing and composite USB devices, subject to PSD-controlled and independently mediated host-facing interfaces.

The Evaluation Activity should require the evaluator to verify that only authorized functions/interfaces/endpoints are exposed to each protected computer and that an integrated hub or composite device cannot provide an uncontrolled path between protected computers.

Locate the relevant PSD v5.0 peripheral requirements and Evaluation Activities, then compare them with the v4.0 security model described here. Done means the specification narrowly permits integrated hubs and composite devices while requiring independent mediation and verification of authorized functions, interfaces, endpoints, and downstream ports.