WebUSB

Last updated

WebUSB is a JavaScript application programming interface (API) specification [1] for securely providing access to USB devices from web applications. [2]

Contents

It was published by the Web Platform Incubator Community Group. As of July 2021, it is in Draft Community status, and is supported [3] by Google Chrome, Microsoft Edge, QQ, Opera, and Samsung Internet.

Introduction

A Universal Serial Bus, or a USB is an industry standard communication protocol used to communicate data across connectors, and cables from computers to peripheral devices and/or other computers. [4] WebUSB is a set of API calls that enable access to these hardware devices from web pages. WebUSB is developed by the World Wide Web Consortium (W3C). [1] The WebUSB API provides a safe, and developer familiar means of communication to edge devices from web pages. The WebUSB API integrates into existing USB libraries and shortens the development cycle for integrating new devices into the web environment by not needing to wait for browser support for these devices.

Early versions of WebUSB came out around as an alternative to Flash, Chrome Serial, and other custom approaches to connecting browsers to hardware. WebUSB aims to solve the four goals of any interface being; fast to make, cross platform, look good, accessibility. [5]

Application to Internet of Things (IoT) architecture

WebUSB API's are able to bridge hardware protocols to internet protocols, enabling the creating of uniform gateways linking edge devices to a centralised networks. [6]

The explosion in computing ability over the last few decades has led to an increase in edge devices. Devices such as lights, thermometers, HVAC, motors are increasingly integrated into centralised internet control servers. [7] These devices have evolved from isolated and previously non-integrated development environments. Consequently, they lack the uniform and consistent communication protocol necessary to develop robust networks. The WebUSB's API framework standardises disparate protocols and is able to expose non-standard Universal Serial Bus (USB) compatible devices to the web. [8]

The WebUSB looks to sit between the perception layer and the network layer. [6] The main goals of software in this gateway are; Scalability, Cost and reliability. The cloud-based deployment of WebUSB libraries enables it to cover scalability, its low overhead deployment significantly lowers cost, and its continual in use development over its lifetime has enabled the framework to attain a high degree of reliability. [9]

WebUSB has formed a cornerstone of the BIPES (Block based Integrated Platform for Embedded Systems) architecture framework. This systems architecture model aims to reduce complexity of IoT systems development by aggregating relevant software into 'Blocks' that are complete units of code and can be deployed to an edge device from a centralised cloud infrastructure. [10] As already mentioned the role of WebUSB is critically tied to its ability to communicate to embedded software through the USB communication protocol. Once the information is inside WebUSB's JavaScript environment it can be transposed and communicated through a variety of software protocols. [1] In this particular architecture model WebUSB bridges the gap between embedded software, and the web browser. The web browser then communicates to the cloud environment using uniform WebUSB constructed data. [10]

Security considerations

WebUSB provides a web page access to a connector to an edge device. The exposure of any device to the internet carries inherent risks and security concerns. [7] By product of design USB ports are designed to trust the device they are connected to. Connecting such a port to an internet facing application introduced a new set of security risks and massively expanding the attack surface for would be malicious actors. [8] [1]

For instance a malicious host web page could request data from a peripheral device, which the device would happily fulfil thinking it was communicating through a standard USB connector. To mitigate this type of attack WebUSB developed a requestDevice() function call. This would notify the user that the site was requesting access to the edge device. This is similar to the access requests browser control for when a web page would like to access the inbuilt camera or microphone. Depending on the wariness of the user this protocol can be enough to prevent certain attacks. A second protocol that was developed is the specification of a request originating from a secure context. [11] [1] This ensures that both the code to be executed and the data returned is not intercepted or modified in transit. This security is implemented through the claimInterface() function. This is an OS supported function, and ensures that only a single execution instance can have user space or kernel space driver access to the device, preventing malicious code on a web page from opening a second channel of communication to the device. [1] Other security considerations included created a public registry of approved connections, but this idea was ultimately scrapped as it required vendors to develop devices with WebUSB in mind. [1]

The threat surface of a USB however is bi-directional and a malicious peripheral device could attack the host. An infected edge device cannot easily be mitigated by WebUSB API's. In many device configurations trusted USB ports are used to deliver firmware upgrades and a malicious edge device could grant attackers persistence in a system. [11] [4]

In light of the security concerns posed by WebUSB, it is only supported by an estimated 76% of browsers. Also notably is that support for WebUSB at a browser level has been volatile over time, with stretches of time where certain browsers turned off access after the discovery of particular security threats. [12] It is these security concerns that have plagued alternatives to WebUSB. Particularly Flash and Google Serial failed to take off because they were unable to be used with adequate answers to these fundamental security risks. [5]

Use in multi-factor authentication

The ability to own and verify a digital identity on the internet is critical to interaction with internet facing infrastructure. WebUSB in combination with special purpose devices and public identification registries can be used as key piece in an infrastructure scale solution to digital identity on the internet. [13] WebUSB API library is able to standardise the connection of peripheral devices to web pages. The security investment in WebUSB makes it a suitable software component in connecting identifiable devices to the internet. [1] Recent research has shown the fallibility of SMS based authentication highlighting how key pieces of the infrastructure can be subverted. [14] Alternative proposals for securing a digital identity involve the use of biometric sensors and/or personal identifiers. However, while these are good at identifying an individual, it is only through WebUSB that they can adequately be integrated into the existing internet tech stack. [13] Cryptographically secure solutions for personal identification exist with support from government and specialised hardware. However, these solutions lack generalised specification for web based infrastructure and are generally hard to support. Gateway support for such a communication protocol can be supported by software middlemen, such as WebUSB. [10] [13]

A model system for multi-factor authentication uses WebUSB in tandem with an identifying hardware such as an ID card built to ISO/IEC 7810:2003 ID-1 [15] standards. This card would constitute a physical representation of an individual's identity. WebUSB would then act as a middle man in facilitating the transfer of data stored on the hardware to a given web server. The number card would be digitally signed by an authorised party and would digitally connect to a server. This connection would require a device capable of reading ISO/IEC 14443 type B connections. [16] In order to make this digital connection valid, WebUSB would serve as software connector. [13]

Usage

WebUSB will only work on supported browsers, for example Chrome. Due to privacy and security concerns it will also only work in a secure context i.e.; over HTTPS, and can only be called through a user actions. For instance in order to instantiate a connection navigator.usb.requestDevice() can only be called through user gesture, such as touch or mouse click. Similarly protection from WebUSB can be provided using a feature policy. For instance Feature-Policy: fullscreen "*"; usb "none"; payment "self" https://payment.example.com would prevent WebUSB from running. [17]

To get access to devices visible to the browser two options are available. navigator.usb.requestDevice() will prompt the user to select which USB access is to be given, or navigator.usb.getDevices() will return a list of USB devices that the origin has access to.

To better search for devices, WebUSB has a number of filtering options. These filters are passed into navigator.usb.requestDevice() as a JavaScript filtering object. These filters are; vendorId,productId,classCode, protocolCode, serialNumber, and subclassCode.

For example, imagine connecting to an Arduino device, this could be done in the following way. Where 0x2341 is Arduino in the list of USB ID's [18] 

navigator.usb.requestDevice({filters:[{vendorId:0x2341}]}).then(device=>{console.log(device.productName);console.log(device.manufacturerName);}).catch(error=>{console.error(error);});

The USB device descriptor returned from the above snippet will contain all important information about the device such as; version, packet size, configuration options etc.

The alternative call to navigator.usb.getDevices() will instead look like this;

navigator.usb.getDevices().then(devices=>{devices.forEach(device=>{console.log(device.productName);console.log(device.manufacturerName);});})

In order to talk to the device there are a few important function calls to run through. device.open() will run through all the required steps of setting up the device, device.selectConfiguration() sets up the configuration, importantly how it is powered, and the number of interfaces. It is then important to claim the interface. This can be done through the device.claimInterface function call. This will simulate a real wired connection and ensure that this web page is the only one able to read and write to the device until the connection is released. Finally the call device.controlTransferOut() will set up the device to communicate through the WebUSB Serial API. Once the set up is all done, data can be transferred to the device using device.transferIn() to transfer bulk data to the device, similarly its sister function device.transferOut() to read data from the device. [17] [1]

Interfaces

In order to generalise interaction with hardware devices WebUSB supports a number of interfaces than abstract away the specific hardware functionality. [8]

Interfaces
Interface NameDescription
USBProvides attributes and methods for finding and connecting USB devices from a web page. This interface inherits from EventTarget.
USBConnectionEventThis connection event is passed to USB.onconnect or USB.ondisconnect when the agent detects a change in the connection status.
USBDeviceInterface that provides metadata about the connected device and methods for controlling it. Importantly this is the main interface the developer will use for interacting with the device.
USBInTransferResultA representation of the results from a data transfer event from the device to the host. Including field for the data and the status of the transfer. There are three options for status fields; 'ok' meaning the transfer was a success, 'stall' indicating an error producing a stall on the endpoint, or 'babble' which indicates more than expected data was transferred.
USBIsochronousInTransferResultSimilar to USBInTransferResult this is a representation of a data transfer from the device to the host when done across an isochronous endpoint. Has no status field, only the packets.
USBIsochronousInTransferPacketRepresents the status of an individual packet from a request to transfer data from the device to the host over an isochronous endpoint. Can return the status of either 'ok' or 'stall'.
USBIsochronousOutTransferResultSimilar to USBInTransferResult this is a representation of a data transfer from the host to the device when done across an isochronous endpoint.
USBIsochronousOutTransferPacketRepresents the status of an individual packet from a request to transfer data from the host to the device over an isochronous endpoint. Same status fields as USBIsochronousInTransferPacket.
USBConfigurationProvides information about a particular configuration of a USB device . This includes information about device version, maximum packet size and supported interfaces.
USBInterfaceProvides information about an interface provided by the USB device. This includes information on whether it is claimed, as well as its communication protocol.
USBAlternateInterfaceProvides information about a particular configuration of an interface and the particular modes the device can operate in.
USBEndPointThe USBEndPoint is a unidirectional data stream either into or out of the device.

Related Research Articles

<span class="mw-page-title-main">Device driver</span> Computer program that operates or controls a device that is attached to a computer

In computing, a device driver is a computer program that operates or controls a particular type of device that is attached to a computer or automaton. A driver provides a software interface to hardware devices, enabling operating systems and other computer programs to access hardware functions without needing to know precise details about the hardware being used.

<span class="mw-page-title-main">USB</span> Standard for computer data connections

Universal Serial Bus (USB) is an industry standard that allows data exchange and delivery of power between many various types of electronics. It specifies its architecture, in particular its physical interface, and communication protocols for data transfer and power delivery to and from hosts, such as personal computers, to and from peripheral devices, e.g. displays, keyboards, and mass storage devices, and to and from intermediate hubs, which multiply the number of a host's ports.

<span class="mw-page-title-main">Web browser</span> Software used to navigate the internet

A web browser is an application for accessing websites. When a user requests a web page from a particular website, the browser retrieves its files from a web server and then displays the page on the user's screen. Browsers are used on a range of devices, including desktops, laptops, tablets, and smartphones. In 2020, an estimated 4.9 billion people have used a browser. The most used browser is Google Chrome, with a 64% global market share on all devices, followed by Safari with 19%.

<span class="mw-page-title-main">Serial port</span> Communication interface transmitting information sequentially

On computers, a serial port is a serial communication interface through which information transfers in or out sequentially one bit at a time. This is in contrast to a parallel port, which communicates multiple bits simultaneously in parallel. Throughout most of the history of personal computers, data has been transferred through serial ports to devices such as modems, terminals, various peripherals, and directly between computers.

<span class="mw-page-title-main">Parallel port</span> Computer interface

In computing, a parallel port is a type of interface found on early computers for connecting peripherals. The name refers to the way the data is sent; parallel ports send multiple bits of data at once, as opposed to serial communication, in which bits are sent one at a time. To do this, parallel ports require multiple data lines in their cables and port connectors and tend to be larger than contemporary serial ports, which only require one data line.

JTAG is an industry standard for verifying designs and testing printed circuit boards after manufacture.

A gateway is a piece of networking hardware or software used in telecommunications networks that allows data to flow from one discrete network to another. Gateways are distinct from routers or switches in that they communicate using more than one protocol to connect multiple networks and can operate at any of the seven layers of the OSI model.

<span class="mw-page-title-main">Terminal server</span> Device that interfaces serial hosts to a network

A terminal server connects devices with a serial port to a local area network (LAN). Products marketed as terminal servers can be very simple devices that do not offer any security functionality, such as data encryption and user authentication. The primary application scenario is to enable serial devices to access network server applications, or vice versa, where security of the data on the LAN is not generally an issue. There are also many terminal servers on the market that have highly advanced security functionality to ensure that only qualified personnel can access various servers and that any data that is transmitted across the LAN, or over the Internet, is encrypted. Usually, companies that need a terminal server with these advanced functions want to remotely control, monitor, diagnose and troubleshoot equipment over a telecommunications network.

The Intelligent Platform Management Interface (IPMI) is a set of computer interface specifications for an autonomous computer subsystem that provides management and monitoring capabilities independently of the host system's CPU, firmware and operating system. IPMI defines a set of interfaces used by system administrators for out-of-band management of computer systems and monitoring of their operation. For example, IPMI provides a way to manage a computer that may be powered off or otherwise unresponsive by using a network connection to the hardware rather than to an operating system or login shell. Another use case may be installing a custom operating system remotely. Without IPMI, installing a custom operating system may require an administrator to be physically present near the computer, insert a DVD or a USB flash drive containing the OS installer and complete the installation process using a monitor and a keyboard. Using IPMI, an administrator can mount an ISO image, simulate an installer DVD, and perform the installation remotely.

In software architecture, a messaging pattern is an architectural pattern which describes how two different parts of an application, or different systems connect and communicate with each other. There are many aspects to the concept of messaging which can be divided in the following categories: hardware device messaging and software data exchange. Despite the difference in the context, both categories exhibit common traits for data exchange.

<span class="mw-page-title-main">Profinet</span> Computer network protocol

Profinet is an industry technical standard for data communication over Industrial Ethernet, designed for collecting data from, and controlling equipment in industrial systems, with a particular strength in delivering data under tight time constraints. The standard is maintained and supported by Profibus and Profinet International, an umbrella organization headquartered in Karlsruhe, Germany.

<span class="mw-page-title-main">PS/2 port</span> 6-pin mini-DIN connector for connecting keyboards and mice to a PC compatible computer

The PS/2 port is a 6-pin mini-DIN connector used for connecting keyboards and mice to a PC compatible computer system. Its name comes from the IBM Personal System/2 series of personal computers, with which it was introduced in 1987. The PS/2 mouse connector generally replaced the older DE-9 RS-232 "serial mouse" connector, while the PS/2 keyboard connector replaced the larger 5-pin/180° DIN connector used in the IBM PC/AT design. The PS/2 keyboard port is electrically and logically identical to the IBM AT keyboard port, differing only in the type of electrical connector used. The PS/2 platform introduced a second port with the same design as the keyboard port for use to connect a mouse; thus the PS/2-style keyboard and mouse interfaces are electrically similar and employ the same communication protocol. However, unlike the otherwise similar Apple Desktop Bus connector used by Apple, a given system's keyboard and mouse port may not be interchangeable since the two devices use different sets of commands and the device drivers generally are hard-coded to communicate with each device at the address of the port that is conventionally assigned to that device.

A datacard is an electronic card for data operations.

<span class="mw-page-title-main">Xped</span> Australian tech company

Xped Limited, formerly Raya Group, is an Internet of Things (IoT) company based in Adelaide, Australia. Its patented ADRC Technology provides a comprehensive IoT platform.

HP Open Extensibility Platform (HP OXP), developed by Hewlett-Packard Co., is an enterprise software development platform that consists of three unique layers. 1) HP OXPd, the device layer, enables document workflow applications, 2) HP OXPm, the management layer, exposes functionality for management software like HP Web Jetadmin, and 3) HP OXPw, the workflow layer, embeds web services technology into software like the HP Universal Printer Driver (HP UPD). The device layer, or HP OXPd, provides a software development kit (SDK) for creating document workflow applications based on standard web service protocols. Document workflow applications are value-added software applications designed specifically to increase user productivity while interacting with multifunction printers ("MFPs").

<span class="mw-page-title-main">LIO (SCSI target)</span> Open-source version of SCSI target

In computing, Linux-IO (LIO) Target is an open-source implementation of the SCSI target that has become the standard one included in the Linux kernel. Internally, LIO does not initiate sessions, but instead provides one or more Logical Unit Numbers (LUNs), waits for SCSI commands from a SCSI initiator, and performs required input/output data transfers. LIO supports common storage fabrics, including FCoE, Fibre Channel, IEEE 1394, iSCSI, iSCSI Extensions for RDMA (iSER), SCSI RDMA Protocol (SRP) and USB. It is included in most Linux distributions; native support for LIO in QEMU/KVM, libvirt, and OpenStack makes LIO also a storage option for cloud deployments.

WebRTC is a free and open-source project providing web browsers and mobile applications with real-time communication (RTC) via application programming interfaces (APIs). It allows audio and video communication to work inside web pages by allowing direct peer-to-peer communication, eliminating the need to install plugins or download native apps.

Mbed is a development platform and real-time operating system (RTOS) designed for internet-connected devices that utilize 32-bit ARM Cortex-M microcontrollers. These internet-enabled devices are often categorized under the Internet of Things (IoT) umbrella. The Mbed project is a collaborative effort led by Arm Holdings, in partnership with various technology companies and contributors.

Universal 2nd Factor (U2F) is an open standard that strengthens and simplifies two-factor authentication (2FA) using specialized Universal Serial Bus (USB) or near-field communication (NFC) devices based on similar security technology found in smart cards. It is succeeded by the FIDO2 Project, which includes the W3C Web Authentication (WebAuthn) standard and the FIDO Alliance's Client to Authenticator Protocol 2 (CTAP2).

Web Authentication (WebAuthn) is a web standard published by the World Wide Web Consortium (W3C). WebAuthn is a core component of the FIDO2 Project under the guidance of the FIDO Alliance. The goal of the project is to standardize an interface for authenticating users to web-based applications and services using public-key cryptography. WebAuthn credentials are sometimes referred to as passkeys.

References

  1. 1 2 3 4 5 6 7 8 9 Grant, R (2021-10-06). "WebUSB API". WICG. Retrieved 2022-01-07.
  2. ↑ "Access USB Devices on the Web". Google Developers . 30 March 2016.
  3. ↑ "WebUSB | Can I use... Support tables for HTML5, CSS3, etc". caniuse.com. Retrieved 2021-07-02.
  4. 1 2 Anderson, Don (2001). Universal Serial Bus System Architecture (2nd ed.). Addison-Wesley. ISBN   978-0-201-30975-1.
  5. 1 2 Hinton, Suz (2018-06-18). Suz Hinton - I'm afraid your browser has been talking to the robots again a gentle intro to WebUSB. CSSSConf Australia.
  6. 1 2 Beniwal, Gunjan; Singhrova, Anita (2022). "A systematic literature review on IoT gateways". Journal of King Saud University - Computer and Information Sciences. 34 (10): 9541–9563. doi: 10.1016/j.jksuci.2021.11.007 . S2CID   244758915 . Retrieved 2021-12-16.
  7. 1 2 Rondon, L; Babun, L; Aris, A; Akkaya, A; Uluagac, A (2021). "Survey on Enterprise Internet-of-Things systems (E-IoT): A security perspective". ISO. arXiv: 2102.10695 . Retrieved 2021-12-19.
  8. 1 2 3 "WebUSB API". Mozilla Developer Blogs. Mozilla. 2021. Retrieved 2021-12-19.
  9. ↑ Talukder, A.K (2020). "The Next Generation Web: Technologies and Services". Big Data Analytics. Lecture Notes in Computer Science. Vol. 12581. pp. 209–229. doi:10.1007/978-3-030-66665-1_14. ISBN   978-3-030-66664-4. S2CID   230795240 . Retrieved 2021-12-19.
  10. 1 2 3 Junior, A. G. D. S.; Gonçalves, L. M. G.; De Paula Caurin, G. A.; Tamanaka, G.T.B; Hernandes, A.C; Aroca, R.V (2020). "BIPES: Block Based Integrated Platform for Embedded Systems". IEEE Access . 8: 197955–197968. doi: 10.1109/ACCESS.2020.3035083 . S2CID   226854474.
  11. 1 2 Lindström, R (2021). "Enabling Smartphones to act as IoT Edge Devices via the Browser-based 'WebUSB API' : The future of the browser and the smartphone in home electronics IoT systems".
  12. ↑ "Google disables WebUSB in Chrome amidst phishing concerns". XDA Developers. 7 March 2018.
  13. 1 2 3 4 Fujita, Y; Inomata, A; Kashiwazaki, H (2019). "Implementation and Evaluation of a Multi-Factor Web Authentication System with Individual Number Card and WebUSB". Asia-Pacific Network Operations and Management Symposium.
  14. ↑ Brian Krebs (2018-06-01). "Reddit Breach Highlights Limits of SMS-Based Authentication". krebs on Security. Retrieved 2021-12-19.
  15. ↑ "ISO/IEC 7810:2003 - Identification cards – Physical characteristics" . Retrieved 2022-01-07.
  16. ↑ "ISO/IEC 14443-1:2018 - Cards and security devices for personal identification – Contactless proximity objects" . Retrieved 2022-01-07.
  17. 1 2 Beaufort, Francis (2021-02-23). "Access WebUSB". web.dev. Retrieved 2022-01-06.
  18. ↑ "Access WebUSB". web.dev. Retrieved 2022-01-06.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.