USB stick encryption on specific network/domain

Question

I am in a difficult situation here. For my company I need to make the use of USB sticks secure, their demand is that when someone uses a USB stick it will only be readable and accessible on the network/domain of the company. So when the USB is used for example at home of the user, it won't work and it will not show anything. It needs to be able to identify if it is on the company's network.

The company is asking me to look for software that is capable to do something like this. The only thing I could find is a program called USB lock https://www.usb-lock-rp.com/usb-lock-remote-protect.html but I do not think this will encrypt the USB sticks on a specific network.

So my question is, does anybody know some kind of solution for this problem? I am stuck atm.

Help will be very much appreciated.

Kind regards,

Jelger

Answer 1

What is common is just the opposite: only allow secure removable storage media on a network, while you want to disallow your secure USB stick outside of the network.

The only way I can imagine, is to encrypt the USB stick and manage to make the key only accessible from the local network. The simplest way would be to use a HSM to store the private key that is used to decrypt the symetric key used for the USB stick encryption. Unfortunately, that will not prevent a malicious user the store the decoded symetric key and later use it outside of the network.

As it makes harder to use the USB stick outside the network, it may (or not) meet you actual requirements. The hard part is that to increase security further, you would need a special USB driver that securely connects to the central point that decodes the symetric key and never let it accessible to the user. It may not be that hard to develop if you can use a normal USB driver as original source, but driver development is risky because a buggy driver can easily make a machine no longer useable, and I have never heard of such a driver. I'm sorry no to be able to give your more than a hint, but I cannot imagine a better way...