The only way to mitigate against these attacks is to treat the USB bus the same way we treat the network: - Communication with devices should only occur once

The only way to mitigate against these attacks is to treat the USB bus the same way we treat the network: - Communication with devices should only occur once they have been identified & authenticated - Authenticated devices can only send type specific messages and can't change type without re-authentication. - Data should be written as encrypted volumes to storage devices. (You should be doing this anyway.) This is more like how bluetooth works. However that still leaves significant problems for HIDs. The only solution I see is remote attestation and securing the comms channel with encryption. Even if USB is patched like this it doesn't solve the problem of having un-trusted peripherals or appliances. For example, would you trust that the signed firmware for a USB scanner is actually secure? It is quite easy for a scanner driver to be subject to a buffer overflow caused by data from the scanner. Scanner embedded malware could be triggered by scanning a specific form, or anywhere it sees interesting text, like 'SECRET' headers on a page. Networked scanner/photocopier/printers are even worse because they return PDF documents and are serviced by outsiders, and anything on the network can often send them a PDF to execute. I've managed to crash my printer many times by sending large/complex PDF/postscript/PCL5.