Session-Level Device Access Restriction Object

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In remote computing environments, virtualized devices connected to client terminals are accessible from multiple user sessions, leading to unauthorized access and security concerns, particularly due to operating systems like Windows that implement Kernel Patch Protection, making it difficult to restrict access through kernel hooks.

Innovation Solution

A Device Access Restriction (DAR) object is attached to the device stack to manage access requests, allowing only authorized sessions to access redirected devices, thereby providing secure and private access by verifying session identity and blocking unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If device virtualization is implemented to allow multiple users to access remote devices, then resource utilization and accessibility are improved, but security and access control are worsened due to unauthorized access from multiple sessions

Engineering Contradiction:

Improvedevice accessibilityVSAvoidaccess security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent segments device access control by creating session-specific device stacks and attaching device access restriction objects to each session. This divides the monolithic device access control into session-level segments, allowing each user session to have isolated and controlled access to virtualized devices, thereby maintaining security while enabling multi-user accessibility.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces device access restriction objects as intermediary components between user sessions and virtualized devices. These objects act as mediators that intercept and evaluate access requests, determining whether to allow or block access based on session authorization. This intermediary layer enables secure multi-session access without requiring kernel-level modifications.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If kernel hooks are used to restrict device access, then access control capability is improved, but system compatibility and ease of implementation are worsened due to Kernel Patch Protection in modern operating systems

Engineering Contradiction:

Improveaccess control capabilityVSAvoidimplementation difficulty

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The patent uses device access restriction objects as intermediary components that operate at the device stack level rather than requiring kernel hooks. These objects serve as mediators between user-mode applications and the device driver, enabling access control through standard operating system interfaces without bypassing Kernel Patch Protection, thus maintaining both security capability and broad system compatibility.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the mechanical approach of kernel-level hooking with a higher-level software-based solution using device access restriction objects. Instead of directly modifying kernel structures (mechanical intervention), the system uses object-oriented access control mechanisms that operate through standard system interfaces, making the solution easier to implement across different operating systems while maintaining effective access control.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS9479598B2System and method for providing session-level access management of a redirected device

Publication Date: 2016.10.25 DELL MARKETING CORP

AI summary

Managing access restriction to a device is provided. The operations may include determining that a device stack corresponds to a device that is remote to the server and is connected locally to a client that is remote to the server; attaching a device access restriction object on top of the device stack; receiving, at the device access restriction object, an access request to the device; and determining, at the device access restriction object, whether the access request is allowed access to the device.