Upper Filter Driver Session Access Control for Storage Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In information handling systems, particularly in Microsoft Windows environments, the miniport driver cannot access or set operating system properties for newly coupled logical units, leading to the inability to restrict access to storage devices to specific user sessions, resulting in all users having access to virtualized devices connected to servers.
Innovation Solution
A filter driver is used to set operating system properties, specifically the session identifier, for storage devices, ensuring that only the associated user can access the logical unit by utilizing custom IOCTL commands and the IoSetDevicePropertyData API within the storage device PDO upper filter driver.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a miniport driver is used to manage storage devices in a multi-user environment, then device accessibility is maintained across all users, but the ability to restrict access to specific user sessions is lost
Solution Approach 1:
An upper filter driver is introduced as an intermediary component between the miniport driver and the storage device. This filter driver intercepts I/O requests and checks session identifiers to determine whether to allow or block access. The filter driver acts as a security gatekeeper without requiring changes to the existing miniport driver architecture, thus enabling access control while maintaining system stability.
Solution Approach 2:
The driver architecture is segmented into distinct functional layers: the miniport driver handles low-level device communication while the upper filter driver handles security and access control. This segmentation allows each driver to specialize in its function, with the filter driver focusing solely on access control decisions based on session identifiers.
2Reliability
If operating system properties are not set for logical units, then device visibility is maintained for all users, but security restrictions cannot be enforced
Solution Approach 1:
The upper filter driver performs preliminary actions by setting operating system properties and session identifiers on logical units before any I/O requests are processed. By pre-configuring the security context and session information, the system ensures that subsequent access control decisions can be made efficiently based on these pre-established properties.
3Adaptability or versatility
If virtualized storage devices are made accessible to multiple users, then resource sharing is enabled, but unauthorized access control is compromised
Solution Approach 1:
The upper filter driver implements a feedback mechanism by checking the session identifier of each I/O request against the authorized session for the logical unit. This feedback loop continuously monitors and enforces access control policies, allowing legitimate users to access their assigned devices while blocking unauthorized access attempts in real-time.
Data Source
AI summary
In certain circumstances it is desirable to restrict access to a SCSI storage device (physical or virtual) to a particular user associated with a specific session identifier. By utilizing a specialized filter driver, certain operating system parameters may be set or modified even though the miniport driver cannot access the device object created by the storport driver for the storage device. The filter driver may issue custom commands to retrieve storage device specific information and use that information to set or modify one or more operating system commands to restrict the access to the storage device.