Session-Specific Symbolic Links for Private USB Device Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote computing systems lack secure and private access controls for virtualized devices, allowing unauthorized access by multiple user sessions, compromising device security and privacy.
Innovation Solution
The implementation of a Device Access Restriction Module (DARM) intercepts symbolic link creation calls, restricting device access to only the user session from which the device is redirected, using device configuration data to determine whether access should be shared or restricted, thereby creating local or global symbolic links in the Object Manager Namespace.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If device access is allowed from multiple user sessions on a server, then device sharing and resource utilization are improved, but device security and privacy are compromised due to unauthorized access
Solution Approach 1:
The patent segments device access control by creating session-specific symbolic links in the object manager namespace. Each user session receives a dedicated symbolic link to the redirected device, isolating access permissions at the namespace level. This segmentation enables multiple sessions to access the device simultaneously while maintaining individual access control, resolving the contradiction between device sharing and security.
Solution Approach 2:
The patent introduces a device access restriction module as an intermediary between the redirected device and user sessions. This module intercepts symbolic link creation requests and implements access control logic, acting as a mediator that grants or denies access based on session configuration. The intermediary mechanism enables controlled sharing while preventing unauthorized access, balancing versatility and security.
2Object-affected harmful factors
If session-based access restriction is implemented for redirected devices, then device security and privacy are improved, but system complexity increases due to additional access control mechanisms
Solution Approach 1:
The patent implements self-service access control by leveraging existing session configuration data and the operating system's native symbolic link mechanism. The device access restriction module utilizes already-available session information and configuration settings without requiring external authentication services or complex permission management systems. This self-service approach provides security while minimizing additional system complexity.
Solution Approach 2:
The patent changes the parameter of symbolic link scope from global to session-specific within the object manager namespace. By modifying the namespace level at which symbolic links are created (from system-wide to session-local), the patent implements access restriction without adding complex control logic. This parameter change approach simplifies the implementation of security controls.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Restricting access to a device from a server, where the device is remote to the server and is connected locally to a client that is remote to the server, is described. The operations may include facilitating interception, at the server, of a function call to create a symbolic link; facilitating determination that the intercepted function call to create the symbolic link corresponds to a device object associated with the device that is remote to the server and is connected locally to a client that is remote to the server; facilitating obtaining configuration data indicating whether access to the device is to be restricted; and facilitating creation of the symbolic link in a local namespace of an object manager namespace of the server, upon obtaining configuration data indicating that access to the device is to be restricted.