Smart Card Stub Isolates Redirected Readers in Remote Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtual desktop infrastructure (VDI) environments, existing USB device redirection techniques face challenges in accessing smart card readers within remote sessions due to security limitations and compatibility issues with different operating systems, leading to incomplete API mapping and increased hardware requirements for clients.
Innovation Solution
Implementing a smart card stub within the remote session and a smart card proxy in Session 0, along with a kernel filter driver, to intercept and manage API calls, allowing access to redirected smart card readers while maintaining session isolation and compatibility across various operating systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If USB device redirection is implemented to make smart card readers accessible within remote sessions, then smart card access capability is improved, but security control and session isolation are worsened
Solution Approach 1:
The system segments smart card reader access by creating session-specific device stacks and filter drivers that isolate each remote session's smart card readers to that session only. The filter driver intercepts API calls and checks session identifiers to determine whether a smart card reader should be accessible, thereby maintaining session isolation while enabling smart card access within the appropriate session context.
Solution Approach 2:
A filter driver is introduced as an intermediary component between the smart card reader device stack and the application layer. This filter driver monitors and controls API calls (such as SCardListReaders) by examining session identifiers and filtering device names based on session affinity, thus mediating between the need for smart card access and the requirement for session isolation.
2Adaptability or versatility
If driver mapping is implemented to enable smart card access from remote sessions, then smart card functionality is improved, but client hardware requirements and system complexity are worsened
Solution Approach 1:
The server-side system performs self-service by implementing all necessary smart card redirection and session isolation functionality through kernel filter drivers and device stack modifications on the server. The client terminal requires no special hardware or driver installations, as the entire smart card access mechanism is handled transparently by the server's virtualization infrastructure, thereby eliminating additional client hardware requirements.
3Ease of operation
If smart card readers are redirected to remote sessions, then user access to smart cards is improved, but cross-session security vulnerabilities are worsened
Solution Approach 1:
The filter driver implements feedback control by continuously monitoring API calls and comparing session identifiers against the device stack's session affinity information. When an application attempts to enumerate or access smart card readers, the filter driver checks whether the requesting session matches the session associated with each reader, providing real-time security feedback that blocks cross-session access attempts while allowing legitimate same-session access.
Solution Approach 2:
The system applies local quality control by associating each smart card reader device stack with a specific session identifier at the local device level. The filter driver examines the local session context of each API call and selectively permits or blocks access based on whether the calling session matches the device's assigned session, thereby ensuring that security properties are applied locally to each device-session pair rather than globally.
Data Source
AI summary
A smart card stub and a smart card proxy can be employed to enable a redirected smart card reader to be accessed within a remote session. To isolate a redirected smart card to a remote session, the smart card stub can be configured to process a response to an application's request to enumerate smart card readers. This processing can include obtaining a session identifier for each enumerated smart card reader and removing any smart card reader from the response if the session identifier of the smart card reader does not match the session identifier of the requesting application. The smart card stub can communicate with a filter driver to obtain the session identifiers employed in this process.