USB Redirection Policies Based on Windows Class
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtual desktop infrastructure (VDI) environments, existing USB device redirection technologies lack granular control over which USB devices can be redirected and do not effectively enforce session-level restrictions, leading to security and privacy concerns as redirected devices are accessible to all user sessions.
Innovation Solution
Implementing a system that determines the Windows class of a USB device using its device descriptor before enumeration, allowing for redirection policies to be applied based on the Windows class, and using a Device Access Restriction driver to enforce session-level restrictions by managing access to redirected devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If USB device redirection is implemented to make devices accessible within virtual desktops, then user convenience and device functionality are improved, but security and privacy are worsened because redirected devices become accessible to all user sessions
Solution Approach 1:
The patent segments device accessibility by creating session-specific symbolic links in local namespaces rather than global namespaces. Each user session gets its own isolated access path to redirected devices through session-local device namespaces, preventing cross-session access while maintaining ease of operation within each session.
Solution Approach 2:
The patent applies local quality by making device namespace access local to each user session. Devices are made accessible with session-specific permissions and visibility, where each session has its own local device namespace that restricts access to only that session's processes, thereby maintaining convenience locally while preventing harmful cross-session access.
2Adaptability or versatility
If existing USB device redirection technologies are used, then device functionality is enabled, but granular control over which devices can be redirected is lacking
Solution Approach 1:
The patent implements dynamic device redirection control by evaluating device descriptors against redirection policies at runtime. The system dynamically determines whether to redirect specific USB devices based on their descriptors (VendorID, ProductID, class, subclass, protocol) and applies session-level restrictions accordingly, enabling fine-grained adaptability without excessive complexity.
3Productivity
If redirected USB devices are made accessible to all user sessions, then device sharing is improved, but session-level security restrictions are worsened
Solution Approach 1:
The patent segments device access by creating separate session-local device namespaces for each user session. Devices are shared within sessions through local symbolic links, but cross-session access is blocked by the session isolation mechanism, maintaining both productivity within sessions and reliability through session boundaries.
Solution Approach 2:
The patent introduces session-local device namespaces as intermediaries between physical USB devices and user applications. These intermediary namespaces enforce session-level access control, allowing devices to be accessible to applications within the same session while blocking access from other sessions, thus maintaining both sharing and security.
Data Source
AI summary
Redirection policies can be applied based on the Windows class of a USB device. When an agent on the server receives notification that a USB device has been connected to a client terminal that has a remote desktop connection with the server, the agent can employ the device descriptor contained in the notification to obtain the Windows class of the device. If the Windows class is obtained, and prior to causing the device to be enumerated on the server, the Windows class can be employed to apply one or more redirection policies. In this way, a redirected USB device can be managed at a much more granular level.