Session Restrictions for Disjoint USB Stacks via Filter Drivers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtual desktop infrastructure (VDI) environments, USB device redirection allows devices connected to clients to be accessed as if they were locally connected to the server, but this lacks session-level restrictions, leading to security and privacy concerns as devices can be accessed by unauthorized users across sessions.
Innovation Solution
Implementing a Device Access Restriction (DAR) driver that registers as an upper filter driver to attach a Device Access Restriction object to the device stack, allowing only access from the original user session by verifying the presence of a redirection virtual bus driver and managing symbolic links to enforce session-level restrictions, even in disjoint stack configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If USB device redirection is implemented to allow device access across sessions, then device accessibility and versatility are improved, but security and privacy are worsened due to unauthorized access by other users
Solution Approach 1:
The patent applies local quality by creating session-specific symbolic links in local namespaces rather than global namespaces. Each user session gets its own isolated view of redirected devices through session-specific symbolic links stored in local namespaces, allowing devices to be accessible within their intended session while preventing cross-session access. This localized approach maintains device accessibility where needed while blocking unauthorized access elsewhere.
2Reliability
If session level restrictions are implemented to prevent unauthorized device access, then security is improved, but device accessibility across sessions is worsened
Solution Approach 1:
The patent applies segmentation by dividing the namespace into local namespaces for each user session rather than using a single global namespace. Each session has its own isolated namespace where symbolic links to redirected devices are created only for that specific session. This segmentation ensures that devices redirected in one session cannot be accessed by other sessions, providing security while maintaining necessary accessibility within each session context.
3Reliability
If a filter driver traverses the device stack to locate the root driver for session identification, then session level control is improved, but device complexity and processing overhead are worsened
Solution Approach 1:
The patent applies preliminary action by having the filter driver perform the device stack traversal and session identification process when the device is first redirected or when access is requested. The session identifier is obtained in advance and stored for use in subsequent access control decisions. This preliminary action ensures that session level control is properly established before any potential unauthorized access can occur, while the complexity of the traversal process is executed only when necessary rather than continuously.
Data Source
AI summary
Session level restrictions can be implemented for devices having disjoint stacks. When a filter driver is loaded onto a device stack, it can traverse the device stack to locate the root driver in the stack. If the root driver is a redirection virtual bus driver, the filter driver can obtain a session identifier associated with the device. Otherwise, if the root driver is not a redirection virtual bus driver, the filter driver can obtain the container ID for the device. The filter driver can then obtain a list of the devices that are enumerated by the redirection virtual bus driver and determine whether any of the devices in the list have a container ID matching the container ID of the device. If a match is found, the session ID of the matching device can be obtained and employed to implement session level restrictions.