VDI Smart Card Access via Domain Socket Permission Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtual desktop infrastructure (VDI) systems, multiple users can access a shared smart card device via secure shell (SSH), allowing unauthorized access and potential attacks on the smart card, as existing permission checking is lacking to prevent such access.
Innovation Solution
Implementing permission checking by changing the ownership and access permissions of a domain socket file to ensure only the rightful owner can access the smart card device, and monitoring user accounts to terminate unauthorized connections or generate warnings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If device redirection is enabled in VDI to allow smart card devices to be accessed by multiple users, then device accessibility is improved, but security is worsened as unauthorized users can access and attack the smart card
Solution Approach 1:
The patent applies local quality by making the domain socket file's access permissions dynamic and user-specific. Instead of a static permission setting, the socket file's ownership and permissions are changed locally for each user session, allowing the same socket file to have different access characteristics for different users. This enables selective access where each user can only access the smart card device through the socket file when they are the active VDI session user, thus maintaining device accessibility while preventing unauthorized access.
2Object-affected harmful factors
If permission checking is added to the domain socket file to prevent unauthorized access, then security is improved, but system complexity is worsened due to additional permission management overhead
Solution Approach 1:
The patent implements self-service by having the system automatically manage socket file permissions without requiring manual intervention. The VDI server or service automatically changes the ownership and permissions of the domain socket file based on the active user session. This automation reduces the operational complexity burden on administrators while maintaining strong security controls, as the permission management is handled by the system itself rather than requiring external configuration for each access scenario.
Data Source
AI summary
The disclosure provides an approach for permission checking in virtualized desktop infrastructure (VDI) redirection so that only a rightful owner can access a smart card device. When a user logs in to a remote desktop via a VDI client, a service to access the smart card device is notified of the log in event and the user's account identifier. The service changes ownership and access permissions of a domain socket file used by processes to communicate with the service so only the user account owns and has permission to access the domain socket. The service may also bind, listen to, and receive requests from the domain socket to check users who have opened the domain socket file. In response, the service may determine processes that have opened the file and associated user accounts, as well as generate warnings and/or terminate processes which are not authorized to access the domain socket.