Virtual Bus Driver Isolating Redirected USB Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtual desktop infrastructure (VDI) environments, USB device redirection allows users to access USB devices as if they were locally connected to the server, but this lacks security and privacy controls, enabling unauthorized access to shared devices.
Innovation Solution
Implementing a virtual bus driver on the server to evaluate and filter IO requests from applications, ensuring only permitted applications can access redirected USB devices, thereby restricting access to specific user sessions and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If USB device redirection is implemented in VDI environment, then users can access USB devices as if locally connected, but security and privacy controls are lost enabling unauthorized access to shared devices
Solution Approach 1:
The patent segments USB device access control by creating separate device stacks for each user session and implementing session-specific filtering. The system divides the previously unified USB access into isolated session contexts, where each session has its own virtual bus driver instance that evaluates and filters IO requests independently, preventing cross-session unauthorized access while maintaining ease of USB device operation within each session.
2Productivity
If USB device is redirected to server, then device functionality is available remotely, but any application in the session can access the device without restriction
Solution Approach 1:
The patent introduces a virtual bus driver as an intermediary component between applications and redirected USB devices. This intermediary evaluates each IO request packet to determine whether it originated from an allowed application, filtering requests before they reach the device. The virtual bus driver acts as a security gatekeeper that maintains remote device functionality while blocking unauthorized application access through intelligent request evaluation and filtering.
3Reliability
If access control filtering is implemented, then unauthorized applications are blocked, but system complexity increases due to additional evaluation layers
Solution Approach 1:
The patent implements self-service mechanisms where the virtual bus driver automatically evaluates IO request packets against session-specific access control policies without requiring manual intervention. The system self-manages the filtering process by examining request origins, comparing against allowed application lists, and automatically blocking or permitting requests based on predefined rules, reducing the perceived complexity for users while maintaining robust security.
Data Source
AI summary
A redirected USB device can be isolated to a set of applications. A virtual bus driver on the server can be configured to evaluate each IO request packet that is directed towards the redirected USB device to determine whether the IO request packet was originated by an application that is permitted to access the redirected device. If the application is not permitted to access the redirected device, the virtual bus driver can prevent the IO request packet from being routed over the remote session to the device. In contrast, if the application is permitted to access the redirected device, the virtual bus driver can route the IO request packet accordingly.