System and method for providing private session-based access to a redirected USB device or local device

• US 8,555,409 B2
• Filed: 11/02/2011
• Issued: 10/08/2013
• Est. Priority Date: 11/02/2011
• Status: Active Grant

• Current Assignee: Dell Marketing Corporation (Dell Technologies Inc.)
• Original Assignee: Wyse Technology Incorporated (Dell Technologies Inc.)
• Inventors: Kaushik, Puneet
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US13/287,982
• Publication Number:
  US 20130111561A1
• Time in Patent Office: 706 Days
• Field of Search: 726/4, 726/29
• US Class Current: 726/29
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0664 at device level, e.g. emulation of a storage device or system
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/59 Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable

Abstract

Restricting access to a device from a server, where the device is remote to the server and is connected locally to a client that is remote to the server, is described. The operations may include facilitating interception, at the server, of a function call to create a symbolic link; facilitating determination that the intercepted function call to create the symbolic link corresponds to a device object associated with the device that is remote to the server and is connected locally to a client that is remote to the server; facilitating obtaining configuration data indicating whether access to the device is to be restricted; and facilitating creation of the symbolic link in a local namespace of an object manager namespace of the server, upon obtaining configuration data indicating that access to the device is to be restricted.

Claims

1. A method for restricting access to a device from a server, the method comprising:

intercepting, at the server, a function call to create a symbolic link;

determining that the intercepted function call corresponds to a device object associated with the device that is remote to the server and is connected locally to a client that is remote to the server;

obtaining configuration data indicating whether access to the device is to be restricted; and

creating the symbolic link in a local namespace of an object manager namespace of the server, upon obtaining configuration data indicating that access to the device is to be restricted.

2. The method according to claim 1, wherein the device is a USB device.

3. The method according to claim 1, wherein creating the symbolic link comprises creating the symbolic link in a local namespace associated with the client'"'"'s user session on the server, the client having the device locally connected.

4. The method according to claim 1, wherein intercepting the functional call comprises:

modifying a system service description table (SSDT) of the server to redirect function calls to create symbolic links to an intercept module; and

redirecting the function call to create the symbolic link to the intercept module.

5. The method according to claim 1, wherein determining that the intercepted function call corresponds to a device object associated with the device that is remote to the server comprises:

traversing a device stack associated with the device object to identify a lowest bus driver associated with the device object; and

determining that the device object is associated with the device that is remote to the server and is connected locally to the client that is remote to the server, based on the identification of the bus driver.

6. The method according to claim 1, wherein obtaining configuration data comprises:

retrieving configuration data associated with the device from a storage device of the server.

7. The method according to claim 1, wherein obtaining configuration data comprises:

receiving configuration data associated with the device object from a user session of the client having the device connected locally.

8. The method according to claim 1, further comprising:

providing secure session-based access to the device using the symbolic link created in the local namespace of the object manager namespace of the server.

9. The method according to claim 1, further comprising:

creating the symbolic link in a local namespace associated with a first user session;

receiving, at the server, a request including the created symbolic link from a second user session;

determining whether the created symbolic link is in a local namespace associated with the second user session or in a global namespace; and

blocking the received request upon determining that the created symbolic link is not in the local namespace associated with the second user session and not in the global namespace.

10. The method according to claim 1, further comprising:

intercepting, at the server, a function call to delete the symbolic link; and

deleting the symbolic link from the object manager namespace of the server.

11. The method according to claim 10, wherein deleting the symbolic link comprises:

determining that the function call to delete the symbolic link corresponds to a symbolic link in the local namespace of the object manager namespace of the server; and

deleting the symbolic link from the local namespace of the object manager namespace of the server.

12. A non-transitory machine-readable storage medium encoded with instructions executable by one or more processors to perform one or more operations, the one or more operations comprising:

intercepting, at a server, a function call to create a symbolic link;

determining that the intercepted function call corresponds to a device object associated with a device that is remote to the server and is connected locally to a client that is remote to the server;

obtaining configuration data indicating whether access to the device is to be restricted; and

creating the symbolic link in a local namespace of an object manager namespace of the server, upon obtaining configuration data indicating that access to the device is to be restricted.

13. The machine-readable storage medium according to claim 12, wherein the device is a USB device.

14. The machine-readable storage medium according to claim 12, wherein creating the symbolic link comprises creating the symbolic link in a local namespace associated with the client'"'"'s user session on the server, the client having the device locally connected.

15. The machine-readable storage medium according to claim 12, wherein intercepting the function call comprises:

modifying a system service description table (SSDT) of the server to redirect function calls to create symbolic links to an intercept module; and

redirecting the function call to create the symbolic link to the intercept module.

16. The machine-readable storage medium according to claim 12, wherein determining that the intercepted function call corresponds to a device object associated with a device that is remote to the server comprises:

traversing a device stack associated with the device object to identify a lowest bus driver associated with the device object; and

determining that the device object is associated with the device that is remote to the server and is connected locally to the client that is remote to the server, based on the identification of the bus driver.

17. The machine-readable storage medium according to claim 12, wherein obtaining configuration data comprises:

retrieving configuration data associated with the device from a storage device of the server.

18. The machine-readable storage medium according to claim 12, wherein obtaining configuration data comprises:

receiving configuration data associated with the device object from a user session of the client having the device connected locally.

19. The machine-readable storage medium according to claim 12, wherein the one or more operations further comprise:

providing secure session-based access to the device using the symbolic link created in the local namespace of the object manager namespace of the server.

20. The machine-readable storage medium according to claim 12, wherein the one or more operations further comprise:

creating the symbolic link in a local namespace associated with a first user session;

receiving, at the server, a request including the created symbolic link from a second user session;

determining whether the created symbolic link is in a local namespace associated with the second user session or in a global namespace; and

blocking the received request upon determining that the created symbolic link is not in the local namespace associated with the second user session and not in the global namespace.

21. The machine-readable storage medium according to claim 12, wherein the one or more operations further comprise:

intercepting, at the server, a function call to delete the symbolic link; and

deleting the symbolic link from the object manager namespace of the server.

22. The machine-readable storage medium according to claim 21, wherein deleting the symbolic link from the object manager namespace of the server comprises:

determining that the function call to delete the symbolic link corresponds to a symbolic link in the local namespace of the object manager namespace of the server; and

deleting the symbolic link from the local namespace of the object manager namespace of the server.

23. A hardware apparatus, comprising:

a processor; and

a memory encoded with instructions executable by the processor to perform one or more operations comprising;

intercepting, at a server, a function call to create a symbolic link;

determining that the intercepted function call to create the symbolic link corresponds to a device object associated with a device that is remote to the server and is connected locally to a client that is remote to the server;

obtaining configuration data indicating whether access to the device is to be restricted; and

creating the symbolic link in a local namespace of an object manager namespace of the server, upon obtaining configuration data indicating that access to the device is to be restricted.

24. The hardware apparatus according to claim 23, wherein the device is a USB device.

25. The hardware apparatus according to claim 23, wherein creating the symbolic link comprises creating the symbolic link in a local namespace associated with the client'"'"'s user session on the server, the client having the device locally connected.

26. The hardware apparatus according to claim 23, wherein intercepting the function call comprises:

modifying a system service description table (SSDT) of the server to redirect, function calls to create symbolic links, to an intercept module; and

redirecting a function call to create the symbolic link to the intercept module.

27. The hardware apparatus according to claim 23, wherein determining that the intercepted function call to create the symbolic link corresponds to a device object associated with a device that is remote to the server comprises:

traversing a device stack associated with the device object to identify a lowest bus driver associated with the device object; and

determining that the device object is associated with the device that is remote to the server and is connected locally to the client that is remote to the server, based on the identification of the bus driver.

28. The hardware apparatus according to claim 23, wherein the obtaining configuration data comprises:

retrieving configuration data associated with the device from a storage device of the server.

29. The hardware apparatus according to claim 23, wherein the obtaining configuration data comprises:

receiving configuration data associated with the device object from a user session of the client having the device connected locally.

30. The hardware apparatus according to claim 23, wherein the one or more operations further comprise:

providing secure session-based access to the device using the symbolic link created in the local namespace of the object manager namespace of the server.

31. The hardware apparatus according to claim 23, wherein the one or more operations further comprise:

creating the symbolic link in a local namespace associated with a first user session;

receiving, at the server, a request including the created symbolic link from a second user session;

determining whether the created symbolic link is in a local namespace associated with the second user session or in a global namespace; and

blocking the received request upon determining that the created symbolic link is not in the local namespace associated with the second user session and not in the global namespace.

32. The hardware apparatus according to claim 23, wherein the one or more operations further comprise:

intercepting, at the server, a function call to delete the symbolic link; and

deleting the symbolic link from the object manager namespace of the server.

33. The hardware apparatus according to claim 32, wherein deleting the symbolic link from the object manager name space of the server comprises:

determining that the function call to delete the symbolic link corresponds to a symbolic link in the local namespace of the object manager namespace of the server; and

deleting the symbolic link from the local namespace of the object manager namespace of the server.