System and method for providing private session-based access to a redirected USB device or local device

• US 9,059,893 B2
• Filed: 10/02/2013
• Issued: 06/16/2015
• Est. Priority Date: 11/02/2011
• Status: Active Grant

• Current Assignee: Dell Marketing Corporation (Dell Technologies Inc.)
• Original Assignee: Wyse Technology L.L.C. (Dell Technologies Inc.)
• Inventors: Kaushik, Puneet
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US14/044,474
• Publication Number:
  US 20140040470A1
• Time in Patent Office: 622 Days
• Field of Search: 726/4, 726/29
• US Class Current: 1/1
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0664 at device level, e.g. emulation of a storage device or system
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/59 Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable

Abstract

Restricting access to a device from a server, where the device is remote to the server and is connected locally to a client that is remote to the server, is described. The operations may include facilitating interception, at the server, of a function call to create a symbolic link; facilitating determination that the intercepted function call to create the symbolic link corresponds to a device object associated with the device that is remote to the server and is connected locally to a client that is remote to the server; facilitating obtaining configuration data indicating whether access to the device is to be restricted; and facilitating creation of the symbolic link in a local namespace of an object manager namespace of the server, upon obtaining configuration data indicating that access to the device is to be restricted.

Claims

1. A method for restricting access to a device from a server, the method comprising:

intercepting, at the server, a request to create a symbolic link;

determining that the intercepted request corresponds to a device object associated with a device remote to the server;

obtaining configuration data of the device; and

creating the symbolic link in an object manager namespace of the server based on the configuration data for the device.

2. The method of claim 1, wherein creating the symbolic link in an object manager namespace of the server based on the configuration data for the device comprises:

creating the symbolic link in a local namespace of an object manager namespace of the server if the configuration data of the device indicates that access to the device is to be restricted; and

creating the symbolic link in a global namespace of an object manager namespace of the server if the configuration data of the device indicates that access to the device is not to be restricted.

3. The method of claim 2, wherein creating the symbolic link in the local namespace of the object manager namespace of the server comprises creating the symbolic link in a local namespace associated with the client'"'"'s user session on the server.

4. The method of claim 1, wherein intercepting the request comprises:

modifying a system service description table (SSDT) of the server to redirect requests to create symbolic links to an intercept module; and

redirecting the request to create the symbolic link to the intercept module.

5. The method of claim 1, wherein determining that the intercepted request corresponds to a device object associated with the device that is remote to the server comprises:

traversing a device stack associated with the device object to identify a lowest bus driver associated with the device object; and

determining, based on the identified bus driver, that the device associated with the device object is remote to the server and connected locally to a client that is remote to the server.

6. The method of claim 3, further comprising providing secure session-based access to the device using the symbolic link created in the local namespace of the object manager namespace of the server.

7. The method of claim 1, further comprising:

creating the symbolic link in a local namespace associated with a first user session if the configuration data of the device indicates that access to the device is to be restricted;

receiving, at the server, a request including the created symbolic link from a second user session;

determining whether the created symbolic link is in a local namespace associated with the second user session or in a global namespace; and

blocking the received request upon determining that the created symbolic link is not in the local namespace associated with the second user session and not in the global namespace.

8. A non-transitory machine-readable storage medium encoded with instructions executable by one or more processors to perform one or more operations, the one or more operations comprising:

intercepting, at the server, a request to create a symbolic link;

determining that the intercepted request corresponds to a device object associated with a device remote to the server;

obtaining configuration data of the device; and

creating the symbolic link in an object manager namespace of the server based on the configuration data for the device.

9. The machine-readable storage medium of claim 8, wherein creating the symbolic link in an object manager namespace of the server based on the configuration data for the device comprises:

creating the symbolic link in a local namespace of an object manager namespace of the server if the configuration data of the device indicates that access to the device is to be restricted; and

creating the symbolic link in a global namespace of an object manager namespace of the server if the configuration data of the device indicates that access to the device is not to be restricted.

10. The machine-readable storage medium according to claim 9, wherein creating the symbolic link in the local namespace of the object manager namespace of the server comprises creating the symbolic link in a local namespace associated with the client'"'"'s user session on the server.

11. The machine-readable storage medium of claim 8, wherein intercepting the request comprises:

modifying a system service description table (SSDT) of the server to redirect requests to create symbolic links to an intercept module; and

redirecting the request to create the symbolic link to the intercept module.

12. The machine-readable storage medium of claim 8, wherein determining that the intercepted request corresponds to a device object associated with a device remote to the server comprises:

traversing a device stack associated with the device object to identify a lowest bus driver associated with the device object; and

determining, based on the identified bus driver, that the device associated with the device object is remote to the server and connected locally to a client that is remote to the server.

13. The machine-readable storage medium of claim 9, wherein the one or more operations further comprise providing secure session-based access to the device using the symbolic link created in the local namespace of the object manager namespace of the server.

14. The machine-readable storage medium of claim 8, wherein the one or more operations further comprise:

creating the symbolic link in a local namespace associated with a first user session if the configuration data of the device indicates that access to the device is to be restricted;

receiving, at the server, a request including the created symbolic link from a second user session;

determining whether the created symbolic link is in a local namespace associated with the second user session or in a global namespace; and

blocking the received request upon determining that the created symbolic link is not in the local namespace associated with the second user session and not in the global namespace.

15. A hardware apparatus, comprising:

a processor; and

a memory encoded with instructions executable by the processor to perform one or more operations comprising;

intercepting, at the server, a request to create a symbolic link;

determining that the intercepted request corresponds to a device object associated with a device remote to the server;

obtaining configuration data of the device; and

creating the symbolic link in an object manager namespace of the server based on the configuration data for the device.

16. The hardware apparatus of claim 15, wherein creating the symbolic link in an object manager namespace of the server based on the configuration data for the device comprises:

creating the symbolic link in a local namespace of an object manager namespace of the server if the configuration data of the device indicates that access to the device is to be restricted; and

creating the symbolic link in a global namespace of an object manager namespace of the server if the configuration data of the device indicates that access to the device is not to be restricted.

17. The hardware apparatus of claim 16, wherein creating the symbolic link in the local namespace of the object manager namespace of the server comprises creating the symbolic link in a local namespace associated with the client'"'"'s user session on the server.

18. The hardware apparatus of claim 15, wherein intercepting the request comprises:

modifying a system service description table (SSDT) of the server to redirect requests to create symbolic links to an intercept module; and

redirecting the request to create the symbolic link to the intercept module.

19. The hardware apparatus of claim 15, wherein determining that the intercepted request corresponds to a device object associated with a device remote to the server comprises:

traversing a device stack associated with the device object to identify a lowest bus driver associated with the device object; and

determining, based on the identified bus driver, that the device associated with the device object is remote to the server and connected locally to a client that is remote to the server.

20. The hardware apparatus of claim 16, wherein the one or more operations further comprise providing secure session-based access to the device using the symbolic link created in the local namespace of the object manager namespace of the server.

21. The hardware apparatus of claim 15, wherein the one or more operations further comprise:

creating the symbolic link in a local namespace associated with a first user session if the configuration data of the device indicates that access to the device is to be restricted;

receiving, at the server, a request including the created symbolic link from a second user session;

determining whether the created symbolic link is in a local namespace associated with the second user session or in a global namespace; and

blocking the received request upon determining that the created symbolic link is not in the local namespace associated with the second user session and not in the global namespace.