Dynamically controlling access to devices

Patent metadata

Field	Value
Publication number	US-10657245-B2
Application number	US-201715458249-A
Country	US
Kind code	B2
Filing date	Mar 14, 2017
Priority date	Mar 14, 2017
Publication date	May 19, 2020
Grant date	May 19, 2020

Abstract

Access to devices can be controlled dynamically. A device control driver can function as an upper filter driver so that it can intercept I/O requests that target a particular device. The device control driver can be configured to communicate with a device control server to dynamically determine whether the current user is allowed to access the particular device. The device control server can employ policy or administrator input to determine whether access should be allowed and can then notify the device control driver accordingly. When access is granted, the device control driver can pass I/O requests down the device driver stack. Otherwise, the device control driver can block the I/O requests. Also, when access is granted, the device control server can specify a permission expiration time after which the device control driver should again resume blocking I/O requests.

First claim

What is claimed:

1. A method, performed by a device control driver that is loaded on a computing device as an upper filter driver on a device driver stack of a device, for dynamically controlling access to the device, the method comprising:
in response to the device being connected to the computing device and in conjunction with the device driver stack of the device being loaded on the computing device, loading, by the device control driver, as an upper filter driver on the device driver stack;
identifying, by the device control driver, information about the device;
sending, by the device control driver, the information about the device to a device control server to request that the device control server provide an indication of whether applications executing on the computing device should be allowed to access the device;
receiving, by the device control driver and from the device control server, the indication of whether the applications executing on the computing device should be allowed to access the device;
when the indication defines that the applications executing on the computing device should be allowed to access the device and in response to intercepting I/O requests that are generated by the applications and that target the device, allowing, by the device control driver, the I/O requests by passing the I/O requests down the device driver stack; and
when the indication defines that the applications executing on the computing device should not be allowed to access the device and in response to intercepting I/O requests that are generated by the applications and that target the device, blocking, by the device control driver, the I/O requests by preventing the I/O requests from being passed down the device driver stack.

2. The method of claim 1 , wherein the information about the device includes an identification of a type of the device.

3. The method of claim 1 , wherein the device control driver also identifies and sends information about a current user with the information about the device.

4. The method of claim 1 , wherein the indication defines that the applications executing on the computing device should be allowed to access the device and includes a permission expiration time.

5. The method of claim 1 , wherein the device control driver intercepts the I/O requests before a function driver in the device driver stack receives the I/O requests.

6. The method of claim 1 , wherein preventing the I/O requests from being passed down the device driver stack comprises failing the I/O requests.

7. The method of claim 1 , further comprising:
polling the device control server to determine whether a change in access permissions to the device has occurred.

8. The method of claim 1 , wherein the device control driver sends the information about the device in response to intercepting an I/O request that targets the device.

9. A method, performed by a device control server in conjunction with a device control driver that is loaded on a computing device as an upper filter driver on a device driver stack for a device, for dynamically controlling access to a device, the method comprising:
receiving, at the device control server, information about the device, the device being connected to or onboard a computing device, the information being received from the device control driver that is loaded on the computing device as an upper filter driver on the device driver stack for the device, the device driver stack being loaded on the computing device;
based on the received information, identifying a policy governing access permissions to the device;
evaluating the policy to determine whether applications executing on the computing device should be allowed to access the device;
when the policy indicates that the applications executing on the computing device should be allowed to access the device, sending a notification to the device control driver that instructs the device control driver to pass I/O requests generated by the applications down the device driver stack when the device control driver intercepts the I/O requests; and
when the policy indicates that the applications executing on the computing device should be allowed to access the device, sending a notification to the device control driver that instructs the device control driver to prevent I/O requests generated by the applications from being passed down the device driver stack when the device control driver intercepts the I/O requests.

10. The method of claim 9 , wherein the received information identifies a type of the device.

11. The method of claim 9 , wherein the received information also identifies a current user of the computing device.

12. The method of claim 9 , wherein evaluating the policy to determine whether the applications executing on the computing device should be allowed to access the device further includes:
when it is determined that the applications executing on the computing device should be allowed to access the device, determining a permission expiration time defining when the applications executing on the computing device should no longer be allowed to access the device.

13. The method of claim 9 , wherein the device control driver sends the notification that instructs the device control driver to allow the applications executing on the computing device to access the device until a permission expiration time has been reached, the method further comprising:
prior to the permission expiration time being reached, receiving, from the device control driver, a polling request;
in response to the polling request, determining that the applications executing on the computing device should no longer be allowed to access the device; and
sending a notification to instruct the device control driver to block the applications executing on the computing device from accessing the device.

14. The method of claim 13 , wherein determining that the applications executing on the computing device should no longer be allowed to access the device comprises:
determining that the policy has been changed to no longer allow the applications executing on the computing device to access the device.

15. The method of claim 9 , wherein evaluating the policy to determine whether the applications executing on the computing device should be allowed to access the device comprises one or more of:
determining whether the policy dictates that a current user can access the device; or
determining whether the policy dictates that access to the device should be allowed at a time when the information about the device is received.

16. The method of claim 9 , wherein the information about the device includes information about a current user of the computing device, and wherein evaluating the policy to determine whether the applications executing on the computing device should be allowed to access the device comprises evaluating whether the policy dictates that the current user is allowed to access the device at a time when the information is received.

17. One or more computer storage media storing computer-executable instructions which when executed on one or more processors of a computing device implement a method for controlling access to a device, the method comprising:
in response to the device being connected to the computing device and in conjunction with a device driver stack of the device being loaded on the computing device, loading, by a device control driver, as an upper filter driver on the device driver stack;
identifying, by the device control driver, information about the device;
sending, by the device control drive

Assignees

• Wyse Technology Llc

Inventors

• Kaushik Puneet
• Joshi Salil

Classifications

• H04L63/0272

  Virtual private networks · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• G06F13/4072

  Drivers or receivers (G06F13/4086 takes precedence; for multistate logic circuits H03K19/0002) · CPC title

• G06F21/70

  Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer · CPC title