Session-level-restriction for universal serial bus storage devices

Patent metadata

Field	Value
Publication number	US-9971726-B2
Application number	US-201414528655-A
Country	US
Kind code	B2
Filing date	Oct 30, 2014
Priority date	Oct 30, 2014
Publication date	May 15, 2018
Grant date	May 15, 2018

Abstract

A system and method of implementing SLR for a USB device of an information handling system is disclosed herein. An OS may load a disk driver stack and a volume driver stack for the USB device, where the USB device is being enumerated by a first driver. The OS may load a second driver on the disk driver stack. The OS may also load second driver on the volume driver stack. The OS may restrict an access to the USB device at the second driver as loaded on the disk driver stack. Furthermore, the OS may restrict an access to a volume of the USB device at the second driver as loaded on the volume driver stack.

First claim

What is claimed is:

1. A method comprising:
by a virtual machine operating system:
loading a disk driver stack and a volume driver stack for a Universal Serial Bus (USB) device, the USB device being enumerated by a first driver and operating in the virtual machine operating system, wherein the disk driver stack manages the USB device, wherein managing the USB device comprises monitoring a health of the USB device, wherein the disk driver stack comprises one or more class filter drivers and one or more disk upper filter drivers associated with the virtual machine operating system for the USB device and wherein the volume driver stack comprises one or more volume upper filter drivers and a volume manager driver;
loading a second driver on the disk driver stack, wherein the second driver comprises at least a session level restriction filter driver;
loading the second driver on the volume driver stack;
receiving a storage number corresponding to a volume of the USB device;
forming a symbolic link corresponding to the storage number;
retrieving a disk device object of the disk driver stack for the USB device, the disk device object being associated with a volume of the USB device, wherein the disk device object is retrieved based on the symbolic link;
restricting an access to the USB device at the second driver as loaded on the disk driver stack; and
restricting an access to a volume of the USB device at the second driver as loaded on the volume driver stack, wherein restricting the access to the volume of the USB device comprises restricting the access by a user to the volume of the USB device at the second driver as loaded on the disk driver stack.

2. The method of claim 1 , wherein the USB device is associated with at least two driver stacks.

3. The method of claim 1 , wherein the USB device is a storage device.

4. The method of claim 1 , wherein restricting the access to the USB device comprises limiting the access to a user session.

5. The method of claim 1 , wherein restricting the access to the volume of the USB device comprises limiting the access to a user session.

6. The method of claim 1 , wherein restricting the access to the USB device at the second driver comprises:
by the operating system:
determining whether the first driver that enumerates the USB device is a predetermined third-party virtual BUS driver;
determining whether a session-level-restriction (SLR) is enabled for the disk driver stack; and
if the first driver substantially matches the pre-determined third-party virtual BUS driver and the SLR is enabled for the disk driver stack, restricting the access to the USB device.

7. The method of claim 1 , wherein restricting the access to the volume of the USB device at the second driver comprises:
by the operating system:
determining whether the disk device object is enumerated by the first driver;
determining whether a session-level-restriction (SLR) is enabled for the disk driver stack; and
if the disk device object is enumerated by the first driver and the SLR is enabled for the disk driver stack, restricting the access to the volume of the USB device.

8. The method of claim 1 , wherein restricting the access to the volume of the USB device at the second driver comprises:
by the operating system:
retrieving a password to access the volume of the USB device, wherein the volume is hidden;
determining whether the retrieved password matches a stored password, the stored password being associated with the hidden volume of the USB device;
if the retrieved password matches the stored password, then:
establishing the hidden volume as a virtual volume; and
providing the access to the virtual volume of the USB device; and

if the retrieved password does not match the stored password, restricting the access to the hidden volume of the USB device.

9. One or more computer-readable non-transitory storage media embodying logic that is operable when executed to:
by a virtual machine operating system:
loading a disk driver stack and a volume driver stack for a Universal Serial Bus (USB) device, the USB device being enumerated by a first driver and operating in the virtual machine operating system, wherein the disk driver stack manages the USB device, wherein managing the USB device comprises monitoring a health of the USB device, and wherein the disk driver stack comprises one or more class filter drivers and one or more disk upper filter drivers associated with the virtual machine operating system for the USB device;
loading a second driver on the disk driver stack, wherein the second driver comprises at least a session level restriction filter driver;
loading the second driver on the volume driver stack;
receiving a storage number corresponding to a volume of the USB device;
forming a symbolic link corresponding to the storage number;
retrieving a disk device object of the disk driver stack for the USB device, the disk device object being associated with a volume of the USB device, wherein the disk device object is retrieved based on the symbolic link;
restricting an access to the USB device at the second driver as loaded on the disk driver stack; and
restricting an access to the volume of the USB device at the second driver as loaded on the volume driver stack, wherein restricting the access to the volume of the USB device comprises restricting the access by a user to the volume of the USB device by not passing through an access request to the disk device object.

10. The media of claim 9 , wherein the USB device is associated with at least two driver stacks.

11. The media of claim 9 , wherein the USB device is a storage device.

12. The media of claim 9 , wherein restricting the access to the USB device at the second driver comprises:
by the operating system:
determining whether the first driver that enumerates the USB device is a pre-determined third-party virtual BUS driver;
determining whether a session-level-restriction (SLR) is enabled for the disk driver stack; and
if the first driver substantially matches the pre-determined third-party virtual BUS driver and the SLR is enabled for the disk driver stack, restricting the access to the USB device.

13. The media of claim 9 , wherein restricting the access to the volume of the USB device at the second driver comprises:
by the operating system:
determining whether the disk device object is enumerated by the first driver;
determining whether a session-level-restriction (SLR) is enabled for the disk driver stack; and
if the disk device object is enumerated by the first driver and the SLR is enabled for the disk driver stack, restricting the access to the volume of the USB device.

14. The media of claim 9 , wherein restricting the access to the volume of the USB device at the second driver comprises:
by the operating system:
retrieving a password to access the volume of the USB device, wherein the volume is hidden;
determining whether the retrieved password matches a stored password, the stored password being associated with the hidden volume of the USB device;
if the retrieved password matches the stored password, then:
establishing the hidden volume as a virtual volume; and
providing the access to the virtual volume of the USB device; and

if the retrieved password does not match the stored password, restricting the access to the hidden volume of the USB device.

15. An information handling system comprising:
one or more processors; and
a memory coupled to the processors comprising instructions executable by the processors, the processors being operable when executing the instructions

Assignees

• Dell Products Lp

Inventors

• Vajravel Gokul Thiruchengode

Classifications

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title

• G06F13/4072 Primary

  Drivers or receivers (G06F13/4086 takes precedence; for multistate logic circuits H03K19/0002) · CPC title

• G06F13/4095

  in incremental bus architectures, e.g. bus stacks · CPC title