System and method for facilitating unlocking a device connected locally to a client
View Patent ↗Systems and methods for facilitating unlocking a device connected locally to a client, utilizing a server located remotely from the client and the device, are provided in accordance with various aspects of the subject technology. In one aspect, a system includes a proxy configured to receive, at the client, at least one string descriptor request from the server over a network, where the at least one string descriptor request is associated with switching an interface of the device from a first interface type to a second interface type. The system further includes a stub driver configured to receive the at least one string descriptor request from the proxy, and to direct the at least one string descriptor request to the device.
1. A system for facilitating unlocking a device connected locally to a client, utilizing a server located remotely from the client and the device, wherein the device comprises an interface, a system partition and a secure data partition, comprising:
a processor;
a stub driver for receiving a secure application from the system partition of the device; and
a proxy for sending the secure application from the stub driver to the server over a network, for receiving, at the client, at least one string descriptor request from the server over the network, wherein the at least one string descriptor request is associated with switching the interface of the device from a first interface type to a second interface type, and, after the interface of the device is switched to the second interface type, and for receiving, at the client, an unlocking command from the server over the network;
wherein the first interface type allows an administrator user to unlock the device and prevents a non-administrator user from unlocking the device; and
wherein the stub driver is further for directing the at least one string descriptor request received by the proxy to the device, and for directing the unlocking command received by the proxy to the device, wherein the interface of the device is for unlocking the secure data partition of the device if the interface accepts the unlocking command.
2. The system of claim 1 , wherein the first interface type comprises only a Small Computer System Interface (SCSI) and the second interface type comprises the SCSI and a Human Interface Device (HID) interface.
3. The system of claim 1 , wherein the second interface type allows the non-administrator user to unlock the device.
4. The system of claim 1 , wherein the device comprises a Universal Serial Bus (USB) device, and the at least one string descriptor request comprises string descriptor requests for index 4 , 5 and 6 , wherein index 4 , 5 and 6 are distinct from each other and sequential.
5. The system of claim 4 , wherein the stub driver is further for receiving a response from the device in response to the string descriptor request for index 4 , wherein the response comprises a string identifying the device as a specific type of device, and for directing the response to the proxy, and the proxy is for sending the response to the server over the network.
6. The system of claim 5 , wherein the specific type of device is a U3 storage device.
7. The system of claim 5 , wherein, after sending the response, the proxy is further for receiving, at the client, the string descriptor requests for index 5 and 6 from the server over the network, and wherein the stub driver is for directing the string descriptor requests for index 5 and 6 from the proxy to the device.
8. The system of claim 4 , wherein the proxy is prevented from receiving any of string descriptor requests for index 1 , 2 and 3 from the server, wherein the index 1 , 2 and 3 are distinct from each other and sequential.
9. The system of claim 1 , wherein the stub driver is further for receiving device information from the interface of the device, and for directing the received device information to the proxy, and wherein the proxy is for sending the device information to the server over the network.
10. The system of claim 9 , wherein the device comprises a Universal Serial Bus (USB) device, and the device information comprises at least one of a device descriptor, a configuration descriptor, an interface descriptor, an endpoint descriptor and a string descriptor.
11. A method for facilitating unlocking a device connected locally to a client, utilizing a server located remotely from the client and the device, wherein the device comprises an interface, a system partition and a secure data partition, the method comprising:
receiving, at the client, a secure application from the system partition of the device;
sending the secure application to the server over the network;
receiving, at the client, at least one string descriptor request from the server over the network, wherein the at least one string descriptor request is associated with switching the interface of the device from a first interface type to a second interface type, the first interface type allowing an administrator user to unlock the device and preventing a non-administrator user from unlocking the device;
directing the received at least one string descriptor request to the device;
after the interface of the device is switched to the second interface type, receiving, at the client, an unlocking command from the server over the network; and
directing the received unlocking command to the device, wherein the interface of the device is for unlocking the secure data partition of the device if the interface accepts the unlocking command.
12. A non-transitory machine-readable storage medium encoded with instructions executable by a processing system to perform a method for facilitating unlocking a device connected locally to a client, utilizing a server located remotely from the client and the device, wherein the device comprises an interface, a system partition and a secure data partition, the instructions operable, when executed by a processor, to:
receive, at the client, a secure application from the system partition of the device;
send the secure application to the server over the network;
receive, at the client, at least one string descriptor request from the server over the network, wherein the at least one string descriptor request is associated with switching the interface of the device from a first interface type to a second interface type, the first interface type allowing an administrator user to unlock the device and preventing a non-administrator user from unlocking the device;
direct the received at least one string descriptor request to the device;
after the interface of the device is switched to the second interface type, receive, at the client, an unlocking command from the server over the network; and
direct the received unlocking command to the device, wherein the interface of the device is for unlocking the secure data partition of the device if the interface accepts the unlocking command.