IP Library › Granted Patent US 8,990,394
Granted Patent B2
US 8,990,394 · App. 13/651,321 · Granted Mar 24, 2015

System and method for providing session-level access management of access requests to a redirected device from a predetermined session

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 8,990,394
App. No.
13/651,321
Granted
Mar 24, 2015
Kind
B2
Abstract

Managing access requests to a device is provided. The operations may include determining that a device stack corresponds to the device that is remote to the server and is connected locally to a client that is remote to the server, the device stack comprising one or more device objects; attaching a device access restriction object on top of the device stack; facilitating restriction of access to the one or more device objects from sessions different from a session associated with the device; receiving, at the device access restriction object, an access request to the device; and determining, at the device access restriction object, whether the access request is allowed access to the device. The access request may be allowed if a session from which the access request is received is a predetermined session.

Claims (77)

1. A method for managing access requests to a device, the method comprising:

storing a device stack in a memory of a server, the device stack comprising one or more device objects, each device object associated with a device driver and comprising a software implementation of a device;

determining, at the server, that the device stack corresponds to the device that is remote to the server and is connected locally to a client that is remote to the server;

facilitating traversing the device stack downwards to identify a device object corresponding to a virtual bus driver at the bottom of the device stack;

attaching a device access restriction object on top of the device stack;

facilitating restriction of access to the one or more device objects from sessions different from a session associated with the device;

receiving, at the device access restriction object, an access request to the device; and

determining, at the device access restriction object, whether the access request is allowed access to the device.

2. The method according to claim 1 , wherein the facilitating restriction of access to the one or more device objects comprises:

for each of the one or more device objects in the device stack, determining whether a corresponding symbolic link exists in a global namespace of an object manager namespace (OMN) and moving the symbolic link to a local namespace of the OMN.

3. The method according to claim 1 , wherein the determining whether the access request is allowed access to the device comprises:

determining whether a session from which the access request is received is a predetermined session; and

determining that the access request is allowed if the session from which the access request is received is the predetermined session.

4. The method according to claim 1 , wherein the determining whether the access request is allowed access to the device comprises:

determining whether a session from which the access request is received is the same as a session of the client; and

determining that the access request is allowed if the session from which the access request is received is the same as the session of the client.

5. The method according to claim 1 , comprising: if the access request is not allowed, generating an error message indicating that the device does not exist.

6. The method according to claim 1 , comprises determining whether the device is configured to be provided with access restriction, wherein the attaching the access restriction object comprises:

attaching the access restriction object on top of the device stack if the device is configured to be provided with access restriction.

7. The method according to claim 1 , wherein the method is performed without hooking to a kernel module.

8. The method according to claim 1 , wherein the device is a USB device.

9. The method according to claim 1 , wherein the access request is made by a process of an application, and wherein receiving the access request to the device comprises:

intercepting the access request to the device made by the process.

10. A non-transitory machine-readable storage medium encoded with instructions executable by one or more processors to perform one or more operations, the one or more operations comprising:

storing a device stack in a memory of a server, the device stack comprising one or more device objects, each device object associated with a device driver and comprising a software implementation of a device;

determining, at the server, that the device stack corresponds to the device that is remote to the server and is connected locally to a client that is remote to the server;

facilitating traversing the device stack downwards to identify a device object corresponding to a virtual bus driver at the bottom of the device stack;

attaching a device access restriction object on top of the device stack;

facilitating restriction of access to the one or more device objects from sessions different from a session associated with the device;

receiving, at the device access restriction object, an access request to the device; and

determining, at the device access restriction object, whether the access request is allowed access to the device.

11. The non-transitory machine-readable storage medium according to claim 10 , wherein the facilitating restriction of access to the one or more device objects comprises:

for each of the one or more device objects in the device stack, determining whether a corresponding symbolic link exists in a global namespace of an object manager namespace (OMN) and moving the symbolic link to a local namespace of the OMN.

12. The non-transitory machine-readable storage medium according to claim 10 , wherein the determining whether the access request is allowed access to the device comprises:

determining whether a session from which the access request is received is a predetermined session; and

determining that the access request is allowed if the session from which the access request is received is the predetermined session.

13. The non-transitory machine-readable storage medium according to claim 10 , wherein the determining whether the access request is allowed access to the device comprises:

determining whether a session from which the access request is received is the same as a session of the client; and

determining that the access request is allowed if the session from which the access request is received is the same as the session of the client.

14. The non-transitory machine-readable storage medium according to claim 10 , comprising: if the access request is not allowed, generating an error message indicating that the device does not exist.

15. The non-transitory machine-readable storage medium according to claim 10 , wherein the one or more operations comprise determining whether the device is configured to be provided with access restriction, wherein the attaching the access restriction object comprises:

attaching the access restriction object on top of the device stack if the device is configured to be provided with access restriction.

16. The non-transitory machine-readable storage medium of claim 10 , wherein the one or more operations are performed without hooking to a kernel module.

17. The non-transitory machine-readable storage medium according to claim 10 , wherein the device is a USB device.

18. The non-transitory machine-readable storage medium of claim 10 , wherein the access request is made by a process of an application, and wherein receiving the access request to the device comprises:

intercepting the access request to the device made by the process.

19. An apparatus, comprising:

one or more modules configured to perform one or more operations comprising:

storing a device stack in a memory of a server, the device stack comprising one or more device objects, each device object associated with a device driver and comprising a software implementation of a device;

determining, at the server, that the device stack corresponds to the device that is remote to the server and is connected locally to a client that is remote to the server;

facilitating traversing the device stack downwards to identify a device object corresponding to a virtual bus driver at the bottom of the device stack;

attaching a device access restriction object on top of the device stack;

facilitating restriction of access to the one or more device objects from sessions different from a session associated with the device;

receiving, at the device access restriction object, an access request to the device; and

determining, at the device access restriction object, whether the access request is allowed access to the device.

20. The apparatus according to claim 19 , wherein the facilitating restriction of access to the one or more device objects comprises:

for each of the one or more device objects in the device stack, determining whether a corresponding symbolic link exists in a global namespace of an object manager namespace (OMN) and moving the symbolic link to a local namespace of the OMN.

21. The apparatus according to claim 19 , wherein the determining whether the access request is allowed access to the device comprises:

determining whether a session from which the access request is received is a predetermined session; and

determining that the access request is allowed if the session from which the access request is received is the predetermined session.

22. The apparatus according to claim 19 , wherein the determining whether the access request is allowed access to the device comprises:

determining whether a session from which the access request is received is the same as a session of the client; and

determining that the access request is allowed if the session from which the access request is received is the same as the session of the client.

23. The apparatus according to claim 19 , comprising: if the access request is not allowed, generating an error message indicating that the device does not exist.

24. The apparatus according to claim 19 , wherein the one or more operations comprise determining whether the device is configured to be provided with access restriction, wherein the attaching the access restriction object comprises:

attaching the access restriction object on top of the device stack if the device is configured to be provided with access restriction.

25. The apparatus according to claim 19 , wherein the one or more operations are performed without hooking to a kernel module.

26. The apparatus according to claim 19 , wherein the device is a USB device.

27. The apparatus according to claim 19 , wherein the access request is made by a process of an application, and wherein receiving the access request to the device comprises:

intercepting the access request made by the process to the device.

28. An apparatus comprising:

means for storing a device stack in a memory of a server, the device stack comprising one or more device objects, each device object associated with a device driver and comprising a software implementation of a device;

means for determining that the device stack corresponds to the device that is remote to the server and is connected locally to a client that is remote to the server;

means for facilitating traversing the device stack downwards to identify a device object corresponding to a virtual bus driver at the bottom of the device stack;

means for attaching a device access restriction object on top of the device stack;

means for facilitating restriction of access to the one or more device objects from sessions different from a session associated with the device;

receiving, at the device access restriction object, an access request to the device; and means for determining, at the device access restriction object, whether the access request is allowed access to the device.

Assignments (17)
RELEASE OF SECURITY INTEREST IN PATENTS PREVIOUSLY RECORDED AT REEL/FRAME (053546/0001) Recorded Jun 23, 2022
From: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS NOTES COLLATERAL AGENT
To: DELL MARKETING L.P. (ON BEHALF OF ITSELF AND AS SUCCESSOR-IN-INTEREST TO CREDANT TECHNOLOGIES, INC.); DELL INTERNATIONAL L.L.C.; DELL PRODUCTS L.P.; DELL USA L.P.; EMC CORPORATION; DELL MARKETING CORPORATION (SUCCESSOR-IN-INTEREST TO FORCE10 NETWORKS, INC. AND WYSE TECHNOLOGY L.L.C.); EMC IP HOLDING COMPANY LLC
Reel/Frame 071642/0001 →
RELEASE OF SECURITY INTEREST IN PATENTS PREVIOUSLY RECORDED AT REEL/FRAME (045455/0001) Recorded May 20, 2022
From: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS NOTES COLLATERAL AGENT
To: DELL MARKETING CORPORATION (SUCCESSOR-IN-INTEREST TO ASAP SOFTWARE EXPRESS, INC.); DELL MARKETING L.P. (ON BEHALF OF ITSELF AND AS SUCCESSOR-IN-INTEREST TO CREDANT TECHNOLOGIES, INC.); DELL USA L.P.; DELL INTERNATIONAL L.L.C.; DELL PRODUCTS L.P.; DELL MARKETING CORPORATION (SUCCESSOR-IN-INTEREST TO FORCE10 NETWORKS, INC. AND WYSE TECHNOLOGY L.L.C.); EMC CORPORATION (ON BEHALF OF ITSELF AND AS SUCCESSOR-IN-INTEREST TO MAGINATICS LLC); EMC IP HOLDING COMPANY LLC (ON BEHALF OF ITSELF AND AS SUCCESSOR-IN-INTEREST TO MOZY, INC.); SCALEIO LLC
Reel/Frame 061753/0001 →
MERGER Recorded May 13, 2022
From: WYSE TECHNOLOGY L.L.C.
To: DELL MARKETING CORPORATION
Reel/Frame 060064/0586 →
RELEASE OF SECURITY INTEREST IN PATENTS PREVIOUSLY RECORDED AT REEL/FRAME (040136/0001) Recorded Apr 26, 2022
From: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS NOTES COLLATERAL AGENT
To: DELL MARKETING CORPORATION (SUCCESSOR-IN-INTEREST TO ASAP SOFTWARE EXPRESS, INC.); DELL MARKETING L.P. (ON BEHALF OF ITSELF AND AS SUCCESSOR-IN-INTEREST TO CREDANT TECHNOLOGIES, INC.); DELL USA L.P.; DELL INTERNATIONAL L.L.C.; DELL PRODUCTS L.P.; DELL MARKETING CORPORATION (SUCCESSOR-IN-INTEREST TO FORCE10 NETWORKS, INC. AND WYSE TECHNOLOGY L.L.C.); EMC CORPORATION (ON BEHALF OF ITSELF AND AS SUCCESSOR-IN-INTEREST TO MAGINATICS LLC); EMC IP HOLDING COMPANY LLC (ON BEHALF OF ITSELF AND AS SUCCESSOR-IN-INTEREST TO MOZY, INC.); SCALEIO LLC
Reel/Frame 061324/0001 →
RELEASE OF SECURITY INTEREST Recorded Nov 3, 2021
From: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH
To: ASAP SOFTWARE EXPRESS, INC.; AVENTAIL LLC; CREDANT TECHNOLOGIES, INC.; DELL USA L.P.; DELL INTERNATIONAL, L.L.C.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL SOFTWARE INC.; DELL SYSTEMS CORPORATION; EMC CORPORATION; EMC IP HOLDING COMPANY LLC; FORCE10 NETWORKS, INC.; MAGINATICS LLC; MOZY, INC.; SCALEIO LLC; WYSE TECHNOLOGY L.L.C.
Reel/Frame 058216/0001 →
SECURITY AGREEMENT Recorded Apr 22, 2020
From: CREDANT TECHNOLOGIES INC.; DELL INTERNATIONAL L.L.C.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL USA L.P.; EMC CORPORATION; FORCE10 NETWORKS, INC.; WYSE TECHNOLOGY L.L.C.; EMC IP HOLDING COMPANY LLC
To: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A.
Reel/Frame 053546/0001 →
SECURITY AGREEMENT Recorded Mar 21, 2019
From: CREDANT TECHNOLOGIES, INC.; DELL INTERNATIONAL L.L.C.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL USA L.P.; EMC CORPORATION; FORCE10 NETWORKS, INC.; WYSE TECHNOLOGY L.L.C.; EMC IP HOLDING COMPANY LLC
To: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A.
Reel/Frame 049452/0223 →
SECURITY AGREEMENT Recorded Sep 21, 2016
From: ASAP SOFTWARE EXPRESS, INC.; AVENTAIL LLC; CREDANT TECHNOLOGIES, INC.; DELL USA L.P.; DELL INTERNATIONAL L.L.C.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL SOFTWARE INC.; DELL SYSTEMS CORPORATION; EMC CORPORATION; EMC IP HOLDING COMPANY LLC; FORCE10 NETWORKS, INC.; MAGINATICS LLC; MOZY, INC.; SCALEIO LLC; SPANNING CLOUD APPS LLC; WYSE TECHNOLOGY L.L.C.
To: CREDIT SUISSE AG, CAYMAN ISLANDS BRANCH, AS COLLATERAL AGENT
Reel/Frame 040134/0001 →
SECURITY AGREEMENT Recorded Sep 21, 2016
From: ASAP SOFTWARE EXPRESS, INC.; AVENTAIL LLC; CREDANT TECHNOLOGIES, INC.; DELL USA L.P.; DELL INTERNATIONAL L.L.C.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL SOFTWARE INC.; DELL SYSTEMS CORPORATION; EMC CORPORATION; EMC IP HOLDING COMPANY LLC; FORCE10 NETWORKS, INC.; MAGINATICS LLC; MOZY, INC.; SCALEIO LLC; SPANNING CLOUD APPS LLC; WYSE TECHNOLOGY L.L.C.
To: THE BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS NOTES COLLATERAL AGENT
Reel/Frame 040136/0001 →
RELEASE OF SECURITY INTEREST Recorded Sep 14, 2016
From: BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS COLLATERAL AGENT
To: DELL MARKETING L.P.; ASAP SOFTWARE EXPRESS, INC.; APPASSURE SOFTWARE, INC.; COMPELLENT TECHNOLOGIES, INC.; CREDANT TECHNOLOGIES, INC.; DELL INC.; DELL PRODUCTS L.P.; DELL USA L.P.; DELL SOFTWARE INC.; FORCE10 NETWORKS, INC.; PEROT SYSTEMS CORPORATION; SECUREWORKS, INC.; WYSE TECHNOLOGY L.L.C.
Reel/Frame 040065/0618 →
RELEASE OF SECURITY INTEREST Recorded Sep 14, 2016
From: BANK OF AMERICA, N.A., AS COLLATERAL AGENT
To: DELL SOFTWARE INC.; FORCE10 NETWORKS, INC.; DELL MARKETING L.P.; ASAP SOFTWARE EXPRESS, INC.; APPASSURE SOFTWARE, INC.; COMPELLENT TECHNOLOGIES, INC.; CREDANT TECHNOLOGIES, INC.; DELL INC.; DELL PRODUCTS L.P.; DELL USA L.P.; PEROT SYSTEMS CORPORATION; SECUREWORKS, INC.; WYSE TECHNOLOGY L.L.C.
Reel/Frame 040040/0001 →
RELEASE OF SECURITY INTEREST Recorded Sep 13, 2016
From: BANK OF AMERICA, N.A., AS ADMINISTRATIVE AGENT
To: DELL MARKETING L.P.; ASAP SOFTWARE EXPRESS, INC.; APPASSURE SOFTWARE, INC.; COMPELLANT TECHNOLOGIES, INC.; CREDANT TECHNOLOGIES, INC.; DELL INC.; DELL PRODUCTS L.P.; DELL USA L.P.; DELL SOFTWARE INC.; FORCE10 NETWORKS, INC.; PEROT SYSTEMS CORPORATION; SECUREWORKS, INC.; WYSE TECHNOLOGY L.L.C.
Reel/Frame 040065/0216 →
PATENT SECURITY AGREEMENT (NOTES) Recorded Jan 2, 2014
From: APPASSURE SOFTWARE, INC.; ASAP SOFTWARE EXPRESS, INC.; BOOMI, INC.; COMPELLENT TECHNOLOGIES, INC.; CREDANT TECHNOLOGIES, INC.; DELL INC.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL SOFTWARE INC.; DELL USA L.P.; FORCE10 NETWORKS, INC.; GALE TECHNOLOGIES, INC.; PEROT SYSTEMS CORPORATION; SECUREWORKS, INC.; WYSE TECHNOLOGY L.L.C.
To: BANK OF NEW YORK MELLON TRUST COMPANY, N.A., AS FIRST LIEN COLLATERAL AGENT
Reel/Frame 031897/0348 →
PATENT SECURITY AGREEMENT (ABL) Recorded Jan 2, 2014
From: DELL INC.; APPASSURE SOFTWARE, INC.; ASAP SOFTWARE EXPRESS, INC.; BOOMI, INC.; COMPELLENT TECHNOLOGIES, INC.; CREDANT TECHNOLOGIES, INC.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL SOFTWARE INC.; DELL USA L.P.; FORCE10 NETWORKS, INC.; GALE TECHNOLOGIES, INC.; PEROT SYSTEMS CORPORATION; SECUREWORKS, INC.; WYSE TECHNOLOGY L.L.C.
To: BANK OF AMERICA, N.A., AS ADMINISTRATIVE AGENT
Reel/Frame 031898/0001 →
PATENT SECURITY AGREEMENT (TERM LOAN) Recorded Jan 2, 2014
From: DELL INC.; APPASSURE SOFTWARE, INC.; ASAP SOFTWARE EXPRESS, INC.; BOOMI, INC.; COMPELLENT TECHNOLOGIES, INC.; CREDANT TECHNOLOGIES, INC.; DELL MARKETING L.P.; DELL PRODUCTS L.P.; DELL SOFTWARE INC.; DELL USA L.P.; FORCE10 NETWORKS, INC.; GALE TECHNOLOGIES, INC.; PEROT SYSTEMS CORPORATION; SECUREWORKS, INC.; WYSE TECHNOLOGY L.L.C.
To: BANK OF AMERICA, N.A., AS COLLATERAL AGENT
Reel/Frame 031899/0261 →
CHANGE OF NAME Recorded Nov 15, 2013
From: WYSE TECHNOLOGY INC.
To: WYSE TECHNOLOGY L.L.C.
Reel/Frame 031645/0051 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 18, 2012
From: KAUSHIK, PUNEET
To: WYSE TECHNOLOGY INC.
Reel/Frame 029155/0030 →