Method and system for preventing unauthorized access to smart card devices in a remote desktop infrastructure
The disclosure provides an approach for permission checking in virtualized desktop infrastructure (VDI) redirection so that only a rightful owner can access a smart card device. When a user logs in to a remote desktop via a VDI client, a service to access the smart card device is notified of the log in event and the user's account identifier. The service changes ownership and access permissions of a domain socket file used by processes to communicate with the service so only the user account owns and has permission to access the domain socket. The service may also bind, listen to, and receive requests from the domain socket to check users who have opened the domain socket file. In response, the service may determine processes that have opened the file and associated user accounts, as well as generate warnings and/or terminate processes which are not authorized to access the domain socket.
1. A method for preventing unauthorized access to a smart card device in a virtual desktop infrastructure (VDI), comprising:
determining that a user account has logged in to an operating system (OS) of a remote desktop from a client device, the remote desktop enabling device redirection to the smart card device which is connected to the client device; and
in response to determining that the user account has logged in to the OS, changing ownership and access permissions of a domain socket file to the user account that has logged in to the OS, the domain socket file being used to communicate with a service which provides access to the smart card device,
wherein responsive to the OS receiving a request by a process running on the OS to establish a connection with the service which provides access to the smart card device, the OS performs operations including:
determining a user account associated with the process, and
establishing the connection if the user account associated with the process has permission to access the domain socket file.
2. The method of claim 1 , further comprising:
receiving, from the domain socket file, a request to check users that have opened the domain socket file;
determining processes that have opened the domain socket file;
determining user accounts associated with the processes that have opened the domain socket file; and
taking remedial action responsive to determining that one of the user accounts associated with the processes that have opened the domain socket file is not permitted to access the domain socket file.
3. The method of claim 2 , wherein the remedial action includes at least one of generating a warning and terminating the processes that have opened the file and are associated with the determined one of the user accounts.
4. The method of claim 2 , wherein the domain socket file periodically sends requests to check users that have opened the domain socket file.
5. The method of claim 2 , wherein:
the steps of determining the processes and determining the user accounts are performed by a script which is triggered upon receiving the request; and
the script further determines whether the user accounts are permitted to access the domain socket file.
6. The method of claim 1 , wherein:
the user account that has logged in to the OS of the remote desktop is logged in via a VDI client; and
the user account associated with the process is logged in to the OS of the remote desktop via secure shell (SSH).
7. The method of claim 1 , wherein determining the user account has logged in to the remote desktop includes receiving notification of a user log in event and an identifier (ID) of the user account that has logged in to the remote desktop.
8. The method of claim 1 , wherein:
the steps of determining the user account that has logged in and changing the ownership and permissions are performed by the service.
9. The method of claim 1 , wherein the process communicates with the service by invoking an application programming interface (API) provided by a dynamic library.
10. A non-transitory computer-readable storage medium containing a program which, when executed by one or more processors, performs operations for preventing unauthorized access to a smart card device in a virtual desktop infrastructure (VDI), the operations comprising:
determining that a user account has logged in to an operating system (OS) of a remote desktop from a client device, the remote desktop enabling device redirection to the smart card device which is connected to the client device; and
in response to determining that the user account has logged in to the OS, changing ownership and access permissions of a domain socket file to the user account that has logged in to the OS, the domain socket file being used to communicate with a service which provides access to the smart card device,
wherein responsive to the OS receiving a request by a process running on the OS to establish a connection with the service which provides access to the smart card device, the OS performs operations including:
determining a user account associated with the process, and
establishing the connection if the user account associated with the process has permission to access the domain socket file.
11. The non-transitory computer-readable storage medium of claim 10 , the operations further comprising:
receiving, from the domain socket file, a request to check users that have opened the domain socket file;
determining processes that have opened the domain socket file;
determining user accounts associated with the processes that have opened the domain socket file; and
taking remedial action responsive to determining that one of the user accounts associated with the processes that have opened the domain socket file is not permitted to access the domain socket file.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the remedial action includes at least one of generating a warning and terminating the processes that have opened the file and are associated with the determined one of the user accounts.
13. The non-transitory computer-readable storage medium of claim 11 , wherein:
the steps of determining the processes and determining the user accounts are performed by a script which is triggered upon receiving the request; and
the script further determines whether the user accounts are permitted to access the domain socket file.
14. The non-transitory computer-readable storage medium of claim 11 , wherein the domain socket file periodically sends requests to check users that have opened the domain socket file.
15. The non-transitory computer-readable storage medium of claim 10 , wherein:
the user account that has logged in to the OS of the remote desktop is logged in via a VDI client; and
the user account associated with the process is logged in to the OS of the remote desktop via secure shell (SSH).
16. The non-transitory computer-readable storage medium of claim 10 , wherein determining the user account has logged in to the remote desktop includes receiving notification of a user log in event and an identifier (ID) of the user account that has logged in to the remote desktop.
17. The non-transitory computer-readable storage medium of claim 10 , wherein:
the steps of determining the user account that has logged in and changing the ownership and permissions are performed by the service.
18. The non-transitory computer-readable storage medium of claim 10 , wherein the process communicates with the service by invoking an application programming interface (API) provided by a dynamic library.
19. A system, comprising:
a processor;
a memory, wherein the memory includes a program executable in the processor to perform operations for preventing unauthorized access to a smart card device in a virtual desktop infrastructure (VDI), the operations comprising:
determining that a user account has logged in to an operating system (OS) of a remote desktop from a client device, the remote desktop enabling device redirection to the smart card device which is connected to the client device, and
in response to determining that the user account has logged in to the OS, changing ownership and access permissions of a domain socket file to the user account that has logged in to the OS, the domain socket file being used to communicate with a service which provides access to the smart card device,
wherein responsive to the OS receiving a request by a process running on the OS to establish a connection with the service which provides access to the smart card device, the OS performs operations including:
determining a user account associated with the process; and
establishing the connection if the user account associated with the process has permission to access the domain socket file.
20. The system of claim 19 , the operations further comprising:
receiving, from the domain socket file, a request to check users that have opened the domain socket file;
determining processes that have opened the domain socket file;
determining user accounts associated with the processes that have opened the domain socket file; and
taking remedial action responsive to determining that one of the user accounts associated with the processes that have opened the domain socket file is not permitted to access the domain socket file.