Blocking an interface of a redirected USB composite device
Session level restrictions can be implemented to limit access to a redirected interface of a composite device. These session level restrictions can be defined within a policy of a directory service, such as Active Directory, to facilitate the dynamic application of the restrictions to the appropriate remote sessions. In this way, access restrictions can be applied to individual interfaces of a redirected composite device so that a particular interface will only be accessible from specified remote sessions.
1. A method for blocking redirection of an individual interface of a USB composite device when the USB composite device is connected to a client terminal that has established a remote session with a server and multiple interfaces of the USB composite device are redirected to the server over the remote session, the method comprising:
in response to a first device stack being created on the server for a first interface of the USB composite device that is redirected to the server over the remote session established between the client terminal and the server;
determining, by a first filter driver on the first device stack, that the first interface is redirected to the server;
accessing, by the first filter driver, a first policy applicable to the remote session to determine that the first interface is prohibited from redirection to the server;
identifying, by the first filter driver, one or more symbolic links in a global object manager namespace that have a device target matching the first interface; and
moving, by the first filter driver, the one or more symbolic links to an object manager namespace that is not associated with any user session on the server to thereby prevent the first interface from being accessed from any user session;
in response to a second device stack being created on the server for a second interface of the USB composite device that is redirected to the server over the remote session established between the client terminal and the server;
determining, by the second filter driver, that the second interface is redirected to the server;
accessing, by the second filter driver, a second policy to determine that the second interface is not prohibited from redirection to the server; and
allowing, by the second filter driver, the second interface to be redirected to the server via the second device stack thereby making the second interface accessible to the client terminal within the remote session.
2. The method of claim 1 , wherein determining that the first and second interfaces are redirected to the server comprises enumerating drivers in the first and second device stack respectively to identify the presence of a virtual bus driver.
3. The method of claim 1 , wherein one or both of the first and second policy comprises an Active Directory group policy object.
4. The method of claim 1 , wherein the one or more symbolic links comprise multiple symbolic links.
5. The method of claim 1 , wherein identifying the one or more symbolic links in the global object manager namespace that have a device target matching the first interface comprises enumerating one or more device objects in the first device stack to identify any symbolic links associated with the one or more device objects.
6. The method of claim 1 , further comprising: identifying one or more symbolic links in one or more local object manager namespaces have a device target matching the first interface; and
moving the one or more symbolic links in the one or more local object manager namespaces to an object manager namespace that is not associated with any user session on the server.
7. The method of claim 1 , wherein moving the one or more symbolic links to the object manager namespace that is not associated with any user session on the server comprises deleting the one or more symbolic links from the global object manager namespace and adding the one or more symbolic links to the object manager namespace that is not associated with any user session on the server.
8. The method of claim 1 , further comprising: prior to identifying the one or more symbolic links in the global object manager namespace that have a device target matching the first interface, determining that an operating system of the server does not allow the first interface to be associated with a property that defines from which sessions the first interface may be accessed.
9. The method of claim 1 , wherein the first policy and the second policy are the same policy.
10. The method of claim 1 , wherein determining that the first interface is prohibited from redirection to the server comprises determining that the first policy prohibits redirection of a class of devices and that the first interface matches the class.
11. A method for blocking redirection of an individual interface of a USB composite device when the USB composite device is connected to a client terminal that has established a remote session with a server and multiple interfaces of the USB composite device are redirected to the server over the remote session, the method comprising:
in response to a first device stack being created on the server for a first interface of the USB composite device that is redirected to the server over the remote session established between the client terminal and the server, determining, by a first filter driver on the first device stack, that the first interface is redirected to the server;
in response to a second device stack being created on the server for a second interface of the USB composite device that is redirected to the server over the remote session established between the client terminal and the server, determining, by a second filter driver on the second device stack, that the second interface is redirected to the server;
accessing, by both the first and second filter drivers, a policy applicable to the remote session over which the first and second interfaces are redirected;
determining, by the first filter driver, that the policy does not prohibit redirection of the first interface, and in response, allowing the first interface to be redirected to the server via the first device stack thereby making the first interface accessible to the client terminal within the remote session; and
determining, by the second filter driver, that the policy prohibits redirection of the second interface;
determining whether an operating system of the server allows device objects to include a session ID property to define from which sessions corresponding devices can be accessed;
when it is determined that the operating system of the server allows device objects to include a session ID property to define from which sessions the corresponding devices can be accessed, assigning an invalid session ID that is not associated with any user session on the server to a session ID property of a device object representing the second interface to thereby prevent the second interface from being accessed from any user session; and
when it is determined that the operating system of the server does not allow device objects to include a session ID property to define from which sessions the corresponding devices can be accessed, moving any symbolic link that has a device target matching the second interface to an object manager namespace that is not associated with any user session on the server to thereby prevent the second interface from being accessed from any user session.
12. The method of claim 11 , wherein the session ID property is the DEVPKEY_Device_SessionId property in the Windows operating system such that the invalid session ID is assigned to the DEVPKEY_DEVICE_SesssionId property.
13. The method of claim 12 , wherein the DEVPKEY_Device_SessionId property is assigned a value of 0xFFFFFFFF.
14. The method of claim 11 , wherein determining that the first and second interfaces are redirected to the server comprises enumerating drivers in the first and second device stack respectively to identify the presence of a virtual bus driver.
15. The method of claim 11 , wherein the policy comprises an Active Directory group policy object.
16. The method of claim 11 , wherein moving any symbolic link that has a device target matching the second interface comprises enumerating one or more device objects in the second device stack to identify any symbolic links associated with the one or more device objects.
17. The method of claim 11 , wherein determining that the first and second interfaces are redirected to the server comprises enumerating drivers in the first and second device stack respectively to identify the presence of a virtual bus driver.
18. The method of claim 11 , wherein determining that the second interface is prohibited from redirection comprises determining that the policy prohibits redirection of a class of devices and that the second interface matches the class.
19. One or more non-transitory computer storage media storing computer executable instructions which when executed on a server implement a method for blocking redirection of an individual interface of a USB composite device when the USB composite device is connected to a client terminal that has established a remote session with a server and multiple interfaces of the USB composite device are redirected to the server over the remote session, the method comprising:
in response to a first device stack being created on the server for a first interface of the USB composite device that is redirected to the server over the remote session established between the client terminal and the server, determining, by a first filter driver on the first device stack, that the first interface is redirected to the server;
in response to a second device stack being created on the server for a second interface of the USB composite device that is redirected to the server over the remote session established between the client terminal and the server, determining, by a second filter driver on the second device stack, that the second interface is redirected to the server;
accessing, by both the first and second filter drivers, a policy applicable to the remote session over which the first and second interfaces are redirected;
determining, by the first filter driver, that the policy does not prohibit redirection of the first interface, and in response, allowing the first interface to be redirected to the server via the first device stack thereby making the first interface accessible to the client terminal within the remote session; and
determining, by the second filter driver, that the policy prohibits redirection of the second interface,
determining whether an operating system of the server allows device objects to include a session ID property to define from which sessions corresponding devices can be accessed;
when it is determined that the operating system of the server allows device objects to include a session ID property to define from which sessions the corresponding devices can be accessed, assigning an invalid session ID that is not associated with any user session on the server to a session ID property of a device object representing the second interface to thereby prevent the second interface from being accessed from any user session; and
when it is determined that the operating system of the server does not allow device objects to include a session ID property to define from which sessions the corresponding devices can be accessed, moving any symbolic link that has a device target matching the second interface to an object manager namespace that is not associated with any user session on the server to thereby prevent the second interface from being accessed from any user session.
20. The non-transitory computer storage media of claim 19 , wherein determining that the first and second interfaces are redirected to the server comprises enumerating drivers in the first and second device stack respectively to identify the presence of a virtual bus driver.