Usb stack isolation for enhanced security
AssigneeVMware, Inc.
InventorsSisimon Soman, Matt Conover
Life of this patent
Estimating the term…
Abstract
Disclosed is a computer and method in a computer that detects attachment of an external device. A determination may be made whether the external device is trusted or untrusted. When the external device is deemed to be trusted, a first device stack may be instantiated in a first OS executing on the computer to conduct interactions with the external device. When the external device is deemed to be untrusted, a second device stack may be instantiated in a second OS executing on the computer to conduct interactions with the external device.
Claims20
A method in a first operating system (OS) executing on a computer system, the method comprising:
- detecting, in the first OS, attachment of an external device;
- determining, in the first OS, whether the external device is trusted or untrusted;
- when the external device is deemed to be trusted, then instantiating a first device stack in the first OS and using the first OS to conduct interactions with the external device via the first device stack;
- and
- when the external device is deemed to be untrusted, then instantiating a second device stack in a second OS executing on the computer system and using the second OS.
A non-transitory computer-readable storage medium having stored thereon computer executable instructions, which when executed by a computer device, cause the computer device to:
- detect, in a first OS that executes on the computer device, attachment of an external device;
- determine, in the first OS, whether the external device is trusted or untrusted;
- instantiate a first device stack in the first OS and use the first OS to conduct interactions with the external device via the first device stack, when the external device is deemed to be trusted;
- and
- instantiate a second device stack in a second OS that executes on the computer and use the second OS to conduct interactions with the external device via the second device stack, when the external device is deemed to be untrusted.
An apparatus comprising:
- a processor component comprising one or more computer processors;
- and
- a computer-readable storage medium comprising instructions for controlling the one or more computer processors to be operable to:
- execute a first OS on the processor component;
- detect, in the first OS, attachment of an external device;
- determine, in the first OS, whether the external device is trusted or untrusted;
- instantiate a first device stack in the first OS and use the first OS to conduct interactions with the external device via the first device stack, when the external device is deemed to be trusted;
- and
- instantiate a second device stack in a second OS that executes on the processor component and use the second OS to conduct interactions with the external device via the second device stack, when the external device is deemed to be untrusted.
Dependencies are inferred from the claim text.