Isolating a redirected biometric device to a remote session

One or more computer storage media storing computer-executable instructions which when executed by one or more processors implement a method for isolating a biometric device that is redirected to a user session so that the biometric device is not accessible to applications that are executing in other user sessions, the method comprising:

• in response to a biometric device being connected to a client terminal that has remotely established a user session on a server, creating a mapping between an identifier of the biometric device and a session ID of the user session;
• in response to a request to enumerate biometric devices that is made by a first application executing in a different user session, intercepting an enumeration response that includes the identifier of the biometric device;
• prior to allowing the enumeration response to proceed to the first application, extracting the identifier of the biometric device from the enumeration response and using the identifier to retrieve the session ID to which the identifier was mapped;
• comparing the retrieved session ID to a session ID of the first application that requested enumeration of the biometric devices;
• and
• upon determining that the retrieved session ID does not match the session ID of the first application, removing the identifier from the enumeration response prior to allowing the enumeration response to proceed to the first application.

A method, implemented by a hooking component and a filter driver, for isolating a biometric device to a user session, the method comprising:

• intercepting, by the hooking component, an enumeration response that includes at least one identifier of a biometric device and that is intended for an application executing in a first user session;
• for each identifier in the enumeration response:
• extracting the identifier of the biometric device from the enumeration response and sending the identifier to a filter driver;
• employing, by the filter driver, the identifier of the biometric device to obtain a session ID with which the identifier is associated and returning the session ID to the hooking component;
• and
• when the hooking component determines that the session ID received from the filter driver does not match the session ID of the first user session, removing, by the hooking component, the identifier of the biometric device from the enumeration response;
• and
• allowing the enumeration response to be provided to the application only after removing each identifier that is associated with a session ID that does not match the session ID of the first user session.