WMUD: A Whitelist Method of USB Devices Redirection for Virtual Desktop

摘要

Virtual Desktop Infrastructure provides a mass of virtual desktops (VD) to users. It is convenient for users to access their VD on any type of clients (physical terminals) rather than to use the constant terminals. VD have more excellent performance in operation with the SPICE protocol which is a special architecture aimed to virtual machines. Universal Serial Bus (USB) device is a kind of most common devices for computers. To ensure the normal operation of USB devices, USB redirection tools are needed by VD and clients. Existing researches mainly focus on the availability and convenience of USB redirection without considering the safety hazard. It is dangerous for VD to allow all the USB devices redirected automatically as most approaches do. To solve these problems we propose a USB redirection filter named Whitelist method of USB devices, which is called WMUD for short. It provides the control with the USB redirection. The WMUD has been implemented in virtualization based on QEMU and SPICE. We do a demonstration through making WMUD for VD. The effectiveness of WMUD has been proved by some experiments. The results show that WMUD control successfully whether the USB devices can be redirected or not automatically. At the same time, the different VD connect with different USB devices based on their unique filter rules. In addition, we confirm that by using the WMUD, the illegal USB devices are denied to redirect into VD even though attackers set the configuration in clients.