Kodetis · USB decontamination station
Between an unknown USB drive and your network, there is only trust.
SAINE takes in the hostile drive, isolates it, analyses its contents, and hands back nothing but sanitised, logged files. The drive never touches your network.
The problem
Three actions. Two seconds each.
- 01
The contractor arrives for a job and plugs their drive into the front-desk workstation to run a demo.
- 02
The intern wants to print a report and uses the nearest workstation, which happens to sit on the production network.
- 03
The field officer collects photographs of a worksite from the memory card just handed over.
None of these three actions is a mistake. They are part of the job, they happen every week, and they pass through no control at all. Between the drive and the network, there is only the trust placed in the person holding it out.
The blind spot
What you already have isn't looking there.
These three measures are in place almost everywhere, and they do their job. They all answer the same question — who is allowed to plug something in? — and none of them answers the one that comes next:what has just come in?
Port blocking by policy
what it covers
Who may plug in a drive, and on which workstations.
what it misses
It says nothing about content. On the authorised workstations — and there have to be some, or the work stops — the drive comes in as it is. Elsewhere, the file arrives by another route: the transfer has not disappeared, it has moved.
The endpoint antivirus
what it covers
Known threats, once the drive has been mounted by the system.
what it misses
It scans after the kernel has mounted the volume and parsed its filesystem. Anything aimed at that step has already run by the time the scan begins.
Policy and awareness training
what it covers
What everyone knows they are supposed to do.
what it misses
It rests on a judgement made case by case, by someone in a hurry, holding a drive that looks perfectly ordinary. And it leaves no trace: after the fact, nothing separates a careful transfer from one that was not.
The crossing
What happens between the two ports.
Step 01Insertion
The drive goes into the input port, physically separate from the rest of the station. No automatic mounting, no host system driver: the kernel never speaks to the device directly.
usbsas-usbdev · usbsas-dev2scsi
Step 02Isolation
Each read task runs in its own process, confined by a seccomp policy of its own. A process opens every file it will need, then enters its sandbox before reading a single byte off the drive.
usbsas-sandbox · seccomp + landlock
Step 03Analysis and neutralisation
Contents are extracted into an intermediate archive, then put through antivirus analysis. Anything the analysis flags does not get past this step. Filesystem formats are never re-interpreted on the output side.
usbsas-files2tar · analyzer
Step 04Traced output
A fresh filesystem is rebuilt from scratch on the output drive. Nothing from the source drive is copied across as it is: no partition table, no boot sector, no filesystem metadata.
usbsas-files2fs · usbsas-fs2dev
What comes out
What your organisation gets back.
- A rebuilt output drive
- A ready-to-use drive holding the files that were kept, and nothing else. It opens on any workstation, with no special tool and no special procedure.
- A log of what went in and what came out
- Every transfer leaves a record of what was presented, what was kept and what was rejected, with the reason for each rejection. The log can be read without replaying the transfer.
- Something to show an auditor
- The record shows that a control took place, when, on which drive, and what came of it. That is what separates a measure that is applied from one that is merely declared.
The files
The trace
The proof
The gap
What changes, step by step.
Three of the five steps leave your network.
The four steps of the crossing, then the networksolid: inside your networkhatched: outside your networkunwanted file caught
Today
5 of 5 steps inside your network
With SAINE
2 of 5 steps inside your network
01Insertion
Enters your network
On a production workstation (inside your network)
On the station alone (outside your network)
02Reading the drive
By the workstation kernel (inside your network)
Never by the kernel (outside your network)
03Analysis
On one person's judgement (inside your network)
The same on every transfer (outside your network)
Rejected here
04Output
As they arrived (inside your network)
Enters your network
On a rebuilt drive (inside your network)
05Network
Already on the network (inside your network)
Found here
Only the retained files (inside your network)
TraceAfter the fact
Nothing separates a checked transfer from an unchecked one.
A checked transfer is identifiable, dated, and tied back to its drive.
One cell = one step · ranks in the order of the transfer, not durations
What it rests on
What you can verify.
- A software core from public research
- SAINE is built on usbsas, developed and released as free software by the CEA, the French atomic energy and alternative energies commission. The source code of the core is public: it can be read, audited and verified without going through us.github.com/cea-sec/usbsas
- Built to ANSSI recommendations
- The station is designed along the recommendations published by ANSSI — the French national cybersecurity agency — on building clean-transfer stations, together with those on hardening GNU/Linux systems.
- The control depends on no outside service
- Extraction, analysis and rebuilding all happen on the station. Where usbsas relies on a remote antivirus platform, SAINE runs the analysis on the station itself: no file is sent anywhere else to be examined, and the station is connected to no trusted network. The antivirus signature database is the one thing that comes from outside, and it can be updated offline, from a dedicated drive.
- Designed and assembled in Réunion Island
- Design, integration and assembly are carried out by Kodetis in Réunion Island. Your technical contact is the team that built the station, not a reseller chain standing in front of it.
Let's talk
What's left is seeing it run.
A demonstration runs on your own drives, with your own files. It is the only way to judge a decontamination station, and it is the shortest one.
“ZimaBoard 2 3D Model” by ZimaSpaceCC BY-NC 4.0Web rendering adapted