Kodetis · USB decontamination station
Between an unknown USB drive and your network, there is only trust.
SAINE takes in the hostile drive, isolates it, analyses its contents, and hands back nothing but sanitised, logged files. The drive never touches your network.
The problem
Three actions. Two seconds each.
- 01
The contractor arrives for a job and plugs their drive into the front-desk workstation to run a demo.
- 02
The intern wants to print a report and uses the nearest workstation, which happens to sit on the production network.
- 03
The field officer collects photographs of a worksite from the memory card just handed over.
None of these three actions is a mistake. They are part of the job, they happen every week, and they pass through no control at all. Between the drive and the network, there is only the trust placed in the person holding it out.
The blind spot
What you already have isn't looking there.
These three measures are in place almost everywhere, and they do their job. They all answer the same question — who is allowed to plug something in? — and none of them answers the one that comes next:what has just come in?
Port blocking by policy
what it covers
Who may plug in a drive, and on which workstations.
what it misses
It says nothing about content. On the authorised workstations — and there have to be some, or the work stops — the drive comes in as it is. Elsewhere, the file arrives by another route: the transfer has not disappeared, it has moved.
The endpoint antivirus
what it covers
Known threats, once the drive has been mounted by the system.
what it misses
It scans after the kernel has mounted the volume and parsed its filesystem. Anything aimed at that step has already run by the time the scan begins.
Policy and awareness training
what it covers
What everyone knows they are supposed to do.
what it misses
It rests on a judgement made case by case, by someone in a hurry, holding a drive that looks perfectly ordinary. And it leaves no trace: after the fact, nothing separates a careful transfer from one that was not.
The crossing
What happens between the two ports.
Step 01Insertion
The drive goes into the input port, physically separate from the rest of the station. No automatic mounting, no host system driver: the kernel never speaks to the device directly.
usbsas-usbdev · usbsas-dev2scsi
Step 02Isolation
Each read task runs in its own process, confined by a seccomp policy of its own. A process opens every file it will need, then enters its sandbox before reading a single byte off the drive.
usbsas-sandbox · seccomp + landlock
Step 03Analysis and neutralisation
Contents are extracted into an intermediate archive, then put through antivirus analysis. Anything the analysis flags does not get past this step. Filesystem formats are never re-interpreted on the output side.
usbsas-files2tar · analyzer
Step 04Traced output
A fresh filesystem is rebuilt from scratch on the output drive. Nothing from the source drive is copied across as it is: no partition table, no boot sector, no filesystem metadata.
usbsas-files2fs · usbsas-fs2dev
What comes out
What your organisation gets back.
- A rebuilt output drive
- A ready-to-use drive holding the files that were kept, and nothing else. It opens on any workstation, with no special tool and no special procedure.
- A log of what went in and what came out
- Every transfer leaves a record of what was presented, what was kept and what was rejected, with the reason for each rejection. The log can be read without replaying the transfer.
- Something to show an auditor
- The record shows that a control took place, when, on which drive, and what came of it. That is what separates a measure that is applied from one that is merely declared.
The files
The trace
The proof
The gap
What changes, step by step.
Three of the five steps leave your network.
The four steps of the crossing, then the networksolid: inside your networkhatched: outside your networkunwanted file caught
Today
5 of 5 steps inside your network
With SAINE
2 of 5 steps inside your network
01Insertion
Enters your network
On a production workstation (inside your network)
On the station alone (outside your network)
02Reading the drive
By the workstation kernel (inside your network)
Never by the kernel (outside your network)
03Analysis
On one person's judgement (inside your network)
The same on every transfer (outside your network)
Rejected here
04Output
As they arrived (inside your network)
Enters your network
On a rebuilt drive (inside your network)
05Network
Already on the network (inside your network)
Found here
Only the retained files (inside your network)
TraceAfter the fact
Nothing separates a checked transfer from an unchecked one.
A checked transfer is identifiable, dated, and tied back to its drive.
One cell = one step · ranks in the order of the transfer, not durations
Security by design
Security is decided before the first file.
- Start from an open core
- SAINE is built on usbsas, developed and released as free software by the CEA, the French atomic energy and alternative energies commission. Starting from public code means choosing a core that anyone can read and audit.github.com/cea-sec/usbsas
- Build within the ANSSI framework
- The recommendations of ANSSI — the French national cybersecurity agency — on clean-transfer stations and on hardening GNU/Linux systems are where the design starts, not a box ticked at the end.
- Nothing leaves the station
- Extraction, analysis and rebuilding happen on the station itself: no file is sent anywhere else to be examined, and the station is connected to no trusted network. Only the antivirus signature database comes from outside, and it can be updated offline, from a dedicated drive.
- Designed and assembled in Réunion Island
- Design, integration and assembly are carried out by Kodetis in Réunion Island. The team that built the station is the team that answers you.
Let's talk
What's left is seeing it run.
A demonstration runs on your own drives, with your own files. It is the only way to judge a decontamination station, and it is the shortest one.
“ZimaBoard 2 3D Model” by ZimaSpace CC BY-NC 4.0 Adapted drawing: dimensions taken from the model