Which one is more secure: "sys-usb" or "sys-net as sys-usb"?

[zithro]

Thanks for the link, but it’s not the same thing really, as the problem is that my device has not only an Ethernet adapter, but also a USB hub. So it’s one more problem than yours !
Also, before thinking about security, I need to make it work ^^

Also, Joanna writes …

To allow the use of USB-connected networking devices in NetVM, we could use a PVUSB backend that can virtualize single USB devices without moving the whole USB controller to the domain. But that would require introducing a whole lot of new code to Dom0 – code that would be directly reachable from VMs (in other words that would be processing lots of untrusted input coming from untrusted domains).

… but does not continue on this path. Her post is from 2011, and may not apply to the current situation.

You can read this post, in which you also participated. It’s about a logitech unified dongle, which handles keyboard+mouse, but maybe the underlying problem is still the same : how to reliably and securely “passthrough” USB devices on the same USB hub and/or controller.
Maybe the answer is simply “NO”, as Joanna wrote in the last paragraph.

Summary

As we can see proper handling of USB devices is quite a challenge for OS architects. It might have been much less of a challenge if the engineers designing the USB, chipsets, and motherboards were a bit more security-conscious. Even such simple practice as never mixing security critical devices (keyboard, touchpad, camera, fingerprint reader), with non-security ones (3G modem), onto the same USB controller, would help tremendously. Or ability to somehow dynamically configure their connectivity, e.g. in BIOS?

Despite the warning, nothing has changed 11 years later …