PSD v5.0: Clarify mediated multi-host peripheral support

Issue
PSD v4.0 already permits PSD-controlled user-peripheral access while preventing a peripheral path associated with one protected computer from communicating with another protected computer.

PSD v5.0 should clarify that one user-facing peripheral may support multiple protected computers where the PSD provides a separate, independently mediated host-facing interface for each protected computer. This allows modern secure-KVM use cases without changing the PSD’s fundamental domain-separation objective.

For example, a single user-facing CAC/smart-card reader may be used with several protected computers. The reader is shared only at the user-facing physical interface; it must not be shared electrically or logically between the protected computers. The PSD must create and control the separate host-facing mediated paths.

This approach can also provide the framework for other approved multi-host user peripherals, where the applicable PP Module permits them. It does not permit a generic peripheral switch, shared USB bus, or bridge between protected computers.

Proposed clarification
Permit a user-facing peripheral to support multiple protected computers only where:

Each protected computer has its own independently mediated host-facing interface.
Enumeration information, configuration information, status, data, and device-control signaling from one protected computer cannot reach another protected computer.
The PSD maintains the required association between the selected domain and the corresponding peripheral interface.
Domain-selection changes, device insertion/removal, reset, reconnection, and fault conditions cannot cause cross-domain transfer or incorrect host association.
The peripheral’s supported functions remain limited to those permitted by the applicable PP or PP Module.

Requested change
Add this clarification and the corresponding Evaluation Activity to the UAD/peripheral PP Module itself, rather than creating a separate Support Document.
Replace the existing restriction on UAD emulation and simultaneous multi-host use with a narrowly scoped option permitting independently mediated host-facing UAD emulation/termination for each protected computer. The option shall require isolated host contexts and shall prohibit a transparent physical-UAD USB path, shared host-side USB bus, or transfer of UAD data, status, control, or authentication results between protected computers.

Note that current generation PSD are vulnerable for certain USB attack on the bi-directional CAC port, it is also not in pratical use as the switched CAC reader disocnnects from the non-selected computer and then re-appear once that host is reselectd.

The Evaluation Activity should require the evaluator to demonstrate independent host-facing mediation and verify that each protected computer cannot observe, control, or receive information from another protected computer through the shared user-facing peripheral.

Start by reading the UAD/peripheral PP Module and its existing restriction on UAD emulation and simultaneous multi-host use. Add the narrowly scoped clarification and corresponding Evaluation Activity, then verify that the activity covers independent host-facing mediation, isolated host contexts, and prevention of cross-domain data, status, control, or authentication transfer.