Protecting selected disks on a computer system
AssigneeMicrosoft Technology Licensing, LLC
InventorsDhananjay Ramakrishnappa, Gregory Irving Thiel, Manoharan Kuppusamy, Yogesh Bansal
Life of this patent
Estimating the term…
Abstract
A server kernel processing system receives an input/output (I/O) request from a user mode computing environment. The I/O request is analyzed to determine whether it is a modification request to modify data in a target volume. If so, target analysis logic determines whether the request is for a target volume that is within a first or second protected volume. If the request is to modify data stored in the first protected volume, the request is blocked. If the request is to modify data in a second protected volume, then a whitelist is examined to determine whether the requesting process and user are on the whitelist. If not, the request is also blocked.
Claims20
A computing system, comprising:
- at least one processor;
- and
- memory storing instructions executable by the at least one processor, wherein the instructions provide in a server kernel:
- data accessing logic configured to:
- receive, from a calling process, a call to perform an operation on data stored on a data storage device;
- call interception logic configured to:
- intercept the call before the call is executed;
- and
- based on determining the call is a data manipulation request to manipulate target data, identify a storage location where the target data is stored;
- target analysis logic configured to:
- based on determining the storage location is not in a master boot record corresponding to the computing system and that the storage location is on a disk that holds a protected storage volume,
- compare the calling process to a set of entries in a whitelist file, the set of entries identifying calling processes that are authorized to access the protected storage volume;
- and
- generate an authorization signal indicating that the calling process is not authorized by the whitelist file based on the comparison;
- and
- call blocking logic configured to:
- block the call from being executed based on the authorization signal.
A method performed by a server kernel, the method comprising:
- receiving, from a calling process, a call representing a data manipulation operation on target data stored on a data storage device;
- intercepting the call before the call is executed;
- identifying a storage location where the target data is stored;
- based on determining the storage location is not in a master boot record and that the storage location is on a disk that holds a protected storage volume,
- generating an authorization signal indicating that the calling process is not authorized by a whitelist file based on a comparison of the calling process to a set of entries in the whitelist file, the set of entries identifying calling processes that are authorized to access the protected storage volume;
- and
- blocking the call from being executed based on the authorization signal.
A computing system, comprising:
- at least one processor;
- and
- memory storing instructions executable by the at least one processor, wherein the instructions provide a server kernel configured to:
- receive, from a calling process, a first call to perform an operation on data stored on a data storage device;
- intercept the first call before the first call is executed;
- based on determining the first call is a data manipulation request to manipulate target data, identify a storage location where the target data is stored;
- based on determining the storage location is not in a master boot record corresponding to the computing system and that the storage location is on a disk that holds a protected storage volume, compare the calling process to a set of entries in a whitelist file;
- generate an authorization signal indicating that the calling process is not authorized by the whitelist file based on the comparison;
- and
- block the first call from being executed based on the authorization signal;
- receive a second call to perform an operation on data stored on the data storage device;
- intercept the second call before the second call is executed;
- based on determining the second call is a data manipulation request to manipulate second target data, identify a second storage location where the second target data is stored;
- determine that the second storage location is in the master boot record;
- generate an interception signal indicating that the second target data is in the master boot record;
- and
- block the second call from being executed based on the interception signal.
Dependencies are inferred from the claim text.