RPC call interception
AssigneeCrowdStrike, Inc.
InventorIon-Alexandru Ionescu
Life of this patent
Estimating the term…
Abstract
A service proxy is described herein. The service proxy is configured to act as an intermediary between a client and a service. The service proxy may observe communications, modify communications, log communications, or the like, particularly so as to enhance the security and reliability of the host device. In some implementations, the service proxy may cooperate with an operating system to take over a named port object. In some implementations, the service proxy may receive messages as an intermediary between the client and the server. In some implementations, the service proxy may attach to a shared memory to intercept communications. In some implementations, the service proxy may be injected into a client process to appear to be the client itself.
Claims20
A computer-implemented method comprising:
- receiving, from a client process, an indication of a communication session between the client process and a service, the indication including a reference to a service port associated with the service;
- injecting a proxy thread into the client process;
- creating a modified indication of the communication session based, at least in part, on the indication of the communication session, the modified indication of the communication session referencing the proxy thread instead of the service port;
- providing the modified indication of the communication session to the client process;
- receiving, by the proxy thread from the client process, a message to be received by the service port;
- analyzing, by the proxy thread, the message;
- and
- forwarding, by the proxy thread, the message to the service port.
A computing device, comprising:
- one or more processors;
- and
- memory storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
- receiving, from a client process, an indication of a communication session between the client process and a service, the indication including a reference to a service port associated with the service;
- injecting a proxy thread into the client process;
- creating a modified indication of the communication session based, at least in part, on the indication of the communication session, the modified indication of the communication session referencing the proxy thread instead of the service port;
- providing the modified indication of the communication session to the client process;
- receiving, by the proxy thread from a sender, a message to be received by a receiver;
- analyzing, by the proxy thread, the message;
- and
- forwarding, by the proxy thread, the message to the receiver,
- wherein the sender is one of the client process or the service, and the receiver is the service port or a client port of the client process.
One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors of a computing device, cause the one or more processors to perform operations comprising:
- receiving, from a client process, an indication of a communication session between the client process and a service, the indication including a reference to a service port associated with the service;
- injecting a proxy thread into the client process;
- creating a modified indication of the communication session based, at least in part, on the indication of the communication session, the modified indication of the communication session referencing the proxy thread instead of the service port;
- providing the modified indication of the communication session to the client process;
- receiving, by the proxy thread from a sender, a message to be received by a receiver;
- analyzing, by the proxy thread, the message;
- and
- forwarding, by the proxy thread, the message to the receiver,
- wherein the sender is one of the client process or the service, and the receiver is the service port or a client port of the client process.
Dependencies are inferred from the claim text.