US 11,113,393 B2 · Providing security features in write filter environments

Abstract

A security client can provide security features in write filter environments. To prevent improper modifications to a protected volume, the security client can be employed to differentiate between direct I/O requests and reparsed I/O requests that are directed to a shadow volume and to block any direct I/O requests. Alternatively or additionally, the security client can be configured to determine whether an I/O request that is directed to the shadow volume targets an artifact in the write filter's exclusion list, and if not, block the I/O request. Alternatively or additionally, the security client can be configured to monitor registry operations to determine whether a modifying registry operation targets the write filter's persistent shadow registry hive, and if so, allow the modifying registry operation only if it targets a registry key in the write filter's exclusion list.

Claims20

Dependent claims

A method, performed by a security client on a computing device, for providing security features in a write filter environment that includes a protected I/O stack on which a write filter is loaded to prevent modification to artifacts on a protected volume and an unprotected I/O stack by which the write filter enables excluded artifacts to be modified, the method comprising:

receiving, at a minifilter of the security client that is loaded on the unprotected I/O stack, an I/O request;
determining, by the minifilter, whether the I/O request is a reparsed I/O request or a direct I/O request;
when the minifilter determines that the I/O request is a reparsed I/O request, allowing the I/O request to be passed down the unprotected I/O stack;
and
when the minifilter determines that the I/O request is a direct I/O request, blocking the I/O request.

2 more elements

One or more computer storage media storing computer executable instructions which when executed on a computing device implement a security client that is configured to provide security features in a write filter environment that includes a protected I/O stack on which a write filter is loaded to prevent modification to artifacts on a protected volume and an unprotected I/O stack by which the write filter enables excluded artifacts to be modified, the security client providing the security features by performing a method comprising:

receiving, at a minifilter of the security client that is loaded on the unprotected I/O stack, a first I/O request;
determining, by the minifilter, that the first I/O request is a direct I/O request;
in response to determining that the first I/O request is a direct I/O request, blocking the first I/O request;
receiving, at the minifilter, a second I/O request;
determining, by the minifilter, that the second I/O request is a reparsed I/O request;
and
in response to determining that the second I/O request is a reparsed I/O request, allowing the second I/O request.

4 more elements

Dependencies are inferred from the claim text.

Providing security features in write filter environments

Life of this patent

Providing security features in write filter environments

Life of this patent

Abstract

Claims20