# US 12,117,966 B2 · System and method for proxying IO sessions to inject external processing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,117,966 B2 - Document ID: US12117966B2 - Status: Granted - Kind: B2 - Application number: 17/446,539 - Filed: 2021-08-31 - Published: 2023-03-02 - Granted: 2024-10-15 - Earliest claimed: 2021-08-31 - Assignees: EMC IP Holding Company LLC - Applicants: EMC IP Holding Company LLC - Inventors: Joel Christner; Amy N. Seibel; Nicole Reineke - Web page: https://patentgrep.com/patent/US12117966B2 ## CPC - G06F 16/1734: {Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs} - G06F 9/545: {where tasks reside in different layers, e.g. user- and kernel-space} - G06F 16/13: File access structures, e.g. distributed indices (arrangements of input from, or output to, record carriers G06F3/06) - G06F 16/172: Caching, prefetching or hoarding of files - G06F 21/54: by adding security routines or objects to programs - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 2209/542: Intercept - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract One example method includes injecting processing into sessions including IO sessions. Events in a file system are intercepted and processed. During processing, policies may be applied to the events. Some of the policies are triggered such that external actions or processing is applied to the event. Once the actions have been performed, the event may be processed by the file system. ## Claims ### Claim 1 A method, comprising: intercepting an event at a filter driver in a kernel space, wherein the event is associated with a resource of a computing system, wherein the event is associated with a session and wherein the session includes an entry for each event associated with the resource that occurred in the session; directing the event to a proxy engine operating in a user space; determining the session associated with the event is a session of interest by the proxy engine; generating a reconstructed session from entries in the session, which is stored in a session cache, wherein the reconstructed session includes the event; applying a policy to the reconstructed session to determine an action to be performed on the event using metadata and/or data stored in the session, wherein the metadata is related to the event; forwarding the reconstructed session to an external system, wherein the action is performed by the external system and wherein the action includes injecting an external processing into an IO (input/output) associated with the event based on the reconstructed session before the event is committed in the computing system, wherein the action is obscuring data, by the external system, associated with the event, wherein the data is unobscured when authorized at a later time; and returning the event to the filter driver to resume processing in the kernel space. ### Claim 2 (depends on 1) The method of claim 1, wherein the event is returned to the filter driver when the session is not of interest for normal processing in the kernel space. ### Claim 3 (depends on 1) The method of claim 1, wherein the metadata includes a session identifier, a handle, an identity of a user, process metadata including process ID, executable name, resource location, and application name, and timestamps and the data includes data to be written or data read from a data store. ### Claim 4 (depends on 1) The method of claim 1, wherein the action is logging, further comprising logging the event by the external system. ### Claim 5 (depends on 1) The method of claim 1, wherein the action is authorization, further comprising authorizing or denying the event by the external system. ### Claim 6 (depends on 1) The method of claim 1, wherein the action further includes manipulation, the method further comprising: manipulating data associated with the event that is to be written to a data store by the external system; or manipulating data, by the external system, that has been read from the data store and returning the manipulated data to a requestor. ### Claim 7 (depends on 1) The method of claim 1, further comprising interpreting the event. ### Claim 8 A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising: intercepting an event at a filter driver in a kernel space, wherein the event is associated with a resource of a computing system, wherein the event is associated with a session and wherein the session includes an entry for each event associated with the resource that occurred in the session; directing the event to a proxy engine operating in a user space; determining the session associated with the event is a session of interest by the proxy engine; generating a reconstructed session from entries in the session, which is stored in a session cache, wherein the reconstructed session includes the event; applying a policy to the reconstructed session to determine an action to be performed on the event using metadata and/or data stored in the session, wherein the metadata is related to the event; forwarding the reconstructed session to an external system, wherein the action is performed by the external system and wherein the action includes injecting an external processing into an IO (input/output) associated with the event based on the reconstructed session before the event is committed in the computing system, wherein the action is obscuring data, by the external system, associated with the event, wherein the data is unobscured when authorized at a later time; and returning the event to the filter driver to resume processing in the kernel space. ### Claim 9 (depends on 8) The non-transitory storage medium of claim 8, wherein the event is returned to the filter driver when the session is not of interest for normal processing in the kernel space. ### Claim 10 (depends on 8) The non-transitory storage medium of claim 8, wherein the metadata includes a session identifier, a handle, an identity of a user, process metadata including process ID, executable name, resource location, and application name, and timestamps and the data includes data to be written or data read from a data store. ### Claim 11 (depends on 8) The non-transitory storage medium of claim 8, wherein the action is logging, further comprising logging the event by the external system. ### Claim 12 (depends on 8) The non-transitory storage medium of claim 8, wherein the action is authorization, further comprising authorizing or denying the event by the external system. ### Claim 13 (depends on 8) The non-transitory storage medium of claim 8, wherein the action further includes manipulation, the method further comprising: manipulating data associated with the event that is to be written to a data store by the external system; or manipulating data, by the external system, that has been read from the data store and returning the manipulated data to a requestor. ### Claim 14 (depends on 8) The non-transitory storage medium of claim 8, further comprising interpreting the event. ### Claim 15 A method, comprising: intercepting an event at a filter driver in a kernel space, wherein the event is associated with a resource of a computing system, wherein the event is associated with a session and wherein the session includes an entry for each event associated with the resource that occurred in the session; directing the event to a proxy engine operating in a user space; determining the session associated with the event is a session of interest by the proxy engine; generating a reconstructed session from entries in the session, which is stored in a session cache, wherein the reconstructed session includes the event; applying a policy to the reconstructed session to determine an action to be performed on the event using metadata and/or data stored in the session, wherein the metadata is related to the event; forwarding the reconstructed session to an external system, wherein the action is performed by the external system and wherein the action includes injecting an external processing into an IO (input/output) associated with the event based on the reconstructed session before the event is committed in the computing system, wherein the action is authorization or manipulation, by the external system, associated with the event, wherein the data is unobscured when authorized at a later time; and returning the event to the filter driver to resume processing in the kernel space.