Efficiently authenticating an application during i/o request handling

A method, performed by a security filter of a security client, for efficiently authenticating an application during I/O request handling, the method comprising:

• registering a first callback routine to be called when a process is being created;
• registering a second callback routine for handling I/O requests;
• in response to the first callback routine being called when a first process is being created, performing the following within the first callback routine:
• identifying a name of an application's executable for which the first process is being created;
• sending the name to a security service;
• receiving, from the security service, a precomputed hash that is associated with the name;
• calculating a hash of the application's executable;
• comparing the calculated hash to the precomputed hash;
• and
• in response to determining that the calculated hash matches the precomputed hash, storing an identifier of the first process in a white list;
• in response to the second callback routine being called to handle a first I/O request, performing the following within the second callback routine:
• obtaining a process identifier associated with the first I/O request;
• and
• accessing the white list to determine that the process identifier associated with the first I/O request matches the stored identifier of the first process.

One or more computer storage media storing computer executable instructions which when executed implement a security client that includes a security filter, the security filter being configured to perform a method for efficiently authenticating an application during I/O request handling, the method comprising:

• maintaining a white list that identifies process identifiers of running applications that have been authenticated;
• receiving an I/O request that attempts to open a handle to an artifact;
• in response to receiving the I/O request, obtaining a process identifier of a first running application that created the I/O request;
• determining that the process identifier of the first running application is included in the white list;
• and
• allowing the first running application to obtain the handle and then use the handle to modify the artifact.