# US 2021/0240816 A1 · Efficiently authenticating an application during i/o request handling

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0240816 A1
- Document ID: US20210240816A1
- Status: Published application
- Kind: A1
- Application number: 16/780,108
- Filed: 2020-02-03
- Published: 2021-08-05
- Earliest claimed: 2020-02-03
- Assignees: Dell Products L.P.
- Applicants: Dell Products L.P.
- Inventors: Ankit Kumar; Gokul Thiruchengode Vajravel; Abhishek Mathur
- Web page: https://patentgrep.com/patent/US20210240816A1

## CPC

- G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
- G06F 21/6281: {at program execution time, where the protection is within the operating system}
- G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications}
- G06F 21/31: User authentication
- G06F 21/44: Program or device authentication
- G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- H04L 69/329: in the application layer [OSI layer 7]
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A security client can efficiently authenticate an application during I/O request handling by maintaining a white list that identifies processes that have been created for authenticated applications. The security client can register to be notified when a process is being created. When such a notification is received, the security client can authenticate the application for which the process is being created and then add an entry to the white list that includes the process identifier of the process being created. Then, when the process subsequently generates I/O requests, the security client can use the white list to quickly determine that the process pertains to an authenticated application and allow the I/O requests to modify protected artifacts.

## Claims

### Claim 1

A method, performed by a security filter of a security client, for efficiently authenticating an application during I/O request handling, the method comprising:
registering to be notified when a process is created;
in response to a notification that a first process is being created, identifying an application for which the first process is being created;
obtaining a precomputed hash for the application;
computing a hash for the application and comparing the computed hash to the precomputed hash;
upon determining that the computed hash matches the precomputed hash, storing an identifier of the first process; and
in response to receiving an I/O request that was initiated by the application, authenticating the application by determining that a process identifier associated with the I/O request matches the stored identifier of the first process.

### Claim 2 (depends on 1)

The method of claim 1, wherein identifying the application for which the process is being created comprises obtaining a name of the application's executable.

### Claim 3 (depends on 1)

The method of claim 1, wherein identifying the application for which the process is being created comprises obtaining a full path of the application's executable.

### Claim 4 (depends on 1)

The method of claim 1, wherein obtaining the precomputed hash for the application comprises sending a name of the application's executable to a security service, wherein the security service uses the name to access a policy in which the name is mapped to the precomputed hash.

### Claim 5 (depends on 1)

The method of claim 1, wherein the precomputed hash for the application is a precomputed hash of the application's executable and wherein computing the hash for the application comprises computing a hash of the application's executable for which the first process is being created.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
in response to a notification that the first process is being deleted, discarding the stored identifier of the first process.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
in conjunction with authenticating the application, accessing a policy to determine whether a current user is authorized to use the application to modify an artifact that is the target of the I/O request.

### Claim 8 (depends on 1)

The method of claim 1, wherein the I/O request is an IRP_MJ_CREATE request.

### Claim 9

A method, performed by a security filter of a security client, for efficiently authenticating an application during I/O request handling, the method comprising:
registering a first callback routine to be called when a process is being created;
registering a second callback routine for handling I/O requests;
in response to the first callback routine being called when a first process is being created, performing the following within the first callback routine:
identifying a name of an application's executable for which the first process is being created;
sending the name to a security service;
receiving, from the security service, a precomputed hash that is associated with the name;
calculating a hash of the application's executable;
comparing the calculated hash to the precomputed hash; and
in response to determining that the calculated hash matches the precomputed hash, storing an identifier of the first process in a white list;
in response to the second callback routine being called to handle a first I/O request, performing the following within the second callback routine:
obtaining a process identifier associated with the first I/O request; and
accessing the white list to determine that the process identifier associated with the first I/O request matches the stored identifier of the first process.

### Claim 10 (depends on 9)

The method of claim 9, wherein sending the name to the security service includes sending a full path to the application's executable.

### Claim 11 (depends on 9)

The method of claim 9, further comprising:
in response to the second callback routine being called to handle a second I/O request, performing the following within the second callback routine:
obtaining a process identifier associated with the second I/O request;
accessing the white list to determine that the process identifier associated with the second I/O request is not included in the white list; and
associating context with the second I/O request, the context indicating that modifications to a file targeted by the second I/O request should be blocked.

### Claim 12 (depends on 9)

The method of claim 9, further comprising:
in response to the second callback routine being called to handle the first I/O request, also performing the following within the second callback routine:
querying the security service to determine whether a current user can modify a file targeted by the first I/O request.

### Claim 13 (depends on 9)

The method of claim 9, wherein the second callback routine is registered for handling IRP_MJ_CREATE requests, and wherein the first I/O request is an IRP_MJ_CREATE request.

### Claim 14

One or more computer storage media storing computer executable instructions which when executed implement a security client that includes a security filter, the security filter being configured to perform a method for efficiently authenticating an application during I/O request handling, the method comprising:
maintaining a white list that identifies process identifiers of running applications that have been authenticated;
receiving an I/O request that attempts to open a handle to an artifact;
in response to receiving the I/O request, obtaining a process identifier of a first running application that created the I/O request;
determining that the process identifier of the first running application is included in the white list; and
allowing the first running application to obtain the handle and then use the handle to modify the artifact.

### Claim 15 (depends on 14)

The computer storage media of claim 14, wherein maintaining the white list comprises:
receiving notifications when processes are being created for applications;
in response to the notifications, authenticating the applications for which the processes are being created; and
adding the process identifier of an application for which a process is being created only when the application has been authenticated.

### Claim 16 (depends on 15)

The computer storage media of claim 15, wherein maintaining the white list comprises:
receiving notifications when processes are being deleted;
in response to each notification that a process is being deleted, determining whether the white list includes the process identifier of the process that is being deleted, and if so, removing the process identifier from the white list.

### Claim 17 (depends on 15)

The computer storage media of claim 15, wherein authenticating the applications for which the processes are being created comprises, for each application:
obtaining a precomputed hash that is associated with a name of the application's executable;
computing a hash of the application's executable;
comparing the precomputed hash to the computed hash; and
determining that the application is authenticated when the precomputed hash matches the computed hash.

### Claim 18 (depends on 14)

The computer storage media of claim 14, wherein the method further comprises:
receiving a second I/O request that attempts to open a handle to an artifact;
in response to receiving the second I/O request, obtaining a process identifier of a second running application that created the second I/O request;
determining that the process identifier of the second running application is not included in the white list; and
allowing the second running application to obtain the handle but preventing the second running application from using the handle to modify the artifact.

### Claim 19 (depends on 18)

The computer storage media of claim 18, wherein preventing the second running application from using the handle to modify the artifact comprises associating context with the handle, the context identifying that writes should be blocked.

### Claim 20 (depends on 14)

The computer storage media of claim 14, wherein the artifact is a file or a registry entry.