Security of computer systems

Abstract

The file system driver software may receive a file access request indicating that an application process is requesting access to a target file in the file system, and the network filter driver software may receive a connection establishment request, the connection establishment request indicates that an application process running on the processing apparatus is requesting establishment of a connection with the target endpoint over the network. In accordance with the present disclosure, one or both of the following: a) file system driver software is configured to authorize or deny file access requests in accordance with status information from network filter driver software, and / or b) the network filter driver software is configured to authorize or reject the connection setup request in accordance with the status information from the file system driver software.

Description

Background Art

[0001] Security is an ongoing concern for users and designers of computer systems, such as servers, desktops, laptops, tablets, smartphones, and wearable devices.

[0002] It is known that when attempting to establish a connection with an endpoint through a network such as the Internet, a network filter (sometimes also referred to as a "firewall") of a computer system checks whether the endpoint is credible. If the endpoint is found to be untrustworthy, the connection to the endpoint can be prevented from being formed. Summary of the invention

[0003] Access to files in the computer system's file system may also be restricted, or files may be designated as sensitive. However, some applications, such as word processing applications or web browsers, may require access to both the file system and the network in order to operate.

[0004] In existing operating systems, drivers that currently handle access to the file system are not provided with any means to communicate with drivers that handle network access, and vice versa. For example, existing firewalls completely block or allow connections based solely on the endpoint itself, and do not consider what files the application has opened.

[0005] It is recognized herein that it would be desirable to make access to files based on state information from driver software that handles network connections, and / or to make connections to endpoints based on state information from driver software that handles file system access.

[0006] According to one aspect disclosed herein, a computer system is provided, comprising: a processing device including one or more processors, a memory including one or more memory devices, and a network interface including one or more interface devices. The memory stores operating system software arranged to run on the processing device, and the operating system software includes file system driver software and network filter driver software. The file system driver software is configured to receive a file access request, which indicates that an application process running on the processing device is requesting access to a target file in a file system of the computer system's memory. The network filter driver software is configured to receive a connection establishment request, which indicates that an application process running on the processing device is requesting to establish a connection with a target endpoint through a network via a network interface of the computer system. The operating system is configured to enable any one or both of the following: a) the file system driver software is configured to authorize or deny a file access request based on status information from the network filter driver software, and / or b) the network filter driver software is configured to authorize or deny a connection establishment request based on status information from the file system driver software.

[0007] In other words, the file system driver software is configured to make a decision to authorize or deny a file access request, and / or the network filter driver software is configured to make a decision to authorize or deny a connection establishment request; and the decision of at least one of the file system driver and the network filter driver is made based on status information from the other.

[0008] Compared to other solutions such as firewalls with full permission or denial of network access, the disclosed system thus allows for more flexibility in determining how to restrict file access and / or network access. For example, processing sensitive data in an application such as a word processing application or a web browser may result in the sensitive data being exposed inadvertently by the user or intentionally by a malicious application. On the other hand, it is desirable to enable applications to more freely access the network when processing non-sensitive data.

[0009] In an embodiment, the file system driver software may be configured to determine whether the target file is sensitive, and the status information from the network filter driver software may include an indication of whether any untrusted network connections are currently active via the network interface. In such an embodiment, the file system software is configured to perform a) according to the following rule: If the target file is sensitive, the file access request will be authorized on the condition that the status information from the network filter driver software indicates that there are no active connections to the untrusted endpoints.

[0010] Alternatively or additionally, the network filter driver software may be configured to determine whether the target endpoint is trusted, and the status information from the file system driver software may include an indication indicating whether the application process has ever read from or written to a sensitive file. In such an embodiment, the network filter driver software may be configured to perform b) according to the following rule: if the target connection is untrusted, the connection establishment request will only be granted if the status information from the file system driver software indicates that the application process has never read from or written to a sensitive file, otherwise the file access request will be denied.

[0011] With respect to this implementation of rule b), it is noted herein that even after an application has closed a file, residual copies of some data from the file may still reside in temporary storage (e.g., cache memory or a RAM area allocated to the application) that the application has accessed. Thus, it is recognized herein that it is desirable to prevent connections to untrusted endpoints requested by an application process not only if the application process currently has a sensitive file open, but also if the current process has ever accessed data of a sensitive file.

[0012] This summary is provided to introduce a selection of concepts in a simplified form, which will be further described in the following detailed description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. The claimed subject matter is also not limited to implementations that solve any or all of the disadvantages described herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] To aid understanding of the present disclosure and to show how the embodiments may be effected, reference is made by way of example to the accompanying drawings, in which:

[0014] Figure 1A is a schematic block diagram showing the physical components of a computer system,

[0015] Figure 1B is a schematic block diagram of a computer system according to the present disclosure,

[0016] Figure 1C is a schematic block diagram of a computer system according to an embodiment of the present disclosure,

[0017] Figure 2 is a schematic flow chart of a method that may be performed by file system driver software according to an embodiment disclosed herein; and

[0018] Figure 3 is a schematic flow chart of a method that may be performed by network filter driver software according to embodiments disclosed herein. DETAILED DESCRIPTION

[0019] When attempting to establish a connection with an endpoint over a network such as the Internet or a local network, a network filter (or so-called "firewall") of a computer system can check whether the endpoint is trustworthy. For example, the endpoint can be the URL of a website that the computer system is trying to connect to over the Internet, another computer that the computer is trying to communicate with over a network, or a peripheral device on a home network or other local network. Detecting the trust status of an endpoint can, for example, include authenticating the endpoint using cryptographic means (e.g., authenticating a certificate or signature of the endpoint), and / or checking whether the address (e.g., URL) or other identifier of the endpoint is in a list of trusted endpoints, or is not in a list of untrusted endpoints, and / or checking for malicious data fingerprints (e.g., fingerprints of known viruses or other malware) in data received from the endpoint. If the endpoint is found to be untrustworthy, the connection to the endpoint can be blocked, or alternatively, the connection may not necessarily be blocked, but a warning may be provided to the user through the user interface (UI) of the computer system. The UI can also prompt the user with a manual option as to whether to block the connection or continue to establish the connection (after all, untrustworthiness does not necessarily mean that the endpoint is malicious, just that it has not passed the check to prove that it is not malicious).

[0020] Files in the computer system's file system may also be designated as sensitive (e.g., confidential, classified, or top secret, etc.), either having been manually designated as sensitive, or may be automatically designated as sensitive based on some rules implemented by the computer system. If a user or the system requests access to a file in order to perform some operation such as reading or modifying the file, then if the file is also designated as sensitive, the UI may prompt the user with a message informing the user of the sensitive nature of the file, and / or may automatically block or authorize access to the file based on an access policy implemented by the computer system, such as based on the credentials of the application or user requesting access.

[0021] Some applications may need access to both the file system and the network in order to operate - for example, a word processing application may need access to the file system in order to read and edit documents, but may also require access to the network to work properly (e.g., to get updates or back up files to the cloud). Another example is a web browser that requires both network and file system access.

[0022] In existing operating systems, the drivers that currently handle access to the file system do not provide any means to communicate with the drivers that handle network access, and vice versa. For example, existing solutions such as firewalls that arbitrate connections to network endpoints simply either block or allow the connection completely, but do not consider what files the application has open at the time or has opened in the past.

[0023] It is recognized herein that it would be desirable to make access to files based on state information from driver software that handles network connections, and / or to make connections to endpoints based on state information from driver software that handles file system access. This would allow for more flexible or intelligent decisions about when to restrict access to files and / or connections to network endpoints than other solutions (such as firewalls that simply allow or deny network access entirely). For example, processing sensitive data in an application such as a word processing application or a web browser may result in the user accidentally or a malicious application intentionally exposing the sensitive data. On the other hand, it would be desirable to enable applications to have more free access to the network when processing non-sensitive data.

[0024] Therefore, the present disclosure provides a method whereby a file system driver shares state information with a network filter driver, so that file access can be made based on the state of the network filter driver, and / or network connection can be made based on the state of the file system driver. For example, this can be used to provide dynamic network access restrictions when processing sensitive data. In an embodiment, in order to provide a general solution, it is not assumed that there is a fixed order of network access and file system access.

[0025] The example implementation uses the following components:

[0026] As a file system minifilter driver for file system drivers,

[0027] WFP callout driver as a network filter driver,

[0028] Methods for determining the sensitivity of documents, and

[0029] A method of determining whether a remote endpoint can be trusted to handle sensitive data.

[0030] In an embodiment, state is maintained for each application process. The state will hold two items - whether the application has ever accessed sensitive data (read or edited sensitive files) and the amount of active connections to untrusted endpoints. Using this state and modifications to the file system driver software and network filter driver software (e.g., the components described above), network access or file system access can be blocked or allowed based on either or both of the following rules.

[0031] If the app wants to open sensitive files, it must not have any active connections to untrusted endpoints.

[0032] Apps can open connections to untrusted endpoints only if the app never reads or edits sensitive files.

[0033] In one embodiment, the WPF callout driver and the file system minifilter driver will execute Figure 2 and Figure 3 , which will be discussed in more detail later.

[0034] Figure 1A The physical components of a computer system 2 in which the solutions herein may be implemented are shown. The computer system 2 is shown in the context of a wider communication system including a network 4 and a network endpoint 6. The computer system 2 may be formed of one or more computer units - either separate computer units within a single housing, or multiple computer units if different housings are networked together via any suitable networking technology (e.g., a wide area network or interconnected network such as the Internet, or a local wired or wireless network such as an Ethernet or Wi-Fi network, or a server structure, etc.). Any separate computer terminal forming the computer system 2 may take any suitable form, such as a server unit, a desktop computer, a laptop computer, a tablet computer, a smart phone, or a wearable device such as a smart watch or smart glasses, etc.

[0035] For example, in an embodiment, the computer system 2 may take the form of a single user terminal, such as a desktop computer, a laptop computer, a tablet computer, a smart phone, or a wearable device; or multiple user terminals networked together via a local wired or wireless network (e.g., a home network or a company intranet) such as an Ethernet, a Wi-Fi network, a Bluetooth network, a 6LowPAN network, a ZigBee network, an optical network, etc. In other embodiments, the computer system 2 may take the form of a server unit or multiple server units networked together via a server structure in the same rack or data center. In other embodiments, the computer system 2 may include one or more user terminals networked together with one or more server units via a local network (e.g., a home network or a company intranet), or a wide area network such as a cellular network, or a wide area Internet such as the Internet.

[0036] The computer system 2 includes a processing device 3, which includes one or more processors. Any such processor may include, for example, a CPU (central processing unit) or a dedicated processor or accelerator processor, such as a GPU (graphics processing unit), a DSP (digital signal processor), an AI accelerator processor, or an encryption processor. The computer system also includes a memory 5 operably coupled to the processing device 3 to allow the processor to extract and run code (software) from the memory 3 and load data from and store data to the memory 3. The memory 5 includes one or more memory devices using one or more volatile and / or non-volatile storage media. Any such memory device may, for example, include electronic memory media, such as ROM (read-only memory), RAM (random access memory), EEPROM (electrically erasable programmable ROM, such as flash memory), WORM (write-once-read-many-read) memory, or OTP (one-time programmable memory), etc.; or magnetic media, such as disks or tapes; or optical media, such as optical disks (e.g., CDROM) or quartz glass storage; or even more exotic forms, such as synthetic biological memory.

[0037] Any memory device used as part of the memory 5 may be inside the same integrated circuit (IC) or IC package, or multiple ICs or IC packages as the processing device; or the memory device may be external but on the same board or in the same housing of the same computer unit, or may be a peripheral memory device external to the housing of the computer unit. For example, in an embodiment, the memory 5 may include a ROM, RAM, or EEPROM on the same IC (i.e., chip) or board as at least one processor of the processing device 3; or a HDD (hard disk drive), SSD (solid state drive), removable disk or tape drive, or optical drive (e.g., CDROM drive) in the housing of the same computer unit; or an external peripheral HDD, SSD, removable disk drive, or optical drive, etc.

[0038] The network 4 may represent any one or more networks - a single network or multiple networks connected via any suitable network interconnection means such as the Internet Protocol (IP). Any such network may be a wired local area network, such as an Ethernet, or a wireless local area network, such as a WI-FI network, a Bluetooth network, a 6LOWPAN network, or a ZigBee network, etc.; or a wide area network, such as a cellular network (e.g., a 3GPP network such as a 2G, 4G, or 5G network) or a PSTN (Public Switched Telephone Network), etc.; or a wide area Internet such as the Internet. Also in an embodiment, the term "local" or "local area" does not exclude variants such as a personal area network (PAN), a body area network (BAN), or a server area network (SAN, also referred to as a server structure); and the term "wide" or "wide area" does not exclude variants such as a metropolitan area network (MAN). The network interface 7 may include any one or more network interface devices for connecting to one or more networks. For example, the network interface 7 may include a network card, a modem, etc. for connecting to any network type previously mentioned.

[0039] Optionally, the computer system 2 may include a user interface (UI) 9, although this is not necessary in all possible scenarios, such as in the case of a server unit or other computer that runs autonomously or is used autonomously by another computer. Where a UI 9 is present, it may take any suitable form for inputting information from and / or outputting information to a user, such as a screen, touch screen, point-and-click interface, keyboard or keypad, or audio interface, etc.

[0040] The network endpoint 6 may be any remote or external computer device, software element, or network location that is separate from the computer system 2, at least because it is separated by the network 4. An endpoint may be identified as a network endpoint by an address within the network 4. An endpoint may include, for example, a server (including one or more server units); a user terminal (e.g., a desktop computer, laptop computer, tablet computer, phone, or wearable device, etc.); a site or location within a network, such as a website; or a specific software entity, such as a robot or other automated service program, etc.

[0041] Figure 1B The software components involved in the currently disclosed scheme are shown. The software components include an operating system (OS) 8 and one or more application processes 10. OS 8 is stored in at least one memory device of the memory 5 and is arranged to run on at least one processor 3 of the processing device. It is configured to perform the functions described below at runtime. Each application process 10 is a currently running instance of an application stored in the memory 5. The difference between an application and an application process is that an "application" refers to a persistent code stored on a non-volatile memory such as a hard disk (or SSD, etc.), which continues to exist even when the application is closed or the computer is turned off, while an application "process" refers to a currently running instance of an application, which ends when the application is closed.

[0042] It will be appreciated that the memory 5 shown in the figure may represent more than one memory device, and that the various software components and any data involved in the presently disclosed technology are not necessarily all stored on the same memory device. For example, OS 8 may be stored in ROM, a hard disk or SSD, or a combination of ROM and HDD / SSD, and when parts thereof are run, they may be temporarily kept in RAM or cache; while (multiple) applications 10 may be stored in one or more HDDs or SSDs or loaded from a removable disk, and when run, parts of (multiple) applications 10 may be kept in RAM or cache memory; and data processed by OS 8 and applications 10 may be kept in RAM, cache and / or registers.

[0043] The OS 8 includes file system driver software 17 for servicing file access requests 28 requesting use of the storage 5 , and network filter driver software 19 for servicing connection establishment requests 30 requesting use of the network interface 7 .

[0044] The file system driver software 17 includes one or more file system drivers. In the case of multiple memory devices, it may include one or more file system drivers corresponding to each memory device, or a given set of one or more drivers may be configured to serve multiple memory devices. In either case, the file system driver software 17 is configured to receive a file access request 28 from an application process 10 running on OS 8. Note that in an embodiment, the request 28 may be received by proxy via one or more intermediate layers (such as a driver manager and / or a system call layer) and may be converted into different forms between the application process 10 and the file system driver software 17. The file access request 28 mentioned herein refers to the substance of the message from the application process 10, and is not necessarily an exact form of the message. The file access request 28 is initiated directly or by proxy from the application process 10, and the request represents a request for the application process to access a file in the file system of the memory 5. The file system refers to a data structure or method in which files are organized in the memory 5. The file access request 28 may, for example, include a request for the application process 10 to read or modify a file in the file system of the memory 5. In response to such a request, the file system driver software 17 will determine whether the request is authorized or denied, and if authorized, service the request by accessing the memory 5 according to the protocol or protocols required to access the file system.

[0045] The network filter driver software 19 includes one or more network filter drivers. In the case of multiple network interface devices, it may include one or more corresponding network filter drivers for serving each network interface device, or a given set of one or more network filter drivers may be configured to serve multiple network interface devices. In either case, the network filter driver software 19 is configured to receive a connection establishment request 30 from an application process 10 running on OS 8. Note that in an embodiment, the request 30 may be received by proxy via one or more intermediate layers (such as a driver manager and / or a system call layer) and may be transformed into different forms between the application process 10 and the network filter driver software 19. The connection establishment request 30 mentioned herein refers to the substance of the message from the application process 10 and is not necessarily an exact form of the message. The connection establishment request 30 is initiated directly or by proxy from the application process 10, and the request represents a request for the application process to form a connection with the specified network endpoint 6. A network filter, sometimes also referred to as a "firewall", is a security solution for monitoring incoming and outgoing network services and connection establishment requests and determining whether to block services and network establishment requests based on a set of one or more security rules. In response to the network establishment request 30 , the network filter driver software 19 will determine whether the request is authorized or denied, and if authorized, service the request by forming a connection with the endpoint 6 via the associated network 4 and the corresponding network interface device of the network interface 7 .

[0046] Figure 1A The element 25 shown in represents shared state information, which can be provided for transmitting data between the file system driver software 17 and the network filter driver software 19 via any channel, such as a shared area of ​​memory or (multiple) shared registers in which the slice state information is stored and can be accessed by both the file system driver software 17 and the network filter driver software 19, or a software process for copying information from one driver software to another driver software, or even a dedicated hardware channel is possible in principle. The shared state information can include state information from the file system driver software 17 or from the network filter driver software 19 or from both. This enables a more intelligent approach to determine whether to authorize access to files and / or endpoints, whereby instead of making decisions in isolation, decisions about whether to authorize access to files can be made based on what network connection is open or even has been opened in the past, and / or decisions about whether to allow connections to endpoints 6 can be made based on what files are currently open or have been opened in the past. In principle, the dependency can include any one or more rules according to any access strategy that the developer wishes to implement. However, a particularly beneficial strategy according to the embodiments disclosed herein is described below.

[0047] According to such an embodiment, the network filter driver software 19 is provided with means for determining whether the network endpoint 6 is trustworthy. This may be any test for proving (not necessarily with 100% certainty) that the endpoint in question is not malicious. This may include, for example, authenticating the endpoint 6 using cryptographic means (e.g. a certificate or signature authenticating the endpoint), and / or checking whether the address (e.g. a URL) or other identifier of the endpoint 6 is in a list of trusted endpoints, or is not in a list of untrusted endpoints, and / or checking for malicious data fingerprints (e.g. fingerprints of known viruses or other malware) in data received from the endpoint 6. If the endpoint fails the test, this does not necessarily mean that it is malicious, just that it has not yet been proven that it is not malicious.

[0048] In addition, the file system driver system 17 can be provided with a component for determining whether a file in the file system of the memory 5 is sensitive. For example, a user can manually specify that a file is sensitive via the UI 9 of the computer system 2; or the OS 8 or the application process 10 can automatically designate a file as sensitive according to some predetermined policies (for example, a policy including rules that certain types of file content or files originating from certain sources are automatically considered sensitive) or a policy learned using AI technology. For example, the designation can be added as a tag to the file, or indicated in a lookup table that maps sensitive status to files. By any means implemented, the file system driver 17 is configured to be able to read the manual or automatic designation.

[0049] In an embodiment, the shared state 25 may include the state of the network filter driver software 19, which may include an indication of whether there are any connections currently open (i.e., active) to any untrusted endpoints, such as a count of currently open connections. Based on this, when the file system driver software 17 receives a file access request 28 from an application process 10 requesting access to a particular target file, the file system driver software 17 may determine whether to grant or deny the request based on an access policy that includes the following rules: a) If the target file is sensitive, the file access request 28 will only be authorized if the shared state information 25 indicates that no active connections to the untrusted endpoint 6 are currently open.

[0050] Alternatively or additionally, the shared state 25 may include the state of the file system driver system, which may include an indication of whether any sensitive files have ever been read or modified by a given application process 10. This state information may be maintained separately for each currently running application process. In such an embodiment, when the network filter driver software 19 receives a connection establishment request 30 from an application process 10 requesting to establish a network connection with a target network endpoint 6, the network filter driver software 19 may determine whether to grant or deny the request based on an access policy that includes the following rules: b) If the target endpoint 6 is untrusted, the connection establishment request 30 will only be authorized if the shared state 25 indicates that the requesting application 10 process has never read from or written to sensitive files.

[0051] As recognized herein, it is particularly desirable to block untrusted connections if the currently running application process 10 ever accessed data of a sensitive file, and not just if the file was open at the time of the connection establishment request 30. This is because even if the file has subsequently been closed, copies of some data from the file may still reside in locations such as RAM, cache, or registers that the requesting process 10 still has access to.

[0052] Preferably, but not essentially, both rules a) and b) are implemented by the file system driver software 17 and the network filter driver software 19 in the same OS 8 .

[0053] NOTE: An "application" refers to persistent code stored on a hard drive (or SSD or similar) that remains even when the application is closed or the computer is turned off, whereas an application "process" refers to the currently running instance of an application. Rule b) is that the currently running application process is not allowed to establish an untrusted connection if it has ever read or edited a sensitive file, but if the application process is closed and a new process is started, or the computer is turned off and on again, the newly running instance of the application can now open an untrusted connection (as long as it has not read or edited a sensitive file again before doing so). The rule is preferably not that the application itself never establishes an untrusted connection again, even if the application is closed and restarted, or the computer is turned off and on again. The application does not retain any persistent state for the application in RAM, cache, or registers for network or file access once the currently running instance is closed.

[0054] Figure 1C Shows Figure 1B Specific example implementation of system 2 of FIG. It should be appreciated that this is only one example, and different implementations providing the same functionality in other types of OS 8 are possible.

[0055] exist Figure 1CIn the implementation of , OS 8 includes a system call layer 12, and the driver management software 14 includes a file system driver manager 16 and a network filter driver manager 18. For example, the file system driver manager 16 may include a minifilter manager, and the network filter driver manager 18 may include a WFP callout engine (WFP=Windows Filtering System). The file system driver software 17 includes a first file system driver 20 and a second file system driver 24. If the file access request 28 is authorized, the first file system driver 20 implements the basic protocol (s) for accessing the file system in the memory 5, and may also implement one or more standard rules for checking or blocking access to the file, such as based on the identity of the user trying to access the file or authenticating the user; while the second file system driver 24 implements additional file access rules (s) based on the shared state 25 from the network filter driver software 19, for example as previously discussed. For example, the first file system driver may be a first minifilter, which may be a standard part of OS 8, and the second file system driver may be a custom minifilter. The network filter driver software 19 includes a first network filter driver 22 and a second network filter driver 26. The first network filter driver 22 implements (multiple) standard firewall protocols for inspecting or blocking connections to the endpoint 6 over (multiple) networks, e.g., based on identification of the endpoint itself or authenticating the endpoint, or monitoring traffic to / from the endpoint, while the second network filter driver 26 implements additional (multiple) network connection rules based on state information 25 from the file system driver software 17, e.g., as previously discussed. For example, the first network filter driver 22 may include a first WFP callout, which may be a standard part of OS 8, and the second network filter driver 26 may be a custom WFP callout.

[0056] In operation, the application process 10 submits each of the file access request 28 and the connection establishment request 30 to the system call layer 12 of the OS 8 in the form of a system call. The system call layer 12 routes the request to the file system driver manager 16 if the request is a file access request 28, or to the network filter driver manager 18 if the request is a connection establishment request 30. Each of the file system drivers 20 and 24 subscribes to the network access requests from the file system driver manager 16, which forwards any requests 28 associated with those file system drivers 20 and 24 to those drivers (the requests 28 may be forwarded in a transformed form). Similarly, each network filter driver 22, 26 subscribes to the connection establishment requests from the network filter driver manager 18, which forwards any requests associated with those drivers 22, 26. In an embodiment, each file system driver (e.g., minifilter) 20, 24 creates a corresponding driver call (e.g., minifilter call) for each file for which it receives any request 28, and subscribes to the requests on a per-file basis. Similarly, each network filter driver 22, 26 (e.g., WFP callout) can create a corresponding driver call (e.g., WFP callout call) for each network endpoint for which it receives any request 30, and subscribe to the requests on a per-endpoint basis. With respect to the minifilter and network filter flows, in the case of the file system filters 20 and 24, these can work together to grant or deny access to files because both file filters use the same framework. In the case of the network filters 22 and 26, the WFP callout (which may also be referred to as a filter) marks the connection as blocked or allowed and returns it to the WFP engine 18. The engine transfers the processing of the network connection (if necessary) to the relevant network driver.

[0057] In such Figure 1C In the illustrated implementation, the file system driver software 17 thus includes a first standard file system driver 20 and a second customized file system driver 24, and the network filter driver software 19 includes a first standard network filter driver 22 and a second customized network filter driver 26 - this advantageously allows the disclosed functionality to be added on top of existing drivers of a legacy operating system in a modular manner. However, it should be appreciated that this implementation is not necessary, and in alternative embodiments, the described functionality of the file system driver software 17 may be implemented using a single combined file system driver that incorporates both existing file system driver functionality and new file system driver functionality; and / or similarly, the described functionality of the network filter driver software 19 may be implemented using a single combined network filter driver that incorporates both existing network filter driver functionality and new network filter driver functionality.

[0058] Figure 2 A method is shown that may be implemented by the file system driver software 17 (e.g., by the custom minifilter 24) when the file system driver software 17 receives a file access request 28 requesting access to a target file. At step S0, the method starts. At step S10, the method determines what type of operation is being requested. If it is an operation other than read or write, the method branches to step S15, where it ends. But if the requested operation is read or write, the method branches to step S20, where it determines whether the target file is sensitive. If not, the method branches to step S60, where it ends. But if it is, the method proceeds to step S30, where it checks the shared state 25 to determine if the untrusted active connection count is greater than zero. If so, the method branches to step S40, where the requested access to the target file is blocked. But if the untrusted active connection count is zero, the method proceeds to step S50, where access is allowed and a flag is set in the shared state 25, indicating that the requesting application process 10 has accessed sensitive data. Then, the method proceeds to step S60 and ends at step S60.

[0059] Figure 3 A method is shown that may be implemented by the network filter driver software 19 (e.g., by a custom WFP callout 26) when a connection establishment request 30 is received requesting to form a connection with a target endpoint 6. At step T0, the method begins. At step T10, the method determines whether the request is to open a new connection or to close an existing connection. If the latter, the method branches to step T15, where it is determined whether the target endpoint 6 is trustworthy. If so, the method branches to step T35, where it ends. However, if not, the method proceeds to step T25, where the count of active untrusted connections is decremented in the shared state 25. The method then proceeds to step T35, where it ends.

[0060] On the other hand, if the request 30 is a request to establish a new connection, the method branches from step T10 to step T20, where it determines whether the target endpoint 6 can be trusted. If so, the method branches to step T60, where the connection is allowed. But if not, the method proceeds to step T30, where it is determined in step 320 whether the requesting application process 10 has ever read or modified sensitive files. If so, the method branches to step T40, where the requested connection is blocked (not established). But if not, the method proceeds to step T50, where the count of active untrusted connections is incremented in the shared state 25. The method then proceeds to step T60, where it ends.

[0061] In some examples, any computer-readable medium accessible to the computer system 2 is used to provide computer executable instructions. Computer-readable media include, for example, computer storage media, such as memory and communication media. Computer storage media include volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing information such as computer-readable instructions, data structures, program modules, etc. Computer storage media include, but are not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), persistent memory, phase change memory, flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, cassettes, tapes, disk storage, shingled disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information for access by a computing device. In contrast, communication media can embody computer-readable instructions, data structures, program modules, etc. in modulated data signals (such as carrier waves) or other transmission mechanisms. As defined herein, computer storage media do not include communication media. Therefore, computer storage media should not be interpreted as propagating signals themselves. A propagating signal itself is not an example of a computer storage medium. Although the computer storage medium (memory 5) is shown within computer system 2, those skilled in the art will appreciate that in some examples, the storage device is remotely distributed or located and accessed via a network or other communication link (e.g., using a communication interface).

[0062] It should be appreciated that the above embodiments are disclosed as examples only.More generally, a system according to any of the following claims may be provided.

[0063] Statement 1: A computer system, comprising: a processing device including at least one processor, a memory including at least one storage device, and a network interface including at least one network interface device; the memory storage is arranged to run on the processing device. The operating system software includes file system driver software and network filter driver software; the file system driver software is configured to receive a file access request, which indicates that an application process running on the processing device is requesting to access a target file in a file system of the computer system's memory; the network filter driver software is configured to receive a connection establishment request, which indicates that an application process running on the processing device is requesting to establish a connection with a target endpoint through a network via a network interface of the computer system; and one or both of the following: a) the file system driver software is configured to authorize or deny the file access request based on status information from the network filter driver software, or b) the network filter driver software is configured to authorize or deny the connection establishment request based on status information from the file system driver software.

[0064] Statement 2: The computer system of statement 1, wherein at least a) the file system driver software is configured to authorize or deny a request to access a target file based on status information from a network filter driver.

[0065] Statement 3: A computer system according to statement 2, wherein the file system driver software is configured to determine whether a target file is sensitive, and status information from a network filter driver includes an indication of whether any untrusted network connections are currently active via a network interface, the file system software being configured to execute according to the following rule a): If the target file is sensitive, then the file access request will be authorized on the condition that the status information from the network filter driver software indicates that there are no active connections to untrusted endpoints.

[0066] Statement 4: The computer system of statement 1, wherein at least b) the network filter driver software is configured to authorize or deny the connection establishment request based on status information from the file system driver.

[0067] Statement 5: A computer system according to statement 4, wherein the network filter driver software is configured to determine whether the target endpoint is trusted, and the status information from the file system driver software includes an indication of whether the application process has ever read from or written to a sensitive file, and the network filter driver software is configured to execute b) according to the following rule: if the target connection is untrusted, the connection establishment request will be authorized only if the status information from the file system driver software indicates that the application process has never read from or written to a sensitive file, but otherwise the file access request will be denied.

[0068] Statement 6: A computer system according to any of the preceding statements, wherein both a) and b).

[0069] Statement 7: A computer system according to statement 6, wherein: the file system driver software is configured to determine whether the target file is sensitive, and the status information from the network filter driver software includes an indication indicating whether any untrusted network connection is currently active via the network interface, and the file system software is configured to execute according to the following rules: a): if the target file is sensitive, the file access request will only be authorized if the status information from the network filter driver software indicates that there is no active connection to the untrusted endpoint; and the network filter driver software is configured to determine whether the target endpoint is trusted, and the status information from the file system driver software includes an indication indicating whether the application process has ever read from or written to a sensitive file, and the network filter driver software is configured to execute according to the following rules: b): if the target connection is untrusted, the connection establishment request will only be authorized if the status information from the file system driver software indicates that the application process has never read from or written to a sensitive file, but otherwise the connection establishment request will be rejected.

[0070] Statement 8: A computer system according to any of the preceding statements, wherein: an operating system includes a file system driver manager, the file system driver manager is configured to receive a file access request from an application process via a system call layer of the operating system, and each of the one or more file system drivers included by the file system driver software is configured to receive the file access request by subscribing to the file access request for the target file forwarded from the file system driver manager; and the operating system includes a network filter driver manager, the network filter driver manager is configured to receive a connection establishment request from the application process via the system call layer, and each of the one or more network filter drivers included by the network filter driver software is configured to receive the connection establishment request by subscribing to the connection establishment request for the target endpoint forwarded from the network filter driver manager.

[0071] Statement 9: A computer system according to statement 8, wherein: one or more file system drivers include a first file system driver and a second file system driver, the second file system driver is configured to perform authorization or denial of file access requests, and the first file system driver is configured to access a memory and thereby perform file access requests when authorized; and one or more network filter drivers include a first network filter driver and a second network filter driver, the second network filter driver is configured to perform authorization or denial of connection establishment requests based on status information from file system driver software, and the first network filter driver is configured to implement one or more other network filter rules for authorizing or denying connection establishment requests or blocking existing connections based on information other than the status of the file system driver software.

[0072] Statement 10: A computer system according to statement 9, wherein the first file system driver includes a first minifilter, the second file system driver includes a second minifilter, the file system driver manager includes a minifilter manager, the first network filter driver includes a first WFP callout driver, the second network filter driver includes a second WFP callout driver, and the network filter driver manager includes a WFP engine.

[0073] Statement 11: A computer system according to any one of statements 1 to 8, wherein one or both of the following: the file system driver software includes a single integrated file system driver, the single integrated file system driver is configured to perform authorization or denial of file access requests and access memory, and thereby perform access requests when authorized; and the network interface driver software includes a single integrated network filter driver, the single integrated network filter driver is configured to perform authorization or denial of connection establishment requests based on status information from the file system software, and implements one or more other network filter rules for authorizing or denying connection establishment requests or blocking existing connections based on information other than the status of the file system driver software.

[0074] According to another aspect disclosed herein, a method of operating a computer system is provided, the computer system including the operation of any of the aforementioned stated file system driver software and / or network filter driver software.

[0075] According to another aspect disclosed herein, there is provided a computer program embodied on a computer-readable storage device, the computer program comprising an operating system, the operating system comprising any of the aforementioned stated file system driver software and network filter driver software.

[0076] Other variations or use cases may become apparent to those skilled in the art once given the disclosure herein.The scope of the present disclosure is not limited by the above-described embodiments but only by the appended claims.

Claims

1. A computer system comprising: A processing device comprising at least one processor, a memory comprising at least one memory device, and A network interface, comprising at least one network interface device; the memory storing operating system software arranged to run on the processing device, the operating system software including file system driver software and network filter driver software; The file system driver software is configured to receive a file access request indicating that an application process running on the processing device is requesting access to a target file in a file system of the memory of the computer system; The network filter driver software is configured to receive a connection establishment request indicating that the application process running on the processing device is requesting to establish a connection with a target endpoint over a network via the network interface of the computer system; as well as One or both of the following: a) the file system driver software is configured to authorize or deny the file access request based on status information from the network filter driver software, and b) The network filter driver software is configured to authorize or deny the connection establishment request based on status information from the file system driver software.

2. The computer system of claim 1, wherein at least a) the file system driver software is configured to authorize or deny the request to access the target file based on the status information from the network filter driver software.

3. A computer system according to claim 2, wherein the file system driver software is configured to determine whether the target file is sensitive, and the status information from the network filter driver software includes an indication indicating whether any untrusted network connections are currently active via the network interface, and the file system software is configured to perform a) according to the following rule: if the target file is sensitive, then the file access request will be authorized on the condition that the status information from the network filter driver software indicates that there are no active connections to untrusted endpoints.

4. The computer system of claim 1, wherein at least b) the network filter driver software is configured to authorize or deny the connection establishment request based on the status information from the file system driver.

5. A computer system according to claim 4, wherein the network filter driver software is configured to determine whether the target endpoint is trusted, and the status information from the file system driver software includes an indication indicating whether the application process has ever read from or written to a sensitive file, and the network filter driver software is configured to perform b) according to the following rule: if the target connection is untrusted, then the connection establishment request will be authorized only if the status information from the file system driver software indicates that the application process has never read from or written to a sensitive file, but otherwise the file access request will be denied.

6. A computer system according to any preceding claim, wherein both a) and b).

7. The computer system of claim 6, wherein: the file system driver software being configured to determine whether the target file is sensitive, and the status information from the network filter driver software includes an indication of whether any untrusted network connections are currently active via the network interface, the file system software being configured to perform according to the following rules a): if the target file is sensitive, then the file access request will only be authorized if the status information from the network filter driver software indicates that there are no active connections to untrusted endpoints; as well as The network filter driver software is configured to determine whether the target endpoint is trusted, and the status information from the file system driver software includes an indication indicating whether the application process has ever read from or written to a sensitive file, and the network filter driver software is configured to execute b) according to the following rule: if the target connection is untrusted, the connection establishment request will be authorized only if the status information from the file system driver software indicates that the application process has never read from or written to a sensitive file, but otherwise the connection establishment request will be rejected.

8. A computer system according to any preceding claim, wherein: The operating system includes a file system driver manager, the file system driver manager is configured to receive the file access request from the application process via a system call layer of the operating system, and each of the one or more file system drivers included by the file system driver software is configured to receive the file access request by subscribing to the file access request for the target file forwarded from the file system driver manager; as well as The operating system includes a network filter driver manager, which is configured to receive the connection establishment request from the application process via the system call layer, and each of the one or more network filter drivers included by the network filter driver software is configured to receive the connection establishment request by subscribing to the connection establishment request for the target endpoint forwarded from the network filter driver manager.

9. The computer system according to claim 8, wherein: the one or more file system drivers including a first file system driver and a second file system driver, the second file system driver being configured to perform the authorization or the denial of the file access request, and the first file system driver being configured to access the memory and thereby perform the file access request when authorized; as well as The one or more network filter drivers include a first network filter driver and a second network filter driver, the second network filter driver being configured to perform the authorization or the rejection of the connection establishment request based on the status information from the file system driver software, and the first network filter driver being configured to implement one or more other network filter rules for authorizing or rejecting the connection establishment request or blocking an existing connection based on information other than the status of the file system driver software.

10. The computer system of claim 9, wherein the first file system driver comprises a first minifilter, the second file system driver comprises a second minifilter, the file system driver manager comprises a minifilter manager, the first network filter driver comprises a first WFP callout driver, the second network filter driver comprises a second WFP callout driver, and the network filter driver manager comprises a WFP engine.

11. The computer system according to any one of claims 1 to 8, wherein one or both of the following: The file system driver software includes a single integrated file system driver configured to perform the authorization or the denial of the file access request and access the memory and thereby perform the access request when authorized; and The network interface driver software includes a single integrated network filter driver, which is configured to perform the authorization or the rejection of the connection establishment request based on the status information from the file system software, and implement one or more other network filter rules for authorizing or rejecting the connection establishment request or blocking an existing connection based on information other than the status of the file system driver software.

12. A method of operating a computer system, the computer system comprising a processing device, the processing device comprising at least one processor, a memory comprising at least one memory device, and a network interface comprising at least one interface device; The method comprises: receiving, by file system driver software, a file access request indicating that an application process running on the processing device is requesting access to a target file in a file system of the memory of the computer system; receiving, by network filter driver software, a connection establishment request indicating that the application process running on the processing device is requesting to establish a connection with a target endpoint over a network via the network interface of the computer system; and One or both of the following: a) determining by the file system driver software whether to authorize or deny the file access request based on status information from the network filter driver software, or b) The network filter driver software determines whether to authorize or reject the connection establishment request based on the status information from the file system driver software.

13. The method of claim 12, wherein the method comprises both a) and b).

14. The method according to claim 13, comprising: determining whether the target file is sensitive, wherein the status information from the network filter driver software includes an indication of whether any untrusted network connections are currently active via the network interface, and wherein a) is performed according to the following rule: if the target file is sensitive, then the file access request will only be authorized if the status information from the network filter driver software indicates that there are no active connections to untrusted endpoints; as well as determining whether the target endpoint is trusted, wherein the status information from the file system driver software includes an indication of whether the application process has ever read from or written to a sensitive file, and b) performed according to the following rule: if the target connection is untrusted, then the connection establishment request will be authorized only if the status information from the file system driver software indicates that the application process has never read from or written to a sensitive file, otherwise the connection establishment request will be rejected.

15. A computer program embodied on a computer readable storage and configured to perform the method according to claim 12, 13 or 14 when run on one or more processors.

Images