10 results about "Filter driver" patented technology

Provided is a computer agent and method to detect and prevent ransomware attacks early without losing customer data, without polluting the customer's file system or consuming any space on a storage device. The computer agent installs a kernel mode layered file system driver which is attached to encryption level group of a filter manager. With this layered file system filter driver design, it creates virtual canary files in directories which appear like normal files to any user or application though these files will not reside on disk. These virtual canary files are spread as baits across the file system to detect and prevent any malicious attack from any process or application. So that the Virtual Canary Files do not consume a large amount of memory, internal structures representing Virtual Canary Files are placed in virtual memory, but actual contents of the Virtual Canary Files do not reside in virtual memory. Other embodiments disclosed.

This invention relates to the field of data encryption, specifically disclosing a method and system for preventing data leakage on enterprise terminals based on kernel encryption and file redirection. The method includes the following steps: S1. At the terminal layer, a secure terminal is deployed, and the C-Y drives of the terminal hard drive are fully encrypted using the VeraCrypt kernel driver. An isolated, unencrypted Z drive is created as a dedicated external network drive. S2. On the secure terminal, kernel-level permission control is executed through the loaded MiniFilter file system filtering driver, including: intercepting and verifying software installation and execution requests, and only allowing software within the whitelist issued by the policy server to start. This invention significantly improves the security of enterprise terminal data by deploying hard drive encryption and partition creation technology based on the VeraCrypt kernel driver on the enterprise terminal. Full encryption of some partitions on the terminal hard drive and the creation of an isolated dedicated external network drive effectively isolate sensitive internal network data from potentially risky external network environments.

The invention relates to the technical field of data security, in particular to a USB flash disk encryption implementation system and method. The system comprises a data partition management module used for forming a common data partition and a hidden encryption partition; the transparent encryption and decryption module is realized based on a file system filter driver and is used for encrypting and decrypting the hidden encryption partition data in real time; the identity authentication module is used for verifying user identity information and dynamically mounting the hidden encryption partition after the user identity information passes the verification; and the security isolation module is used for establishing a security data transmission channel and monitoring an access state, and automatically unloading the hidden encryption partition when a condition is met. The method comprises the steps of partition creation, request interception, identity verification, dynamic mounting, real-time encryption and decryption and automatic unloading. According to the invention, security level-to-level management and transparent encryption and decryption of U disk data are realized, and the problems of poor compatibility and complex operation in the prior art are solved.

The present application belongs to the technical field of computer data security, and particularly relates to a method for protecting specified paths and files from tampering, which comprises the following steps: registering a relevant main function code callback routine in a Windows file system filtering driver framework, and constructing an interception layer for intercepting I / O requests; constructing an access control list with PID and file object path as key values in a kernel non-paging memory; synchronously extracting PID and target file complete path in the callback routine, and judging according to system processes, exemption lists, and protection paths / types, and rejecting the request if it does not meet the conditions; and achieving dynamic management of strategies by establishing a control channel. The present application solves the problem of strategy failure caused by volume path changes by hiding file persistent volume IDs in the system; adopts hierarchical data structures and concurrent synchronization mechanisms to ensure efficient queries and little impact on disk IO performance; and supports multi-dimensional fine control with the help of multi-layer control switches and scenario-based templates.

The invention relates to a data management and control method and device, computer equipment, a storage medium and a program product. Receiving a first management and control strategy sent by the zero-trust agent through the management and control service, determining a device type according to a device identifier of an inserted device when the filter driver service monitors that the computer device has a device insertion event, and storing the storage device when the device type is the storage device. And performing data management and control according to the first management and control strategy under the condition that the equipment identifier is not located in the first equipment identifier set and the second equipment identifier set. According to the embodiment of the invention, the management and control service and the filter driver service are deployed in the computer equipment with the zero-trust agent, and the zero-trust identity authentication characteristic is combined, so that the user can be quickly identified, the first management and control strategy and the management and control object of the first management and control strategy are positioned more accurately, the safety operation efficiency is effectively improved, and the false alarm noise point is reduced.

A method includes receiving, by a container storage interface (CSI) filter driver executing on a node of a container-based cluster managed by a container orchestrator, a request to perform a storage system-based control plane operation associated with a containerized application executing on the node; determining, by the CSI filter driver, that the storage system-based control plane operation is to be performed with respect to a legacy storage system configured to store data for one or more non-containerized applications; and generating, by the CSI filter driver based on the determining that the storage system-based control plane operation is to be performed with respect to the legacy storage system, a command configured to direct a storage interface driver associated with the legacy storage system to perform the storage system-based control plane operation.

The invention provides an off-line file automatic encryption synchronization method and system, and the method comprises the steps: intercepting an I / O request through a kernel mode file filter driver, and initializing monitoring when a write release event is captured; performing stability judgment based on a sliding window on the monitored object, calculating a discrete difference fluctuation ratio, and confirming that writing is complete after convergence; calculating the local information entropy of the file to generate a weighted feature sensing fingerprint, and performing duplicate removal through Hamming distance comparison; generating a dynamic key based on the system epoch time to perform streaming encryption; only uploading the missing ciphertext data block according to a missing bitmap fed back by the server; and the server side decrypts the restored file and generates a chained hash log for solidification storage. According to the method, the file writing state can be accurately judged, data damage is prevented, and efficient duplicate removal, incremental transmission and whole-process credible traceability are achieved.

The invention belongs to the technical field of computer data security, and particularly relates to a method for protecting a specified path and a file from being tampered, which comprises the following steps of: registering a related main function code callback routine in a Windows file system filter drive framework, and constructing an interception layer for intercepting an I / O (Input / Output) request; constructing an access control list taking PID and file object paths as key values in a kernel non-paging memory; pID and a complete path of a target file are synchronously extracted in a callback routine, hierarchical judgment is performed according to a system process, an exemption list and a protection path / type, and a request is rejected if a condition is not met; through establishing a control channel, strategy dynamic management is realized. According to the method, the file persistence volume ID is hidden through the system, so that the problem of strategy failure caused by volume path change is solved; a hierarchical data structure and a concurrent synchronization mechanism are adopted to ensure efficient query and small influence on disk IO performance; by means of a multi-layer control switch and a scenarized template, multi-dimensional fine control is supported.

An information management system can detect instances in which data is being stored in a non-standard file path and can alert the user of the client computing device, modify the storage policy to include the non-standard file path, and / or initiate a secondary copy operation to prevent data loss of the data stored in the non-standard file path. For example, a client computing device may execute a filter driver that monitors interactions with files in the file system. The filter driver can identify any non-standard file paths not subject to a storage policy that include files in which interactions occurred. For a non-standard file path, the filter driver can determine whether the frequency of interaction with files in the non-standard file path satisfies a threshold frequency. If the threshold is satisfied, then the filter driver may determine that the files should be subject to the storage policy and take appropriate action.

The invention discloses a block-level additional backup method and system supporting file exclusion, and relates to the technical field of data backup and recovery, and the method comprises the following steps: deploying and initializing a file system filter driver; configuring an exclusion file rule, and creating an initial exclusion bitmap; dynamically monitoring the change of the storage space of the excluded file; in cooperation with a block-level backup driver, backup data filtering is achieved; according to the method, a file system sensing layer is introduced into a block-level backup process, data blocks corresponding to files located in an exclusion list can be accurately recognized before and after backup, the data blocks are skipped in a backup data set, and the data blocks in the backup data set are subjected to consistency verification and exclusion bitmap maintenance. According to the method, transmission and storage of invalid data are eliminated from the source, particularly for data which are written frequently but have no reserved value, the reduction effect of the backup data volume is particularly remarkable, and consistency processing is synchronously carried out on file system metadata while specified file data blocks are eliminated.