Filter Driver Shadow Copy Access Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Shadow copies in computing systems pose a security risk by allowing unauthorized access to sensitive information, as malicious users can exploit them to elevate privileges and access protected data, bypassing existing security measures.
Innovation Solution
Implementing a method that monitors and prevents unauthorized access to shadow copies using a filter driver that intercepts requests and enforces a shadow copy access policy, restricting access based on user accounts, group membership, file paths, and time, and preventing both unauthorized access to existing shadow copies and their creation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If shadow copies are enabled for backup purposes, then data backup capability is improved, but security vulnerability increases allowing unauthorized access to sensitive information
Solution Approach 1:
A filter driver is introduced as an intermediary component between shadow copy operations and the file system. This filter driver monitors and controls access to shadow copies, blocking unauthorized access attempts while permitting legitimate backup operations. The filter driver acts as a security gatekeeper that evaluates each shadow copy request against established security policies before allowing or denying access.
Solution Approach 2:
The system preemptively blocks unauthorized shadow copy operations before they can compromise security. By implementing access control policies that prevent malicious users from creating or accessing shadow copies of sensitive files, the system neutralizes potential security threats before they can exploit the shadow copy mechanism for privilege escalation or data theft.
2Object-affected harmful factors
If shadow copy access is restricted through filtering, then security is improved, but system complexity increases due to additional monitoring layers
Solution Approach 1:
The filter driver implements self-service by automatically evaluating shadow copy requests against pre-configured security policies without requiring manual intervention. The system autonomously determines whether to allow or block each shadow copy operation based on the user's credentials, the target file's sensitivity, and the current security context, thereby managing complexity through automation rather than manual control mechanisms.
Solution Approach 2:
The filter driver serves multiple functions within a single component: it monitors shadow copy requests, evaluates user credentials, enforces security policies, and blocks unauthorized access. By consolidating these security functions into one universal filter driver rather than implementing separate mechanisms for each function, the system reduces overall complexity while maintaining comprehensive security protection.
Data Source
AI summary
A method is described. The method includes monitoring a request to access one or more files via a shadow copy on a computing device. The method also includes preventing unauthorized access to the shadow copy based on a shadow copy access policy. Monitoring the request to access a shadow copy may include using a filter driver to intercept a request for a previously created shadow copy or a request to create a shadow copy.