Systems and methods for protecting a folder from unauthorized file modification
A method for protecting a folder from unauthorized file modification may include receiving, from a remote device, a modify request for a target file in a folder and determining whether the folder is a protected folder. The method may also include determining, in response to determining the folder is the protected folder, whether the remote device is a trusted host. The method may further include allowing, in response to determining that the remote device is the trusted host, the modify request for the target file.
1. A computer-implemented method for protecting a folder from unauthorized file modification, the method being performed by a computing device comprising at least one processor, the method comprising:
receiving, by a minifilter of the computing device from an authorized process on a remote device, a modify request for a target file in a local folder, wherein the modify request includes a filename for the target file, the filename includes a hash that corresponds to a key maintained by a lockdown server, the modify request is intercepted by a minifilter of the remote device, and the authorized process is authorized by the lockdown server through the minifilter of the remote device;
detecting, locally by the computing device, a marker file in the local folder;
determining, locally by the computing device in response to detecting the marker file, that the local folder is tho a protected folder;
determining, by the computing device, in response to determining the local folder is the protected folder and based at least on the hash in the filename being confirmed with the lockdown server, whether the remote device is a trusted host;
removing, in response to determining that the remote device is the trusted host, the hash from the filename to locally identify the target file; and
allowing, by the computing device in response to determining that the remote device is the trusted host, the modify request for the target file.
2. The method of claim 1 , wherein the modify request includes a network address of the remote device for identifying the remote device and determining whether the remote device is the trusted host is based on the network address.
3. The method of claim 1 , wherein receiving the modify request further comprises intercepting, by the minifilter of the computing device, the modify request.
4. The method of claim 3 , wherein the minifilter communicates with the lockdown server to determine whether the remote device is the trusted host.
5. The method of claim 1 , wherein determining whether the remote device is the trusted host further comprises confirming, by contacting the remote device, the modify request.
6. The method of claim 1 , wherein determining whether the remote device is the trusted device comprises acknowledging, by the minifilter of the remote device to the minifilter of the computing device, that the modify request is from the remote device.
7. The method of claim 1 , further comprising, before receiving, by the computing device from the process on the remote device, the modify request:
detecting, by the minifilter of the remote device, the modify request for the target file in the local folder of the computing device from the process on the remote device;
detecting, by the remote device by accessing the computing device, a marker file in the local folder of the computing device;
determining, by the remote device in response to detecting the marker file, that the target file is in a protected folder;
determining, by the remote device in response to determining that the target file is in the protected folder, that the process is an authorized process for accessing the target file in the local folder of the computing device; and
sending, by the remote device in response to determining that the process is the authorized process, the modify request to the computing device.
8. A system for protecting a folder from unauthorized file modification, the system comprising:
a receive module, stored in memory, for receiving, by a minifilter of the system from an authorized process on a remote device that the remote device has determined is authorized by a lockdown server to access a target file in a local folder of the system, a modify request for the target file in the local folder, wherein the modify request includes a filename for the target file, the filename includes a hash that corresponds to a key maintained by the lockdown server, and the modify request is intercepted by a minifilter of the remote device to authorize the authorized process;
a folder module, stored in the memory, for determining locally that the local folder is the protected folder by detecting a marker file in the local folder;
a host validation module, stored in the memory, for determining, in response to determining the local folder is the protected folder and based at least on the hash in the filename being confirmed with the lockdown server, whether the remote device is a trusted host and in response to determining that the remote device is the trusted host, remove the hash from the filename to locally identify the target file;
a modify module, stored in the memory, for allowing, in response to determining that the remote device is the trusted host, the modify request for the target file; and
at least one physical processor that executes the receive module, the folder module, the host validation module, and the modify module.
9. The system of claim 8 , wherein the modify request includes a network address of the remote device to identify the remote device and determining whether the remote device is the trusted host is based on the network address.
10. The system of claim 8 ,
wherein receiving the modify request further comprises intercepting, by the minifilter of the system, the modify request.
11. The system of claim 10 , wherein the minifilter communicates with a lockdown server to determine whether the remote device is the trusted host.
12. The system of claim 8 , wherein the host validation module is configured to determine whether the remote device is the trusted device by acknowledging, by the minifilter of the remote device to the minifilter of the system, that the modify request is from the remote device.
13. The system of claim 8 , wherein the remote device is configured to:
detect, by the minifilter of the remote device, the modify request for the target file in the protected folder from the process on the remote device;
detect, by the remote device by accessing the system, a marker file in the local folder of the system;
determine, by the remote device in response to detecting the marker file, that the target file is in the protected folder;
determine, by the remote device in response to determining that the target file is in the protected folder, that the process is an authorized process for accessing the target file in the local folder of the system; and
send, by the remote device in response to determining that the process is the authorized process, the modify request to the system.
14. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing system including a remote device and a computing device, cause the computing system to:
receive, by a minifilter of the computing device from an authorized process on the remote device, a modify request for a target file in a local folder of the computing device, wherein the modify request includes a filename for the target file, the filename includes a hash that corresponds to a key maintained by a lockdown server, the modify request is intercepted by a minifilter of the remote device, and the authorized process is authorized by the lockdown server through the minifilter of the remote device;
detect, locally by the computing device, a marker file in the local folder;
determine, locally by the computing device in response to detecting the marker file, that the local folder is a protected folder;
determine, by the computing device in response to determining the local folder is the protected folder and based at least on the hash in the filename being confirmed with the lockdown server, whether the remote device is a trusted host;
remove, in response to determining that the remote device is the trusted host, the hash from the filename to locally identify the target file; and
allow, by the computing device in response to determining that the remote device is the trusted host, the modify request for the target file.
15. The non-transitory computer-readable medium of claim 14 , wherein receiving the modify request further comprises intercepting, by the minifilter of the computing system, the modify request.
16. The non-transitory computer-readable medium of claim 14 , further comprising instructions for:
detecting, by the minifilter of the remote device before the computing device receives the modify request, the modify request for the target file in the local folder of the computing device from the process on the remote device;
detecting, by the remote device by accessing the computing device, the marker file in the local folder of the computing device;
determining, by the remote device in response to detecting the marker file, that the target file is in a protected folder;
determining, by the remote device in response to determining that the target file is in the protected folder, that the process is an authorized process for accessing the target file in the local folder of the computing device; and
sending, by the remote device in response to determining that the process is the authorized process, the modify request to the computing device.