Dynamic adjustment of the file format to identify untrusted files
View Patent ↗Approaches for an operating system to ascertain whether files stored its file system have been deemed trustworthy. When an operating system receives a request to perform an operation involving a file that is stored within the file system maintained by the operating system, the operating system requests the file from a driver. In turn, the driver consults a set of trust data to identify whether the file has been previously deemed trustworthy. Upon the driver determining that the file has been deemed trustworthy, the driver provides the file to the operating system in a first format. On the other hand, upon the driver determining that the file has not been deemed trustworthy, the driver provides the file to the operating system in a second format that is different than the first format. Advantageously, the file is stored in a single format in the file system.
1. A non-transitory computer-readable storage medium that stores one or more sequences of instructions, which when executed by one or more processors, causes:
informing an operating system as to whether one or more files have been deemed trustworthy by performing:
in response to an operating system receiving a request to perform an operation involving a file that is stored within a file system maintained by the operating system, the operating system requesting the file from a driver;
upon the driver being requested by the operating system, the driver consulting a set of trust data to identify whether the file has been deemed trustworthy;
upon the driver determining that the file has been deemed trustworthy by consulting the trust data, the driver providing the file to the operating system in a first format; and
upon the driver determining that the file has not been deemed trustworthy by consulting the trust data, the driver providing the file to the operating system in a second format that is different than the first format,
wherein the file is stored in a single format in the file system.
2. The non-transitory computer-readable storage medium of claim 1 , wherein the single format is said first format.
3. The non-transitory computer-readable storage medium of claim 1 , wherein the second format is a different name of the file than the first format.
4. The non-transitory computer-readable storage medium of claim 1 , wherein the second format is a different or additional file extension for the file than present in the first format.
5. The non-transitory computer-readable storage medium of claim 1 , wherein the trust data is stored within the same folder of the file system as the file.
6. The non-transitory computer-readable storage medium of claim 1 , wherein all trust data associated with files stored in the file system is stored in a single location.
7. The non-transitory computer-readable storage medium of claim 1 , wherein the operation is a move operation, a copy operation, or a rename operation, and wherein the trust data identifies the same state of trustworthiness for the file, and any copy thereof, after the performance of the operation as the trust data did before the performance of the operation.
8. The non-transitory computer-readable storage medium of claim 1 , wherein the operating system is a host operating system that executes on a computer system, and wherein the trust data is updatable by the host operating system but not any virtual machines that are instantiated on the computer system.
9. An apparatus, comprising:
one or more processors; and
one or more non-transitory computer-readable storage mediums storing one or more sequences of instructions, which when executed, causes:
informing an operating system as to whether one or more files have been deemed trustworthy by performing:
in response to an operating system receiving a request to perform an operation involving a file that is stored within a file system maintained by the operating system, the operating system requesting the file from a driver;
upon the driver being requested by the operating system, the driver consulting a set of trust data to identify whether the file has been deemed trustworthy;
upon the driver determining that the file has been deemed trustworthy by consulting the trust data, the driver providing the file to the operating system in a first format; and
upon the driver determining that the file has not been deemed trustworthy by consulting the trust data, the driver providing the file to the operating system in a second format that is different than the first format,
wherein the file is stored in a single format in the file system.
10. The apparatus of claim 9 , wherein the single format is said first format.
11. The apparatus of claim 9 , wherein the second format is a different name of the file than the first format.
12. The apparatus of claim 9 , wherein the second format is a different or additional file extension for the file than present in the first format.
13. The apparatus of claim 9 , wherein the trust data is stored within the same folder of the file system as the file.
14. The apparatus of claim 9 , wherein all trust data associated with files stored in the file system is stored in a single location.
15. The apparatus of claim 9 , wherein the operation is a move operation, a copy operation, or a rename operation, and wherein the trust data identifies the same state of trustworthiness for the file, and any copy thereof, after the performance of the operation as the trust data did before the performance of the operation.
16. The apparatus of claim 9 , wherein the operating system is a host operating system that executes on a computer system, and wherein the trust data is updatable by the host operating system but not any virtual machines that are instantiated on the computer system.
17. A method, comprising:
informing an operating system as to whether one or more files have been deemed trustworthy by performing:
in response to an operating system receiving a request to perform an operation involving a file that is stored within a file system maintained by the operating system, the operating system requesting the file from a driver;
upon the driver being requested by the operating system, the driver consulting a set of trust data to identify whether the file has been deemed trustworthy;
upon the driver determining that the file has been deemed trustworthy by consulting the trust data, the driver providing the file to the operating system in a first format; and
upon the driver determining that the file has not been deemed trustworthy by consulting the trust data, the driver providing the file to the operating system in a second format that is different than the first format,
wherein the file is stored in a single format in the file system.
18. The method of claim 17 , wherein the single format is said first format.
19. The method of claim 17 , wherein the second format is (a) a different name of the file than the first format or (b) a different or additional file extension for the file than present in the first format.
20. The method of claim 17 , wherein the operating system is a host operating system that executes on a computer system, and wherein the trust data is updatable by the host operating system but not any virtual machines that are instantiated on the computer system.