Implementing a security solution using a layering system
A security solution can be implemented using a layering system. By using a layering system, any changes that are made to a computing system can be isolated within a separate write layer. Due to this isolation, the changes, which may even be malicious, can be evaluated without fear that the resources in other layers will be negatively affected. In this way, even security threats that are still unknown to antivirus solutions (so-called zero-day attacks) can be prevented from harming the system.
1. A method, implemented on a computing device on which at least one frozen layer and a write layer are mounted and in which a layering driver causes resources on the at least one frozen layer and the write layer to appear as if the resources were stored in a same storage location, for providing a security solution using a layering system, the method comprising:
receiving, at the layering driver, an input/output (“I/O”) request;
accessing layer metadata of the at least one frozen layer to identify to which frozen layer the I/O request is directed, each frozen layer and the write layer comprising a separately mounted storage area;
determining that the I/O request pertains to an attempt to create or update a resource on the identified frozen layer;
modifying the I/O request to direct the I/O request to the write layer such that the resource is added to the write layer, which is a separately mounted storage area from each frozen layer, rather than being added to or updated on the identified frozen layer; and
while the resource is stored on the write layer, evaluating the resource to determine whether the resource is malicious.
2. The method of claim 1 , further comprising:
after determining that the resource is not malicious, converting the write layer into a frozen layer;
creating a new write layer; and
modifying subsequent I/O requests that attempt to create or update a resource on any frozen layer to direct the subsequent I/O requests to the new write layer.
3. The method of claim 1 , further comprising:
after one or more resources have been stored on the new write layer, converting the new write layer into a frozen layer; and
merging the frozen layer that was converted front the new write layer with the frozen layer that was converted from the write layer such that resources that were stored on the write layer and the new write layer are stored on a single frozen layer.
4. The method of claim 1 , wherein the write layer is created in response to determining that the I/O request pertains to an attempt to create a resource on the identified frozen layer thereby causing the resource to be stored in isolation on the separately mounted storage area.
5. The method of claim 1 , wherein modifying the I/O request comprises changing a drive letter of the I/O request to match a drive letter assigned to the write layer.
6. The method of claim 1 , wherein modifying the I/O request includes adding layer metadata to the write layer to reflect the presence of the resource on the write layer.
7. The method of claim 1 , wherein the I/O request is a request to update a resource that is stored on the identified frozen layer such that the updated resource is stored on the write layer.
8. The method of claim 7 , further comprising:
modifying layer metadata of one or both of the write layer or the identified frozen layer to cause the layering driver to access the updated resource on the write layer rather than the resource on the identified frozen layer.
9. The method of claim 1 , further comprising:
converting the write layer into a first frozen write layer; and
creating a second write layer that is a separately mounted storage area from the first frozen write layer and from each of the at least one frozen layers.
10. The method of claim 9 , further comprising:
converting the second write layer into a second frozen write layer; and
merging the first and second frozen write layers.
11. The method of claim 10 , wherein merging the first and second frozen write layers comprises combining resources and metadata from the first and second frozen write layers into a same frozen write layer, the same frozen write layer comprising a separately mounted storage area from each of the at least one frozen layers.
12. The method of claim 1 ,
wherein evaluating the resource to determine whether the resource is malicious comprises evaluating the resource while the resource is executed.
13. The method of claim 1 , further comprising:
receiving, at the layering driver, a second I/O request;
accessing layer metadata of the write layer to determine that the I/O request is directed to the resource stored on the write layer; and
passing the I/O request to the write layer to allow the resource to be accessed.
14. One or more computer storage media storing computer executable instructions which when executed by one or more processors of a computing device perform a method for providing a security solution using a layering system that includes at least one frozen layer, a write layer and a layering driver that causes resources on the at least one frozen layer and the write layer to appear as if the resources were stored in a same storage location, the method comprising:
receiving, at the layering driver, an input/output (“I/O”) request;
accessing layer metadata of the at least one frozen layer to identify to which frozen layer the I/O request is directed, each frozen layer and the write layer comprising a separately mounted storage area;
determining that the I/O request pertains to an attempt to create or update a resource on the identified frozen layer;
modifying the I/O request to direct the I/O request to the write layer such that the resource is added to the write layer, which is a separately mounted storage area from each frozen layer, rather than being added to or updated on the identified frozen layer;
while the resource is stored on the write layer, evaluating the resource to determine whether the resource is malicious;
upon determining that the resource is malicious, discarding the write layer.
15. The computer storage media of claim 14 , wherein the method further comprises:
converting one of the at least one frozen layers into a second write layer.
16. The computer storage media of claim 15 , wherein the method further comprises:
receiving at the layering driver, a second I/O request;
accessing the layer metadata to identify to which frozen layer the second I/O request is directed;
determining that the second I/O request pertains to an attempt to create or update a second resource on the identified frozen layer;
modifying the second I/O request to direct the second I/O request to the second write layer such that the second resource is added to the second write layer.
17. The computer storage media of claim 15 , wherein the method further comprises:
converting the second write layer into a frozen write layer; and
redirecting any I/O requests that would modify or create a resource on the frozen write layer to a third write layer, the third write layer comprising a separate mounted storage area.
18. A computing device for implementing a security solution using a layering system, comprising:
one or more processors;
one or more frozen layers, each of which is a separately mounted storage area on the computing device;
a write layer that is a separately mounted storage area on the computing device from each of the one or more frozen layers; and
computer storage media storing a layering driver and a layering security system, wherein, when the one or more processors execute the layering driver, the layering driver performs the following:
receive I/O requests;
determine to which of the one or more frozen layers or the write layer each I/O request is directed; and
determine that an I/O request is directed to a frozen layer by evaluating layer metadata of the frozen layer;
upon determining that the I/O request is directed to the frozen layer and pertains to an attempt to update or add a resource on the frozen layer, modify the I/O request to cause the I/O request to be directed to the write layer; and
wherein, when the one or more processors execute the layering security system, the layering security system evaluates one or more resources stored on the write layer to determine whether any of the one or more resources stored on the write layer is malicious; and
wherein the layering driver converts the write layer into a frozen layer and creates a new write layer when the layering security system determines that no resources stored on the write layer are malicious.
19. The computing device of claim 18 , wherein modifying the I/O request to cause the I/O request to be directed to the write layer comprises updating layer metadata of the write layer to reflect that the resource is stored on the write layer.
20. The computing device of claim 18 , wherein the layering driver is also configured to merge two frozen layers by combining resources stored on the two frozen layers onto a single frozen layer.