Restricting applications and users that can make persistent changes to artifacts
View Patent ↗Applications and users can be restricted from making persistent changes to artifacts on a protected volume. In Windows-based systems that include a file-based write filter, a policy-based write filter can be positioned below the file-based write filter and can examine any write requests that target artifacts of a protected volume and are not redirected by the file-based write filter. The policy-based write filter can examine the write requests against any applicable policies to determine whether the write requests should be allowed to proceed. If the policy-based write filter determines that a write request is not allowed by policy, it can fail the write request to thereby prevent the targeted artifact from being updated in the protected volume.
1. A method for preventing an artifact on a protected volume from being modified, the method comprising:
loading a policy-based write filter in a device stack corresponding to a protected volume, the policy-based write filter being loaded below a file-based write filter, the policy-based write filter being associated with policies that define whether artifacts on the protected volume should be allowed to be modified;
receiving, at the policy-based write filter, a first request to modify a first artifact on the protected volume, the policy-based write filter receiving the first request after the file-based write filter has allowed the first request;
evaluating the first request against the policies to determine that the policies do not permit the first artifact to be modified by the first request; and
preventing the first request from modifying the first artifact even though the file-based write filter allowed the first request.
2. The method of claim 1 , wherein the file-based write filter is the File-Based Write Filter of the Windows Embedded operating system.
3. The method of claim 1 , wherein the policies define which applications can modify a particular artifact.
4. The method of claim 1 , wherein the policies define which users can modify a particular artifact.
5. The method of claim 1 , wherein the policies define which users can use which applications to modify a particular artifact.
6. The method of claim 1 , wherein the file-based write filter is configured to selectively redirect requests to modify artifacts of the protected volume to an overlay.
7. The method of claim 1 , wherein determining that the policies do not permit the first artifact to be modified by the first request comprises one of:
determining that a source of the first request is a first application and the policies do not allow the first application to be used to modify the first artifact;
determining that the first request is associated with a first user and the policies do not allow the first user to modify the first artifact; and
determining that a source of the first request is a first application that is executed by a first user and the policies do not allow the first user to employ the first application to modify the first artifact.
8. The method of claim 1 , wherein determining that the policies do not permit the first artifact to be modified by the first request comprises one of:
determining that a source of the first request is a first application and the policies do not allow the first application to be used to modify the first artifact;
determining that the first request is associated with a first user and the policies do not allow the first user to modify the first artifact; or
determining that a source of the first request is a first application that is executed by a first user and the policies do not allow the first user to employ the first application to modify the first artifact.
9. The method of claim 1 , further comprising:
adding an entry to a log that indicates that the first request was prevented from modifying the first artifact.
10. The method of claim 1 , wherein the first request comprises an input/output request packet (IRP) and wherein preventing the first request from modifying the first artifact comprises completing the IRP with a failure status.
11. The method of claim 1 , further comprising:
receiving, at the policy-based write filter, a second request to modify a second artifact on the protected volume;
evaluating the second request against the policies to determine that the policies permit the second artifact to be modified by the second request; and
allowing the second request to complete.
12. The method of claim 11 , further comprising:
adding an entry to a log that indicates that the second request was allowed.
13. The method of claim 12 , wherein the entry identifies one or both of an application or a user associated with the second request.
14. One or more computer storage media storing computer-executable instructions which when executed implement a policy-based write filter that is configured to be loaded in a device stack corresponding to a protected volume below a file-based write filter and that is further configured to perform the following:
receive requests to modify artifacts on the protected volume after the requests have been evaluated and allowed by the file-based write filter;
evaluate the requests against policies; and
for each request, either block or allow the request based on the evaluation, wherein blocking the request comprises preventing the artifact to which the request is direct from being modified even though the file-based write filter approved the request.
15. The computer storage media of claim 14 , wherein the policy-based write filter only allows a request to modify an artifact on the protected volume when the policies indicate that an application that is the source of the request is allowed to modify the artifact.
16. The computer storage media of claim 14 , wherein the policy-based write filter only allows a request to modify an artifact on the protected volume when the policies indicate that a user that is associated with the request is allowed to modify the artifact.
17. The computer storage media of claim 14 , wherein the policy-based write filter only allows a request to modify an artifact on the protected volume when the policies indicate that a user that is associated with the request is allowed to use an application that is the source of the request to modify the artifact.
18. The computer storage media of claim 14 , wherein the request is an input/output request packet (IRP) and wherein blocking the request comprises completing the IRP with a failure status.
19. A method for augmenting protection of a volume comprising:
loading a policy-based write filter under a file-based write filter in a device stack pertaining to the volume; and
for any input/output request packet (IRP) that represents a modification to an artifact on the volume and that the file-based write filter evaluated and did not redirect to an overlay, evaluating the IRP against policies such that when the policies indicate that the artifact is allowed to be modified, the policy-based write filter allows the IRP to be passed down the device stack, whereas, when the policies indicate that the artifact is not allowed to be modified, the policy-based write filter fails the IRP.
20. The method of claim 19 , wherein the policies indicate that an artifact is allowed to be modified by identifying one or more users that are allowed to use one or more applications to modify the artifact.