Securing access to functionality of a file-based write filter

1. A method, implemented by a policy-based filter that executes on a computing device as an intermediary between a file-based write filter and a write filter application programming interface (API) that applications employ to access functionality of the file-based write filter, for securing access to functionality of the file-based write filter, the method comprising:

in response to an application employing the write filter API to submit a request to add an artifact to an exclusion list of the file-based write filter to thereby cause the file-based write filter to allow Input/Output (I/O) requests that target the artifact to be directed to a protected volume, intercepting, by the policy-based filter, the request to add the artifact to the exclusion list before the request to add the artifact to the exclusion list is passed to the file-based write filter;

evaluating, by the policy-based filter, the request to add the artifact to the exclusion list against policies; and

when the policies indicate that the request to add the artifact to the exclusion list is not authorized, blocking, by the policy-based filter, the request to add the artifact to the exclusion list so that the request to add the artifact to the exclusion list is not passed to the file-based write filter thereby causing the file-based write filter to redirect I/O requests that target the artifact so that the I/O requests are not directed to the protected volume, whereas when the policies indicate that the request to add the artifact to the exclusion list is authorized, allowing, by the policy-based filter, the request to add the artifact to the exclusion list so that the request to add the artifact to the exclusion list is passed to the file-based write filter thereby causing the file-based write filter to allow I/O requests that target the artifact to be directed to the protected volume.

2. The method of claim 1 , wherein intercepting the request to add the artifact to the exclusion list comprises hooking a call to a function of the write filter API.

3. The method of claim 1 , wherein intercepting the request to add the artifact to the exclusion list comprises employing a filter driver to receive an input/output control (IOCTL) targeting the file-based write filter that was generated in response to the application employing the write filter API to submit the request to add the artifact to the exclusion list.

4. The method of claim 1 , wherein evaluating the request to add the artifact to the exclusion list against policies comprises determining whether the application is permitted to add exclusions to the exclusion list.

5. The method of claim 1 , wherein evaluating the request to add the artifact to the exclusion list against policies comprises determining whether a current user is permitted to add exclusions to the exclusion list.

6. The method of claim 1 , wherein evaluating the request to add the artifact to the exclusion list against policies comprises determining whether an access window is open.

7. The method of claim 6 , wherein determining whether an access window is open comprises communicating with an agent.

8. The method of claim 7 , wherein the agent communicates with a server-based component to determine whether an administrator has opened an access window.

9. The method of claim 1 , further comprising:

intercepting, by the policy-based filter, a request to persist an artifact stored in an overlay to the protected volume before the request to persist the artifact stored in the overlay to the protected volume is passed to the file-based write filter;

evaluating, by the policy-based filter, the request to persist the artifact stored in the overlay to the protected volume against policies; and

when the policies indicate that the request to persist the artifact stored in the overlay to the protected volume is not authorized, blocking, by the policy-based filter, the request to persist the artifact stored in the overlay to the protected volume so that the request to persist the artifact stored in the overlay to the protected volume is not passed to the file-based write filter thereby causing the file-based write filter to retain the artifact in the overlay and to continue redirecting I/O requests that target the artifact so that the I/O requests are directed to the overlay rather than to the protected volume, whereas when the policies indicate that the request to persist the artifact stored in the overlay to the protected volume is authorized, allowing, by the policy-based filter, the request to persist the artifact stored in the overlay to the protected volume so that the request to persist the artifact stored in the overlay to the protected volume is passed to the file-based write filter thereby causing the file-based write filter to persist the artifact to the protected volume.

10. The method of claim 1 , further comprising:

intercepting, by the policy-based filter, a request to disable the file-based write filter before the request to disable the file-based write filter is passed to the file-based write filter;

evaluating, by the policy-based filter, the request to disable the file-based write filter against policies; and

when the policies indicate that the request to disable the file-based write filter is not authorized, blocking, by the policy-based filter, the request to disable the file-based write filter so that the request to disable the file-based write filter is not passed to the file-based write filter thereby causing the file-based write filter to remain enabled, whereas when the policies indicate that the request to disable the file-based write filter is authorized, allowing, by the policy-based filter, the request to disable the file-based write filter so that the request to disable the file-based write filter is passed to the file-based write filter thereby causing the file-based write filter to be disabled.

11. The method of claim 1 , further comprising:

intercepting, by the policy-based filter, a request to disable write filtering for a particular volume before the request to disable write filtering for the particular volume is passed to the file-based write filter;

evaluating, by the policy-based filter, the request to disable write filtering for the particular volume against policies; and

when the policies indicate that the request to disable write filtering for the particular volume is not authorized, blocking, by the policy-based filter, the request to disable write filtering for the particular volume so that the request to disable write filtering for the particular volume is not passed to the file-based write filter thereby causing the file-based write filter to continue performing write filtering for the particular volume, whereas when the policies indicate that the request to disable write filtering for the particular volume is authorized, allowing, by the policy-based filter, the request to disable write filtering for the particular volume so that the request to disable write filtering for the particular volume is passed to the file-based write filter thereby causing the file-based write filter to disable write filtering for the particular volume.

12. A method, implemented by a policy-based filter that executes on a computing device as an intermediary between a file-based write filter and a write filter application programming interface (API) that applications employ to access functionality of the file-based write filter, for securing access to functionality of the file-based write filter, the method comprising:

in response to an application employing the write filter API to submit a request to persist an artifact stored in an overlay to a protected volume, intercepting, by the policy-based filter, the request to persist the artifact stored in the overlay to the protected volume before the request to persist the artifact stored in the overlay to the protected volume is passed to the file-based write filter;

evaluating, by the policy-based filter, the request to persist the artifact stored in the overlay to the protected volume against policies; and

when the policies indicate that the request to persist the artifact stored in the overlay to the protected volume is not authorized, blocking, by the policy-based filter, the request to persist the artifact stored in the overlay to the protected volume so that the request to persist the artifact stored in the overlay to the protected volume is not passed to the file-based write filter thereby causing the file-based write filter to retain the artifact in the overlay and to continue redirecting Input/Output (I/O) requests that target the artifact so that the I/O requests are directed to the overlay rather than to the protected volume, whereas when the policies indicate that the request to persist the artifact stored in the overlay to the protected volume is authorized, allowing, by the policy-based filter, the request to persist the artifact stored in the overlay to the protected volume so that the request to persist the artifact stored in the overlay to the protected volume is passed to the file-based write filter thereby causing the file-based write filter to persist the artifact to the protected volume.

13. The method of claim 12 , wherein intercepting the request to persist the artifact stored in the overlay to the protected volume comprises one or both of:

hooking a call to a function of the write filter API; or

employing a filter driver to receive an input/output control (IOCTL) targeting the file-based write filter that was generated in response to the application employing the write filter API to submit the request to persist the artifact stored in the overlay to the protected volume.

14. The method of claim 12 , wherein evaluating the request to persist the artifact stored in the overlay to the protected volume against policies comprises one or more of:

determining whether the application is permitted to persist artifacts stored in the overlay to the protected volume;

determining whether a current user is permitted to persist artifacts stored in the overlay to the protected volume; or

determining whether an access window is open.

15. The method of claim 12 , wherein evaluating the request to persist the artifact stored in the overlay to the protected volume against policies comprises:

determining whether the application is permitted to persist artifacts stored in the overlay to the protected volume;

determining whether a current user is permitted to persist artifacts stored in the overlay to the protected volume; and

determining whether an access window is open.

16. A method, implemented by a policy-based filter that executes on a computing device as an intermediary between a file-based write filter and a write filter application programming interface (API) that applications employ to access functionality of the file-based write filter, for securing access to functionality of the file-based write filter, the method comprising:

in response to an application employing the write filter API to submit a request to disable the file-based write filter, intercepting, by the policy-based filter, the request to disable the file-based write filter before the request to disable the file-based write filter is passed to the file-based write filter;

evaluating, by the policy-based filter, the request to disable the file-based write filter against policies; and

when the policies indicate that the request to disable the file-based write filter is not authorized, blocking, by the policy-based filter, the request to disable the file-based write filter so that the request to disable the file-based write filter is not passed to the file-based write filter thereby causing the file-based write filter to remain enabled, whereas when the policies indicate that the request to disable the file-based write filter is authorized, allowing, by the policy-based filter, the request to disable the file-based write filter so that the request to disable the file-based write filter is passed to the file-based write filter thereby causing the file-based write filter to be disabled.

17. The method of claim 16 , wherein the request to disable the file-based write filter comprises a request to disable write filtering for a particular volume such that when the policies indicate that the request to disable write filtering for the particular volume is not authorized, the policy-based filter blocks the request to disable write filtering for the particular volume so that the request to disable write filtering for the particular volume is not passed to the file-based write filter thereby causing the file-based write filter to continue performing write filtering for the particular volume, whereas when the policies indicate that the request to disable write filtering for the particular volume is authorized, the policy-based filter allows the request to disable write filtering for the particular volume so that the request to disable write filtering for the particular volume is passed to the file-based write filter thereby causing the file-based write filter to disable write filtering for the particular volume.

18. The method of claim 16 , wherein intercepting the request to disable the file-based write filter comprises one or both of:

hooking a call to a function of the write filter API; or

employing a filter driver to receive an input/output control (IOCTL) targeting the file-based write filter that was generated in response to the application employing the write filter API to submit the request to disable the file-based write filter.

19. The method of claim 16 , wherein evaluating the request to disable the file-based write filter against policies comprises one or more of:

determining whether the application is permitted to disable the file-based write filter;

determining whether a current user is permitted to disable the file-based write filter; or

determining whether an access window is open.

20. The method of claim 16 , wherein evaluating the request to disable the file-based write filter against policies comprises:

determining whether the application is permitted to disable the file-based write filter;

determining whether a current user is permitted to disable the file-based write filter; and

determining whether an access window is open.