IP Library Granted Patent US 10,831,712
Granted Patent B2
US 10,831,712 · App. 15/993,515 · Granted Nov 10, 2020

Identifying and correlating physical devices across disconnected device stacks

Inventors: Cameron Gutman (Redmond, WA); Aaron LeMasters (New York, NY)
Assignee: CrowdStrike, Inc.
G06F16/1734G06F9/44G06F9/4403G06F21/10H04L41/0809H04L63/10H04W12/08G06F2213/0042
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,831,712
App. No.
15/993,515
Granted
Nov 10, 2020
Kind
B2
Abstract

Drivers in different functional paths can use different types of identifiers for the same hardware device, such that the drivers may not be able to natively coordinate their actions related to the hardware device due to incompatible identifier types. However, a driver at a file system layer of one functional path can obtain a volume Physical Device Object (PDO) identifier at a volume layer and find a disk PDO identifier at a disk layer that is associated with the same device number. The driver can also find a parent device instance identifier from the disk PDO identifier, and use the parent device instance identifier as a plug-and-play (PnP) identifier for the hardware device during communications with a second driver in a PnP functional path.

Claims (47)

1. A method, comprising:

determining, by a driver at a file system layer in a storage functional path associated with a mass storage device connected to a computing device, a volume Physical Device Object (PDO) identifier used at a volume layer of the storage functional path;

determining, by the driver, a device number associated with the volume PDO identifier;

determining, by the driver, a disk PDO identifier used at a disk layer of the storage functional path that is also associated with the device number;

obtaining, by the driver, a parent device instance identifier associated with the disk PDO identifier;

mapping, by the driver, a file system identifier for the mass storage device used by the driver in the storage functional path to the parent device instance identifier; and

using, by the driver, the parent device instance identifier as a plug-and-play (PnP) identifier for the mass storage device during communications with a second driver in a PnP functional path.

2. The method of claim 1 , wherein obtaining the parent device instance identifier associated with the disk PDO identifier comprises using an operating system routine to directly retrieve the parent device instance identifier based on the disk PDO identifier.

3. The method of claim 1 , wherein the mass storage device is a Universal Serial Bus (USB) device and wherein obtaining the parent device instance identifier associated with the disk PDO identifier comprises:

retrieving, by the driver, a device instance identifier associated with the disk PDO identifier;

identifying, by the driver, the mass storage device among one or more enumerated USB devices connected to the computing device based on the mass storage device also being associated with the device instance identifier; and

using, by the driver, a USB device PDO identifier associated with the mass storage device as the parent device instance identifier.

4. The method of claim 3 , wherein the device instance identifier is an identifier assigned to the mass storage device in the PnP functional path.

5. The method of claim 1 , wherein the driver is a device control file system minifilter configured to selectively block individual read or write requests associated with the mass storage device based on information about a blocking policy retrieved from the second driver in response to the communications.

6. The method of claim 5 , wherein the blocking policy identifies the mass storage device based on the PnP identifier.

7. The method of claim 5 , wherein the second driver is a device control PnP driver configured to selectively block the mass storage device from being mounted at system boot or when the mass storage device is plugged in to the computing device based on the blocking policy.

8. The method of claim 1 , wherein the mass storage device is a Universal Serial Bus (USB) device.

9. A method, comprising:

determining, by a driver at a first layer of a functional path associated with a hardware device connected to a computing device, a first Physical Device Object (PDO) identifier used at a second layer of the functional path;

determining, by the driver, a device number associated with the first PDO identifier;

determining, by the driver, a second PDO identifier at a third layer of the functional path that is also associated with the device number;

obtaining, by the driver, a parent device instance identifier associated with the second PDO identifier;

mapping, by the driver, a first identifier for the hardware device used by the driver in the functional path to the parent device instance identifier; and

using, by the driver, the parent device instance identifier as a second identifier for the hardware device during communications with a second driver in a different functional path.

10. The method of claim 9 , wherein obtaining the parent device instance identifier associated with the second PDO identifier comprises using an operating system routine to directly retrieve the parent device instance identifier based on the second PDO identifier.

11. The method of claim 9 , wherein the hardware device is a Universal Serial Bus (USB) device and wherein obtaining the parent device instance identifier associated with the second PDO identifier comprises:

retrieving, by the driver, a device instance identifier associated with the second PDO identifier;

identifying, by the driver, the hardware device among one or more enumerated USB devices connected to the computing device based on the hardware device also being associated with the device instance identifier; and

using, by the driver, a USB device PDO identifier associated with the hardware device as the parent device instance identifier.

12. The method of claim 11 , wherein the device instance identifier is an identifier assigned to the hardware device in the different functional path.

13. The method of claim 9 , wherein the functional path is a storage functional path and the different functional path is a Plug-and-Play (PnP) functional path.

14. The method of claim 9 , wherein the functional path is a networking functional path and the different functional path is a Plug-and-Play (PnP) functional path.

15. One or more non-transitory computer-readable media storing computer-executable instructions for a driver that, when executed by one or more processors of a computing device, cause the one or more processors to perform operations comprising:

determining, at a file system layer in a storage functional path associated with a mass storage device connected to the computing device, a volume Physical Device Object (PDO) identifier used at a volume layer of the storage functional path;

determining a device number associated with the volume PDO identifier;

determining a disk PDO identifier used at a disk layer of the storage functional path that is also associated with the device number;

obtaining a parent device instance identifier associated with the disk PDO identifier;

mapping a file system identifier for the mass storage device used at the file system layer in the storage functional path to the parent device instance identifier; and

using the parent device instance identifier as a plug-and-play (PnP) identifier for the mass storage device during communications between the driver at the file system layer and a second driver in a PnP functional path.

16. The non-transitory computer-readable media of claim 15 , wherein obtaining the parent device instance identifier associated with the disk PDO identifier comprises using an operating system routine to directly retrieve the parent device instance identifier based on the disk PDO identifier.

17. The non-transitory computer-readable media of claim 15 , wherein the mass storage device is a Universal Serial Bus (USB) device and wherein obtaining the parent device instance identifier associated with the disk PDO identifier comprises:

retrieving a device instance identifier associated with the disk PDO identifier;

identifying the mass storage device among one or more enumerated USB devices connected to the computing device based on the mass storage device also being associated with the device instance identifier; and

using a USB device PDO identifier associated with the mass storage device as the parent device instance identifier.

18. The non-transitory computer-readable media of claim 15 , wherein the driver is a device control file system minifilter configured to selectively block individual read or write requests associated with the mass storage device based on information about a blocking policy retrieved from the second driver in response to the communications.

19. The non-transitory computer-readable media of claim 18 , wherein the blocking policy identifies the mass storage device based on the PnP identifier.

20. The non-transitory computer-readable media of claim 18 , wherein the second driver is a device control PnP driver configured to selectively block the mass storage device from being mounted at system boot or when the mass storage device is plugged in to the computing device based on the blocking policy.

Assignments (4)
RELEASE OF SECURITY INTEREST Recorded Jan 6, 2026
From: FIRST-CITIZENS BANK & TRUST COMPANY
To: CROWDSTRIKE HOLDINGS, INC.; CROWDSTRIKE, INC.
Reel/Frame 074202/0710 →
PATENT SECURITY AGREEMENT Recorded Jan 5, 2021
From: CROWDSTRIKE HOLDINGS, INC.; CROWDSTRIKE, INC.
To: SILICON VALLEY BANK, AS ADMINISTRATIVE AGENT
Reel/Frame 054899/0848 →
SECURITY INTEREST Recorded Apr 22, 2019
From: CROWDSTRIKE HOLDINGS, INC.; CROWDSTRIKE, INC.; CROWDSTRIKE SERVICES, INC.
To: SILICON VALLEY BANK, AS ADMINISTRATIVE AGENT
Reel/Frame 048953/0205 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded May 30, 2018
From: GUTMAN, CAMERON; LEMASTERS, AARON
To: CROWDSTRIKE, INC.
Reel/Frame 045941/0419 →
Continuity (2)
Provisional Application 62663911 · Apr 27, 2018
Related Publication 20190332690A1 · Oct 31, 2019