IP Library Granted Patent US 11,423,186
Granted Patent B2
US 11,423,186 · App. 16/248,315 · Granted Aug 23, 2022

Verified inter-module communications interface

Inventors: Aaron LeMasters (New York, NY); Ion-Alexandru Ionescu (Seattle, WA)
Assignee: CrowdStrike, Inc.
G06F21/85G06F13/4068G06F21/54
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,423,186
App. No.
16/248,315
Granted
Aug 23, 2022
Kind
B2
Abstract

Some example computing systems herein include two modules, e.g., drivers. A first can instantiate an interface associated with a service routine, receive, by the service routine, a verification message; and send, in response, a confirmation message via the interface. A second can locate the interface; open a handle to the interface; send the verification message via the handle, the verification message identifying at least an interface type or a version; and receive, via the handle, the confirmation message associated with the verification message. In some examples, the first driver is a Plug and Play driver. In some examples, the first module can receive, by the service routine, a command associated with the interface; determine that the command is a valid command based at least in part on stored command data; and send, via the interface, a response to the command.

Claims (85)

1. A system comprising:

at least one processing unit; and

at least one tangible non-transitory computer-readable storage medium comprising first processor-executable instructions and second processor-executable instructions,

wherein the first processor-executable instructions are executable by the at least one processing unit to cause the at least one processing unit to perform first operations, associated with a first driver, comprising:

instantiating an interface associated with communications between the first driver and a second driver, wherein the interface is associated with a service routine that is configured to be invoked based on a message being sent across the interface;

receiving, via the service routine, a verification message; and

sending, in response to receiving the verification message, a confirmation message associated with the verification message via the interface, and

wherein the second processor-executable instructions are executable by the at least one processing unit to cause the at least one processing unit to perform second operations, associated with the second driver, comprising:

locating the interface;

opening a handle to the interface;

sending the verification message via the handle, the verification message identifying at least an interface type or an interface version; and

receiving, via the handle, the confirmation message associated with the verification message.

2. The system according to claim 1 , wherein:

the first operations further comprise:

receiving, via the service routine, a command;

determining that the command is a valid command, based at least in part on stored command data associated with the interface; and

sending, via the interface, a response to the command, and

the second operations further comprise:

sending, via the handle, the command; and

receiving, via the handle, the response to the command.

3. The system according to claim 1 , wherein locating the interface comprises:

determining that the interface is not available; and

in response to determining that the interface is not available, awaiting availability of the interface.

4. The system according to claim 1 , wherein at least one of the first driver or the second driver is a Plug and Play (PnP) driver.

5. A computer-implemented method comprising:

locating, by a second driver, an interface associated with a first driver, wherein the interface is associated with a service routine that is configured to be invoked based on a message being sent across the interface;

opening, by the second driver, a handle to the interface;

sending, by the second driver, a verification message to the first driver via the handle, wherein the verification message indicates at least one of an interface type or an interface version; and

receiving, by the second driver and from the first driver via the handle, a confirmation message associated with the verification message.

6. The computer-implemented method according to claim 5 , wherein the locating comprises:

determining, by the second driver, that the interface is not available; and

in response to determining that the interface is not available, awaiting availability of the interface.

7. The computer-implemented method according to claim 6 , wherein the awaiting comprises at least one of:

awaiting, in a user mode, a notification from an operating system indicating that the interface is available, or

awaiting, in a kernel mode, a call to a registered notification callback.

8. The computer-implemented method according to claim 6 , wherein the verification message is sent by an interaction thread and the awaiting comprises at least, in a kernel mode:

spawning a notification thread;

in the interaction thread, waiting for a synchronization signal;

registering a notification callback to be executed in the notification thread when the interface becomes available; and

providing, by the notification callback, the synchronization signal.

9. The computer-implemented method according to claim 5 , wherein:

the locating is performed by an interaction thread,

the interaction thread runs in a mode selected from a group consisting of a user mode and a kernel mode, and

the locating comprises enumerating active device instances associated with a predetermined interface identifier at least partly by calling an enumeration routine associated with the mode of the interaction thread.

10. The computer-implemented method according to claim 5 , further comprising, after the opening and before the sending:

retrieving a persistent property associated with the interface; and

determining that the persistent property matches one of the interface type or the interface version.

11. The computer-implemented method according to claim 5 , wherein:

the interface supports an input/output control (ioctl) operation, and

the verification message is sent via the ioctl operation.

12. The computer-implemented method according to claim 5 , wherein:

the sending is performed by an interaction thread running in a kernel mode,

the interface supports a query-functions operation,

the computer-implemented method further comprises retrieving from the interface, using the query-functions operation, a reference to the service routine, and

sending the verification message comprises invoking the service routine.

13. The computer-implemented method according to claim 5 , further comprising:

opening a system-local communications interface using a predetermined name of the system-local communications interface,

wherein the verification message is sent via the system-local communications interface.

14. At least one tangible non-transitory computer-readable storage medium comprising processor-executable instructions associated with a first driver that, when executed by at least one processing unit, cause the at least one processing unit to perform operations, associated with the first driver, comprising:

instantiating an interface associated with the first driver, wherein the interface is associated with a service routine configured to be invoked based on a message being sent across the interface;

receiving, via the service routine and from a second driver, a verification message associated with the interface;

sending, in response to receiving the verification message, a confirmation message to the second driver via the interface;

receiving, via the service routine, a command associated with the interface;

determining that the command is a valid command based at least in part on stored command data associated with the interface; and

sending, via the interface, a response to the command.

15. The at least one tangible non-transitory computer-readable storage medium according to claim 14 , the operations further comprising:

binding the service routine to a driver object associated with the interface,

wherein instantiating the interface is performed after binding the service routine.

16. The at least one tangible non-transitory computer-readable storage medium according to claim 14 , the operations further comprising, before sending the confirmation message:

extracting, from the verification message, at least one of an interface type or an interface version; and

determining that the at least one of the interface type or the interface version is supported by the interface, based at least in part on stored capability data associated with the first driver.

17. The at least one tangible non-transitory computer-readable storage medium according to claim 14 , the operations further comprising:

locating a handler for the command based at least in part on the stored command data;

determining that the command is the valid command in response to the locating of the handler;

invoking the handler;

receiving, from the handler, response data; and

determining the response comprising the response data.

18. The at least one tangible non-transitory computer-readable storage medium according to claim 14 , wherein instantiating the interface comprises passing a predetermined interface identifier of the interface to an operating-system (OS) routine.

19. The at least one tangible non-transitory computer-readable storage medium according to claim 14 , wherein:

the interface supports an input/output control (ioctl) operation, and

at least one of sending the confirmation message or receiving the command is performed via the ioctl operation.

20. The at least one tangible non-transitory computer-readable storage medium according to claim 14 , wherein:

the interface supports a query-functions operation associated with the service routine and

the operations further comprise, in response to invocation by a caller of the query-functions operation, providing to the caller a reference to the service routine.

21. The at least one tangible non-transitory computer-readable storage medium according to claim 14 , wherein the interface comprises a system-local communications interface associated with a predetermined name.

Assignments (4)
RELEASE OF SECURITY INTEREST Recorded Jan 6, 2026
From: FIRST-CITIZENS BANK & TRUST COMPANY
To: CROWDSTRIKE HOLDINGS, INC.; CROWDSTRIKE, INC.
Reel/Frame 074202/0710 →
PATENT SECURITY AGREEMENT Recorded Jan 5, 2021
From: CROWDSTRIKE HOLDINGS, INC.; CROWDSTRIKE, INC.
To: SILICON VALLEY BANK, AS ADMINISTRATIVE AGENT
Reel/Frame 054899/0848 →
SECURITY INTEREST Recorded Apr 22, 2019
From: CROWDSTRIKE HOLDINGS, INC.; CROWDSTRIKE, INC.; CROWDSTRIKE SERVICES, INC.
To: SILICON VALLEY BANK, AS ADMINISTRATIVE AGENT
Reel/Frame 048953/0205 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 29, 2019
From: LEMASTERS, AARON; IONESCU, ION-ALEXANDRU
To: CROWDSTRIKE, INC.
Reel/Frame 048163/0089 →
Continuity (2)
Provisional Application 62618413 · Jan 17, 2018
Related Publication 20190220627A1 · Jul 18, 2019