Efficiently authenticating an application during I/O request handling
A security client can efficiently authenticate an application during I/O request handling by maintaining a white list that identifies processes that have been created for authenticated applications. The security client can register to be notified when a process is being created. When such a notification is received, the security client can authenticate the application for which the process is being created and then add an entry to the white list that includes the process identifier of the process being created. Then, when the process subsequently generates I/O requests, the security client can use the white list to quickly determine that the process pertains to an authenticated application and allow the I/O requests to modify protected artifacts.
1. A method, performed by a security filter of a security client, for efficiently authenticating an application during I/O request handling, the method comprising:
registering to be notified when a process is created;
in response to a notification that a first process is being created, identifying an application for which the first process is being created;
obtaining a precomputed hash for the application;
computing a hash for the application and comparing the computed hash to the precomputed hash;
upon determining that the computed hash matches the precomputed hash, storing an identifier of the first process that was created for the application to thereby enable the identifier of the first process to be used to authenticate the application when the application subsequently initiates I/O requests in the context of the first process;
in response to receiving an I/O request that was initiated by the application in the context of the first process, authenticating the application by determining that a process identifier associated with the I/O request matches the stored identifier of the first process; and
in response to a notification that the first process is being terminated, discarding the stored identifier of the first process.
2. The method of claim 1 , wherein identifying the application for which the process is being created comprises obtaining a name of the application's executable.
3. The method of claim 1 , wherein identifying the application for which the process is being created comprises obtaining a full path of the application's executable.
4. The method of claim 1 , wherein obtaining the precomputed hash for the application comprises sending a name of the application's executable to a security service, wherein the security service uses the name to access a policy in which the name is mapped to the precomputed hash.
5. The method of claim 1 , wherein the precomputed hash for the application is a precomputed hash of the application's executable and wherein computing the hash for the application comprises computing a hash of the application's executable for which the first process is being created.
6. The method of claim 1 , further comprising:
in conjunction with authenticating the application, accessing a policy to determine whether a current user is authorized to use the application to modify an artifact that is the target of the I/O request.
7. The method of claim 1 , wherein the I/O request is an IRP_MJ_CREATE request.
8. The method of claim 1 , further comprising:
maintaining a white list that identifies process identifiers of running applications that have been authenticated, wherein storing the identifier of the first process comprises storing the identifier of the first process in the white list.
9. The method of claim 8 , wherein authenticating the application by determining that the process identifier associated with the I/O request matches the stored identifier of the first process comprises accessing the white list.
10. A method, performed by a security filter of a security client, for efficiently authenticating an application during I/O request handling, the method comprising:
registering a first callback routine to be called when a process is being created;
registering a second callback routine for handling I/O requests;
in response to the first callback routine being called when a first process is being created, performing the following within the first callback routine:
identifying a name of an application's executable for which the first process is being created;
sending the name to a security service;
receiving, from the security service, a precomputed hash that is associated with the name;
calculating a hash of the application's executable;
comparing the calculated hash to the precomputed hash; and
in response to determining that the calculated hash matches the precomputed hash, storing an identifier of the first process in a white list to thereby enable the identifier of the first process to be used to authenticate the application when the application subsequently initiates I/O requests in the context of the first process;
in response to the second callback routine being called to handle a first I/O request, performing the following within the second callback routine:
obtaining a process identifier associated with the first I/O request; and
accessing the white list to determine that the process identifier associated with the first I/O request matches the stored identifier of the first process; and
in response to determining that the process identifier associated with the first I/O request matches the stored identifier of the first process, allowing the first I/O request; and
in response to a notification that the first process is being terminated, discarding the stored identifier of the first process.
11. The method of claim 10 , wherein sending the name to the security service includes sending a full path to the application's executable.
12. The method of claim 10 , further comprising:
in response to the second callback routine being called to handle a second I/O request, performing the following within the second callback routine:
obtaining a process identifier associated with the second I/O request;
accessing the white list to determine that the process identifier associated with the second I/O request is not included in the white list; and
associating context with the second I/O request, the context indicating that modifications to a file targeted by the second I/O request should be blocked.
13. The method of claim 10 , further comprising:
in response to the second callback routine being called to handle the first I/O request, also performing the following within the second callback routine:
querying the security service to determine whether a current user can modify a file targeted by the first I/O request.
14. The method of claim 10 , wherein the second callback routine is registered for handling IRP_MJ_CREATE requests, and wherein the first I/O request is an IRP_MJ_CREATE request.
15. One or more computer storage media storing computer executable instructions which when executed implement a method for efficiently authenticating an application during I/O request handling, the method comprising:
registering to be notified when a process is created;
in response to a notification that a first process is being created, identifying an application for which the first process is being created;
obtaining a precomputed hash for the application;
computing a hash for the application and comparing the computed hash to the precomputed hash;
upon determining that the computed hash matches the precomputed hash, storing an identifier of the first process that was created for the application to thereby enable the identifier of the first process to be used to authenticate the application when the application subsequently initiates I/O requests in the context of the first process;
in response to receiving an I/O request that was initiated by the application in the context of the first process, authenticating the application by determining that a process identifier associated with the I/O request matches the stored identifier of the first process; and
in response to a notification that the first process is being terminated, discarding the stored identifier of the first process.
16. The computer storage media of claim 15 , wherein identifying the application for which the process is being created comprises obtaining a name of the application's executable.
17. The computer storage media of claim 15 , wherein identifying the application for which the process is being created comprises obtaining a full path of the application's executable.
18. The computer storage media of claim 15 , wherein obtaining the precomputed hash for the application comprises sending a name of the application's executable to a security service, wherein the security service uses the name to access a policy in which the name is mapped to the precomputed hash.
19. The computer storage media of claim 15 , wherein the precomputed hash for the application is a precomputed hash of the application's executable and wherein computing the hash for the application comprises computing a hash of the application's executable for which the first process is being created.