Security for computer systems
Filesystem driver software can receive a file access request indicating that an application process is requesting to access a target file in a filesystem, Network filter driver software can receive a connection establishment request indicating that the application process running on the processing apparatus is requesting to establish a connection over a network with a target endpoint. According to the present disclosure, one or both of: a) the filesystem driver software is configured to grant or deny the file access request in dependence on state information from the network filter driver software, and/or b) the network filter driver software is configured to grant or deny the connection establishment request in dependence on state information from the filesystem driver software.
1. A computer system comprising:
a processing apparatus comprising a processor,
memory comprising a memory device, and
a network interface comprising a network interface device;
the memory storing operating system software arranged to execute on the processing apparatus, the operating system software comprising instructions operative upon execution by the processing apparatus to:
receive, by filesystem driver software of the operating system software, a file access request indicating that an application process running on the processing apparatus is requesting access to a target file in a filesystem of the memory of the computer system;
receive, by the network filter driver software of the operating system software, a connection establishment request indicating that the application process running on the processing apparatus is requesting to establish a connection over a network with a target endpoint via the network interface of the computer system;
via a communication channel for sharing state between the filesystem driver software and the network filter driver software, accessing, by the filesystem driver software, network filter driver software state information; and
by the filesystem driver software, grant or deny the file access request in dependence on the network filter driver software state information.
2. The computer system of claim 1 , wherein the network filter driver software state information comprises an indication of whether there is any active network connection with an untrusted endpoint and the instructions are further operative, upon execution by the processing apparatus, to, by the filesystem driver software, determine whether the target file is designated as sensitive, wherein the granting or denying of the file access request is based on the network filter driver software state information according to a rule that: if the target file is designated as sensitive then the file access request will be denied unless the network filter driver software state information indicates no active connections to any untrusted endpoint.
3. The computer system of claim 1 , wherein the instructions are further operative upon execution by the processing apparatus to:
via the communication channel for sharing state between the filesystem driver software and the network filter driver software, accessing, by the network filter driver software, filesystem driver software state information; and
by the network filter driver software, grant or deny the connection establishment request in dependence on the filesystem driver software state information.
4. The computer system of claim 3 , wherein the filesystem driver software state information comprises an indication of whether the application process has ever read from or written to a file designated as sensitive and the instructions are further operative, upon execution by the processing apparatus, to, by the network filter driver software, determine whether the target endpoint is trusted and the network filter driver software is operative to perform the granting or denying of the connection establishment request based on the filesystem driver software state information according to a rule that: if the target endpoint is untrusted, the connection establishment request will be granted only on condition that the filesystem driver software state information indicates that the application process has never read from or written to any sensitive file, but otherwise the file access request will be denied.
5. The computer system of claim 1 , wherein the network filter driver software state information includes an indication of whether there is any active network connections with an untrusted endpoint, the filesystem driver software denying the file access request upon the network filter driver software state information indicating that an active network connection with any untrusted endpoint exists.
6. The computer system of claim 1 , wherein:
the network filter driver software receives filesystem driver software state information from the filesystem driver software via the communication channel;
the filesystem driver software state information comprises an indication of whether the application process has ever read from or written to any sensitive file; and
the network filter driver software denies the connection establishment request unless the target endpoint is trusted or the filesystem driver software state information indicates that the application process has never read from or written to any sensitive file.
7. The computer system of claim 1 , wherein:
the operating system software comprises a filesystem driver manager operative upon execution by the processing apparatus to receive the file access request from the application process via a system call layer of the operating system software, and each of one or more filesystem drivers comprised by the filesystem driver software is operative upon execution by the processing apparatus to receive the file access request by subscribing to have file access requests for the target file forwarded from the filesystem driver manager; and
the operating system software comprises a network filter driver manager operative upon execution by the processing apparatus to receive the connection establishment request from the application process via the system call layer, and each of one or more network filter drivers comprised by the network filter driver software is operative upon execution by the processing apparatus to receive the connection establishment request by subscribing to have connection establishment requests for the target endpoint forwarded from the network filter driver manager.
8. The computer system of claim 7 , wherein:
the one or more filesystem drivers comprises a first filesystem driver and a second filesystem driver, the second filesystem driver being operative upon execution by the processing apparatus to perform the granting or denying of the file access request, and the first filesystem driver being operative upon execution by the processing apparatus to access the memory and thereby execute the file access request when granted;
the one or more network filter drivers comprise a first network filter driver and a second network filter driver, the second network filter driver being operative upon execution by the processing apparatus to perform the granting or denying of the connection establishment request, and the first network filter driver being operative upon execution by the processing apparatus to implement one or more other network filter rules for granting or denying the connection establishment request or blocking an existing connection based on information other than a state of the filesystem driver software; and
the communication channel is established between the second filesystem driver and the second network filter driver.
9. The computer system of claim 8 , wherein the first filesystem driver comprises a first minifilter, the second filesystem driver comprises a second minifilter, the filesystem driver manager comprises a minifilter manager, the first network filter driver comprises a first operating system filtering platform callout driver, the second network filter driver comprises a second operating system filtering platform callout driver, and the network filter driver manager comprises an operating system filtering platform engine.
10. The computer system of claim 1 , wherein the network filter driver software comprises a single integrated network filter driver operative upon execution by the processing apparatus to perform the granting or denying of the connection establishment request based on filesystem driver software state information received by the network filter driver software via the communication channel, and to implement one or more other network filter rules for granting or denying the connection establishment request or blocking an existing connection based on information other than a state of the filesystem driver software.
11. A method of operating a computer system comprising a processing apparatus that includes at least one processor, memory, and a network interface, the method comprising:
receiving, by filesystem driver software of an operating system software, a file access request indicating that an application process running on the processing apparatus is requesting to access a target file in a filesystem of the memory of the computer system;
receiving, by network filter driver software of the operating system software, a connection establishment request indicating that the application process running on the processing apparatus is requesting establishment of a connection over a network with a target endpoint via the network interface of the computer system;
via a communication channel for sharing state between the filesystem driver software and the network filter driver software, accessing, by the network filter driver software, filesystem driver software state information; and
by the network filter driver software, granting or denying the connection establishment request in dependence on the filesystem driver software state information.
12. The method of claim 11 , further comprising, by the network filter driver software, determining whether the target endpoint is trusted, wherein;
the filesystem driver software state information comprises an indication of whether the application process has ever read from or written to any file designated as sensitive; and
the granting or denying of the connection establishment request is based on the filesystem driver software state information according to a rule that: if the target endpoint is untrusted, the connection establishment request will be denied unless the filesystem driver software state information indicates that the application process has never read from or written to any sensitive file.
13. The method of claim 11 , further comprising:
via the communication channel for sharing state between the filesystem driver software and the network filter driver software, accessing, by the filesystem driver software, network filter driver software state information; and
by the filesystem driver software, determining whether to grant or deny the file access request in dependence on the network filter driver software state information.
14. The method of claim 13 , wherein the network filter driver software state information comprises an indication of whether any untrusted network connections are currently active via the network interface, the method further comprising determining, by the filesystem driver software, whether the target file is designated as sensitive, wherein the granting or denying of the file access request by the filesystem driver software is based on the network filter driver software state information according to a rule that: if the target file is designated as sensitive then the file access request will be denied unless the network filter driver software state information indicates no active connections to any untrusted endpoint exist.
15. The method of claim 11 , wherein the filesystem driver software state information includes an indication of whether the application process has ever read from or written to any file designated as sensitive, the network filter driver software denying the connection establishment request upon the filesystem driver software state information indicating that the application process has ever read from or written to any file designated as sensitive.
16. The method of claim 11 , wherein:
the filesystem driver software receives network filter driver software state information from the network filter driver software via the communication channel;
the network filter driver software state information comprises an indication of whether any untrusted network connections are currently active via the network interface; and
the filesystem driver software denies the file access request unless the target file is not designated as sensitive or the network filter driver software state information indicates no active connections to any untrusted endpoint exists.
17. An operating system software for a computer system embodied on non-transitory computer-readable storage, the operating system software comprising filesystem driver software and network filter driver software, the computer operating system software being operative upon execution to:
receive, by the filesystem driver software of the operating system software, a file access request indicating that an application process running on the computer system is requesting to access a target file in a filesystem of a memory of the computer system;
receive, by the filesystem driver software and via a communication channel for sharing state between the filesystem driver software and the network filter driver software, network filter driver software state information from the network filter driver software;
receive, by the network filter driver software of the operating system software, a connection establishment request indicating that the application process running on the computer system is requesting to establish a connection over a network with a target endpoint via a network interface of the computer system;
receive, by the network filter driver software and via the communication channel, filesystem driver software state information from the filesystem software driver;
by the filesystem driver software, grant or deny the file access request in dependence on the network filter driver software state information; and
by the network filter driver software, grant or deny the connection establishment request in dependence on the filesystem driver software state information.
18. The operating system software of claim 17 , wherein the filesystem driver software is operative upon execution to determine whether the target file is designated as sensitive, and the network filter driver software state information comprises an indication of whether any untrusted network connections are currently active via the network interface, the filesystem driver software being operative to grant or deny the file access request according to a rule that if the target file is designated as sensitive then the file access request will be granted on condition that the network filter driver software state information indicates that no active connections to an untrusted endpoint exist.
19. The operating system software of claim 17 , wherein the network filter driver software is operative upon execution to determine whether the target endpoint is trusted, and the filesystem driver software state information comprises an indication of whether the application process has ever read from or written to any sensitive file, the network filter driver software being operative to grant or deny the connection establishment request according to a rule that if the target endpoint is untrusted, the connection establishment request will be denied unless the filesystem driver software state information indicates that the application process has never read from or written to any file designated as sensitive.
20. The operating system software of claim 17 , wherein:
the filesystem driver software is operative upon execution to determine whether the target file is designated as sensitive, and the network filter driver software state information comprises an indication of whether any untrusted network connections are currently active via the network interface, the filesystem driver software being operative to grant or deny the file access request according to a rule that if the target file is designated as sensitive then the file access request will be granted on condition that the network filter driver software state information indicates that no active connections to an untrusted endpoint exist; and
the network filter driver software is operative upon execution to determine whether the target endpoint is trusted, and the filesystem driver software state information comprises an indication of whether the application process has ever read from or written to any sensitive file, the network filter driver software being operative to grant or deny the connection establishment request according to a rule that if the target endpoint is untrusted, the connection establishment request will be granted only on condition that the filesystem driver software state information indicates that the application process has never read from or written to any file designated as sensitive, but otherwise the file access request will be denied.