Systems and methods for protecting a folder from unauthorized file modification

Patent metadata

Field	Value
Publication number	US-12056251-B2
Application number	US-202016822821-A
Country	US
Kind code	B2
Filing date	Mar 18, 2020
Priority date	Mar 18, 2020
Publication date	Aug 6, 2024
Grant date	Aug 6, 2024

Abstract

A method for protecting a folder from unauthorized file modification may include receiving, from a remote device, a modify request for a target file in a folder and determining whether the folder is a protected folder. The method may also include determining, in response to determining the folder is the protected folder, whether the remote device is a trusted host. The method may further include allowing, in response to determining that the remote device is the trusted host, the modify request for the target file.

First claim

What is claimed is:

1. A computer-implemented method for protecting a folder from unauthorized file modification, the method being performed by a computing device comprising at least one processor, the method comprising:
receiving, by a minifilter of the computing device from an authorized process on a remote device, a modify request for a target file in a local folder, wherein the modify request includes a filename for the target file, the filename includes a hash that corresponds to a key maintained by a lockdown server, the modify request is intercepted by a minifilter of the remote device, and the authorized process is authorized by the lockdown server through the minifilter of the remote device;
detecting, locally by the computing device, a marker file in the local folder;
determining, locally by the computing device in response to detecting the marker file, that the local folder is tho a protected folder;
determining, by the computing device, in response to determining the local folder is the protected folder and based at least on the hash in the filename being confirmed with the lockdown server, whether the remote device is a trusted host;
removing, in response to determining that the remote device is the trusted host, the hash from the filename to locally identify the target file; and
allowing, by the computing device in response to determining that the remote device is the trusted host, the modify request for the target file.

2. The method of claim 1 , wherein the modify request includes a network address of the remote device for identifying the remote device and determining whether the remote device is the trusted host is based on the network address.

3. The method of claim 1 , wherein receiving the modify request further comprises intercepting, by the minifilter of the computing device, the modify request.

4. The method of claim 3 , wherein the minifilter communicates with the lockdown server to determine whether the remote device is the trusted host.

5. The method of claim 1 , wherein determining whether the remote device is the trusted host further comprises confirming, by contacting the remote device, the modify request.

6. The method of claim 1 , wherein determining whether the remote device is the trusted device comprises acknowledging, by the minifilter of the remote device to the minifilter of the computing device, that the modify request is from the remote device.

7. The method of claim 1 , further comprising, before receiving, by the computing device from the process on the remote device, the modify request:
detecting, by the minifilter of the remote device, the modify request for the target file in the local folder of the computing device from the process on the remote device;
detecting, by the remote device by accessing the computing device, a marker file in the local folder of the computing device;
determining, by the remote device in response to detecting the marker file, that the target file is in a protected folder;
determining, by the remote device in response to determining that the target file is in the protected folder, that the process is an authorized process for accessing the target file in the local folder of the computing device; and
sending, by the remote device in response to determining that the process is the authorized process, the modify request to the computing device.

8. A system for protecting a folder from unauthorized file modification, the system comprising:
a receive module, stored in memory, for receiving, by a minifilter of the system from an authorized process on a remote device that the remote device has determined is authorized by a lockdown server to access a target file in a local folder of the system, a modify request for the target file in the local folder, wherein the modify request includes a filename for the target file, the filename includes a hash that corresponds to a key maintained by the lockdown server, and the modify request is intercepted by a minifilter of the remote device to authorize the authorized process;
a folder module, stored in the memory, for determining locally that the local folder is the protected folder by detecting a marker file in the local folder;
a host validation module, stored in the memory, for determining, in response to determining the local folder is the protected folder and based at least on the hash in the filename being confirmed with the lockdown server, whether the remote device is a trusted host and in response to determining that the remote device is the trusted host, remove the hash from the filename to locally identify the target file;
a modify module, stored in the memory, for allowing, in response to determining that the remote device is the trusted host, the modify request for the target file; and
at least one physical processor that executes the receive module, the folder module, the host validation module, and the modify module.

9. The system of claim 8 , wherein the modify request includes a network address of the remote device to identify the remote device and determining whether the remote device is the trusted host is based on the network address.

10. The system of claim 8 ,
wherein receiving the modify request further comprises intercepting, by the minifilter of the system, the modify request.

11. The system of claim 10 , wherein the minifilter communicates with a lockdown server to determine whether the remote device is the trusted host.

12. The system of claim 8 , wherein the host validation module is configured to determine whether the remote device is the trusted device by acknowledging, by the minifilter of the remote device to the minifilter of the system, that the modify request is from the remote device.

13. The system of claim 8 , wherein the remote device is configured to:
detect, by the minifilter of the remote device, the modify request for the target file in the protected folder from the process on the remote device;
detect, by the remote device by accessing the system, a marker file in the local folder of the system;
determine, by the remote device in response to detecting the marker file, that the target file is in the protected folder;
determine, by the remote device in response to determining that the target file is in the protected folder, that the process is an authorized process for accessing the target file in the local folder of the system; and
send, by the remote device in response to determining that the process is the authorized process, the modify request to the system.

14. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing system including a remote device and a computing device, cause the computing system to:
receive, by a minifilter of the computing device from an authorized process on the remote device, a modify request for a target file in a local folder of the computing device, wherein the modify request includes a filename for the target file, the filename includes a hash that corresponds to a key maintained by a lockdown server, the modify request is intercepted by a minifilter of the remote device, and the authorized process is authorized by the lockdown server through the minifilter of the remote device;
detect, locally by the computing device, a marker file in the local folder;
determine, locally by the computing device in response to detecting the marker file, that the local folder is a protected folder;
determine, by the computing device in response to determining the local folder is the protected folder and based at least on the hash in the filename being conf

Assignees

• Veritas Technologies Llc

Inventors

• Subramanian Narayan
• Panna Arindam
• Sridharan Srineet

Classifications

• G06F21/64 Primary

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• G06F16/1774

  Locking methods, e.g. locking methods for file systems allowing shared and concurrent access to files · CPC title