Symmetric bridge component for communications between kernel mode and user mode

Patent metadata

Field	Value
Publication number	US-2018239657-A1
Application number	US-201715438553-A
Country	US
Kind code	A1
Filing date	Feb 21, 2017
Priority date	Feb 21, 2017
Publication date	Aug 23, 2018
Grant date	—

Abstract

A symmetric, cross-platform, bridge component is described herein. The bridge component creates an interface (through a set of application programming interfaces (APIs)) to enable the sending of data between a pair of components, called “endpoints,” a first endpoint component of the pair being executed in a kernel mode of a computing device, and a second endpoint component of the pair being executed in a user mode of the computing device. A process for sending data between a kernel-level endpoint component and a user-level endpoint component executing on a computing device involves opening a communications port, setting the communications port to a connected state, and sending a message containing the data via the communications port. Data may be transmitted in this manner between the user mode and the kernel mode of the computing device in either direction.

First claim

What is claimed is:

1 . A system comprising:
at least one processor; memory storing computer-executable instructions that, when executed by the at least one processor, cause the system to:
open a communications port for sending data originating from a first endpoint component to a second endpoint component, wherein:
the first endpoint component is executable in at least one of: (i) a kernel mode of the system, or (ii) a user mode of the system, and
the second endpoint component is executable in the other of the kernel mode or the user mode;

set the communications port to a connected state to create an opened and connected communications port;
send a message containing the data via the opened and connected communications port; and
receive the data at the second endpoint component.

2 . The system of claim 1 , wherein:
the computer-executable instructions cause the system to open the communications port by causing a first bridge component to activate a function to initialize the communications port in the kernel mode; and the computer-executable instructions cause the system to set the communications port to the connected state in response to a second bridge component activating the function in the user mode.

3 . The system of claim 2 , wherein the communications port is set to a waiting state in response to activation of the function by the first bridge component and until the second bridge component activates the function.

4 . The system of claim 1 , wherein:
the computer-executable instructions cause the system to open the communications port by causing a first bridge component to activate a function to initialize the communications port in the user mode; and the computer-executable instructions cause the system to set the communications port to the connected state in response to a second bridge component activating the function in the kernel mode.

5 . The system of claim 1 , wherein:
opening the communications port further comprises returning a port handle for the communications port; and sending the message is based at least in part on the port handle.

6 . The system of claim 1 , wherein opening the communications port further comprises assigning a port identifier to the communications port that uniquely identifies the communications port by differentiating the communications port from other communications ports that have been opened on the computing device.

7 . A method comprising:
opening a communications port for sending data originating from a first endpoint component to a second endpoint component, wherein:
the first endpoint component is executable in at least one of: (i) a kernel mode of a computing device, or (ii) a user mode of the computing device, and
the second endpoint component is executable in the other of the kernel mode or the user mode;
setting the communications port to a connected state; in response to opening the communications port and setting the communications port to the connected state, sending a message containing the data via the communications port; and receiving the data at the second endpoint component.

8 . The method of claim 7 , further comprising, prior to sending the message via the communications port:
serializing the data as serialized data; and creating the message based at least in part on the serialized data.

9 . The method of claim 8 , wherein:
the serialized data comprises a message buffer having a starting address and a length; and sending the message comprises activating a function that specifies the starting address and the length of the message buffer.

10 . The method of claim 9 , wherein:
the function comprises a synchronous function; and the message buffer remains valid and unchanged at least until a call to the synchronous function is returned with at least one of an indication that the message was successfully sent, an indication that a timeout occurred, or an indication that the message failed to send.

11 . The method of claim 9 , wherein:
the function comprises an asynchronous function; and the message buffer remains valid and unchanged at least until a callback function is activated in response to at least one of the message being successfully sent, a timeout occurring, or the message failing to send.

12 . The method of claim 11 , wherein sending the message comprises:
queuing the message; and sending the message in a different thread context than a thread context in which the message was queued.

13 . The method of claim 8 , further comprising, prior to receiving the data at the second endpoint component:
deserializing the serialized data to obtain the data; and providing the data at least one of: (i) a kernel-level component instantiated in the kernel mode, or (ii) a user-level component instantiated in the user mode.

14 . The method of claim 7 , wherein:
opening the communications port comprises activating a function to initialize the communications port in the kernel mode; and setting the communications port to the connected state occurs in response to activating the function in the user mode.

15 . The method of claim 7 , wherein:
opening the communications port comprises activating a function to initialize the communications port in the user mode; and setting the communications port to the connected state occurs in response to activating the function in the kernel mode.

16 . The method of claim 7 , wherein:
the first endpoint component is attached to at least one of: (i) a kernel-level bus of a kernel-level security agent executing in the kernel mode, or (ii) a user-level bus of a user-level security agent executing in the user mode; and the second endpoint component is attached to the other of the kernel-level bus or the user-level bus.

17 . One or more non-transitory computer-readable media storing computer-executable instructions configured to implement symmetric bridge component for sending data between a kernel mode of a computing device and a user mode of the computing device, the symmetric bridge component performing operations comprising:
opening a communications port for sending the data originating from a first endpoint component to a second endpoint component, wherein:
the first endpoint component is executable in at least one of: (i) the kernel mode, or (ii) the user mode, and
the second endpoint component is executable in the other of the kernel mode or the user mode;
setting the communications port to a connected state; and in response to opening the communications port and setting the communications port to the connected state, sending a message containing the data via the communications port.

18 . The one or more non-transitory computer-readable media of claim 17 , wherein:
opening the communications port comprises activating a function to initialize the communications port in the kernel mode; and setting the communications port to the connected state occurs in response to activating the function in the user mode.

19 . The one or more non-transitory computer-readable media of claim 17 , wherein:
opening the communications port comprises activating a function to initialize the communications port in the user mode; and setting the communications port to the connected state occurs in response to activating the function in the kernel mode.

20 . The one or more non-transitory computer-readable media of claim 17 , wherein:
opening the communications port further comprises returning a port handle for the communications port;

Assignees

• Crowdstrike Inc

Inventors

• Petrbok Milos
• Mccambridge Colin Christopher

Classifications

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F13/14

  Handling requests for interconnection or transfer · CPC title

• G06F9/546 Primary

  Message passing systems or structures, e.g. queues · CPC title

• G06F9/541

  via adapters, e.g. between incompatible applications · CPC title

• G06F9/545

  where tasks reside in different layers, e.g. user- and kernel-space · CPC title