Methods and systems for securely managing file-attribute information for files in a file system

Patent metadata

Field	Value
Publication number	US-9465937-B1
Application number	US-13061608-A
Country	US
Kind code	B1
Filing date	May 30, 2008
Priority date	May 30, 2008
Publication date	Oct 11, 2016
Grant date	Oct 11, 2016

Abstract

A computer-implemented method for securely managing file-attribute information for files in a file system may comprise: 1) identifying at least one file, 2) identifying file-attribute information that identifies at least one file attribute for the file, 3) identifying volatile metadata associated with the file that contains file-attribute information, 4) determining that the file has been modified, and 5) automatically deleting the volatile metadata. Corresponding systems and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for securely managing file-attribute information for files in a file system, the method comprising:
identifying at least one file;
identifying at least one file attribute of the file that would be useful to a security software program when analyzing the file;
storing the file attribute as volatile metadata for the file that is automatically deleted when the same file is modified;
ensuring that the security software program can rely upon the file attribute identified within the volatile metadata for the file by, upon determining that the file has been modified, automatically deleting the volatile metadata for the file in response to the determination that the same file has been modified;
identifying non-volatile metadata associated with the file;
after determining that the file has been modified, updating the non-volatile metadata.

2. The method of claim 1 , wherein determining that the file has been modified comprises:
installing a boot-time device driver;
registering a file-system minifilter for the boot-time device driver;
identifying, using at least one of the file-system minifilter and the boot-time device driver, at least one modification to the file.

3. The method of claim 2 , wherein installing the boot-time device driver comprises requiring the boot-time device driver to load earlier than all other non-system-critical drivers.

4. The method of claim 2 , wherein registering the file-system minifilter for the boot-time device driver comprises registering the file-system minifilter at an altitude that is lower than all other non-allocated altitudes.

5. The method of claim 1 , wherein storing the file attribute as volatile metadata comprises:
creating the volatile metadata;
storing the volatile metadata in a file-attribute-information database.

6. The method of claim 5 , further comprising limiting access to the file-attribute-information database to applications with administrative-access rights.

7. The method of claim 5 , wherein storing the volatile metadata comprises storing the volatile metadata as a single file.

8. The method of claim 5 , wherein the file-attribute-information database comprises a kernel-mode database.

9. The method of claim 5 , wherein the file-attribute-information database comprises a single database file.

10. The method of claim 1 , wherein updating the non-volatile metadata comprises:
identifying at least one modification to the file;
updating the non-volatile metadata based at least in part on the modification to the file.

11. The method of claim 1 , wherein identifying the non-volatile metadata comprises:
creating the non-volatile metadata;
storing the non-volatile metadata in a file-attribute-information database.

12. The method of claim 1 , wherein:
determining that the file has been modified comprises:
determining that a first file has been modified;
determining that a second file has been modified;

automatically deleting the volatile metadata comprises, after determining that both the first file and the second file have been modified, automatically deleting volatile metadata associated with both the first file and the second file.

13. The method of claim 1 , wherein the file attribute comprises at least one of:
a last-scanned date for the file;
a last-modified date for the file;
a hash for the file;
a digital signature for the file;
file-ancestry information for the file.

14. A computer-implemented method for securely managing file-attribute information for files in a file system, the method comprising:
identifying a file-system change journal;
determining, by analyzing the file-system change journal, that at least one file in the file system has been modified;
identifying volatile metadata for the file that is automatically deleted when the same file is modified, wherein the volatile metadata identifies at least one file attribute of the file that would be useful to a security software program when analyzing the file;
ensuring that the security software program can rely upon the file attribute identified within the volatile metadata for the file by automatically deleting the volatile metadata for the file in response to the determination that the same file has been modified;
identifying non-volatile metadata associated with the file;
after determining that the file has been modified, updating the non-volatile metadata.

15. The method of claim 14 , wherein the file-system change journal is an NTFS change journal.

16. The method of claim 14 , wherein the file was modified in at least one of:
a removable-storage-device environment;
a non-NTFS operating-system environment;
an operating-system safe-mode environment.

17. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by a computing device, cause the computing device to:
identify at least one file;
identify at least one file attribute of the file that would be useful to a security software program when analyzing the file;
store the file attribute as volatile metadata for the file that is automatically deleted when the same file is modified;
ensure that the security software program can rely upon the file attribute identified within the volatile metadata for the file by, upon determining that the file has been modified, automatically deleting the volatile metadata for the file in response to the determination that the same file has been modified;
identify non-volatile metadata associated with the file;
after determining that the file has been modified, update the non-volatile metadata.

Assignees

• Spiegel Mark
• Buches David
• Gardner Patrick
• Kane David
• Symantec Corp

Inventors

• Spiegel Mark
• Buches David
• Gardner Patrick
• Kane David

Classifications

• G06F21/565 Primary

  by checking file integrity · CPC title

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F21/6281

  at program execution time, where the protection is within the operating system · CPC title