Symmetric bridge component for communications between kernel mode and user mode

• US 10,387,228 B2
• Filed: 02/21/2017
• Issued: 08/20/2019
• Est. Priority Date: 02/21/2017
• Status: Active Grant

• Current Assignee: Crowdstrike, Inc. (CrowdStrike Holdings Incorporated)
• Original Assignee: Crowdstrike, Inc. (CrowdStrike Holdings Incorporated)
• Inventors: Petrbok, Milos, McCambridge, Colin Christopher
• Primary Examiner(s): Ho, Andy
• Application Number:
  US15/438,553
• Publication Number:
  US 20180239657A1
• Time in Patent Office: 910 Days
• Field of Search: 719313, 719328
• CPC Class Codes: G06F 13/14 Handling requests for interconnection or transfer
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 9/44 Arrangements for executing specific programs
• CPC Class Codes: G06F 9/541 via adapters, e.g. between incompatible applications
• CPC Class Codes: G06F 9/545 where tasks reside in different layers, e.g. user- and kernel-space
• CPC Class Codes: G06F 9/546 Message passing systems or structures, e.g. queues

Abstract

A symmetric, cross-platform, bridge component is described herein. The bridge component creates an interface (through a set of application programming interfaces (APIs)) to enable the sending of data between a pair of components, called “endpoints,” a first endpoint component of the pair being executed in a kernel mode of a computing device, and a second endpoint component of the pair being executed in a user mode of the computing device. A process for sending data between a kernel-level endpoint component and a user-level endpoint component executing on a computing device involves opening a communications port, setting the communications port to a connected state, and sending a message containing the data via the communications port. Data may be transmitted in this manner between the user mode and the kernel mode of the computing device in either direction.

Claims

1. A system comprising:

at least one processor;

memory storing computer-executable instructions that, when executed by the at least one processor, cause the system to implement a symmetric bridge component partially in a user mode of the system and partially in a kernel mode of the system, wherein the symmetric bridge component is configured to cause the system to;

open a communications port by causing a first bridge component, of the symmetric bridge component, to activate a function to initialize the communications port in one of the kernel mode or the user mode;

set the communications port to a connected state to create an opened and connected communications port in response to a second bridge component, of the symmetric bridge component, activating the function in the other of the kernel mode or the user mode;

send a message containing data via the opened and connected communications port, the data originating from a first endpoint component executable in one of the kernel mode or the user mode; and

receive the data at a second endpoint component executable in the other of the kernel mode or the user mode.

2. The system of claim 1, wherein the communications port is set to a waiting state in response to activation of the function by the first bridge component and until the second bridge component activates the function.

3. The system of claim 1, wherein:

opening the communications port further comprises returning a port handle for the communications port; and

sending the message is based at least in part on the port handle.

4. The system of claim 1, wherein opening the communications port further comprises assigning a port identifier to the communications port that uniquely identifies the communications port by differentiating the communications port from other communications ports that have been opened on the system.

5. The system of claim 1, wherein the symmetric bridge component comprises at least one common application programming interface (API) for communication of the data between the kernel mode and the user mode in both directions.

6. The system of claim 1, wherein:

the first endpoint component is attached to at least one of;

(i) a kernel-level bus of a kernel-level security agent executing in the kernel mode, or (ii) a user-level bus of a user-level security agent executing in the user mode; and

the second endpoint component is attached to the other of the kernel-level bus or the user-level bus.

7. A method comprising:

opening a communications port by causing a first bridge component to activate a function to initialize the communications port in one of a kernel mode of a computing device or a user mode of the computing device;

setting the communications port to a connected state in response to a second bridge component activating the function in the other of the kernel mode or the user mode;

in response to opening the communications port and setting the communications port to the connected state, sending a message containing data via the communications port, the data originating from a first endpoint component executable in one of the kernel mode or the user mode; and

receiving the data at a second endpoint component executable in the other of the kernel mode or the user mode.

8. The method of claim 7, further comprising, prior to sending the message via the communications port:

serializing the data as serialized data; and

creating the message based at least in part on the serialized data.

9. The method of claim 8, wherein:

the function is a first function;

the serialized data comprises a message buffer having a starting address and a length; and

sending the message comprises activating a second function that specifies the starting address and the length of the message buffer.

10. The method of claim 9, wherein:

the second function comprises a synchronous function; and

the message buffer remains valid and unchanged at least until a call to the synchronous function is returned with at least one of an indication that the message was successfully sent, an indication that a timeout occurred, or an indication that the message failed to send.

11. The method of claim 9, wherein:

the second function comprises an asynchronous function; and

the message buffer remains valid and unchanged at least until a callback function is activated in response to at least one of the message being successfully sent, a timeout occurring, or the message failing to send.

12. The method of claim 11, wherein sending the message comprises:

queuing the message; and

sending the message in a different thread context than a thread context in which the message was queued.

13. The method of claim 8, further comprising, prior to receiving the data at the second endpoint component:

deserializing the serialized data to obtain the data; and

providing the data to at least one of;

(i) a kernel-level component instantiated in the kernel mode, or (ii) a user-level component instantiated in the user mode.

14. The method of claim 7, wherein:

the first endpoint component is attached to at least one of;

(i) a kernel-level bus of a kernel-level security agent executing in the kernel mode, or (ii) a user-level bus of a user-level security agent executing in the user mode; and

the second endpoint component is attached to the other of the kernel-level bus or the user-level bus.

15. The method of claim 7, wherein the first bridge component and the second bridge component are each part of a symmetric bridge component that is implemented partially in the user mode and partially in the kernel mode and that comprises at least one common application programming interface (API) for communication of the data between the kernel mode and the user mode in both directions.

16. The method of claim 7, further comprising setting the communications port to a waiting state in response to activation of the function by the first bridge component and until the second bridge component activates the function.

17. One or more non-transitory computer-readable media storing computer-executable instructions configured to implement a symmetric bridge component for sending data between a kernel mode of a computing device and a user mode of the computing device, the symmetric bridge component performing operations comprising:

opening a communications port by causing a first bridge component, of the symmetric bridge component, to activate a function to initialize the communications port in one of the kernel mode or the user mode;

setting the communications port to a connected state in response to a second bridge component, of the symmetric bridge component, activating the function in the other of the kernel mode or the user mode; and

in response to opening the communications port and setting the communications port to the connected state, sending a message containing the data via the communications port, the data originating from a first endpoint component executable in one of the kernel mode or the user mode, and the data received at a second endpoint component executable in the other of the kernel mode or the user mode.

18. The one or more non-transitory computer-readable media of claim 17, wherein:

opening the communications port further comprises returning a port handle for the communications port; and

sending the message is based at least in part on the port handle.

19. The one or more non-transitory computer-readable media of claim 17, wherein opening the communications port further comprises assigning a port identifier to the communications port that uniquely identifies the communications port by differentiating the communications port from other communications ports that have been opened on the computing device.

20. The one or more non-transitory computer-readable media of claim 17, wherein the symmetric bridge component comprises at least one common application programming interface (API) for communication of the data between the kernel mode and the user mode in both directions.

21. The one or more non-transitory computer-readable media of claim 17, wherein the communications port is set to a waiting state in response to activation of the function by the first bridge component and until the second bridge component activates the function.