Methods and systems for securely managing file-attribute information for files in a file system

• US 9,465,937 B1
• Filed: 05/30/2008
• Issued: 10/11/2016
• Est. Priority Date: 05/30/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Spiegel, Mark, Buches, David, Gardner, Patrick, Kane, David
• Primary Examiner(s): DWIVEDI, MAHESH H
• Application Number:
  US12/130,616
• Time in Patent Office: 3,056 Days
• Field of Search: 707/634
• US Class Current: 1/1
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system

Abstract

A computer-implemented method for securely managing file-attribute information for files in a file system may comprise: 1) identifying at least one file, 2) identifying file-attribute information that identifies at least one file attribute for the file, 3) identifying volatile metadata associated with the file that contains file-attribute information, 4) determining that the file has been modified, and 5) automatically deleting the volatile metadata. Corresponding systems and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for securely managing file-attribute information for files in a file system, the method comprising:

identifying at least one file;

identifying at least one file attribute of the file that would be useful to a security software program when analyzing the file;

storing the file attribute as volatile metadata for the file that is automatically deleted when the same file is modified;

ensuring that the security software program can rely upon the file attribute identified within the volatile metadata for the file by, upon determining that the file has been modified, automatically deleting the volatile metadata for the file in response to the determination that the same file has been modified;

identifying non-volatile metadata associated with the file;

after determining that the file has been modified, updating the non-volatile metadata.

2. The method of claim 1, wherein determining that the file has been modified comprises:

installing a boot-time device driver;

registering a file-system minifilter for the boot-time device driver;

identifying, using at least one of the file-system minifilter and the boot-time device driver, at least one modification to the file.

3. The method of claim 2, wherein installing the boot-time device driver comprises requiring the boot-time device driver to load earlier than all other non-system-critical drivers.

4. The method of claim 2, wherein registering the file-system minifilter for the boot-time device driver comprises registering the file-system minifilter at an altitude that is lower than all other non-allocated altitudes.

5. The method of claim 1, wherein storing the file attribute as volatile metadata comprises:

creating the volatile metadata;

storing the volatile metadata in a file-attribute-information database.

6. The method of claim 5, further comprising limiting access to the file-attribute-information database to applications with administrative-access rights.

7. The method of claim 5, wherein storing the volatile metadata comprises storing the volatile metadata as a single file.

8. The method of claim 5, wherein the file-attribute-information database comprises a kernel-mode database.

9. The method of claim 5, wherein the file-attribute-information database comprises a single database file.

10. The method of claim 1, wherein updating the non-volatile metadata comprises:

identifying at least one modification to the file;

updating the non-volatile metadata based at least in part on the modification to the file.

11. The method of claim 1, wherein identifying the non-volatile metadata comprises:

creating the non-volatile metadata;

storing the non-volatile metadata in a file-attribute-information database.

12. The method of claim 1, wherein:

determining that the file has been modified comprises;

determining that a first file has been modified;

determining that a second file has been modified;

automatically deleting the volatile metadata comprises, after determining that both the first file and the second file have been modified, automatically deleting volatile metadata associated with both the first file and the second file.

13. The method of claim 1, wherein the file attribute comprises at least one of:

a last-scanned date for the file;

a last-modified date for the file;

a hash for the file;

a digital signature for the file;

file-ancestry information for the file.

14. A computer-implemented method for securely managing file-attribute information for files in a file system, the method comprising:

identifying a file-system change journal;

determining, by analyzing the file-system change journal, that at least one file in the file system has been modified;

identifying volatile metadata for the file that is automatically deleted when the same file is modified, wherein the volatile metadata identifies at least one file attribute of the file that would be useful to a security software program when analyzing the file;

ensuring that the security software program can rely upon the file attribute identified within the volatile metadata for the file by automatically deleting the volatile metadata for the file in response to the determination that the same file has been modified;

identifying non-volatile metadata associated with the file;

after determining that the file has been modified, updating the non-volatile metadata.

15. The method of claim 14, wherein the file-system change journal is an NTFS change journal.

16. The method of claim 14, wherein the file was modified in at least one of:

a removable-storage-device environment;

a non-NTFS operating-system environment;

an operating-system safe-mode environment.

17. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by a computing device, cause the computing device to:

identify at least one file;

identify at least one file attribute of the file that would be useful to a security software program when analyzing the file;

store the file attribute as volatile metadata for the file that is automatically deleted when the same file is modified;

ensure that the security software program can rely upon the file attribute identified within the volatile metadata for the file by, upon determining that the file has been modified, automatically deleting the volatile metadata for the file in response to the determination that the same file has been modified;

identify non-volatile metadata associated with the file;

after determining that the file has been modified, update the non-volatile metadata.