It’s been a while since I posted, before the new server was set up… so if this is a dupe, my apologies. (I’m not sure my newsreader is set up exactly for posting to this group.)
Alright, here’s a toughie…
We have a filter that quite nicely works with a Ring3 control app to determine whether or not a process is allowed access to clear text of a protected file or not. If it is, during the file reads (IRP_NOCACHE), my filter gets to manipulate (decrypt) the data on the way to the target buffer (the App or the cache). If the application accessing the data is not entitled to clear text data, we can either deny the open (which we currently do) or simply let it flow through without decrypting it. Obviously, in the latter case, only one type of application (entitled to the clear text or not) can have the file open - otherwise we would have a security breach.
EFS has dedicated APIs for use by specific programs (defrag, backup/restore) that allow them to read and write data in encrypted form, even while an authorized app going through the file system to access the clear text.
Question… Is there any reasonable way for my filter to support simultaneous access (in both encrypted and unencrypted form - assuming I know which process should be allowed which) by arbitrary applications to the appropriate data in either clear or cipher text form? This would be like maintaining two different copies of the same file in the cache - one cleartext, one cipher text.
Yes, you can maintain two cached views of the same file. It is difficult to
get right but it can be done.
It stems from maintaining your own sectionobjectpointer structure which is
swapped into the fileobject that is to have the ‘other’ view.
Pete
Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-170161-
xxxxx@lists.osr.com] On Behalf Of G.W. Wilhelm, Jr.
Sent: Tuesday, March 16, 2004 8:59 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] encrypted and unencrypted data access at the same time
It’s been a while since I posted, before the new server was set up… so
if this is a dupe, my apologies. (I’m not sure my newsreader is set up
exactly for posting to this group.)
Alright, here’s a toughie…
We have a filter that quite nicely works with a Ring3 control app to
determine whether or not a process is allowed access to clear text of a
protected file or not. If it is, during the file reads (IRP_NOCACHE), my
filter gets to manipulate (decrypt) the data on the way to the target
buffer (the App or the cache). If the application accessing the data is
not entitled to clear text data, we can either deny the open (which we
currently do) or simply let it flow through without decrypting it.
Obviously, in the latter case, only one type of application (entitled to
the clear text or not) can have the file open - otherwise we would have a
security breach.
EFS has dedicated APIs for use by specific programs (defrag,
backup/restore) that allow them to read and write data in encrypted form,
even while an authorized app going through the file system to access the
clear text.
Question… Is there any reasonable way for my filter to support
simultaneous access (in both encrypted and unencrypted form - assuming I
know which process should be allowed which) by arbitrary applications to
the appropriate data in either clear or cipher text form? This would be
like maintaining two different copies of the same file in the cache - one
cleartext, one cipher text.
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com