Patent Description:
However, allowing remote access to backup images may create security vulnerabilities. For example, ransomware software may access the folder containing backup images and encrypt the backup images for ransom. Other malware may access and corrupt the backup images. Although restricting access to the shared folder may prevent such security vulnerabilities, legitimate processes may be prevented from properly functioning. In addition to backup applications, other applications, such as archiving software, replication software, security software, etc., may also require protecting data from malware while permitting access to legitimate processes.

<CIT> discloses data file protection to prevent unauthorized access to contents of the data file in a user system.

<CIT> relates to protection against unauthorized data alteration by storing copies of files/ folders in a write-protected partition only accessible while in a trusted operating environment.

<CIT> is concerned with providing security systems to secure and protect resources, in particular with distribution of changes to security policies in an efficient manner to the affected entities.

The present disclosure, therefore, identifies and addresses a need for systems and methods for protecting a folder from unauthorized file modification.

As will be described in greater detail below, the present disclosure describes various systems and methods for protecting a folder from unauthorized file modification by receiving a modify request from a remote device for a target file in a folder, determining that the folder is a protected folder, determining that the remote device is a trusted host, and allowing the modify request for the target file.

In one embodiment, a method for protecting a folder from unauthorized file modification according to claim <NUM> is defined.

In some examples, determining whether the target file is in the protected folder may further include determining whether the folder includes a marker file, and determining, in response to determining the folder includes the marker file, that the folder is the protected folder.

In some examples, detecting the modify request may include intercepting, by a minifilter of the remote device, the modify request. In some examples, the modify request may include a network address of the remote device. In some examples, determining whether the remote device is the trusted host may be based on the network address. In some examples, the modify request may include a hash of a key maintained by a lockdown server and determining whether the remote device is the trusted host may be based on recognizing the hash.

In some examples, receiving the modify request may further include intercepting, by a minifilter, the modify request. In some examples, the minifilter may communicate with a lockdown server to determine whether the remote device is a trusted host. In some examples, determining whether the remote device is the trusted host may further include confirming, by contacting the remote device, the modify request. In some examples, the minifilter may communicate with a remote minifilter associated with the remote device to determine whether the remote device is the trusted host.

In one example, a system for protecting a folder from unauthorized file modification may include several modules stored in memory, including (i) a receive module, stored in memory, for receiving, from a remote device, a modify request for a target file in a folder, (ii) a folder module, stored in the memory, for determining whether the folder is a protected folder, (iii) a host validation module, stored in the memory, for determining, in response to determining the folder is the protected folder, whether the remote device is a trusted host, (iv) a modify module, stored in the memory, for allowing, in response to determining that the remote device is the trusted host, the modify request for the target file, and (v) at least one physical processor that executes the receive module, the folder module, the host validation module, and the modify module.

In some examples, the remote device may send the modify request in response to (a) detecting the modify request from a process on the remote device, (b) determining whether the target file is in the protected folder, (c) determining, in response to determining that the target file is in the protected folder, whether the process is an authorized process, and (d) sending, in response to determining that the process is the authorized process, the modify request.

In some examples, detecting the modify request may include intercepting, by a minifilter of the remote device, the modify request. In some examples, the modify request may include a network address of the remote device. In some examples, determining whether the remote device is the trusted host may be based on the network address.

In some examples, the system may further include a minifilter. Receiving the modify request may further include intercepting, by the minifilter, the modify request. In some examples, the minifilter may communicate with a lockdown server to determine whether the remote device is the trusted host.

In another embodiment, the above-described method may be encoded as computer-readable instructions on a non-transitory computer-readable according to claim <NUM>.

In some examples, detecting the modify request may include intercepting, by a minifilter of the remote device, the modify request. In some examples, receiving the modify request may further include intercepting, by a minifilter, the modify request.

Features from any of the embodiments described herein may be used in combination with one another in accordance with the general principles described herein. These and other embodiments, features, and advantages will be more fully understood upon reading the following detailed description in conjunction with the accompanying drawings and claims.

Together with the following description, these drawings demonstrate and explain various principles of the present disclosure.

Throughout the drawings, identical reference characters and descriptions indicate similar, but not necessarily identical, elements. While the example embodiments described herein are susceptible to various modifications and alternative forms, specific embodiments have been shown by way of example in the drawings and will be described in detail herein. However, the example embodiments described herein are not intended to be limited to the particular forms disclosed.

The present disclosure is generally directed to systems and methods for protecting a folder from unauthorized file modification. As will be explained in greater detail below, by intercepting a modify request for a target file in a folder, identifying the folder as a protected folder, authenticating the remote device making the modify request as a trusted host, and allowing the modify request from the trusted host, the various systems and methods describe herein may be able to restrict malware from unauthorized modifications of files in a shared folder while allowing legitimate processes to modify the files. By intercepting modify requests from remote devices, the various systems and methods described herein may potentially alleviate bandwidth consumption by simplifying authentication of legitimate processes. Alternatively or additionally, the systems and methods may facilitate identification of protected folders accessed over a network.

Moreover, the systems and methods described herein may improve the functioning and/or performance of a networked computer by efficiently authenticating modify requests on protected folders without increasing overhead. These systems and methods may also improve the field of network security and/or backup systems by providing protection for backup images.

The following will provide, with reference to <FIG>, detailed descriptions of example systems for protecting a folder from unauthorized file modification. Detailed descriptions of corresponding computer-implemented methods will also be provided in connection with <FIG>. In addition, detailed descriptions of example minifilters and folders will be provided in connection with <FIG> and <FIG>.

<FIG> is a block diagram of an example system <NUM> for protecting a folder from unauthorized file modification. As illustrated in this figure, example system <NUM> may include one or more modules <NUM> for performing one or more tasks. As will be explained in greater detail below, modules <NUM> may include a receive module <NUM>, a folder module <NUM>, a host validation module <NUM>, and a modify module <NUM>. Although illustrated as separate elements, one or more of modules <NUM> in <FIG> may represent portions of a single module or application.

In certain embodiments, one or more of modules <NUM> in <FIG> may represent one or more software applications or programs that, when executed by a computing device, may cause the computing device to perform one or more tasks. For example, and as will be described in greater detail below, one or more of modules <NUM> may represent modules stored and configured to run on one or more computing devices, such as the devices illustrated in <FIG> (e.g., computing device <NUM>, remote device <NUM>, and/or server <NUM>). One or more of modules <NUM> in <FIG> may also represent all or portions of one or more special-purpose computers configured to perform one or more tasks.

As illustrated in <FIG>, example system <NUM> may also include one or more memory devices, such as memory <NUM>. Memory <NUM> generally represents any type or form of volatile or non-volatile storage device or medium capable of storing data and/or computer-readable instructions. In one example, memory <NUM> may store, load, and/or maintain one or more of modules <NUM>. Examples of memory <NUM> include, without limitation, Random Access Memory (RAM), Read Only Memory (ROM), flash memory, Hard Disk Drives (HDDs), Solid-State Drives (SSDs), optical disk drives, caches, variations or combinations of one or more of the same, or any other suitable storage memory.

As illustrated in <FIG>, example system <NUM> may also include one or more physical processors, such as physical processor <NUM>. Physical processor <NUM> generally represents any type or form of hardware-implemented processing unit capable of interpreting and/or executing computer-readable instructions. In one example, physical processor <NUM> may access and/or modify one or more of modules <NUM> stored in memory <NUM>. Additionally or alternatively, physical processor <NUM> may execute one or more of modules <NUM> to facilitate protecting a folder from unauthorized file modification. Examples of physical processor <NUM> include, without limitation, microprocessors, microcontrollers, Central Processing Units (CPUs), Field-Programmable Gate Arrays (FPGAs) that implement softcore processors, Application-Specific Integrated Circuits (ASICs), portions of one or more of the same, variations or combinations of one or more of the same, or any other suitable physical processor.

As illustrated in <FIG>, example system <NUM> may also include one or more additional elements <NUM>, such as folder <NUM>, target file <NUM>, marker file <NUM>, minifilter <NUM>, and process <NUM>. Folder <NUM> may be a shared folder that may be locally accessed and remotely accessed. Target file <NUM> may be a file in folder <NUM> that may be subject to being remotely accessed. Target file <NUM> may be, for instance, a backup image file or any other type of data file. Marker file <NUM> may be an indicator that folder <NUM> may be a protected folder, as will be described further below. Minifilter <NUM> may be a kernel mode filter for filtering file system operations, as will be described further below. Process <NUM> may be a process, such as a backup application, that may access folder <NUM> and/or target file <NUM>.

Example system <NUM> in <FIG> may be implemented in a variety of ways. For example, all or a portion of example system <NUM> may represent portions of example system <NUM> in <FIG>. As shown in <FIG>, system <NUM> may include a computing device <NUM> and a remote device <NUM> in communication with a server <NUM> via a network <NUM>. In one example, all or a portion of the functionality of modules <NUM> may be performed by computing device <NUM>, remote device <NUM>, server <NUM>, and/or any other suitable computing system. As will be described in greater detail below, one or more of modules <NUM> from <FIG> may, when executed by at least one processor of computing device <NUM>, remote device <NUM>, and/or server <NUM>, enable computing device <NUM>, remote device <NUM>, and/or server <NUM> to protect a folder from unauthorized file modification.

Computing device <NUM> generally represents any type or form of computing device capable of reading computer-executable instructions. Computing device <NUM> may be, for example, an endpoint device running client-side backup software. Additional examples of computing device <NUM> include, without limitation, laptops, tablets, desktops, servers, cellular phones, Personal Digital Assistants (PDAs), multimedia players, embedded systems, wearable devices (e.g., smart watches, smart glasses, etc.), smart vehicles, so-called Internet-of-Things devices (e.g., smart appliances, etc.), gaming consoles, variations or combinations of one or more of the same, or any other suitable computing device.

Remote device <NUM> generally represents any type or form of computing device capable of reading computer-executable instructions. Remote device <NUM> may be, for example, an admin device for maintaining endpoint devices. Additional examples of remote device <NUM> include, without limitation, laptops, tablets, desktops, servers, cellular phones, Personal Digital Assistants (PDAs), multimedia players, embedded systems, wearable devices (e.g., smart watches, smart glasses, etc.), smart vehicles, so-called Internet-of Things devices (e.g., smart appliances, etc.), gaming consoles, variations or combinations of one or more of the same, or any other suitable computing device.

Server <NUM> generally represents any type or form of computing device that is capable of managing security permissions. For example, server <NUM> may be a lockdown server or centralized admin server. Additional examples of server <NUM> include, without limitation, storage servers, database servers, application servers, and/or web servers configured to run certain software applications and/or provide various storage, database, and/or web services. Although illustrated as a single entity in <FIG>, server <NUM> may include and/or represent a plurality of servers that work and/or operate in conjunction with one another.

Network <NUM> generally represents any medium or architecture capable of facilitating communication or data transfer. In one example, network <NUM> may facilitate communication between computing device <NUM>, remote device <NUM>, and server <NUM>. In this example, network <NUM> may facilitate communication or data transfer using wireless and/or wired connections. Examples of network <NUM> include, without limitation, an intranet, a Wide Area Network (WAN), a Local Area Network (LAN), a Personal Area Network (PAN), the Internet, Power Line Communications (PLC), a cellular network (e.g., a Global System for Mobile Communications (GSM) network), portions of one or more of the same, variations or combinations of one or more of the same, or any other suitable network.

Many other devices or subsystems may be connected to system <NUM> in <FIG> and/or system <NUM> in <FIG>. Conversely, all of the components and devices illustrated in <FIG> and <FIG> need not be present to practice the embodiments described and/or illustrated herein. The devices and subsystems referenced above may also be interconnected in different ways from that shown in <FIG>. Systems <NUM> and <NUM> may also employ any number of software, firmware, and/or hardware configurations. For example, one or more of the example embodiments disclosed herein may be encoded as a computer program (also referred to as computer software, software applications, computer-readable instructions, and/or computer control logic) on a computer-readable medium.

The term "computer-readable medium," as used herein, generally refers to any form of device, carrier, or medium capable of storing or carrying computer-readable instructions. Examples of computer-readable media include, without limitation, transmission-type media, such as carrier waves, and non-transitory-type media, such as magnetic-storage media (e.g., hard disk drives, tape drives, and floppy disks), optical-storage media (e.g., Compact Disks (CDs), Digital Video Disks (DVDs), and BLU-RAY disks), electronic-storage media (e.g., solid-state drives and flash media), and other distribution systems.

<FIG> is a flow diagram of an example computer-implemented method <NUM> for protecting a folder from unauthorized file modification. The steps shown in <FIG> may be performed by any suitable computer-executable code and/or computing system, including system <NUM> in <FIG>, system <NUM> in <FIG>, and/or variations or combinations of one or more of the same. In one example, each of the steps shown in <FIG> may represent an algorithm whose structure includes and/or is represented by multiple sub-steps, examples of which will be provided in greater detail below.

As illustrated in <FIG>, at step <NUM> one or more of the systems described herein may receive, from a remote device, a modify request for a target file in a folder. For example, receive module <NUM> may, as part of computing device <NUM> in <FIG>, receive, from remote device <NUM>, a modify request for target file <NUM> in folder <NUM>.

The term "modify request," as used herein, generally refers to a request to perform an operation on a specified file. Examples of modify requests include, without limitation, write operations for changing data of the specified file, move operations for moving the specified file to a different folder, rename operations for changing a name and/or path of the specified file, compression operations for compressing the specified file, encryptions operations for encrypting the specified file, and other operations for changing the specified file, its attributes, its metadata, etc..

The systems described herein may perform step <NUM> in a variety of ways. In one example, receiving the modify request may include intercepting, by minifilter <NUM>, the modify request.

The term "minifilter," as used herein, generally refers to a filter for a file system of an operating system which may intercept input/output (I/O) requests for the file system before the I/O requests reach the file system. Examples of minifilters include, without limitation, any kernel mode filter on top of a file system, such as may be available with operating systems. <FIG> illustrates an example minifilter <NUM>, which may correspond to minifilter <NUM>.

<FIG> illustrates an operating environment <NUM> for a file system <NUM> and includes a file system driver <NUM> and minifilter <NUM>. File system <NUM> may include a file system for organizing and managing files stored in a memory or storage device, such as memory <NUM>. File system driver <NUM> may provide software support for accessing file system <NUM> and may support user mode operations including a read <NUM>, a write <NUM>, a move <NUM>, and a create <NUM>.

As seen in <FIG>, minifilter <NUM> may intercept certain operations and may allow (e.g., ignore) certain other operations. In <FIG>, minifilter <NUM> may intercept write <NUM> and move <NUM>, but may automatically permit read <NUM> and create <NUM>. In some implementations, minifilter <NUM> may intercept all operations of certain types (e.g., all write and move operations) and ignore operations of other certain types (e.g., all read and create operations). Although not illustrated in <FIG>, in other implementations, additional minifilters may further filter operations such that a given operation may be filtered through various minifilters before reaching file system <NUM>. Once minifilter <NUM> intercepts an operation, minifilter <NUM> may perform additional processing before permitting or denying the operation, as will be described further below.

Turning back to step <NUM>, minifilter <NUM>, which may be a part of or operate in conjunction with receive module <NUM>, may intercept the modify request at the target device, e.g., computing device <NUM>, after receive module <NUM> receives the modify request from remote device <NUM>. For instance, minifilter <NUM> may intercept the modify request, from process <NUM> of remote device <NUM>, for modifying target file <NUM> in folder <NUM> of computing device <NUM>. Minifilter <NUM> may be configured to intercept any modify request for further processing before permitting the modify request.

In some implementations, remote device <NUM>, may include its own minifilter <NUM> for intercepting the modify request before remote device <NUM> sends the modify request to computing device <NUM>. In such implementations, minifilter <NUM> of remote device <NUM> may detect the modify request from process <NUM> on remote device <NUM> for modifying target file <NUM> in folder <NUM> of computing device <NUM>. Minifilter <NUM> of remote device <NUM> may determine, using determination factors similar to those described below with respect to step <NUM>, to determine whether target file <NUM> is in a protected folder. In some implementations, if folder <NUM> is not a protected folder, minifilter <NUM> may permit the modify request to be sent.

Minifilter <NUM> may, in response to determining that target file <NUM> is in a protected folder (e.g. that folder <NUM> is a protected folder), determine whether process <NUM> of remote device <NUM> (e.g., the process making the modify request) is an authorized process. For example, minifilter <NUM> may check a digital signature of process <NUM> or may otherwise identify process <NUM> (e.g., detecting a process ID). Minifilter <NUM> may communicate with a lockdown server, such as server <NUM>, to authorize process <NUM> (e.g., to verify the digital signature of process <NUM>). In other implementations, minifilter <NUM> may authorize process <NUM> based on a whitelist, or other authentication methods. Once minifilter <NUM> authorizes process <NUM>, minifilter <NUM> may remember process <NUM>, for instance by its process ID, in order to facilitate authorization of process <NUM> for subsequent modify requests. In such implementations, receive module <NUM> or another module <NUM> may track process creation and termination such that expired process IDs (e.g., process IDs corresponding to terminated processes) may be invalidated to no longer authorize the corresponding terminated process. For example, if process <NUM> terminates, minifilter <NUM> may no longer authorize the corresponding process ID. If a new instance of process <NUM> is created, minifilter <NUM> may re-authorized the new instance of process <NUM>.

Minifilter <NUM> may, in response to determining that process <NUM> is an authorized process, send the modify request to computing device <NUM>. If process <NUM> is not authorized, minifilter <NUM> may block the modify request from being sent, e.g., by discarding the modify request. In some implementations, the modify request may also include an identifier, such as a network address, for identifying remote device <NUM> making the modify request.

As illustrated in <FIG>, at step <NUM> one or more of the systems described herein may determine whether the folder is a protected folder. For example, folder module <NUM> may, as part of computing device <NUM> in <FIG>, determine whether folder <NUM> is a protected folder.

The term "protected folder," as used herein, generally refers to a folder (e.g., a directory, path, respository, etc.) having files. The access to the files in the protected folder may be restricted to authorized processes and/or trusted hosts.

The systems described herein may perform step <NUM> in a variety of ways. In one example, folder module <NUM> may access a list or table that enumerates protected folders on computing device <NUM>. For example, minifilter <NUM> may maintain, for instance in a local memory, a list of protected folders and recognize folder <NUM> in the list. However, due to variability in path names in network environments, such a list may not reliably identify protected folders, particularly when accessed by remote devices such as remote device <NUM>.

In some examples, minifilter <NUM>, as part of folder module <NUM>, may identify folder <NUM> as a protected folder based on whether folder <NUM> includes a marker file, such as marker file <NUM>. Minifilter <NUM> may allow read requests on folder <NUM> such that remote device <NUM> may read the contents of folder <NUM> and identify folder <NUM> as a protected folder based on the presence of marker file <NUM>. Thus, remote device <NUM> may reliably identify folder <NUM> as a protected folder despite any variation to a pathname for folder <NUM>.

<FIG> illustrates an environment <NUM> for creating a new protected folder. A process <NUM>, which may correspond to process <NUM>, may create a new protected folder. Process <NUM> may be, for example, a backup application for backing up data, a security application, or other administrative application that may create a protected folder for protecting files therein from unauthorized changes. Process <NUM> may create a folder <NUM>, which may correspond to folder <NUM>. Process <NUM> may also communicate with a server <NUM>, which may correspond to server <NUM>. Server <NUM> may be a security server, such as a lockdown server, a centralized admin server, or other server which may manage security software. Process <NUM> may notify server <NUM> that folder <NUM> is a protected folder.

In response to being notified by process <NUM>, server <NUM> may communicate a minifilter <NUM>, which may correspond to minifilter <NUM>. Minifilter <NUM> may be a minifilter configured on a file system hosting folder <NUM>. Minifilter <NUM> may add folder <NUM> to a registry <NUM> and a minifilter memory <NUM>. Registry <NUM> may be a persistent storage for storing a list of protected folders within a purview of minifilter <NUM>. Minifilter memory <NUM> may be a kernel memory for holding the list of protected folders during a runtime of minifilter <NUM>. In some implementations, minifilter memory <NUM> may load the list of protected folders from registry <NUM> when minifilter <NUM> initializes.

Minifilter <NUM> may further add a marker file <NUM> to folder <NUM>. The inclusion of marker file <NUM> in folder <NUM> may indicate that folder <NUM> is a protected file such that marker file <NUM> itself may not need to contain data. In some implementations, marker file <NUM> may contain data, such as metadata regarding folder <NUM>.

Returning to <FIG>, at step <NUM> one or more of the systems described herein may determine, in response to determining the folder is the protected folder, whether the remote device is a trusted host. For example, host validation module <NUM> may, as part of computing device <NUM> in <FIG>, determine, in response to determining the folder is the protected folder, whether remote device <NUM> is a trusted host.

The term "trusted host," as used herein, generally refers to a computing device that may be authorized or otherwise validated. Trusted hosts may be authenticated in various ways, including via identification and whitelists, passwords, keys or tokens, etc..

The systems described herein may perform step <NUM> in a variety of ways. In one example, the modify request may include an identifier, such as a network address or other identifier, of remote device <NUM>. Minifilter <NUM>, which may be part of host validation module <NUM>, may query server <NUM> with the identifier. Server <NUM>, which may be a lockdown server or other security server, may authenticate remote device <NUM> as a trusted host based on the identifier.

In other examples, host validation module <NUM> and/or minifilter <NUM> may use an in-band protocol to confirm whether remote device <NUM> is the trusted host. For instance, the modify request may include a filename of target file <NUM>. This filename may include a hash of a dynamic secret or other key maintained by server <NUM>. Host validation module <NUM> may confirm the hash with server <NUM> or may otherwise recognize the hash. The inclusion of the hash may establish that remote device <NUM> is a trusted host, as server <NUM> may share such hash with trusted hosts. Host validation module <NUM> may then strip the hash from the filename in order to identify target file <NUM>.

In yet other examples, host validation module <NUM> may confirm, by contacting remote device <NUM>, the modify request. For instance, minifilter <NUM> of computing device <NUM> may communicate with minifilter <NUM> of remote device <NUM> to confirm whether remote device <NUM> is the trusted host. Additionally or alternatively, host validation module <NUM> may request or otherwise notify server <NUM> to communicate with remote device <NUM> in order to confirm that remote device <NUM> sent the modify request. As described above, minifilter <NUM> of remote device <NUM> may initially intercept the modify request originating from remote device <NUM> and may be able to acknowledge, to minifilter <NUM> of computing device <NUM> and/or server <NUM>, that the modify request is from remote device <NUM>.

At step <NUM> one or more of the systems described herein may allow, in response to determining that the remote device is the trusted host, the modify request for the target file. For example, modify module <NUM> may, as part of computing device <NUM> in <FIG>, allow, in response to determining that remote device <NUM> is the trusted host, the modify request for target file <NUM>.

The systems described herein may perform step <NUM> in a variety of ways. In one example, minifilter <NUM> may allow the modify request such that target file <NUM> may be modified according to the modify request.

As explained above in connection with <FIG>, a backup application may use a disk as primary storage for storing backup images in a local disk folder of a local machine. The local disk folder may be shared for network access such that backup services running on various admin servers may cooperate to create and/or update backup images in the shared folder. The shared folder may include a marker file to indicate that the shared folder is a protected network folder.

In one example, a backup process on an admin server may attempt to update a backup image in the shared folder. A minifilter on the admin server may recognize, due to the presence of the marker file, that the shared folder is a protected network folder. The minifilter may then authenticate the process, and once the process is authenticated, send the update attempt to the local machine. A local minifilter on the local machine may intercept the update attempt, recognize the folder as a protected folder, authenticate the admin server, and once authenticated, allow the update attempt to proceed.

In another example, an editing process on the admin server may attempt to update the backup image in the shared folder. The minifilter on the admin server may recognize, due to the presence of the marker file, that the shared folder is a protected network folder. The minifilter may attempt to authenticate the editing process. However, the editing process may not be authorized to modify the backup image, and the minifilter may deny the update such that the update request is not sent to the local machine.

In yet another example, the local machine may receive an update request for the backup image in the shared folder from a remote machine. The remote machine may not have a minifilter configured to authenticate an originating process of the update request such that the update request is sent. The local minifilter may recognize that the shared folder is a protected folder, and determine that the update request was not sent from a trusted host, ultimately denying the update request.

Thus, by utilizing a minifilter in the remote machine and/or the local machine, the systems and methods described herein may protect files in a shared folder. An update request may be denied at the remote machine and/or the local machine. In addition, using a marker file may facilitate remote minifilters identifying protected folders. Although the present disclosure describes protecting shared folders for backup software, the inventive concepts described herein may be used with other software requiring data protection, including archival software, replication software, security software, admin software, databases, etc..

While the foregoing disclosure sets forth various embodiments using specific block diagrams, flowcharts, and examples, each block diagram component, flowchart step, operation, and/or component described and/or illustrated herein may be implemented, individually and/or collectively, using a wide range of hardware, software, or firmware (or any combination thereof) configurations. In addition, any disclosure of components contained within other components should be considered example in nature since many other architectures can be implemented to achieve the same functionality.

In some examples, all or a portion of example system <NUM> in <FIG> may represent portions of a cloud-computing or network-based environment. Cloud-computing environments may provide various services and applications via the Internet. These cloud-based services (e.g., software as a service, platform as a service, infrastructure as a service, etc.) may be accessible through a web browser or other remote interface. Various functions described herein may be provided through a remote desktop environment or any other cloud-based computing environment.

In various embodiments, all or a portion of example system <NUM> in <FIG> may facilitate multi-tenancy within a cloud-based computing environment. In other words, the modules described herein may configure a computing system (e.g., a server) to facilitate multi-tenancy for one or more of the functions described herein. For example, one or more of the modules described herein may program a server to enable two or more clients (e.g., customers) to share an application that is running on the server. A server programmed in this manner may share an application, operating system, processing system, and/or storage system among multiple customers (i.e., tenants). One or more of the modules described herein may also partition data and/or configuration information of a multi-tenant application for each customer such that one customer cannot access data and/or configuration information of another customer.

According to various embodiments, all or a portion of example system <NUM> in <FIG> may be implemented within a virtual environment. For example, the modules and/or data described herein may reside and/or execute within a virtual machine. As used herein, the term "virtual machine" generally refers to any operating system environment that is abstracted from computing hardware by a virtual machine manager (e.g., a hypervisor).

In some examples, all or a portion of example system <NUM> in <FIG> may represent portions of a mobile computing environment. Mobile computing environments may be implemented by a wide range of mobile computing devices, including mobile phones, tablet computers, e-book readers, personal digital assistants, wearable computing devices (e.g., computing devices with a head-mounted display, smartwatches, etc.), variations or combinations of one or more of the same, or any other suitable mobile computing devices. In some examples, mobile computing environments may have one or more distinct features, including, for example, reliance on battery power, presenting only one foreground application at any given time, remote management features, touchscreen features, location and movement data (e.g., provided by Global Positioning Systems, gyroscopes, accelerometers, etc.), restricted platforms that restrict modifications to system-level configurations and/or that limit the ability of third-party software to inspect the behavior of other applications, controls to restrict the installation of applications (e.g., to only originate from approved application stores), etc. Various functions described herein may be provided for a mobile computing environment and/or may interact with a mobile computing environment.

While various embodiments have been described and/or illustrated herein in the context of fully functional computing systems, one or more of these example embodiments may be distributed as a program product in a variety of forms, regardless of the particular type of computer-readable media used to actually carry out the distribution. The embodiments disclosed herein may also be implemented using modules that perform certain tasks. These modules may include script, batch, or other executable files that may be stored on a computer-readable storage medium or in a computing system. In some embodiments, these modules may configure a computing system to perform one or more of the example embodiments disclosed herein.

The preceding description has been provided to enable others skilled in the art to best utilize various aspects of the example embodiments disclosed herein. This example description is not intended to be exhaustive or to be limited to any precise form disclosed. Many modifications and variations are possible without departing from the scope of the present disclosure as defined by the appended claims. The embodiments disclosed herein should be considered in all respects illustrative and not restrictive. Reference should be made to the appended claims in determining the scope of the present disclosure.

Claim 1:
A computer-implemented method for protecting a folder from unauthorized file modification, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
receiving, from a remote device, a modify request for a target file in a folder, wherein the remote device sends the modify request in response to:
detecting the modify request from a process on the remote device;
determining whether the target file is in a protected folder;
determining, in response to determining that the target file is in the protected folder, whether the process is an authorized process; and
sending, in response to determining that the process is the authorized process,
the modify request;
determining whether the folder is the protected folder;
determining, in response to determining the folder is the protected folder, whether the remote device is a trusted host; and
allowing, in response to determining that the remote device is the trusted host, the modify request for the target file.