EaseFilter Transparent File Encryption Filter Driver SDK

Overview

The EaseFilter Encryption Filter Driver (EEFD) SDK provides a kernel-mode framework for Windows environments that allows developers to implement military-grade, transparent, "at-rest" data encryption. Unlike traditional disk encryption that operates at the volume level, EEFD operates at the file-system level. This enables granular, policy-based security that can dynamically encrypt and decrypt data on the fly based on specific users, processes, or file paths, without requiring any modifications to existing user applications.

Core Architecture

The SDK leverages the Windows File System Minifilter architecture to intercept I/O requests before they reach the physical storage medium (NTFS, FAT, Network).

The architecture consists of two primary components:

1. Kernel-Mode Filter Driver (EaseFlt.sys): Sits between the I/O Manager and the file system. It intercepts I/O Request Packets (IRPs) for read/write operations, enforcing encryption policies and performing cryptographic transformations in real time.
2. User-Mode API Library (FilterAPI.dll): A managed and unmanaged library (supporting C++, C#, Java, Python, Go, Rust) that allows developers to communicate with the kernel driver. It is used to define filter rules, manage encryption keys, and register I/O callbacks.

Key Technical Features

Cryptographic Standards

The encryption engine utilizes Microsoft Cryptography Next Generation (CNG) libraries and is fully US FIPS 140-2 compliant.

• Algorithms: Advanced Encryption Standard (AES) with 128, 192, and 256-bit key sizes (Symmetric Block Cipher).
• Hardware Acceleration: Native support for AES-NI (Intel Advanced Encryption Standard New Instructions), providing up to a 10x performance improvement for parallel operation modes (CBC-decrypt, CTR) compared to pure software encryption.
• Block-Level Decryption (Partial Decryption): Decrypts data in 16-byte blocks. If an application requests a specific offset within a massive file, the driver decrypts only the necessary 16-byte segments requested by the application rather than the entire file, significantly boosting read performance and reducing I/O latency.

Isolation Filter Technology (Unique Cache Views)

In a standard Windows environment, the System Cache Manager maintains a single view of file data in memory. If an authorized process opens an encrypted file and populates the cache with clear text, an unauthorized process could potentially read that clear text directly from the shared cache.

EaseFilter solves this by bypassing the global System Cache Manager to create independent memory cache views for each process or user:

• Authorized View: When an authorized process requests the file, the driver decrypts it in memory and places it into a specific "Clear Data" cache section.
• Unauthorized View: When an unauthorized process (e.g., explorer.exe or a backup tool) requests the file, the driver serves data from a separate cache section containing the raw, encrypted bytes.

The Role of Shadow File Objects

To manage these isolated views simultaneously, the driver uses two types of File Objects:

1. Upper File Object: This is what the user application sees. It represents the specific "View" (decrypted or encrypted) granted to that process based on security policies.
2. Shadow (Lower) File Object: This is used by the driver to communicate with the actual storage device. It always handles the raw, encrypted data.

Digital Rights Management (DRM) Headers & File Structure

The driver allows developers to attach customized metadata headers directly to encrypted files. This encrypted file header allows you to embed Digital Rights Management (DRM) metadata (Encryption Keys/IVs, Security IDs, or File Policies).

Structure of the File on Disk:

1. Header (Metadata): Your custom data (e.g., 1KB).
2. Encrypted Data: The actual content of the file, encrypted using AES-256.

The filter driver strictly hides this header from user applications. When an authorized process opens the file, the driver strips the header in memory so the application thinks the file starts exactly at Offset 0.

Policy-Based Control Vectors

The "Isolated View" is triggered by granular Access Control Policies. You can isolate views and enforce encryption rules based on:

• File Path/Type: Per-file or per-folder policies with inclusion/exclusion filters.
• Process Name/ID: Restrict decryption to specific binaries (e.g., only winword.exe gets clear text).
• User SID: Restrict decryption to specific Windows user accounts or domains (e.g., only the "HR_Manager" user sees decrypted data).
• IP Address: For files accessed over a network.

Why Use EEFD vs. Traditional Encryption Libraries?

• No Code Changes Needed: Works transparently at the kernel level. Your enterprise applications don't need built-in encryption logic.
• High Performance: On-access encryption eliminates the overhead of duplicating files and keeps I/O fast.
• Partial Encryption/Decryption: Random block-level decryption is a massive performance optimization for large files where only small portions are accessed at a time.
• Flexible Key Management: Use static keys, per-user keys, or seamlessly integrate with your existing external Key Management Systems (KMS).

Transparent Data Flow

Write Operation (Encryption)

1. An authorized application initiates a Write request to a file.
2. The Pre-Write Callback in the EaseFilter driver intercepts the clear data buffer.
3. The driver encrypts the data using AES-256 in memory.
4. The encrypted cipher text (appended after the hidden header) is passed down the I/O stack and written to the physical disk.

Read Operation (Decryption)

1. An authorized application initiates a Read request.
2. The file system retrieves the raw encrypted data from the disk.
3. The Post-Read Callback intercepts the returning buffer. The driver checks the Process ID and User SID against the policy.
4. If authorized, the Decryption Engine restores the data to clear text in the memory buffer before it reaches the application. If unauthorized, the application receives the raw cipher-text.

Integration Workflow

Implementing the EEFD SDK follows a standard initialization and rule-setting pattern.

1. Initialize the Filter Control: Instantiate the FilterControl object and apply your license key. Set the filter type to FILE_SYSTEM_ENCRYPTION.
2. Define Filter Rules: Create FileFilter objects to establish encryption boundaries using wildcards (e.g., C:\SecureData\*.docx).
3. Configure Access Policies: For each rule, specify the inclusion/exclusion lists for processes and users (User SIDs).
4. Register Callbacks (Optional): To inject custom key management logic from an external KMS or apply DRM tags, set EnableEncryptionKeyFromService to true and register the OnFilterRequestEncryptKey callback.
5. Start the Filter Service: Push the configuration to the kernel driver to begin active interception.

Common Use Cases

1. Data at Rest Encryption

Prevents physical data breaches by ensuring files are encrypted when written to disk. You can also specify if newly created files in a watched directory should bypass encryption.

// Encrypt all files within the SecureData directory
FileFilter filter = new FileFilter("C:\\SecureData\\*");

// Enable the encryption engine for this rule
filter.EnableEncryption = true;

// Optional: Don't encrypt newly created files in this folder, only protect existing ones
// filter.EnableEncryptNewFile = false; 

// Assign the 256-bit AES key (in production, fetch this from a secure KMS)
filter.EncryptionKey = Encoding.UTF8.GetBytes("Your32ByteSuperSecretKeyHere1234");

filterControl.AddFilter(filter);

2. Insider Threat Protection

Prevents unauthorized internal processes or users from accessing clear text. Isolation Minifilter Technology ensures only approved apps (or specific User SIDs) get the decrypted view.

FileFilter filter = new FileFilter("C:\\Finance\\*");
filter.EnableEncryption = true;
filter.EncryptionKey = mySecureKey;

// Deny decrypted read access to all processes by default (they see cipher text)
filter.AccessFlags = FilterAPI.ALLOW_MAX_ACCESS_RIGHT & ~FilterAPI.ALLOW_ENCRYPTED_READ;

// Explicitly authorize Word to receive the decrypted clear text view
filter.AddProcessRight("WINWORD.exe", FilterAPI.ALLOW_MAX_ACCESS_RIGHT);

// Explicitly authorize a specific user domain/account to read decrypted data
filter.userAccessRightList.Add("DomainName\\AuthorizedUser", FilterAPI.ALLOW_MAX_ACCESS_RIGHT);

// Set black list for all other users to only see raw encrypted bytes
filter.userAccessRightList.Add("*", FilterAPI.ALLOW_MAX_ACCESS_RIGHT & ~(uint)FilterAPI.AccessFlag.ALLOW_READ_ENCRYPTED_FILES);

filterControl.AddFilter(filter);

3. Secure File Sharing (DRM)

Encrypted files can be distributed externally. By enabling the key request from a service, you can dynamically authorize file access, assign custom keys, and read/write custom DRM tag data to the encrypted file's physical header.

FileFilter filter = new FileFilter("C:\\SharedFolder\\*");
filter.EnableEncryption = true;

// Enable the encryption key from service; you can append custom DRM data here
filter.EnableEncryptionKeyFromService = true;

// Register the callback function to authorize file access and manage keys dynamically
filter.OnFilterRequestEncryptKey += OnFilterRequestEncryptKey;

filterControl.AddFilter(filter);

// Callback implementation
public void OnFilterRequestEncryptKey(object sender, EncryptEventArgs e)
{
    e.ReturnStatus = NtStatus.Status.Success;

    if (e.IsNewCreatedFile)
    {
        // If you want to block the new file creation, you can return access denied status:
        // e.ReturnStatus = NtStatus.Status.AccessDenied;

        // If you want the file to be created without encryption, return below status:
        // e.ReturnStatus = NtStatus.Status.FileIsNoEncrypted;

        // For a newly created file, add custom DRM/tag data to the encrypted file header.
        // Here we just add the file name as the tag data.
        e.EncryptionTag = UnicodeEncoding.Unicode.GetBytes(e.FileName);
    }
    else
    {
        // This is an encrypted file open request; request the encryption key and IV.

        // If you want to block the encrypted file from being opened, return access denied:
        // e.ReturnStatus = NtStatus.Status.AccessDenied;

        // If you want to return the raw encrypted data (cipher text) for this file:
        // e.ReturnStatus = NtStatus.Status.FileIsEncrypted;

        // Retrieve the tag data previously set when the new file was created.
        byte[] tagData = e.EncryptionTag;
    }

    // Assign the encryption key for the encrypted file (fetch your own key securely)
    e.EncryptionKey = Utils.GetKeyByPassPhrase(GlobalConfig.MasterPassword, 32);
           
    // If you want to use your own IV for the encrypted file, set the value here.
    // If you do not set the IV here, a unique auto-generated IV will be assigned.
    // e.IV = Utils.GetIVByPassPhrase(GlobalConfig.MasterPassword);
}

4. Ransomware Protection

Combine encryption with access control to block untrusted binaries from modifying, deleting, or encrypting your already-secured data.

FileFilter filter = new FileFilter("C:\\ProtectedBackups\\*");

filter.EnableEncryption = true;
filter.EncryptionKey = mySecureKey;

// Block files from being renamed or deleted by any process
filter.AccessFlags = FilterAPI.ALLOW_MAX_ACCESS_RIGHT 
                    & ~FilterAPI.BLOCK_FILE_DELETION 
                    & ~FilterAPI.BLOCK_FILE_RENAME;

// Whitelist the backup agent to allow writing and modification
filter.AddProcessRight("VeeamAgent.exe", FilterAPI.ALLOW_MAX_ACCESS_RIGHT);

filterControl.AddFilter(filter);

Conclusion and Next Steps for Developers

The EaseFilter Encryption Filter Driver SDK drastically reduces the complexity of building kernel-level, transparent data encryption into your enterprise applications. By abstracting away the deep intricacies of the Windows I/O Manager and System Cache, the SDK allows you to focus on your application's core logic, key management, and security policies using high-level languages like C#, C++, or Python.

To get started with your integration:

1. Test the Samples: Download the EaseFilter SDK and run the pre-configured C# or C++ AutoFileEncryption demo projects. This is the fastest way to see the Isolation Filter Technology and block-level decryption in action.
2. Define Your Architecture: Decide whether you will use static keys via the API, or if you need to build a dynamic key-delivery system using the OnFilterRequestEncryptKey callback for DRM and Secure File Sharing.
3. Prototype Access Rules: Start with restrictive ProcessNameAccessRightList and userAccessRightList configurations to strictly control which test applications receive the decrypted clear text views.
4. Review the API Docs: Consult the complete EaseFilter API Reference to explore advanced features like custom audit logging, network path filtering, and hardware acceleration settings.