The EaseFilter Encryption Filter Driver (EEFD) SDK provides a kernel-mode framework for Windows environments that allows developers to implement military-grade, transparent, "at-rest" data encryption. Unlike traditional disk encryption that operates at the volume level, EEFD operates at the file-system level. This enables granular, policy-based security that can dynamically encrypt and decrypt data on the fly based on specific users, processes, or file paths, without requiring any modifications to existing user applications.
Core Architecture
The SDK leverages the Windows File System Minifilter architecture to intercept I/O requests before they reach the physical storage medium (NTFS, FAT, Network).
The architecture consists of two primary components:
Kernel-Mode Filter Driver (EaseFlt.sys): Sits between the I/O Manager and the file system. It intercepts I/O Request Packets (IRPs) for read/write operations, enforcing encryption policies and performing cryptographic transformations in real time.
User-Mode API Library (FilterAPI.dll): A managed and unmanaged library (supporting C++, C#, Java, Python, Go, Rust) that allows developers to communicate with the kernel driver. It is used to define filter rules, manage encryption keys, and register I/O callbacks.
Key Technical Features
Cryptographic Standards
The encryption engine utilizes Microsoft Cryptography Next Generation (CNG) libraries and is fully US FIPS 140-2 compliant.
Algorithms: Advanced Encryption Standard (AES) with 128, 192, and 256-bit key sizes (Symmetric Block Cipher).
Hardware Acceleration: Native support for AES-NI (Intel Advanced Encryption Standard New Instructions), providing up to a 10x performance improvement for parallel operation modes (CBC-decrypt, CTR) compared to pure software encryption.
Block-Level Decryption (Partial Decryption): Decrypts data in 16-byte blocks. If an application requests a specific offset within a massive file, the driver decrypts only the necessary 16-byte segments requested by the application rather than the entire file, significantly boosting read performance and reducing I/O latency.
Isolation Filter Technology (Unique Cache Views)
In a standard Windows environment, the System Cache Manager maintains a single view of file data in memory. If an authorized process opens an encrypted file and populates the cache with clear text, an unauthorized process could potentially read that clear text directly from the shared cache.
EaseFilter solves this by bypassing the global System Cache Manager to create independent memory cache views for each process or user:
Authorized View: When an authorized process requests the file, the driver decrypts it in memory and places it into a specific "Clear Data" cache section.
Unauthorized View: When an unauthorized process (e.g., explorer.exe or a backup tool) requests the file, the driver serves data from a separate cache section containing the raw, encrypted bytes.
The Role of Shadow File Objects
To manage these isolated views simultaneously, the driver uses two types of File Objects:
Upper File Object: This is what the user application sees. It represents the specific "View" (decrypted or encrypted) granted to that process based on security policies.
Shadow (Lower) File Object: This is used by the driver to communicate with the actual storage device. It always handles the raw, encrypted data. On-Access File Encryption SDK
Digital Rights Management (DRM) Headers & File Structure
The driver allows developers to attach customized metadata headers directly to encrypted files. This encrypted file header allows you to embed Digital Rights Management (DRM) metadata (Encryption Keys/IVs, Security IDs, or File Policies).
Structure of the File on Disk:
Header (Metadata): Your custom data (e.g., 1KB).
Encrypted Data: The actual content of the file, encrypted using AES-256.
The filter driver strictly hides this header from user applications. When an authorized process opens the file, the driver strips the header in memory so the application thinks the file starts exactly at Offset 0.
Policy-Based Control Vectors
The "Isolated View" is triggered by granular Access Control Policies. You can isolate views and enforce encryption rules based on:
File Path/Type: Per-file or per-folder policies with inclusion/exclusion filters.
Process Name/ID: Restrict decryption to specific binaries (e.g., only winword.exe gets clear text).
User SID: Restrict decryption to specific Windows user accounts or domains (e.g., only the "HR_Manager" user sees decrypted data).
IP Address: For files accessed over a network.
Why Use EEFD vs. Traditional Encryption Libraries?
No Code Changes Needed: Works transparently at the kernel level. Your enterprise applications don't need built-in encryption logic.
High Performance: On-access encryption eliminates the overhead of duplicating files and keeps I/O fast.
Partial Encryption/Decryption: Random block-level decryption is a massive performance optimization for large files where only small portions are accessed at a time.
Flexible Key Management: Use static keys, per-user keys, or seamlessly integrate with your existing external Key Management Systems (KMS).