CN102194079B

CN102194079B - File access filtering method

Info

Publication number: CN102194079B
Application number: CN2011100666875A
Authority: CN
Inventors: 于晓军; 万雪松; 赵辰清
Original assignee: STRONG UNION TECHNOLOGY Co Ltd
Current assignee: STRONG UNION TECHNOLOGY Co Ltd
Priority date: 2011-03-18
Filing date: 2011-03-18
Publication date: 2013-09-11
Anticipated expiration: 2031-03-18
Also published as: CN102194079A

Abstract

The invention discloses a file access filtering method which belongs to the technical field of network safety. The file access filtering method comprises the following steps: S1) processing an IRP (input/output request package) request category and a request of withdrawing from drive, and mounting a corresponding dispatch function; S2) processing calling of a user layer, and emitting a calling command to an inner nuclear layer; S3) getting an afferent Handle through a parameter when calling a Windows inner nuclear function in user-defined functions, and inquiring whether a path corresponding to the Handle is a file folder path or not by calling the inner nuclear function of a system, if the path is the file holder path and does not contain a magnetic disk drive, not performing contrast, if the path is a file path, comparing in a white list; and S4) notifying an application program of the user layer of retrieving illegal access file information recorded in a BackList through a shared event created between the user layer and the inner nuclear layer, and using the application program of the user layer to write the illegal access file information into a log file. By adopting the file access filtering method, a user can conveniently further adopt measures for protecting personal files.

Description

The file access filter method

Technical field

The present invention relates to the network security technology field, particularly a kind of file access filter method.

Background technology

Along with computer and internet more and more become an indispensable part in people's life, personal document's safety problem more and more comes into one's own.A lot of rogue programs or wooden horse stealthily scan user's file under the ignorant situation of user, even file is uploaded on the specified server.

Under windows platform, operating system is divided into two parts: client layer (also being called the Ring3 layer) and inner nuclear layer (also being called the Ring0 layer).The api interface that Windows provides all calls Ring0 layer kernel function from the Ring3 layer and realizes function.Can say like this, if reach protection computer, protected file, take measures to be absolutely necessary at the Ring0 layer.

Kai Fa file protection product in the market, one of technology of employing are exactly by Windows kernel function ZwCreateFile function is linked up with (HOOK), reach the purpose of control documents operation, protected file.

As everyone knows, the visit of file at first will be called the handle that ZwCreateFile takes file under the Windows, by the handle further operations such as the reading and writing of operation file, deletion again of file.If in the ZwCreateFile function, add the interception code, just can obtain the action of all operations file, parameters such as file path, authority, process.The specific implementation process of hook: SSDT (System Services Descriptor Table, the system service description list) table by the windows kernel searches the ZwCreateFile function address.Replace to self-defining MyCreateFile function address, in MyCreateFile, call primal system ZwCreateFile function, so just reach the entire flow of hook windows function.The specific implementation process of monitoring: in self-defining function MyCreateFile function, at first obtain the user and want parameters such as the file path of operation file and current process.According to permission process and file path, the tabulation of the white list of file type compares, and looks at whether allow to pass through.If eligible being present in the white list, will continue calling system function ZwCreateFile function.Ineligible or do not exist in the white list, will never call the ZwCreateFile function, directly return failure.So just arrive the purpose of monitoring file access.

The defective of above implementation method is: 1, efficient is lower: because the visit of file and file all will be passed through the ZwCreateFile function, so the contrast in a lot of paths all is the contrast at equipment and folder path in fact.Because white list is long, contrast an efficient fully and can descend naturally a lot, and these contrasts can bring the consumption of unnecessary internal memory and cpu resource, increased the risk of instability of system.2, do not record those files once by illegal operation: user's file is by illegal operation; utilize product that it is protected; but the user does not also know those files by that process illegal operation, like this this process operation file again of also can having an opportunity.

Summary of the invention

(1) technical matters that will solve

The technical problem to be solved in the present invention is: how to provide a kind of and carry out the efficient height, make things convenient for the user further to take measures to protect personal document's file access filter method.

(2) technical scheme

For solving the problems of the technologies described above, the invention provides a kind of file access filter method, may further comprise the steps:

S1, processing I/O request bag IRP ask classification and withdraw from driving request, and the corresponding function of sending is installed;

S2, process user layer call, and send call instruction to inner nuclear layer;

S3, take the handle Handle that imports into by parameter when calling described Windows kernel function in described self-defining function, whether the path of inquiring about this Handle correspondence by the kernel function of calling system is folder path; If folder path, and do not comprise the disk drive, then do not compare; If file path, then in described white list, compare, if this document path is not allowing then will be recorded to current unauthorized access fileinfo among the return-list BackList within the scope of visit in explanation this document path within the white list scope of claimed file path;

S4, the shared event by creating between client layer and the inner nuclear layer, the application program of notice client layer is fetched the unauthorized access fileinfo that records among the BackList, and the client layer application program is written to this unauthorized access fileinfo in the journal file.

Wherein, step S2 is specially: when client layer sent initiation command, inner nuclear layer began to search the address of a kind of Windows kernel function among the system service description list SSDT, and this address translation is become a kind of address of self-defining function, thereby finished the hook action.

Wherein, among the step S1, described IRP request classification comprises IRP_MJ_CREATE, IRP_MJ_READ, IRP_MJ_CLOSE and IRP_MJ_DEVICE_CONTROL.

Wherein, described Windows kernel function is the ZwCreateFile function.

(3) beneficial effect

The present invention has distinguished file path and folder path by when HOOK kernel function ZwCreateFile makes protected file not by unauthorized access.Improved folder path speed relatively, accelerated comparison efficiency.Lay the foundation for further file being carried out extended operation.The user can see the circumstances of protected file by checking daily record (log) file, when understands, which process, has visited illegal operation such as which file, is next step checking and killing Trojan of user, and rogue programs such as virus provide help.

Description of drawings

Fig. 1 is method flow diagram of the present invention.

Embodiment

Below in conjunction with drawings and Examples, the specific embodiment of the present invention is described in further detail.Following examples are used for explanation the present invention, but are not used for limiting the scope of the invention.

As shown in Figure 1, file access filter method of the present invention may further comprise the steps:

S1, processing I/O request bag IRP ask classification and withdraw from driving request DriverUnload, and the corresponding function of sending is installed;

S2, process user layer call, and send call instruction to inner nuclear layer, for example: when client layer sends initiation command, inner nuclear layer begins to search the address of Windows kernel function ZwCreateFile among the system service description list SSDT, and this address translation become the address of self-defining function MyCreateFile, thereby finish hook HOOK action;

S3, take the handle Handle that imports into by parameter when calling described Windows kernel function in described self-defining function, whether the path of inquiring about this Handle correspondence by the kernel function of calling system is folder path; If folder path, and do not comprise the disk drive, for example: C: do not compare because this situation not within the list scope of needs contrast, is directly returned; If file path, then in described white list, compare, if this document path is not allowing then will be recorded to current unauthorized access fileinfo among the return-list BackList within the scope of visit in explanation this document path within the white list scope of claimed file path;

S4, the shared event Event by creating between client layer and the inner nuclear layer, the application program of notice client layer is fetched the unauthorized access fileinfo that records among the BackList, and the client layer application program is written to this unauthorized access fileinfo in the journal file.

Above embodiment only is used for explanation the present invention; and be not limitation of the present invention; the those of ordinary skill in relevant technologies field; under the situation that does not break away from the spirit and scope of the present invention; can also make a variety of changes and modification; therefore all technical schemes that are equal to also belong to category of the present invention, and scope of patent protection of the present invention should be defined by the claims.

Claims

1. a file access filter method is characterized in that, may further comprise the steps:

S1, processing IRP ask classification and withdraw from driving request, and the corresponding function of sending is installed;

S2, process user layer call, and send call instruction to inner nuclear layer; When client layer sends initiation command, inner nuclear layer begins to search the address of a kind of Windows kernel function among the system service description list SSDT, and this address translation become a kind of address of self-defining function, thus finish the hook action, described Windows kernel function is the ZwCreateFile function;

S3, take the handle Handle that imports into by parameter when calling described Windows kernel function in described self-defining function, whether the path of inquiring about this Handle correspondence by the kernel function of calling system is folder path; If folder path, and do not comprise the disk drive, then do not compare; If file path, then in white list, compare, if this document path is not allowing then will be recorded to current unauthorized access fileinfo among the return-list BackList within the scope of visit in explanation this document path within the white list scope of claimed file path;

2. file access filter method as claimed in claim 1 is characterized in that, among the step S1, described IRP request classification comprises IRP_MJ_CREATE, IRP_MJ_READ, IRP_MJ_CLOSE and IRP_MJ_DEVICE_CONTROL.