KR101221399B1 - File access control system and method based on file path - Google Patents

Abstract

The present invention relates to a file access control system of a computer, and more particularly, to a file path-based file access control system and method for performing file access control by a file path in which a file is stored.
The present invention provides a file input / output monitoring unit that extracts and outputs a file path included in the file access control command when a file access control command for a file is generated, and path nodes by analyzing file paths of files stored in a storage device. A file tree path table which is classified and stored as a file and an access policy for each of the last nodes of the file tree path are stored. The file paths inputted from the file input / output monitoring unit are analyzed and classified into tree nodes. And sequentially searching for nodes classified in the file tree path table to include all nodes of the file path, and including an access control unit for performing file access control according to an access policy corresponding to a final node.

Description

FILE ACCESS CONTROL SYSTEM AND METHOD BASED ON FILE PATH}

The present invention relates to a file access control system of a computer, and more particularly, to a file path-based file access control system and method for performing file access control by a file path in which a file is stored.

Generally, an operating system (OS) performs file access control for security. Typically file identification is required for file access control. The identification of a file for file access control is made by the full path or file ID of the file (hereinafter referred to as "file identifier").

In general, an operating system such as Windows may have a long path and a short path in the same file, and a combination of the two may be used to create multiple paths for a single file. It is not appropriate because it can come out. Therefore, in Windows, a file identifier method using a file identifier (FileID) unique to files generated by a file system is applied.

Therefore, when performing access control, the file access control unit creates and manages file identifiers for files for which the file access control policy is set as a hash table. Typically, a policy consists of one policy per file.

If a file identifier is assigned a unique value to each file in the same drive, but the same file is stored in two different drivers, the same file identifier may be assigned to the two files. Therefore, the file identifier cannot be used alone, but with a drive letter.

In order to obtain a file identifier, the handle is obtained by opening the file using the full path of the file in which the file is stored, and the file identifier is obtained by opening the file by a function using the handle as a parameter. For Windows, the ZwQueryInformationFile () function may be used as a function for obtaining the file identifier.

1 is a diagram illustrating a method of obtaining a file identifier in a general Windows kernel. Hereinafter, a method of obtaining a file identifier in a Windows kernel for performing file access control based on a general file identifier after obtaining a handle will be described with reference to FIG. 1.

First, when a file access event is generated by an application program driving, the Windows application driver 10 as a user layer provides a file access command to the first file system filter driver 20 of the kernel layer (①). The file access command may be a file open command by a file read or write command, a file creation command, a file delete command, a file execution command, or the like.

The first file system filter driver 20 monitors whether a file access command is input from the Windows application driver 10 when a file access event is generated, and when the file access command is input, the input file access command is re-entered. Determines if a file access command exists. The determination of whether the file access command is a reentrant command is determined by checking whether a thread ID identical to a thread ID unique to the file access command is stored. The stored thread ID is deleted after obtaining file handle information in step ⑨ described later. As a result of the determination, if the file access command is not a reentry file access command, file information including file full path and file name included in the file access command is detected and file full path information for obtaining handle information of the selected file is sent to the file search unit 21. Provide a file inquiry request (②).

The file inquiry unit 21 that has received a file inquiry request generates and outputs a file inquiry command including the entire file path information (③).

The output file inquiry command may be input directly to the file manager 40, or when a program for generating a system filter driver, such as a virus program, is installed, is input to the second file system filter driver 30.

When the file manager 40 is directly input to the file manager 40, the file manager 40 receives the file inquiry command and receives handle information about a file of a file path included in the file inquiry command from the first file system filter driver 20. It is provided to the file inquiry unit 20 (⑨).

When the handle information is obtained, the first file system filter driver 20 obtains a file identifier FileID of the selected file by using the ZwQueryInformationFile () function.

On the other hand, when a file inquiry command is input to the second file system filter driver 30, the second file system filter driver 30 detects file information from the file inquiry command, and a file for performing a corresponding function. File information detected for opening is provided to the file inquiry unit 31 (④). For example, when the second file system filter driver unit 30 is a driver installed by a virus application program, the first file system filter driver unit 20 generates a file access command for virus scanning of the selected file. (⑤).

Then, the first file system filter driver 20 determines whether the file access command is a reentry command. At this time, the file access command is a command re-entry from the second file system filter driver 30 and is bypassed as it is and outputted to the file manager 40 (6).

The file manager 40 receives the bypassed file access command, reads handle information on a file corresponding to the file information included in the file access command, and reads the file inquiry unit of the second file system filter driver 30. 31) (⑦).

The file inquiry unit 31 that has received the file information provides the file management unit 40 with a file inquiry command by the request of the file inquiry unit 21 of the first file system filter drive 20 (9).

Then, the file manager 40 provides the handle information on the file of the file path included in the file inquiry command to the file inquiry unit 20 of the first file system filter driver 20 (9).

When the handle information is obtained, the first file system filter driver 20 obtains a file identifier FileID of the selected file by using the ZwQueryInformationFile () function.

As described above, the file identifier-based access control requires a lot of time in order to obtain a file identifier, which causes a lot of time and a lot of load on the system.

In addition, the conventional file identifier-based access control has a problem in that a stack overflow may be generated by performing a hang phenomenon and infinite repetition by opening a file to obtain a file identifier.

In addition, the conventional file identifier-based access control has a problem that a system may become unstable because a collision may occur when acquiring a file identifier between applications generating a file system filter driver.

Accordingly, an object of the present invention is to divide a path for file access control in a tree method when creating and accessing a file, to register it in a hash table, and to perform file access based on a file path registered in a hash table. It is to provide a control system and method.

단, MAXSIZE는 상기 테이블의 버킷(Bucket) 수File path based file access control system of the present invention for achieving the above object; A file input / output monitoring unit which extracts and outputs a file path included in the file access control command when a file access control command for a file is generated, and a file including path information including a long path and a short path from a Windows application driver. File tree path table and each file tree that classify the path information into nodes constituting the long and short paths of the path information and assign the classified nodes to a table to include the long path and the short path information. Access policy for each of the last nodes of the path is stored, and the file paths inputted from the file input / output monitoring unit are analyzed and classified into tree nodes, and the nodes classified in the file tree path table are sequentially found. For one of the long and short paths of the file path In the case of including the node includes an access control for performing a file access control according to the access policy set in the last node, the file input and output monitoring unit, extracts the file path included in the file access command to output to the access control And at least one file system filter driver.
File path based file access control system of the present invention for achieving the above object; A file input / output monitoring unit which extracts and outputs a file path included in the file access control command when a file access control command for a file is generated, and a file including path information including a long path and a short path from a Windows application driver. File tree path table and each file tree that classify the path information into nodes constituting the long and short paths of the path information and assign the classified nodes to a table to include the long path and the short path information. Access policy for each of the last nodes of the path is stored, and the file paths inputted from the file input / output monitoring unit are analyzed and classified into tree nodes, and the nodes classified in the file tree path table are sequentially found. For one of the long and short paths of the file path In the case of including the node includes an access control unit for performing a file access control according to the corresponding access policy set in the last node, the file input and output monitoring unit, extracts the file path included in the file access command, and extracts the extracted file path And a file system mini filter driver having an open mode output to the access controller and a normalization mode for obtaining a long path and outputting the long path if the extracted file is a short path.
File path based file access control system of the present invention for achieving the above object; A file input / output monitoring unit which extracts and outputs a file path included in the file access control command when a file access control command for a file is generated, and a file including path information including a long path and a short path from a Windows application driver. File tree path table and each file tree that classify the path information into nodes constituting the long and short paths of the path information and assign the classified nodes to a table to include the long path and the short path information. Access policy for each of the last nodes of the path is stored, and the file paths inputted from the file input / output monitoring unit are analyzed and classified into tree nodes, and the nodes classified in the file tree path table are sequentially found. For one of the long and short paths of the file path In the case of including nodes, the access control unit performs a file access control according to a corresponding access policy set in a final node, wherein the analyzed nodes of the file path are buckets corresponding to a key calculated by Equation 2 below. It is characterized in that sequentially assigned to and stored in.
&Quot; (2) "

However, MAXSIZE is the number of buckets in the table.

delete

delete

delete

delete

delete

File path based file access control method of the present invention for achieving the object of the present invention; In the file access control method, when a file registration event including path information including a long path and a short path is received from a Windows application driver, the file access control method is classified and classified into nodes constituting the long path and the short path of the path information. A file path based access policy setting process of allocating nodes to a file tree path table to include long path and short path information, and registering an access policy for each of the last nodes of each file tree path; When a file access command is generated, path information included in the file access command is detected, nodes of the path information are detected and sequentially tracked in the table to access a file mapped to a final node including nodes of the file path. Includes a file access control process that performs file access control in accordance with policy. However, the file path based access policy setting process may include an event generation step of checking whether a file registration event occurs from an access policy setting application of a window application driver through a file input / output monitoring unit, and registering the file when the file registration event occurs. A file path obtaining step of obtaining a file path including a long path and a short path to the file to be registered from a file registration command generated when an event occurs; and classifying nodes of long path and short path of the obtained file path A key value calculating step of detecting and calculating a key value for each node according to Equation 3 below, and each node in a bucket of a file path table corresponding to the key value to include path information when the key value is calculated. Allocating and storing a path table, and the file path Receiving the access policy of the file corresponding to the file paths registered in the table via the access policy setting application in the window, the application driving unit characterized in that it includes a file access policy setting step of setting an access policy file.
File path based file access control method of the present invention for achieving the object of the present invention; The file access control process may include a file access event generation step of checking whether a file access event occurs from applications of a Windows application driver through a file input / output monitoring unit, and obtaining a file path from a file access command when a file access event occurs. A file path obtaining step, detecting a node of the obtained file path, calculating a key value for each node by Equation 3 below, and calculating the key values in the path table. An access policy registration determination step of sequentially tracking corresponding nodes in the path table according to the file path to check whether all nodes corresponding to the file path are present; and if all nodes exist, a file mapped to the last node of the nodes. A file that performs file access control in accordance with an access policy And one access control step.

delete

delete

delete

delete

delete

The present invention has the effect of reducing the time required for access control because it does not need to obtain a file identifier to perform the access control can save the time required to obtain at least one file identifier.

In addition, since the present invention does not need to open a file to obtain a file identifier, a hang phenomenon and infinitely repeating stack overflow due to recurrence do not occur, thereby improving the safety of the system.

In addition, the present invention has the effect of improving the safety and speed of the system because the file system filter drivers of the application programs using the file system filter driver that is on the increase can reduce the collision occurring when obtaining the file identifier.

1 is a diagram illustrating a configuration of a general file identifier-based file access control device.
2 is a view showing the configuration of a file path based file access control apparatus according to the present invention;
3 is a view for explaining the configuration of a file path-based file access control apparatus in the case of having a single file system filter driver according to the present invention;
4 is a diagram illustrating a configuration of a file path-based file access control apparatus when two file system filter driver units are provided according to the present invention.
FIG. 5 is a diagram illustrating a configuration of a file input / output monitoring unit of a file path based file access control apparatus using a file system mini filter driver according to a third embodiment of the present invention.
6 is a flowchart illustrating a method of forming a file path table for file path based file access control according to the present invention.
7 is a flowchart illustrating a file path board file access control method according to the present invention.

Hereinafter, a file path based file access control system and method according to the present invention will be described with reference to the accompanying drawings.

2 is a diagram illustrating a configuration of a file path-based file access control apparatus according to the present invention.

The file path based file access control apparatus according to the present invention includes a window application driver 10, a file input / output monitor 100, a file manager 40, and an access controller 200.

The Windows application driver 10 includes various application programs for accessing a file, and outputs a file access command to the kernel layer when a file access event is generated by a user from the driven application program.

The file input / output monitoring unit 100 monitors the Windows application driver 10 to monitor whether file access for file input / output occurs, and to access from a file access command when a file access command is generated from the Windows application driver 10. The file path name of the file is detected and provided to the access control unit 200.

The file manager 40 creates and deletes a file according to the file system of the operating system, and reads and writes the generated file.

The access control unit 200 performs access control based on the file path for the file having the file path input from the file input / output monitoring unit 100.

In more detail, the access controller 200 includes an access control controller 210, a route table generator 220, a route table storage 230, and an access policy storage 240.

The access control control unit 210 controls the overall operation of the access control unit 200 according to the present invention. In particular, the access control control unit 210 is a file path and access policy for all files or files selected in a file, such as a file newly created by the file access policy application of the Windows application driver 10 or a storage device such as a hard disk. Receive the received in the path table storage unit 230 and the access policy storage unit 240, respectively, and performs the file access control according to the stored file path and access policy. In particular, the access control controller 210 detects each node of the file path through the path table generator 220 without storing the file path input from the file input / output monitoring unit 100 when the file paths for the files are stored. The nodes are assigned to the path table and stored according to the file path order. In addition, the access control control unit 210 sequentially detects each node of the file path according to the file path and controls all the nodes of the file path even when the file access control for the file path input from the file input / output monitoring unit 100 is performed. In this case, the access control policy assigned to the final node is read from the access policy storage 240 to perform access control.

Specifically, from the viewpoint of the path table generator 220, when the file path is input from the access control controller 210, nodes constituting the file path, for example, the path is “C”. In case of \ Test \ TestFile001.txt ", C, Test, TestFile001.txt is detected as a node, and C, Test, TestFile001.txt is stored in the path table sequentially. The route table generator 220 calculates a key according to Equation 1 below when storing the nodes in the route table and stores the node in a bucket corresponding to the calculated key.

However, MAXSIZE is the number of buckets

Table 1 below shows a part of the file path table. The number of buckets (MAXSIZE) is 1024, the file path is C: \ Test \ testFile001.txt for long path (LongPath) and C: \ Test \ TestFi ~ 1.txt for short path (ShortPath), and node C of the path Is ASCII code of "1026", TEST ASCII code is "1025", TestFile001.txt ASCII code is "1027", and TestFi ~ 1.txt ASCII code is "1028" Assuming this, the method of storing in the file path table of Table 1 will be described. The sum of the ASCII codes is not a sum of actual ASCII codes, but a predetermined value.

Bucket no One 2 3 4 5 One Test (1-1) C (2-1) Testfile001.txt
(3-1) TestFi ~ 1.txt
(4-1) a.txt (5-1) 2 b.txt (3-2)

According to Equation 1, the key value of C is 1026 & (1024-1) = 2, the key value of Test is 1025 & (1024-1) = 1, and the key value of TestFile001.txt is 1027 & (1024-1). ) = 3, and the key value of TestFi ~ 1.txt is 1028 & (1024-1) = 4. Therefore, C is registered at position 2-1, test is registered at position 1-1, TestFile001.tex is registered at position 3-1, and TestFi ~ 1.txt is registered at position 4-1.

After the registration as described above, if the policy registration command for the a.txt file having the sum of ASCII codes "1029" and a path of C: \ Test \ a.txt is inputted, the path table generator 220 generates the a.txt file. Since the key value of the file is 5, register it at position 5-1. At this time, since C and Test are registered in advance, only the reference counter is incremented without registering them repeatedly. The reference counter can prevent the memory increase caused by repeatedly registering the same node and is used to delete the policy for the registered file. To delete a registered policy, delete it for each node in the path as in the case of registration. After finding the key value of the node to be deleted, find the node and decrement the reference counter. When the value is 0, the node is deleted completely.

Subsequently, if a policy registration command for the b.txt file having the sum of the ASCII codes "1027" and the file path of C: \ Test \ b.txt is generated, the path table generator 220 generates a node, b.txt. Register at 32 positions. At this time, since C and Test are registered in advance, only the reference counter is incremented without duplicate registration.

(Embodiment 1)

3 is a diagram illustrating in detail a configuration of a file input / output monitoring unit of a file path-based file access control device according to a first embodiment of the present invention having a single file system filter driver unit according to the present invention.

Referring to FIG. 3, by configuring path-based access control as shown in FIG. 2, the first file system filter driver 110 of the file input / output monitoring unit 100 receives a file access command from the Windows application driver 10. (①).

When the file access command is input, the first file system filter driver 110 transmits a file path included in the file access command to the access controller 200 without performing a process for obtaining a file identifier to perform file path based access control. After executing, bypass the file access command according to the policy (②). If the policy is allowed only for a specific administrator, the access control unit 200 will bypass the file access command through the first file system filter driver 110 only after authentication is successful through the existing authentication process. If the authentication fails, the first file system filter driver 110 may block the file access command.

The file manager 20 that receives the file access command performs a process on the file and provides the processing result to the first file system filter driver 110 (③).

As described above, since there are no processes for file identification, the system speed can be improved.

(Second Embodiment)

FIG. 4 is a diagram illustrating a configuration of a file path-based file access control apparatus in the case of having two file system filter driver units according to the present invention, and further comprising a second file system filter driver unit 120 by an antivirus program. The case is shown.

As shown in FIG. 4, the first file system filter driver 110 performs a path-based access control according to the present invention, and the second file system filter driver 120 performs a file identifier-based access control. It is shown. This is to provide compatibility with antivirus applications that perform file identifier based access control. However, it would be possible to derive a vaccine application for performing route-based access control according to the present invention.

Referring to FIG. 4, the first file system filter driver 110 outputs a file access command after performing file path based access control as shown in FIG. 3 (③).

The file access command is input to the file inquiry unit 121 of the second file system filter driver unit 120.

The file inquiry unit 121 receiving the file access command generates a file access command for virus scanning as described in FIG. 1 and outputs the file access command to the first file system filter driver 110 (④). Processes ⑤ to ⑧ of FIG. 4 corresponding to ⑥ to process ⑨ are performed.

(Third Embodiment)

5 is a diagram illustrating a configuration of a file input / output monitoring unit of a file path-based file access control apparatus using a file system mini filter driver according to a third embodiment of the present invention.

In the third embodiment of the present invention, as shown in FIG. 5, the file input / output monitoring unit 100 is configured as the file system mini filter driver unit 130.

The file system mini filter driver 130 may return the short path as it is if the path input by the user is a short path, and the long path if the path is input by the user. It provides a normalization mode that takes a path and returns it, and returns a long path as it is. That is, in the open mode, the file system mini filter driver 130 provides the path included in the file access command to the access controller 200 as it is. On the other hand, in the normalized mode, the file system mini-filter driver 130 provides the access control unit 200 as long as the path included in the file access command is a long path, and obtains a long path if the short path is obtained, and accesses the obtained long path. Provided to the controller 200.

However, in normalized mode, performance can be degraded because it takes a lot of work to find a long path for a short path. Therefore, it would be desirable to use open mode rather than normalized mode.

Note that even when the file system mini filter driver 130 is used, only the process of obtaining the path is different from the file system filter driver 130, and the other operations are the same. shall.

6 is a flowchart illustrating a method of forming a file path table for file path based file access control according to the present invention. Hereinafter, a file path registration method will be described with reference to FIG. 6.

First, as shown in FIG. 2, the access control controller 210 checks whether a file path registration event occurs from the window application driver 10 (S511). The file path registration event is generated by a file access control policy application program executed in the Windows application driver 10. For example, if the file access control policy is set to perform access control on all files, a file path registration event for all initial files to which the policy is applied will occur. If the policy is set to perform file access control only for a specific file selected in the file access control policy, the file path registration event may occur only for the file selected through the file access control policy setting application. If the policy is set to control file access only for newly created files, the file path registration event will occur only when a new file is created. The file path registration command by the file path registration event also includes a file path including a short path and a long path in the same manner as the file access command.

When a file registration event occurs, the access control controller 210 outputs a file registration command directly or to the path table generator 220 to detect file path information included in the file registration command (S513).

When the file path information including the long path and the short path is detected, the path table generator 220 sequentially orders the nodes of the long path and the short path included in the file path from the parent node under the control of the access control controller 210. In operation S515, key values for the nodes are calculated according to Equation 1 above.

When the key value is calculated, the route table generator 220 allocates and stores corresponding nodes to a bucket corresponding to the calculated key value of the route table stored in the route table storage 230 (S517).

If the bucket is allocated and stored as described above, the access control control unit 210 will notify that the path table registration is completed to the policy setting application program of the window application driving unit 10. In response to this, when an access control policy is input to a final node, that is, a file name, from the policy setting application of the Windows application driver 10, an access policy mapped to the last node assigned to the path table in the access policy storage 240 is input. It is stored (S519).

7 is a flowchart illustrating a file path substrate file access control method according to the present invention.

Referring to FIG. 7, the access control controller 210 determines whether a file access event occurs by checking whether a file access command is input through the file input / output monitoring unit 100 (S611).

When a file access event occurs, the access control controller 210 detects a file path included in a file access command (S613), sequentially detects nodes of the file path from an upper node, and detects each of the detected nodes. The key value according to Equation 1 is calculated (S615).

When the key value is calculated, the access control control unit 210 sequentially tracks the node corresponding to the key value corresponding to the upper node of the file path in the table of the path table storage unit 230 (S617).

In this case, the access control controller 210 determines whether all nodes of the file path are present (S619), and if there are all nodes, the access control policy assigned to the last node is loaded from the access policy storage 240 and loaded. The file access control is performed according to the file access policy (S621).

On the other hand, the present invention is not limited to the above-described typical preferred embodiment, it can be carried out in various ways without departing from the gist of the present invention various modifications, changes, substitutions or additions in the art Anyone who has this can easily understand it. It is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, it is intended to cover various modifications within the scope of the appended claims.

10: Windows application driver 40: File management unit
100: file input and output monitoring unit 200: access control unit
210: access control control unit 220: route table generation unit
230: route table storage unit 240: access policy storage unit

Claims (7)

delete A file input / output monitoring unit which extracts and outputs a file path included in the file access control command when a file access control command for a file occurs;
When a file registration event having path information including a long path and a short path is received from a Windows application driver, the nodes are classified into nodes constituting the long path and the short path of the path information, and the classified nodes are long path and short path. A file tree path table for allocating and registering information in a table to store information and an access policy for each of the last nodes of each file tree path are stored. The tree node is analyzed by analyzing the file path input from the file input / output monitoring unit. Classify the nodes in the file tree path table and sequentially include the nodes for one of the long path and the short path of the file path according to the corresponding access policy set in the last node. Including an access control to perform,
The file input and output monitoring unit,
And at least one file system filter driver unit extracting a file path included in the file access command and outputting the file path to the access control unit.

A file input / output monitoring unit which extracts and outputs a file path included in the file access control command when a file access control command for a file occurs;
When a file registration event having path information including a long path and a short path is received from a Windows application driver, the nodes are classified into nodes constituting the long path and the short path of the path information, and the classified nodes are long path and short path. A file tree path table for allocating and registering information in a table to store information and an access policy for each of the last nodes of each file tree path are stored. The tree node is analyzed by analyzing the file path input from the file input / output monitoring unit. Classify the nodes in the file tree path table and sequentially include the nodes for one of the long path and the short path of the file path according to the corresponding access policy set in the last node. Including an access control to perform,
The file input and output monitoring unit,
An open mode for extracting a file path included in the file access command, outputting the extracted file path to the access control unit, and a normalizing mode for obtaining a long path if the extracted file is a short path and outputting the long path to the access control unit; File path based file access control system comprising a file system mini-filter driver provided.
A file input / output monitoring unit which extracts and outputs a file path included in the file access control command when a file access control command for a file occurs;
When a file registration event having path information including a long path and a short path is received from a Windows application driver, the nodes are classified into nodes constituting the long path and the short path of the path information, and the classified nodes are long path and short path. A file tree path table for allocating and registering information in a table to store information and an access policy for each of the last nodes of each file tree path are stored. The tree node is analyzed by analyzing the file path input from the file input / output monitoring unit. Classify the nodes in the file tree path table and sequentially include the nodes for one of the long path and the short path of the file path according to the corresponding access policy set in the last node. Including an access control to perform,
The parsed nodes of the file path are sequentially assigned and stored in a bucket corresponding to a key calculated by Equation 2 below.
&Quot; (2) "

However, MAXSIZE is the number of buckets in the table.
delete In the file access control method,
When a file registration event having path information including a long path and a short path is received from a Windows application driver, the nodes are classified into nodes constituting the long path and the short path of the path information, and the classified nodes are long path and short path. A file path-based access policy setting process of allocating and registering an access policy in a file tree path table to include information, and registering an access policy for each of the last nodes of each file tree path;
When a file access command for the file is generated, path information included in the file access command is detected, nodes of the path information are detected, sequentially tracked in the table, and mapped to a final node including nodes of the file path. Including file access control process to perform file access control according to the file access policy,
The file path based access policy setting process,
An event generation step of checking whether a file registration event occurs from the access policy setting application of the window application driver through the file input / output monitoring unit;
A file path obtaining step of obtaining a file path including a long path and a short path to the file to be registered from a file registration command generated when the file registration event occurs when the file registration event occurs;
A key value calculation step of classifying and detecting the nodes of the long path and the short path of the obtained file path, and calculating a key value for each node by Equation 3 below;
A path table allocation step of allocating and storing the nodes in a bucket of a file path table corresponding to the key value so that the path information is included when the key value is calculated;
And a file access policy setting step of setting a file access policy by receiving an access policy of a file corresponding to a file path registered in the file path table through the access policy setting application of a Windows application driver. Way.
The method according to claim 6,
The file access control process,
A file access event generation step of checking whether a file access event occurs from applications of the Windows application driver through the file input / output monitoring unit;
A file path obtaining step of obtaining a file path from a file access command when a file access event occurs;
A key value calculating step of detecting nodes of the obtained file path and calculating a key value for each node by Equation 3 below;
An access policy registration determination step of sequentially checking nodes corresponding to the calculated key values in the path table in the path table according to a file path to check whether all nodes corresponding to the file path are provided;
And a file access control step of performing file access control according to a file access policy mapped to the last node of the nodes if all nodes exist.

&Quot; (3) "

However, MAXSIZE is the number of buckets in the table.

Images