基于Windows内核态个人防火墙的设计与实现  

Design and implementation of personal firewall based on Windows kernel mode

作　　者：何映[1] 覃以威[1] 李丹[1] 

机构地区：[1]广西师范大学物理科学与技术学院,广西桂林541004

出　　处：《现代电子技术》2012年第6期49-52,56,共5页Modern Electronics Technique

摘　　要：为了提高防火墙对非法数据包的拦截能力,增强Windows主机上网的安全性,设计并实现了一个基于Windows内核态的个人防火墙。它由应用程序和驱动程序2部分组成,其中应用程序负责对数据包进行实时监控以及安全规则实现,并向用户报告防火墙的运行状态或安全事件;基于NDIS中间层驱动程序对数据包进行拦截,采用设备输入和输出控制(IOCTL)方法实现内核态进程与用户态进程间的通信。测试结果表明,该防火墙能在Windows平台下稳定运行,能够有效拦截非法数据包。In order to improve the firewallrs ability to intercept illegal packets and enhace the security of the host running a Windows OS, a personal firewall was designed and implemented based on Windows kenel mode. It consists of two main parts：application programs which runs in user mode, and driver programs which runs in kernel mode. The received packets are monitored in real-time and the security rules are implemented with the former, and the packets are intercepted with the lat- ter which is designed based on NDIS. The communication between user-mode and kernel-mode inter-process is implemented with the way of driver defined IOCTL. The test results show that this firewall can run stably on Windows platform and can effectively intercept all the illegal packets.

关 键 词：防火墙 NDIS 中间层驱动 Passthru 进程间通信 

分 类 号：TN919-34[电子电信—通信与信息系统] TP393.08[电子电信—信息与通信工程]