基于HOOK和过滤驱动的双层文件防泄密技术  

A Double Layer Leak Prevention Technology Based on the HOOK and File Filter Driver

作　　者：周洪波[1] ZHOU Hongbo(College of Mathematics and Information Science,Guiyang University,Guiyang 550005,China)

机构地区：[1]贵阳学院数学与信息科学学院

出　　处：《湖北民族学院学报（自然科学版）》2019年第4期439-444,共6页Journal of Hubei Minzu University(Natural Science Edition)

基　　金：贵州省软科学研究计划项目(黔科合LH字[2015]7294号)

摘　　要：在文件防护方面有着多种保护手段,以往传统的以口令的方式对文件进行保护的方式需要用户频繁的对文件进行加解密,这显然很繁琐,而透明防护即是以用户察觉不到的方式对文件进行保护.透明防护最关键的是对文档保护时文件泄密的情况,常用的透明防护技术有应用层HOOK和驱动层过滤技术,只采用单一的一种技术或多或少都会存在一些泄密的可能.一种好的解决方案是将两种技术加以结合并改进,对文档完整性、安全性进行有效防护,通过分别在应用层和驱动层插入一层HOOK和文件过滤驱动来实现.试验结果表明,该方案能堵住常见的各种泄密情况,安全稳定可靠,且不需要额外的硬件和软件支持,成本很低,不管是个人还是企事业单位都适合普遍采用.There are many means of protecting files,and the traditional way(password file protection mode)frequently requires the user to encrypt and decrypt the file,which is obviously very cumbersome,and transparent protection that is based on the user perceptible for the protection of the file.The key is to protect the transparent protective document file information leak,transparent protection technology are commonly used HOOK application layer and driver layer filtering technology,using only a single technology are more or less there will be some leaks.A good solution is to combine two kinds of technology and improvement of the document,integrity,safety effective protection.Based on the application layer and driver layer inserting a layer of HOOK and file filter driver,the experimental results show that,the scheme can obviously prevent various common tests in the presence of a leak,safe and reliable,and does not require additional hardware and software support,the cost is very low,whether for a person or business unit commonly used.

关 键 词：防泄密 文件过滤驱动 文件防护 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]