Research and implementation of file security mechanisms based on file system filter driver

Abstract

First of all, from the aspect of key component in the Windows kernel, using the related tools of operating system kernel, to analyze and debug each kernel component by combining with the verification procedures, and objects of individual component in executable level is analyzed deeply, to be familiar with the internal principles of each executable component, and learn to use the kernel debugger, laying the foundations for subsequent in-depth kernel development. Then, this paper studied the techniques commonly used by malicious programs, including the hidden process, images, files and various hook techniques. On this basis, for all kinds of malicious behavior, this paper gives the principle of counter-measures, which is taken by file system filter driven. A file system filter driver module is designed and implemented in this paper. This module realizes the basic encryption and decryption, however a simple XOR operation is used in encryption operation. Because it does not affect research ideas through developing file system filter driver to study the Windows kernel. In the implement of transparent encryption and decryption modules, mainly introduce how to achieve each core routine problem according to the custom data structure combining with the kernel file operation process. The detailed logic flow diagrams and text description are given for each core processing routine. This paper explains basic data structure which is developed by the Windows kernel driver, combing this with the knowledge of the Windows kernel components and the understanding of functional needs permits the customization of a number of important data types. These customized data types include description disk file encryption identification, as well as the process control block in memory that is used to safeguard legitimate processes. The core of this paper is to sort out the processing of files operating the in the kernel, and using this to achieve a core based processing flow of transparent encryption and decryption of code modules.