Research And Implement Of Host-based File Realtime Monitor Technology

At present, there are already some mature technologies of information storage security aiming at network attack, such as firewall and IDS, while the development of Host-based information storage security technology is lag and can not satisfy the market's requirement. According to the limitation of the technology, the article designs a Host-based file realtime monitor technology which is used in TFSS, then describes the design project of TFSS on the foundation of the technology.The article laies a strong emphasis on description of the realization mechanism which is used in the file realtime monitor module of TFSS。TFSS runs on Win2000 or other higher version platforms. According to these systems'structure characteristic, double-level monitor mechanism is used in file realtime monitor module. The double-level monitor mechanism ensures TFSS monitor function's stabilization and greate efficiency. Then the article introduces the design and realization of user level monitor module and kernel level monitor module detailedly, including how to realize the system clipboard monitor, the file motion control, file print job interdiction, and the directory share monitor in system's user level, how to realize the process accessing filter, the process privilege control, the file encryption and decryption in system's kernel level. Finally, the article summarizes the merit and limitation of the host-based file realtime monitor technology and proposes some useful suggestions to improve it. From a serial of test, it is proved that the Host-based file realtime technology is well efficient and advanced.