Method and system for intercepting and capturing port data in WinNT operation system

Abstract

The invention relates to a method and a system for intercepting and capturing port data in a WinNT operation system. The method comprises the steps of: creating a log file corresponding to a port in a kernel mode; intercepting and capturing each operation request aiming at the port, judging whether the operation requests are reading / writing requests or not according to an IO_STACK_LOCATION data structure correlative to an information resource planning (IRP) data structure of the operation requests, if so, storing data to be read / written by the reading / writing requests to the log file corresponding to the port, and then, executing the read / write requests; and otherwise, executing the operation requests. When the technical scheme of the method and the system is utilized, the cost for intercepting and capturing the port data can be reduced.

Description

technical field [0001] The invention relates to the field of data interception, in particular to a method and system for intercepting port data in a WinNT operating system. Background technique [0002] Microsoft's WinNT operating system is a 32-bit operating system based on NT technology, which includes Windows 2000, Windows 2003 and Windows XP systems. At present, the WinNT operating system has become the mainstream operating system for most daily office computers. Office computers often store some important data, such as financial data, customer lists, and various statistical data. If these data are leaked out, it will bring huge risks and losses to the unit. Therefore, it is necessary to input or The output data is strictly monitored to ensure the safety of important data. Since the computer input or output data is carried out through the port, the computer port can be used to monitor the computer input or output data, which inevitably intercepts the data read and writ...

AI Technical Summary

Problems solved by technology

But prior art adopts hardware interception equipment to intercept port data, the quantity of the used hardware interception equipment can not be less than the quantity of the port to monitor, for each unit that will realize computer data monitoring, the unit to be monitored The number of computers is usually relatively large, and some computers have multiple input and output ports that need to be monitored, which results in a high cost of computer port data interception using existing technologies

Images