Windows-printing-pool-based printing content monitoring and auditing method of printer

Abstract

The invention belongs to the technical field of computer and network security auditing, and discloses a windows-printing-pool-based printing content monitoring and auditing method of a printer. The printing content monitoring and auditing method is implemented by an auditing console, a data server and an agent module; and the agent module captures printing auditing data according to the following steps of: intercepting data processing actions of a winspool.drv in a printing process, and capturing initial document printing data, document printing end data, initial printing data of each page of a document and printing end data of each page of the document; capturing basic information and printing time of the printed document in the initial document printing data and the document printing end data; capturing the EMF (Enhanced MetaFile) copy of each page of the document in the initial printing data of each page of the document and the printing end data of each page of the document, and counting the total number of pages of the document; and taking the captured basic information and the printing time of the printed document, the EMF copy of each page of the document and the counted total number of pages of the document as the printing auditing data.

Description

Technical field [0001] The invention is a computer and network security audit technology field. It involves a method of printed content monitoring and auditing methods. Specifically, a printer printing content monitoring and audit method based on the Windows printing pool is printer. Background technique [0002] For a long time, in order to protect the confidentiality of the Windows system output information, the monitoring and auditing of printer printing content has always been one of the focus of people's research;The omissions and incompleteness of the printed content monitoring audit make it one of the difficulties of monitoring audit.The difficulty of printing and monitoring audit is mainly manifested in: ⑴ The printer architecture is complicated; the printing system of the Windows system is centered on the printing pool, and it is supported by the print interface provided by a set of GDI (Windows graphics device interface) and the printed pool customer DLL; ⑵ PrinterTypes...

AI Technical Summary

Problems solved by technology

The above points make it difficult to monitor and audit the printing content of the printer.

At present, the main printing monitoring and auditing technology is the polling print queue technology. The data interception point is at the application layer, and there are serious defects of missing audit and unable to obtain copy data.

Images