Security domain file copy and content copy protection method based on Windows 7

Abstract

The present invention discloses a method for protecting file copy and content copy based on Windows 7 security domain. The method comprises: obtaining transfer information generated during data transfer; calling a pre-made monitoring process based on the transfer information, and monitoring and confirming the data transfer process; and clearing the data in the clipboard when confirming that the data in the security domain is transferred to the non-security domain. The technical solution of the present application can effectively reduce data leakage.

Description

Technical Field

[0001] The present invention relates to the technical field of software engineering, and in particular to a Windows 7-based security domain file copy and content copy protection method. Background Art

[0002] Microsoft Windows is an operating system developed based on a graphical user interface. It is mainly used in computers, smartphones and other devices and is one of the most widely used operating systems in the world. However, in the Windows operating environment, sensitive data can be easily copied and stolen by unauthorized personnel. Existing file system security measures and protection tools cannot effectively prevent file copying, resulting in data leaks. Summary of the invention

[0003] In view of the defects in the prior art, the present invention provides a Windows 7-based security domain file copy and content copy protection method that can effectively reduce data leakage.

[0004] The present application provides a Windows 7-based security domain file copy and content copy protection method, the Windows 7-based security domain file copy and content copy protection method comprising:

[0005] Obtain transfer information generated during data transfer;

[0006] Based on the transfer information, a pre-made monitoring process is called, and the data transfer process is monitored and confirmed;

[0007] When it is confirmed that the data in the secure domain is transferred to the non-secure domain, the data in the clipboard is cleared.

[0008] In one aspect, the step of calling a prefabricated monitoring process based on the transfer information and monitoring and confirming the data transfer process includes:

[0009] The transfer information is sent to a prefabricated hook function, and the hook function monitors and confirms the data transfer process based on the transfer information.

[0010] In one aspect, the hook function includes a file opening function and a file closing function;

[0011] The step of the hook function monitoring and confirming the data transfer process based on the transfer information includes:

[0012] Based on the file opening function, the number of files opened in the security domain is obtained;

[0013] Acquire the number of closed files in the security domain based on the file closing function;

[0014] After the number of open files in the security domain decreases and returns to zero, the data in the clipboard is cleared.

[0015] In one aspect, the transfer information includes a file opening path and a file closing path;

[0016] The step of obtaining the number of file openings in the security domain based on the file opening function comprises:

[0017] Sending the file opening path to the file opening function;

[0018] If the file opening path points to the security domain, the file opening quantity increases;

[0019] If the file opening path points to the non-secure domain, the number of files opened remains unchanged;

[0020] The step of acquiring the number of file closes in the security domain based on the file close function comprises:

[0021] Sending the file closing path to the file closing function;

[0022] If the file closing path points to the security domain, the number of file openings is reduced;

[0023] If the file closing path points to the non-secure domain, the number of file openings remains unchanged.

[0024] In one aspect, the data includes file data and text data, the hook function also includes a copy function and a paste function, and the transfer information also includes a copy path and a paste path;

[0025] The step of the hook function confirming the data transfer process based on the transfer information further includes:

[0026] When the copy path object of the copy function is file data, if the paste path of the paste function points to the non-secure domain, clearing the data in the clipboard;

[0027] When the copy path object of the copy function is text data, if the number of open files in the security domain is greater than zero, the data in the clipboard is cleared.

[0028] In one aspect, the step of the hook function confirming the data transfer process based on the transfer information further includes:

[0029] When the copy function confirms that the copy object is file data:

[0030] In the case where the replication path points to the security domain:

[0031] If the paste path points to the security domain, then pasting is allowed;

[0032] If the paste path points to the non-secure domain, clearing the data in the clipboard;

[0033] In the case where the copy path points to the non-secure domain, pasting is allowed;

[0034] When the copy function confirms that the copy object is text data:

[0035] In the case where the copy path points to the security domain, pasting is allowed;

[0036] In the case where the replication path points to the non-secure domain:

[0037] If the number of open files in the security domain is zero, pasting is allowed;

[0038] If the number of open files in the security domain is greater than zero, the data in the clipboard is cleared.

[0039] In one aspect, before the step of obtaining the transfer information generated during the data transfer process, the method includes:

[0040] A driver program is set, a monitoring process is started based on the driver program, and the monitoring process is protected by the driver program.

[0041] In one aspect, the step of protecting the monitoring process by the driver comprises:

[0042] When it is detected that the driver program is closed, the driver program is automatically restarted;

[0043] When it is detected that the monitoring process is closed, the driver program controls the monitoring process to automatically restart.

[0044] In one aspect, before the step of sending the transfer information to a prefabricated hook function, wherein the hook function monitors and confirms the data transfer process based on the transfer information, the method further comprises:

[0045] The hook function is initialized so that the information obtained by the hook function is reset to zero.

[0046] The beneficial effects of the present invention are as follows: data is stored in the security domain, and the protection level of the data is improved. When the data stored in the security domain is transferred to an area outside the security domain, that is, when it is transferred to the non-security domain, the data in the clipboard is not cleared, so that when performing an action such as pasting, the data has been cleared and the transfer operation cannot be continued, which effectively protects the data and reduces data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for the specific embodiments or the description of the prior art. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn according to the actual scale.

[0048] Figure 1 This is a schematic diagram of the process steps of the Windows 7-based security domain file copy and content copy protection method of this application;

[0049] Figure 2 This is a schematic diagram of the steps of the data transfer monitoring process using the hook function in the Windows 7-based security domain file copy and content copy protection method of this application;

[0050] Figure 3 This is a schematic diagram of the process steps for analyzing and judging by the condition of the number of file closings in the Windows 7-based security domain file copy and content copy protection method of this application;

[0051] Figure 4 This is a schematic diagram of the process steps of calling a file open function through a file open path in the Windows 7-based security domain file copy and content copy protection method of this application;

[0052] Figure 5 This is a schematic diagram of the process steps of calling a file closing function through a file closing path in the Windows 7-based security domain file copy and content copy protection method of this application;

[0053] Figure 6 This is a schematic diagram of the steps of the processing flow for file data and text data in the Windows 7-based security domain file copy and content copy protection method of this application;

[0054] Figure 7 This is a schematic diagram of the file data processing flow steps in the Windows 7-based security domain file copy and content copy protection method of this application;

[0055] Figure 8This is a schematic diagram of the steps of the text data processing flow in the Windows 7-based security domain file copy and content copy protection method of this application;

[0056] Fig. 9 This is a schematic diagram of the process steps for setting up a driver and monitoring a process in the Windows 7-based security domain file copy and content copy protection method of this application;

[0057] Fig.10 This is a schematic diagram of the steps of the driver's protection process for the monitoring process in the Windows 7-based security domain file copy and content copy protection method of this application.

[0058] Fig.11 This is a schematic diagram of the steps for initializing the hook function in the Windows 7-based security domain file copy and content copy protection method of this application.

[0059] Fig.12 This is a schematic diagram of the functional module structure in the data protection system of this application.

[0060] In the attached figure, 100, security domain; 200, non-security domain; 300, clipboard; 400, monitoring process; 500, driver program. DETAILED DESCRIPTION

[0061] The following embodiments of the technical solution of the present invention are described in detail in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and are therefore only used as examples, and cannot be used to limit the protection scope of the present invention.

[0062] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by those skilled in the art to which the present invention belongs.

[0063] See also Figure 1 As shown, the present application provides a Windows 7-based security domain file copy and content copy protection method, which is mainly used in the Windows operating system. The Windows 7-based security domain file copy and content copy protection method includes:

[0064] Step S10, obtaining transfer information generated during the data transfer process; when transferring data, some transfer actions are often performed, such as copying, pasting, opening the copied file, opening the pasted location, etc. The data transfer process can be analyzed and judged through these transfer information.

[0065] Step S20, calling the prefabricated monitoring process 400 based on the transfer information, and monitoring and confirming the data transfer process; in the present application, a monitoring process is provided, and the monitoring process 400 monitors the data transfer process through the transfer information, so as to determine whether the data in the security domain 100 is transferred to the non-security domain 200.

[0066] Step S30, when it is confirmed that the data in the secure domain 100 is transferred to the non-secure domain 200, the data in the clipboard 300 is cleared. For example, when it is confirmed that the data in the secure domain 100 is transferred to the non-secure domain 200, a clear instruction is generated, and the data in the clipboard 300 is cleared according to the clear instruction, so that even if a paste operation is performed, the data is empty.

[0067] It should be noted that in this application, the storage space of the operating system is divided into a secure domain 100 and a non-secure domain 200. Before obtaining the transfer information generated during the data transfer process, the secure domain 100 can be initialized, that is, one or more disk partitions of the secure domain 100 are encrypted using the same set of keys.

[0068] In this embodiment, data is stored in the security domain 100, which improves the protection level of the data. When transferring the data stored in the security domain 100 to an area outside the security domain 100, that is, transferring to the non-security domain 200, the data in the clipboard 300 is not cleared. In this way, when performing an action such as pasting, the data has been cleared and the transfer operation cannot be continued, which effectively protects the data and reduces data leakage.

[0069] In addition, in the embodiment of the present application, the pre-made monitoring process 400 is called, and when the monitoring process 400 finds that the file or text in the security domain 100 is copied to the non-security domain 200, it is deleted immediately. By calling the pre-made monitoring process 400, the intrusion to the original business system is reduced, that is, no modification or restriction is made to the original business code.

[0070] See also Figure 2 As shown, in one embodiment of the present application, the steps of calling the prefabricated monitoring process 400 based on the transfer information and monitoring and confirming the data transfer process include:

[0071] Step S200, the transfer information is sent to a pre-made hook function, and the hook function monitors and confirms the data transfer process based on the transfer information. The hook function can be pre-edited in the system, and when the data is transferred, the hook function can be called through the transfer information.

[0072] Hook functions can be understood as a programming mode that allows developers to insert custom code when specific events or operations occur. This mechanism is often used to extend or modify the behavior of software without directly modifying its source code. Hook functions are usually called when specific events occur, such as user operations, system status changes, etc. They are pluggable and flexible. Developers can add or change functions by implementing hook functions without having to modify the original code, reducing intrusion into the original system.

[0073] In one embodiment of the present application, the hook function includes a file opening function and a file closing function; during the process of opening a file, open transfer information will be generated, and the file opening function can be called through the file opening transfer information; similarly, during the process of closing a file, close transfer information will be generated, and the file closing function can be called through the file closing transfer information.

[0074] See also Figure 3 As shown, the hook function monitors and confirms the data transfer process based on the transfer information, including:

[0075] Step S210, based on the file opening function, obtain the number of files opened in the security domain 100; for example, in the initial state, the number of files opened in the security domain 100 is 0, and each time a new file is opened, the number of files opened increases by one.

[0076] Step S220, based on the file closing function, obtains the number of closed files in the security domain 100; after a file in the security domain 100 is opened and closed, the number of open files will change, and each time a file is closed, the number of open files in the security domain 100 will decrease. After a file in the security domain 100 is opened and then closed, it is currently displayed that no file in the security domain 100 is open. In the prior art, it is usually assumed that copy and paste actions can be performed. However, after a file in the security domain 100 is opened, a copy operation may be performed, and the data may be copied to the clipboard 300, and then the opened file may be closed, and then the data in the clipboard 300 may be pasted, so as to circumvent the monitoring of the hook function. For this purpose, step S230 is used to solve the problem.

[0077] Step S230, after the number of open files in the security domain 100 is reduced and returned to zero, the data in the clipboard 300 is cleared. That is, as long as the hook function detects that a file in the security domain 100 has been opened and then reduced and closed again, a data clearing operation is performed on the clipboard 300, regardless of whether the data in the clipboard 300 is from the security domain 100, thereby reducing the above-mentioned circumvention behavior and improving data protection.

[0078] It can be understood that after detecting that the number of open files in the security domain 100 decreases and returns to zero, it is determined that the data in the security domain 100 is transferred to the non-security domain 200.

[0079] In one embodiment of the present application, the transfer information includes a file opening path and a file closing path;

[0080] See also Figure 4 As shown, the steps of obtaining the number of files opened in the security domain 100 based on the file opening function include:

[0081] Step S211, sending the file opening path to the file opening function; after obtaining the file opening path, the file opening function can determine the source of the file and determine whether it has opened the file in the security domain 100.

[0082] Step S211a, if the file opening path points to the security domain 100, the number of file openings increases; the number of file openings defined in the security domain 100 is count, the file path is path, the file path path includes the file opening path and the file closing path, if the file opening path path is within the security domain 100, the number of file openings count is represented as an increase of 1.

[0083] Step S211b, if the file opening path points to the non-secure domain 200, the number of files opened remains unchanged; when the file opening path path points to the non-secure domain 200, it means that the opened file comes from the non-secure domain 200 and is not data that needs to be protected, then the sign of the number of files opened count remains unchanged.

[0084] See also Figure 5 As shown, the step of obtaining the number of file closes in the security domain 100 based on the file close function includes:

[0085] Step S221, sending the file closing path to the file closing function; after obtaining the file closing path, the file closing function can also determine the source of the file to determine whether it has closed the file in the security domain 100.

[0086] Step S221a, if the file closing path points to the security domain 100, the number of open files decreases; when the file closing path path points to the security domain 100, it means that the file in the security domain 100 is closed, and the number of open files count is expressed as minus one.

[0087] Step S221b, if the file closing path points to the non-secure domain 200, the number of files opened remains unchanged. If the file closing path points to the non-secure domain 200, the number of files opened remains unchanged. When the number of files opened count=0, the clipboard 300 is cleared.

[0088] In one embodiment of the present application, data includes file data and text data. Text data is mainly used to record and store text information. Common text document extensions include: txt, doc, docx, wps, etc. File data is a collection of information stored on a computer using a computer hard disk as a carrier. File data can be a text document, a picture, a program, etc. In some cases, file data can include text data, such as when text data is part of file data. The hook function also includes a copy function and a paste function, and the transfer information also includes a copy path and a paste path; the copy function can be called through the copy path, and the paste function can be called through the paste path.

[0089] See also Figure 6 As shown, the hook function confirms the data transfer process based on the transfer information, and also includes:

[0090] Step S240, when the copy path object of the copy function is file data, if the paste path of the paste function points to the non-secure domain 200, the data in the clipboard 300 is cleared; that is, the copy path comes from the secure domain 100, and the paste path points to the non-secure domain 200, which is a process of transferring data from the secure domain 100 to the non-secure domain 200, so the data in the clipboard 300 is cleared. The protection of file data is mainly controlled by the paste path.

[0091] Step S250, when the copy path object of the copy function is text data, if the number of files opened in the security domain 100 is greater than zero, the data in the clipboard 300 is cleared. For text data, it is mainly controlled by the number of files opened. This can reduce the situation of copying part of the data in the file when the file is opened. In other words, as long as the hook function detects that a file is opened in the security domain 100, pasting text data is a prohibited behavior.

[0092] In one embodiment of the present application, the data format is defined to include file data and text data, flag = 1 for file data and flag = 0 for text data; the copy path is defined as sign, sign = 1 when the copy path comes from the secure domain 100, and sign = 0 when the copy path comes from the non-secure domain 200. The paste path is defined as dest, dest = 1 when the paste path points to the secure domain 100, and dest = 0 when the paste path points to the non-secure domain 200.

[0093] See also Figure 7 and Figure 8 As shown, the hook function confirms the data transfer process based on the transfer information, and also includes:

[0094] Step S241, when the copy function confirms that the copy object is file data: further confirm whether the source of the copy path is the security domain 100 or the non-security domain 200, that is, step S2411 and step S2412.

[0095] Step S2411, when the copy path points to the security domain 100: further confirm whether the paste path points to the security domain 100 or the non-security domain 200, that is, step S2411a and step S2411b.

[0096] Step S2411a, if the paste path points to security domain 100, pasting is allowed; the copy path comes from security domain 100, and the paste path also points to security domain 100. Copying and pasting within security domain 100 are allowed, which is an allowed behavior and can be pasted.

[0097] Step S2411b, if the paste path points to the non-secure domain 200, the data in the clipboard 300 is cleared; the paste path is in the non-secure domain 200, which is a prohibited behavior.

[0098] Step S2412: Pasting is allowed if the copy path points to the non-secure domain 200. That is, if the source of the copy path is the non-secure domain 200, then pasting can be performed to the secure domain 100 or the non-secure domain 200.

[0099] Step S251, when the copy function confirms that the copy object is text data: further confirm whether the source of the copy path is the security domain 100 or the non-security domain 200.

[0100] Step S2511, when the copy path points to the security domain 100, pasting is allowed; general copy operations are allowed, such as copy and paste between security domains 100, copy and paste from the non-security domain 200 to the security domain 100, and copy and paste between non-security domains 200.

[0101] Step S2512, when the copy path points to the non-security domain 200: further analysis and judgment is made based on the number of files opened in the security domain 100.

[0102] Step S2512a, if the number of open files in the security domain 100 is zero, pasting is allowed; that is, if the files in the security domain 100 are not opened, the paste operation can be performed at this time.

[0103] Step S2512b: If the number of files opened in the security domain 100 is greater than zero, the data in the clipboard 300 is cleared. That is, if there are files opened in the security domain 100, the paste operation is not allowed, and the clipboard 300 is cleared.

[0104] 1. If flag=1

[0105] (1) If sign = 1;

[0106] ①, if dest=1, pasting is allowed;

[0107] ②. If dest=0, pasting is not allowed.

[0108] (2) If sign = 0, pasting is allowed.

[0109] 2. If flag=0

[0110] (1) If dest=1, pasting is allowed;

[0111] (2) If dest=0;

[0112] ①, if count=0, pasting is allowed;

[0113] ②. If count>0, pasting is not allowed.

[0114] In general, in this embodiment, copying data is allowed, and monitoring is mainly on the pasting process, and whether to perform a clipboard 300 clearing operation is determined by pasting to the secure domain 100 or to the non-secure domain 200.

[0115] See also Fig. 9 As shown, in one embodiment of the present application, before the step of obtaining the transfer information generated during the data transfer process, the step includes:

[0116] Step S01 , setting a driver program 500 , starting a monitoring process 400 based on the driver program 500 , and protecting the monitoring process 400 through the driver program 500 .

[0117] The driver 500 is a Windows kernel driver.

[0118] First, write the driver 500 code or obtain a ready-made .sys driver file. The driver 500 is initialized through the DriverEntry function, sets the device object and the driver 500 uninstall function, and registers the IRP processing functions for processing different types of I / O requests (such as creation, closing, and device control, etc.). The driver 500 responds to the I / O request packet issued by the operating system and performs corresponding operations, such as device management, data transmission, or control command processing. Finally, the driver 500 cleans up the resources through the Unload function.

[0119] Secondly, the kernel driver process is started when the operating system is started, and it runs in the kernel state to protect the monitoring process 400.

[0120] Again, use a trusted developer certificate. When the driver is loaded, Windows will verify the signature of the driver 500 to ensure that the signature is valid and the certificate has not expired. Only drivers that pass the verification will be loaded.

[0121] Finally, after the driver 500 is installed, the device manager detects the corresponding device and loads the driver 500 into the kernel.

[0122] See also Fig.10 As shown, in one embodiment of the present application, the step of protecting the monitoring process 400 by the driver 500 includes:

[0123] Step S011 , when it is detected that the driver program 500 is closed, the driver program 500 automatically restarts; this ensures that the driver program 500 drives the monitoring process 400 .

[0124] Step S012: When it is detected that the monitoring process 400 is closed, the driver 500 controls the monitoring process 400 to automatically restart, thereby ensuring that the monitoring process 400 monitors the data transfer process.

[0125] The kernel driver process and the monitoring process 400 cannot be closed after being started. Once any one of them is closed, the closed program will be restarted immediately.

[0126] See also Fig.11 As shown, in one embodiment of the present application, before the transfer information is sent to a prefabricated hook function, the hook function monitors and confirms the data transfer process based on the transfer information, including:

[0127] Step S201, initialize the hook function and reset the information obtained by the hook function to zero. This can improve the accuracy of monitoring the data transfer process and reduce misoperation. At this time, count=0, sign=0, flag=0.

[0128] See also Fig.12 As shown, the present application also provides a data protection system, the data protection system includes a processor and a memory, the memory stores a computer program, and when the computer program is executed by the processor, the above-mentioned security domain file copy and content copy protection method based on Windows 7 is implemented. The data protection system also includes a security domain 100 and a non-security domain 200. In the copy and paste process, the clipboard 300 is required, and the driver 500 drives the monitoring process 400 to enable the monitoring process 400 to monitor the data in the clipboard 300.

[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

Claims

1. A method for protecting file copy and content copy in a security domain based on Windows 7, characterized in that: The Windows 7-based security domain file copy and content copy protection method includes: Obtain transfer information generated during data transfer; Based on the transfer information, a pre-made monitoring process is called, and the data transfer process is monitored and confirmed; When it is confirmed that the data in the secure domain is transferred to the non-secure domain, the data in the clipboard is cleared; The step of calling a prefabricated monitoring process based on the transfer information and monitoring and confirming the data transfer process comprises: sending the transfer information to a prefabricated hook function, wherein the hook function monitors and confirms the data transfer process based on the transfer information; The hook function includes a file opening function and a file closing function; The step of monitoring and confirming the data transfer process based on the transfer information by the hook function includes: obtaining the number of files opened in the security domain based on the file opening function; obtaining the number of files closed in the security domain based on the file closing function; and clearing the data in the clipboard after the number of files opened in the security domain decreases and returns to zero; The data includes file data and text data, the hook function also includes a copy function and a paste function, and the transfer information also includes a copy path and a paste path; The step in which the hook function confirms the data transfer process based on the transfer information also includes: when the copy path object of the copy function is file data, if the paste path of the paste function points to the non-security domain, the data in the clipboard is cleared; when the copy path object of the copy function is text data, if the number of open files in the security domain is greater than zero, the data in the clipboard is cleared.

2. The Windows 7-based security domain file copy and content copy protection method according to claim 1, characterized in that: The transfer information includes a file opening path and a file closing path; The step of obtaining the number of file openings in the security domain based on the file opening function comprises: Sending the file opening path to the file opening function; If the file opening path points to the security domain, the file opening quantity increases; If the file opening path points to the non-secure domain, the number of files opened remains unchanged; The step of acquiring the number of file closes in the security domain based on the file close function comprises: Sending the file closing path to the file closing function; If the file closing path points to the security domain, the number of file openings is reduced; If the file closing path points to the non-secure domain, the number of file openings remains unchanged.

3. The Windows 7-based security domain file copy and content copy protection method according to claim 1, characterized in that: The step of the hook function confirming the data transfer process based on the transfer information further includes: When the copy function confirms that the copy object is file data: In the case where the replication path points to the security domain: If the paste path points to the security domain, then pasting is allowed; If the paste path points to the non-secure domain, clearing the data in the clipboard; In the case where the copy path points to the non-secure domain, pasting is allowed; When the copy function confirms that the copy object is text data: In the case where the copy path points to the security domain, pasting is allowed; In the case where the replication path points to the non-secure domain: If the number of open files in the security domain is zero, pasting is allowed; If the number of open files in the security domain is greater than zero, the data in the clipboard is cleared.

4. The method for protecting file copy and content copy based on Windows 7 security domain according to any one of claims 1 to 3, characterized in that: Before the step of obtaining the transfer information generated during the data transfer process, the method includes: A driver program is set, a monitoring process is started based on the driver program, and the monitoring process is protected by the driver program.

5. The Windows 7-based security domain file copy and content copy protection method according to claim 4, characterized in that: The step of protecting the monitoring process by the driver comprises: When it is detected that the driver program is closed, the driver program is automatically restarted; When it is detected that the monitoring process is closed, the driver program controls the monitoring process to automatically restart.

6. The Windows 7-based security domain file copy and content copy protection method according to claim 1, characterized in that: Before the step of sending the transfer information to a prefabricated hook function, wherein the hook function monitors and confirms the data transfer process based on the transfer information, the method includes: The hook function is initialized so that the information obtained by the hook function is reset to zero.

Images