Research and design of Windows firewall driver based on hook

doi:10.3724/SP.J.1087.2005.01529

Journal of Computer Applications ›› 2005, Vol. 25 ›› Issue (07): 1529-1530.DOI: 10.3724/SP.J.1087.2005.01529

• Information security • Previous Articles Next Articles

Research and design of Windows firewall driver based on hook

XIAN Ji-qing¹，TAN Dan2，CHEN Hui2

1. College of Automation, Chongqing University of Posts and Telecommunications; 
2. College of Computer Science and Technology, Chongqing University of Posts and Telecommunications

Received:2005-02-07 Revised:2005-05-08 Online:2005-07-01 Published:2005-07-01

基于hook的Windows防火墙驱动程序研究与设计

鲜继清¹，谭丹²，陈辉²

1.重庆邮电学院自动化学院，重庆 400065； 2.重庆邮电学院计算机科学与技术学院，重庆 400065

作者简介:鲜继清(1946-)，男，四川西充人，副教授，主要研究方向：通信系统与网络；谭丹(1981-)，男，湖南浏阳人，硕士研究生，主要研究方向：计算机网络安全；陈辉(1979-)，女，新疆乌鲁木齐人，硕士研究生，主要研究方向：网络管理、IPv6技术.
基金资助:
国家863计划项目（2003AA412030）

Abstract

Abstract:

The network driver of Windows 2000/XP was analyzed, and a scheme of implementing firewall driver using NDIS(Network Driver Interface Specification) hook was presented. Different from API hook, the method could take effect without reboot and strengthen the ability of resisting intrusion. The driver worked on network layer and filtered all data packets through the computer, so it could protect users' information effectively and conveniently. A driver communication model based on share memory and event object was also provided. The analysis of this model indicates that it can greatly improve the communication efficiency between driver and application.

Key words: firewall, NDIS hook, driver, share memory, event object

摘要：

在分析介绍Windows 2000/XP平台的网络驱动程序的基础上，提出了一种使用NDIS hook技术实现防火墙驱动程序的方法。这种方法不同于已有的API hook技术，它无需重新启动操作系统就能生效，并增强了抵御网络攻击的能力。由于它工作在网络层，可以对所有进出计算机的数据包进行过滤，因此可以更方便有效地保护用户信息安全。同时提出并设计了一个基于共享内存和事件对象的驱动程序通信模型。分析证明该模型可有效提高驱动程序与应用程序通信的效率。

关键词: 防火墙, NDIS钩子, 驱动程序, 共享内存, 事件对象

CLC Number:

TP393.08

XIAN Ji-qing，TAN Dan，CHEN Hui. Research and design of Windows firewall driver based on hook[J]. Journal of Computer Applications, 2005, 25(07): 1529-1530.

鲜继清，谭丹，陈辉. 基于hook的Windows防火墙驱动程序研究与设计[J]. 计算机应用, 2005, 25(07): 1529-1530.

[1]	QIN Binbin, PENG Liangkang, LU Xiangming, QIAN Jiangbo. Research progress on driver distracted driving detection [J]. Journal of Computer Applications, 2021, 41(8): 2330-2337.
[2]	TAN Xitang, LIU Sha, ZHU Qinyue, FAN Qingwen, WANG Chen. Matrix LED high-beam intelligent assistant control system [J]. Journal of Computer Applications, 2019, 39(6): 1855-1862.
[3]	CHEN Jingren, WU Yefu, WU Bing. Driver behavior spectrum analysis method based on vehicle driving data [J]. Journal of Computer Applications, 2018, 38(7): 1916-1922.
[4]	TAN Haiqing, CHEN Zhengguo, CHEN Wei, XIAO Nong. Design of DDR3 protocol parsing logic based on FPGA [J]. Journal of Computer Applications, 2017, 37(5): 1223-1228.
[5]	WANG Xudong, CHEN Qingping, LI Wen, ZHANG Xinming. Time-based strategy audit scheme of access control list in multi-layer firewall [J]. Journal of Computer Applications, 2017, 37(1): 212-216.
[6]	FENG Huifang, MENG Yuru. Connectivity characteristics based on mobility model for vehicular Ad Hoc networks [J]. Journal of Computer Applications, 2015, 35(7): 1829-1832.
[7]	HAN Zhenyang, CHEN Xingshu, HU Liang, CHEN Lin. Communication access control method based on software defined networking for virtual machines in IaaS platforms [J]. Journal of Computer Applications, 2015, 35(5): 1262-1266.
[8]	YIN Yi, WANG Yun. Analysis method of inclusion relations between firewall rules [J]. Journal of Computer Applications, 2015, 35(11): 3083-3086.
[9]	WU Hao LIU Xiaojie LUO Peng. TRAP-4 based continuous data protection system [J]. Journal of Computer Applications, 2014, 34(1): 54-57.
[10]	HU Xingbo JIANG Yuan LIANG Hong GUO Yuhua FU Yonghua. Design and implementation of electronic paper display driver software [J]. Journal of Computer Applications, 2013, 33(10): 2989-2992.
[11]	LI Jia QI Yanyan ZHU Weijie. Porting of protocol SAE J1939 to Android system [J]. Journal of Computer Applications, 2013, 33(09): 2467-2469.
[12]	CHEN Shi-qiang ZHOU Xu WANG Jun-Feng TANG Hui. Location error eliminating approach for network delay measurement based on network driver interface specification [J]. Journal of Computer Applications, 2012, 32(07): 1787-1790.
[13]	LIU Dai-fei DUAN Hua-yan ZHU Meng-zi. Development and application of intelligent control system for post parcel servo based on Modbus protocol [J]. Journal of Computer Applications, 2012, 32(05): 1477-1480.
[14]	WANG Fang-fang YI Ling-zhi CHEN Hai-yan LU Qi-xiang. Design of embedded Ethernet-CAN communication card based on FPGA [J]. Journal of Computer Applications, 2012, 32(05): 1247-1250.
[15]	HE Wei YOU Jing ZHANG Ling. Development and application of video driver based on RAW capture mode of DM642 [J]. Journal of Computer Applications, 2012, 32(01): 279-283.

Research and design of Windows firewall driver based on hook

基于hook的Windows防火墙驱动程序研究与设计

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics