Research and Application of USB Filter Driver Based on Windows Kernel

摘要

The wide usage of USB storage device brings us shortcut and convenience, at the same time it also brings us some potential security hazards which we could never turn around and run. Hence, to strengthen the monitoring of USB storage devices has become an important issue in the research of information security. This paper mainly introduces the WDM driver model, deeply analyzes the communication principle of USB device and the IRP packet interception technology based on USB filter driver. On this basis, we finally implement the function of access control for USB storage device in the Windows kernel. As it is implemented in Windows kernel, so the function of access control can not be easily bypassed by the malicious program. The safety and reliability of USB filter driver based on Windows kernel is much higher than the previous software.