A Case Study: File Access Privacy Control Using Filter Hook Driver

Sandbox security model is extremely useful for secure execution of untrusted applications. Many sandbox model based security systems proposed so far provide security by intercepting system calls invoked by applications and controlling their execution. However, a problem in existing sandbox based systems is the amount of overhead required for security checks performed after system call interception. In addition, it is difficult for computer novices to manage their security systems because the system settings are complex. In this paper, a function was proposed and implemented to monitor only the file access in Microsoft Windows environment. Test result shows that this function could protect files from unallowed access and then minimize the overhead of application execution time.