File System Minifilter Based Data Leakage Prevention System

Abstract

In recent years, more and more companies and institutions tend to keep most of their data in digital format. There is a large specter of information stored by such entities, like medical records, contracts, internal procedures, etc. that can be considered as being confidential, thus protecting them is a great concern. Since employees have access to such information, either by negligence or bad intention, they could leak the aforementioned information. As a solution to the given problem, our implementation is based on a file system mini filter driver that will block potentially unwanted file system operations, such as copying a confidential file to a removable storage device. The aforementioned architecture allows us to intercept and block I/O requests that originate from CopyFile or ReadFileAPIs. Another feature consists in blocking external devices such as SD cards, USB drives or external hard drives (the drives are detected, assigned a drive letter, but no further operations are allowed).