| 摘要 |
A system and method for a process attribute based computer network filter assigns a process attribute to a process executing on a computing device and assigns a network attribute to a network interface card (NIC) associated with the computing device. When the process desires to send a communication packet to another process on a different computing device over a network to which the NIC is connected, the process sends an application program interface (API) system call to the NIC. The API call is intercepted by a system call trap handler, which, in cooperation with a session filter driver and a network filter driver, determines the process attribute associated with the process and the network attribute associated with the NIC. If the session filter driver and the network filter driver, in cooperation with the system call trap handler, determine that the process attribute and the network attribute correspond, then the communication packet is allowed to pass to the network. Similarly, a packet received over the network is processed by the session filter driver and the network filter driver to determine whether the packet can pass to the process to which the received packet is destined.
|
