Sharing Data in Filter Driver

[lok.vikram]

I am developing File Filter Driver using IFS(Installable File System) kit to trap the file access event.

Requirement :

user program will activate/deactivate the filter driver,communicate with the filter driver and based on the policy instructs the filter driver to allow/disallow the file access.

There will be queue that will stores info regarding file like
processid who has accessed the file
file name
size
access method(w,r).
etc.

user program will take the decision on the basis of information on the queue.
So the Question here is which program should create and populate the queue.
user program or kernel program.

Please advice me on this.