how to intercept system calls

Hi, I wanna encrpto some data in kernel, and these encrypto data storage on disk .i should decrypt data before system call trasmit to user mode. then what should i do ? how to get encrypt data ? I wanna intercept write function(kernel), when this function got encrypt data i will decrypt.