CN101236534A - Hard Disk Encryption Method Based on PCI Card in Windows Environment - Google Patents

Abstract

The invention relates to the field of computer security, and specifically provides a method for preventing hard disk data leakage. The invention comprises a PCI card, a section of loading program stored in the PCI card expansion ROM image, and a section of hard disk encryption and decryption program stored in the non-extension ROM of the PCI card. The loading program monitors the Windows operating system to read and write the target hard disk through the INT13H interrupt, and completes the encryption and decryption of the target hard disk data; at the same time, the hard disk encryption and decryption program is embedded in the Windows operating system when the computer is started. The hard disk encryption and decryption program monitors the Windows operating system to read and write the target hard disk through the driver program, and completes the encryption and decryption of the target hard disk data. The invention is novel in design and does not need to add additional hardware devices between the computer main board and the hard disk; the cost of use is low, and only one PCI card is needed; it is easy to use, and the hardware serial number of the PCI card and the hardware serial number of the target hard disk are required for encryption and decryption. key. The key binds the PCI card and the target hard disk as a key and a lock, just insert the matching PCI card, and there is no need to enter the user name and password.

Description

Hard Disk Encryption Method Based on PCI Card in Windows Environment

technical field

The invention relates to the field of computer security, and specifically provides a method for preventing hard disk data leakage.

Background technique

With the increasing degree of informatization, information security is particularly important. Computer data is generally stored on the local hard disk, and unauthorized data copying or even direct theft of the hard disk will bring serious losses to computer users. Among many solutions to prevent hard disk data leakage, encrypting hard disk data is an effective method.

Currently existing hard disk encryption schemes generally need to be combined with complex hardware devices, such as adding additional hardware devices between the computer motherboard and the hard disk, and the cost of use is relatively high. In addition, due to the close integration with hardware, there are compatibility issues.

Contents of the invention

The purpose of the present invention is to provide a low-cost hard disk encryption method based on a PCI card.

Technical scheme of the present invention is:

It includes a PCI card, a loading program stored in the PCI card expansion ROM image, and a hard disk encryption and decryption program stored in the non-extended ROM of the PCI card; the loading program monitors the Windows operating system to read and write the target hard disk through INT13H interrupt, and completes the target Encryption and decryption of hard disk data; at the same time, when the computer starts, the hard disk encryption and decryption program is embedded in the Windows operating system; the hard disk encryption and decryption program monitors the Windows operating system to read and write the target hard disk through the driver program, and completes the encryption and decryption of the target hard disk data; loads the program Obtain the hardware serial number PID of the PCI card and the hardware serial number HID of the target hard disk with the encryption and decryption program of the hard disk, and calculate the key needed for the encryption and decryption of the target hard disk by the function f(PID, HID).

The loading program is stored in the image of the PCI card expansion ROM; when the self-test operation performed by the computer BIOS detects that the PCI card has an expansion ROM, the image in the expansion ROM is read into a certain area in the memory COOOOH~DFFFFH, and then a Remote call, execute the loading program in the image; the loading program monitors the Windows operating system to read and write the target hard disk through INT13H interrupt, decrypt the data read from the target hard disk, encrypt the data written to the target hard disk; at the same time, modify the read registration in the memory Table information and file system information, the hard disk encryption and decryption program is embedded in the Windows operating system as a disk filter driver.

The hard disk encryption and decryption program is stored in the non-extended ROM of the PCI card; it is a disk filter driver working in the Windows operating system kernel; when the Windows operating system abandons the use of INT13H interrupts and uses the driver to read and write the target hard disk, the hard disk encryption and decryption The program takes over the encryption and decryption of data on the target hard disk.

When the self-test operation performed by the computer BIOS detects that the PCI card has an expansion ROM, the image in the expansion ROM is read into a certain area in the memory COOOOH-DFFFFH, and then a remote call is made to execute the loading program in the image. The loader monitors the computer's reading and writing of the target hard disk by modifying the interrupt service routine of INT13H. After the loading program is modified, read the content of sector 0 of the hard disk into memory 0000:7C00 and execute it, and start the Windows operating system from the hard disk. In the subsequent startup process, the Windows boot program (Osloader.exe) on the hard disk reads registry information and file system information through INT13H. The loader monitors the read and write of the registry by the bootloader, calls the original INT13H interrupt service program to read the registry on the hard disk to the memory, and modifies the read content in the memory, so that the bootloader loads a file that does not exist on the hard disk. kernel driver. When the boot program reads the kernel driver program through INT13H, the loading program redirects the read operation to the PCI card to read the hard disk encryption and decryption program stored in the non-extended ROM of the PCI card. So far, the boot program has obtained the content of the hard disk encryption and decryption program, and loads it into the Windows operating system according to the instructions of the registry. After the boot program completes the system initialization work, the Windows operating system begins to start. From this moment, the Windows operating system will give up using the INT13H interrupt and use the driver to access storage devices such as hard disks. As a disk filter driver, the hard disk encryption and decryption program embedded in the kernel of the Windows operating system takes over the monitoring of the read and write operations of the target hard disk, decrypts the data obtained by the read operation, and encrypts the data obtained by the write operation.

The beneficial effects of the present invention are:

1) The design is novel. There is no need to add additional hardware devices between the computer motherboard and the hard disk.

2) The use cost is low. Only one PCI card is required.

3) Easy to use. The hardware serial number of the PCI card and the hardware serial number of the target hard disk generate the key needed for encryption and decryption. The key binds the PCI card and the target hard disk as a key and a lock, just insert the matching PCI card, and there is no need to enter the user name and password.

Description of drawings

Figure 1 - Schematic diagram of the disk storage driver hierarchy.

Figure 2 - Schematic diagram of usage of PCI card storage space.

Figure 3 - Workflow diagram for booting from a PCI card.

Detailed ways

The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. The present invention is not limited to the following embodiments, and any designs that utilize the design ideas of the present invention and make some simple changes should fall within the scope of protection of the present invention.

The PCI card is used as the carrier of the loading program and the hard disk encryption and decryption program. The loading program is stored in the image of the PCI card expansion ROM, and the hard disk encryption and decryption program is stored in the non-extension ROM of the PCI card, as shown in Figure 2.

The hard disk encryption and decryption program (DiskSecure.sys) works in the Windows operating system kernel and is located between the disk driver (Disk.sys) and the partition driver (PartMgr.sys), as shown in Figure 1. After the Windows operating system starts, the computer reads and writes to the hard disk through input and output request packets (IRP). When the Windows operating system needs to access the hard disk, it constructs the corresponding IRP and downloads it layer by layer. The hard disk encryption and decryption program analyzes the IRP sent by the partition driver: if the IRP is a read operation, the hard disk encryption and decryption program first sends the IRP to the disk driver, and the disk driver returns the IRP to the hard disk encryption and decryption after completing the read operation program. The hard disk encryption and decryption program uses the key to decrypt the data in the IRP; after the decryption is completed, the IRP is returned to the Windows operating system. If the IRP is a write operation, the hard disk encryption and decryption program recreates a new IRP according to the IRP, and uses a key to encrypt the data in the newly created IRP; after the encryption is completed, the newly created IRP is sent to the disk driver.

When the Windows operating system starts, it needs a lot of initialization data, which are stored in the registry. When the system starts, the bootloader reads the registry to complete the initialization operation. The loader monitors the read operation of the boot program to the registry and the file system, and modifies the data read by the boot program in memory.

The UpperFilters key in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318} indicates the hierarchical order of disk storage drivers: PartMgr.sys, Diskperf.sys. Among them, Diskperf.sys is unique to Windows 2000. Here we need to modify the UpperFilters key value in the memory, and the hierarchical order becomes: DiskSecure.sys, PartMgr.sys, Diskperf.sys. In addition, we also need to add the DiskSecure key under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services key in the memory, and add the Start, Group and other key values under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DiskSecure key and assign corresponding values . Among them, Start=0 means that DiskSecure.sys is loaded when the computer starts. After the modification of the registry data in the memory takes effect, the boot program needs to obtain the information of the DiskSecure.sys file from the file system. The loader intercepts the boot program's access to the SYSTEM32\DRIVERS directory information, and adds DiskSecure.sys information in the memory, such as file size, file location, and so on. When the boot program reads DiskSecure.sys (DiskSecure.sys does not exist on the hard disk) according to these information, the loader redirects the read operation to the PCI card, and reads the DiskSecure.sys placed in the non-extended ROM of the PCI card. So far, the boot program has obtained the content of DiskSecure.sys, and loads DiskSecure.sys into the Windows operating system according to the instructions of the registry, as shown in Figure 3.

Claims (3)

1. Under the Windows environment based on the hard disk encryption method of pci card, it is characterized in that: comprise a pci card, one section loading procedure that leaves in the pci card expansion ROM reflection, one section HD encryption decrypted program that leaves in the non-expansion ROM of pci card; Loading procedure monitoring Windows operating system is interrupted the read-write target hard disk by INT13H, finishes the encryption and decryption to the target hard disk data; When computer starting, the HD encryption decrypted program is embedded Windows operating system simultaneously; HD encryption decrypted program monitoring Windows operating system is read and write target hard disk by driver, finishes the encryption and decryption to the target hard disk data; Loading procedure and HD encryption decrypted program obtain the hardware sequence number PID of pci card and the hardware sequence number HID of target hard disk, and (PID HID) calculates the key that the target hard disk encryption and decryption need by function f.
2. 2. based on the hard disk encryption method of pci card, it is characterized in that under the Windows environment as claimed in claim 1: described loading procedure leaves in the reflection of pci card expansion ROM; The self check operation detection of carrying out when computer BIOS is read in some zones among internal memory C0000H～DFFFFH with the reflection in the expansion ROM when pci card has expansion ROM, makes a far call then, carries out the loading procedure in videoing; Loading procedure monitoring Windows operating system is interrupted the read-write target hard disk by INT13H, and the data that deciphering is read from target hard disk are encrypted the data that write target hard disk; In internal memory, revise registry information and the filesystem information that reads simultaneously, the HD encryption decrypted program is embedded Windows operating system as the disk filter drive program.
3. 3. based on the hard disk encryption method of pci card, it is characterized in that under the Windows environment as claimed in claim 1: described HD encryption decrypted program leaves in the non-expansion ROM of pci card; It is a disk filter drive program that is operated in the Windows operating system nucleus; When Windows operating system abandoned using INT13H to interrupt using instead driver read-write target hard disk, the HD encryption decrypted program was taken over the encryption and decryption to the target hard disk data.

Images